texts: Elliptic curve subgroup with $p$ elements in field of characteristic $p$

texts:
Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime subgroup equal to field size answers this question in the negative when $k = 1$, but Hasse's theorem doesn't rule out e.g. curves of order $p (p - 1)$ over $\mathrm{GF}(p^2)$. Smart's attack (and some similar approaches) works for anomalous elliptic curves, which have exactly $p^k$ points, but I'm not sure if it generalizes.
My motivation for asking this question is that I am trying to construct an elliptic curve in $p^2$ characteristic (so over a ring, not a field) where DDH is hard and can be used to hide something in the part of the ring that wouldn't be there if you mod out to characteristic $p$. This would allow the construction of an ECC-based additively homomorphic encryption scheme that has efficient decryption for long plaintexts because discrete log would be efficient for only those points that are the identity modulo $p$, similarly to how Paillier encryption uses that discrete log is efficient in a subgroup of $(\mathbb Z / N^2 \mathbb Z)^\times$.
However, there is an issue with doing this for most curves. Let $E_p$ be the group of the modulo $p$ elliptic curve, and $E_{p^2}$ a corresponding curve modulo $p^2$. It turns out that Hensel lifting allows $p^k$ ways of lifting a point in $E_p$ to one in $E_{p^2}$, so $|E_{p^2}| = p^k |E_p|$. The problem is then that if $|E_p|$ is not divisible by $p$ then multiplication by $|E_p|$ would give a point that is the identity modulo $p$, so the part I am attempting to hide would have an easy discrete log. The only hope to fix this is if $E_{p^2} = E_p \times (\mathbb Z/p\mathbb Z)^k$ and $p$ divides $|E_p|$, because then multiplication by $|E_p|$ would always output the identity element of $E_{p^2}$, losing all information. Hence my question about whether any such curve can be secure.


texts:
How to make cipher resist against Side channel Attacks. Specially Timing Attack, Cachet Timing Attach, Simple/ Differential Power Analysis.

Uptil now it seems all Standard Algorithms like AES, Cameillia etc have been successfully broken using side channel Attacks.

What are the design criteria to counter these?


texts: How to find a triple of keys that maps plaintext to given cipherext using EDE

texts:
What is a practical method for for finding a triple of keys that maps a given plaintext to a given ciphertext using EDE?

I think this requires something similar to a man-in-the-middle attack...


texts: In a 2048 bit RSA key. Are $P, Q$, exponent $P$, exponent $Q$, and the coefficient guaranteed to be half of the length of the modulus (128 bytes)?


texts: Textbook RSA signature forgery when e=65537

texts:
Searching about RSA signature forgery I came across this question.
In the answer, it is stated that

for small to moderate $e$ (including $e=3$ and $e=2^{16}+1$, often used in practice), it would be possible to forge a large class of messages, including C strings showing as anything desired. For any $m_0$, it is easy to exhibit $m_1$ such that $m=m_0||m_1$ is the (non-modular) e-th power of a known integer $\sigma$ (compute $\sigma=⌈\sqrt[e]{m_0 2^{2e|N|}}⌉$ and $m_1 = \sigma^e − m_0 2^{2e|n|}$ of size $2e|N|$ bit); this $\sigma$ verifies as the signature for $m$; and $m$ prints the same as $m_0$ if $m_0$ is a zero-terminated C-string.

And actually I am having a hard time seeing how this can work with $e = 2^{16}+1$.
I would say that $\sigma$ will most probably be greater than the modulus $N$ in this case and the reduction will make everything fall apart.
Should there be a condition on

$m_1 = \sigma^e − m_0 2^{2e|n|}$ of size $2e|N|$ bit

and thus the forgery shall work for $e = 2^{16}+1$ but only with a very large modulus and not standard 1024-/2048-/4096-bit ones?
Can anyone shed some light on this?
Many thanks


texts: Chosen plain-text attack proof for Bethencourt CP-ABE scheme

texts:
Consider the CPA security game which consists of the following steps:

Initialization
Setup
Phase 1
Challenge
Phase 2
Guess

Can someone provide the proof for this game under Bethencourt CP-ABE considering the following:

Suppose an adversary $\mathcal{A}$ has non-negligible advantage $\epsilon = Adv_{\mathcal{A}}$. Using a simulator $\mathcal{B}$ that can distinguish a DBDH tuple from a random tuple with advantage $\frac{\epsilon}{2}$. Let $e:\mathbb{G}_0 \times \mathbb{G}_0 \rightarrow \mathbb{G}_T$ be an efficiently computable bilinear map where $\mathbb{G}_0$ has a prime order $p$ with generator $g$.

The DBDH challenger selects:

$a,b,c \in \mathbb{Z}_P$

$\mu \in \{0,1 \}$

$g \in \mathbb{G}_0$

Random element $R \in \mathbb{G}_T$

The challenger defines $T=e(g,g)^{abc}$ if $\mu=0$ otherwise $T=R$. The simulator $\mathcal{B}$  is then given <$g,A,B,C,T$>=<$g,g^a,g^b,g^c,T$>. The simulator here acts as the challenger.

I have looked for this proof in many papers but can't seem to find it for the traditional Bethencourt CP-ABE.


texts: Does AES-NI offer better side-channel protection compared to AES in software? Also, it would be great of you could provide according references in your answer.


texts: If Alice and Bob have a secure channel for key exchange and Mallory doesn't man-in-the-middle attack them, but in the future eavesdrops on their connection and sees the key exchange, can Mallory break it like RSA with a quantum computer?


texts: Combining classical attacks and quantum cryptanalysis

texts:
I'm regularly reading that AES-256 is secure against quantum computers because Grover's algorithm will only halve the key strength (i.e. "only" require $\sqrt{2^l} = 2^{l/2}$ operations instead of the full $2^{l-1}$ operations required to brute force the key).

However, would it be possible that classical attacks on symmetric ciphers such as AES could be sped up using quantum computing based algorithms? Is it possible / likely that the security of a block cipher is degraded more severely (e.g. by more than an additional 2 bits strength) if or when capable quantum computers become available?


texts: How to calculate Public Key exponent if I have p, q, Dp, Dq, QInv?

texts:
I have a private key components p, q, Dp, Dq, and QInv. I need to calculate the public key modulus and exponent. Modulus was super simple p*q, but exponent I can't figure out. Have searched all the articles and often found how to go opposite way - generating public private key once you pick the exponenet.

I have been trying ModInverse from p-1 and q-1, and solve x with GCD on all the componenets, but nothing gave me the right value (I know the value I should get is x010001). Seems to be a little bit more complex that this...

Im really in to the code and less in math, so if I could get the answer which use simple math operations as 'Add', 'Sub', 'Multiply', 'Mod', 'ModInverse', 'GCD' etc. would be great!


texts: Symmetric encryption vulnerable when encrypting and decrypting are the same?

texts:
To my understanding, symmetric encryption is where encrypting and decrypting data can occur with the same key.

It's possible for symmetric encryption that the encrypting and decrypting algorithms are the same, but this is not always the case. If I'm not mistaken, with AES this could be the case for some block modes, not for others, but I'm not 100% certain about this. (?)

A dummy example which has this property is ROT13 encryption (which therefore also happens to be ROT13 decryption).

An encryption scheme can work as follows:

Based on some password or key, define a deterministic stream of pseudorandom noise or garbage ("entropy stream").
Output data = input data XOR'ed with the entropy stream from step 1.

In this case, encrypting and decrypting are the same.

Assuming that the entropy generator in step 1 is safe (i.e. can be considered a cryptographically secure source of randomness), is the above encryption scheme sound and safe? Or are their still downsides to it compared to other symmetric encryptions, that may not have the poperty of encrypting and decrypting being the exact same algorithm?


texts:
Suppose we have three parties, Alice, Bob, and Carol. Alice can receive messages from Bob and Carol individually, but can only send messages to both simultaneously. Additionally, Alice cannot tell if Bob and Carol can send/receive messages to/from each other. This is what Alice wants to figure out

Bob and Carol are always both going to say that they can communicate, even if they can't. What challenge can Alice give to the two of them to ensure that they are not lying?


texts: Can I use the cipher text ouput of only one DES rotation as plaintext to check validity?

texts: I have made a python code for one DES rotation. Can I use the resulting cipher text as a plain text for the same rotation with the same key? I think the answer is no, I can't do so. But I need to be sure, an explanation will be very helpful.


texts: Why does the Bombe not consider the Ringstellung when determining stecker pairs?

texts:
I am doing research on the Bombe Machine, and I read that when the Bombe tries to find the stecker (plugboard) partners of letters, it only needs to use the rotor types and arrangement and also the "rotor core offset," which is just a combination of the rotor positions and the ring settings.

However, the ring setting does matter. If the 1st rotor position is A and the ring setting is A, the core offset would be the same as if the rotor position was B and the ring setting was B, but the 1st rotor output would be shifted down a letter, which would produce a drastically different output.

So, how do they account for that? I don't see how neglecting the ring setting is fine.


texts:
I have to elements of multiplicative group of finite field with generator g -
$$g^x,g^y $$
Can I get? $$g^{xy} $$


texts: Elgamal Encryption: Why does Bob get to reuse his keypair while Alice has to generate a new one for every message?

texts:
From Christof Paar's book

The protocol consists of two phases, the classical DHKE (Steps a–f) which is followed by the message encryption and decryption (Steps g and h, respectively). Bob computes his private key $d$ and public key $β$. This key pair does not change, i.e., it can be used for encrypting many messages. Alice, however, has to generate a new public–private key pair for the encryption of every message. Her private key is denoted by $i$ and her public key by $k\,E$. The latter is an ephemeral (existing only temporarily) key, hence the index $E$. The joint key is denoted by $k,M$ because it is used for masking the plaintext.

So why does Bob get to use the same keypair while Alice has to generate a new keypair every time?
Also, in case of TLS/HTTP, between a Browser & a Website - which one is Alice & which one is Bob?


texts: How to protect against brute force attacks in the case of a small dictionary?

texts:
Sorry if I'm not using the right terminology, as I'm new to crypto.

I want to know the most effective way to protect a database against brute force attacks in the case of a small dictionary.

For instance, suppose I have a user database, and that I want to protect a certain attribute/field of my users that has a small cardinality (e.g. the field can assume one of at most a few hundred values), for instance "country". There are a small number of countries in the world, so a brute force attack would be effective even if I hashed the country field: the attacker could just hash all countries and try those hashes one by one on a given user. Worse, they could use simple statistics to make their guesses more educated.

What should I do in this case? Should I add some salt before hashing? If I store the salt and the attacker gets access to it, is the field still protected?

Edit: My question is not tied to the specific case of the column of a table. Rather, I am asking what are the algorithms to use when the dictionary size is small.


texts: Is there a flaw in whole disk encryption vs volume or folder encryption?

texts:
My company just implemented whole disk encryption on all laptops (Symantec) and the concept seems flawed.  Please correct me if I'm wrong, but if I have known file in plain text and that same file in encrypted text, it possible to use that information to find the key for decryption.

If there is a better stack to ask this question on, please let me know and I'll repost.


texts: Can you clarify the proof that secure LR-two party protocols do not exist?

texts:
In the paper “Multiparty Computation Secure Against Continual Memory Leakage” on pg. 1237, the footnote #1 discuss why it is not possible to construct a leakage resilient two-party protocol.  But I'm confused about the 2nd half.

  Assume the adversary controls party $P_1$. In this case, he knows the
  entire secret state $s_1$ of $P_1$, and can choose his leakage function L to
  depend on $s_1$: i.e., L=$L_{s_1}$ .

This makes sense to me. If the adversary controls $P_1$ obviously he knows secret state $s_1$ and can use $s_1$ to his advantage to construct a leakage function $L_{s_1}$.  The only thing left to do is to leak on the other unknown secret states (like $s_2$). So he creates a leakage function that takes as input $s_2$ --> L=$L_{s_1}(s_2)$.  But the next part talks about a shrinking function $g$ which doesn't make sense to me.

  Note that L takes as input the secret
  state $s_2$ of $P_2$, and thus the adversary can leak any (shrinking)
  function $g(s_1, s_2)$ by setting $L_{s1}(s_2)$ = $g(s_1, s_2)$

What is the point of setting L = g ? Couldn't they just do L = $L(s_1,s_2)$? Why introduce another function?

The next part really confuses me…

  But, recall that from the secret states ($s_1 , s_2$ ) the parties can
  compute any function of the original inputs ($x_1 , x_2$ ).

Two questions regarding the specific quote above:

What does this mean exactly?
Where are they telling me to recall this information from? I don't see any references.


texts: What is most secure way for one party to encrypt 4 bytes in less than 40 bytes, which will be publicly available?

texts:
I have a project where a user needs to store a U32 encrypted on a blockchain such that they can recover it themselves: the user will always have their key available but may "forget" the U32 value. No other party needs to decode the information, but the plaintext will eventually also be public on the chain.
The user has an entropy seed from which an infinite number of keys of any size can be deterministically derived. I was looking to using a single block of AES but it occurred to me that a simple XOR would also suffice. Assuming the user derives a unique "key" every time they perform this type of operation, is there any reason to do anything more complicated than that?


texts:
Let's say I have a message 0123456789abcdefghijklmnopqrstuvwxyz which gives me the SHA-256 hash 74e7e5bb9d22d6db26bf76946d40fff3ea9f0346b884fd0694920fccfad15e33.

I want to prove to someone that I know a part of the message that hash to the hash, for example xxx34567xxxxxxxxxxxxxxx is it possible to do this?
Obviously the counter party should not know what xxxxxxxxx stands for.


texts: Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?

texts:
After the introduction of McBits, I was interested what security notions are neccessary for IND-CCA2 security of integrated encryption schemes (IES, following the key encapsulation mechanism / data encapsulation mechanism KEM/DEM  approach). Now I've recently answered a different question and stated that the DEM and the KEM both need to be CCA secure in order for the whole scheme to be CCA secure.

As a consequence of this I asked myself how to generically construct an IND-CCA2 public key encryption scheme. My question now is:

Is the below ("simple") KEM/DEM public key encryption scheme IND-CCA2 under the assumption that $KDF(x)$ behaves like a random oracle and that $f_K(m):\mathcal K\times \mathcal M \rightarrow \mathcal C$ is an invertible one-way trapdoor function?

The scheme (formalized as per "Introduction to modern Cryptgraphy", second edition, by Katz and Lindell):

The KEM:
$Gen:$ the same as for $f_K(m)$
$Encaps:$ choose a random $k\in \mathcal M$, apply $c\gets f_K(k)$, convert both to a (suitable) binary representation and output $(c,KDF(k))$ with KDF being a secure arbitrary length hash function
$Decaps:$ convert $c$ from a binary string to an element of $\mathcal C$, apply $k\gets f^{-1}_K(c)$ and output $KDF(k)$ or $\bot$ in case $k=\bot$ which is always the case whenever $c \notin \text{Range}(f_K)$ holds.

The encryption scheme is then constructed as in construction 11.10, meaning the returned $c$ is prepended to the ciphertext, the $KDF(k)$ is used to key an authenticated encryption with associated data (AEAD) scheme which does the bulk encryption. To prevent unclearities while parsing the inputs and outputs a special encoding (pairing functions) must be used, any additional data introduced here will be fed into the AEAD scheme, see this comment (by Ricky Demer) for the details. Decryption is then obviously applying Decaps to the prepended $c$ and decrypting and verifying using the AEAD scheme, decryption fails (and thereby returns $\bot$) if either $Decaps$ or the AEAD scheme return $\bot$.


texts: Verifying dealer parameters in 1-2 oblivious transfer

texts:
I read the description of 1-2 oblivious transfer algorithm in wikipedia.
In the algorithm described Alice has two messages $m_0, m_1$. Bob picks value $b \in {0,1}$, and the protocol allows Bob to obtain $m_b$, while Alice does not know which value was sent to Bob.

The protocol requires that Alice creates an RSA private,public key pair, and also a value for e. I was wondering if Bob has to perform any verification over there values. It seems to me that Alice can craft special values for N=pq, and e such that it is easier for Alice to find out what was the value of Bob's b.

An edge case would be for Alice to pick e=0. In that case, $k^e = 1$, and therefore the blinding performed by Bob does nothing, and Alice can always discover b.

What if Alice chooses an N that is not really a multiplication of two large primes, with a combination of a specially crafted value of e?

Is there a way for Bob to defend himself against such behavior from Alice?


texts: AES-192 bit fixed matrix values in mixed column step

texts:
In advanced encryption standard,in mixed column step,how those fixed matrix values came? The values are (02 03 01 01),
will these values will be the same for 192 bit plain text?


texts:
So before I start I'm learning how this algorithm still works so my first question is for the x,y, and z steps (of getting the keystream I believe). The formula is t = y 20 XOR y 21 for y. There is one for x which I believe is the XOR of 13,16,17, and 18. Then z is the XOR of 7,20,21, and 22. Now my question is do these formulas ever change or are they always like this. Also later on in the keystream is s = x 18 XOR y 21 XOR z 22 always the same formula or does this change depending of the plaintext size? Finally is major also m = maj (x 18, y 10, z 10) every time?

Side Questions I also noticed while solving this?

When you do the actual bit shift does the last variable like x 22 disappear?
If the s formula was to be solved with s = 0 XOR 1 XOR 1 would the correct logic be 0 XOR 1 = 1 so then 1 XOR 1 = 0 so s = 0?


texts: How to encrypt dates using format preserving encryption and avoid collisions

texts:
I'm encrypting with an FPE algorithm in C#.  What I did is convert the date I want to encrypt to the day of year value and a year value like so.

string input = "1901-01-01";
DateTimeOffset parsedDateOffset = new DateTimeOffset();
bool parsed = false;
parsed = DateTimeOffset.TryParseExact(input, "yyyy-MM-dd", CultureInfo.InvariantCulture, DateTimeStyles.AllowWhiteSpaces, out parsedDateOffset);

if(parsed){

    DateTime dtNew = new DateTime(parsedDateOffset.Year, parsedDateOffset.Month, parsedDateOffset.Day);
    int dayOfYear = dtNew.DayOfYear;
    int yyyy = parsedDateOffset.Year;

// Then I encrypt the day of year separate from the year

    int encodedDay = FE11.Encrypt(365, dayOfYear, Encoding.UTF8.GetBytes(input.ToString()), Encoding.UTF8.GetBytes("0"));
    int encodedYear= FE11.Encrypt(2015 - 1901, yyyy, Encoding.UTF8.GetBytes(input.ToString()), Encoding.UTF8.GetBytes("0"));

// Then combine them together again taking into account leap year

     DateTime encodedDate = new DateTime((int)encodedYear, 1, 1).AddDays((int)encodedDay - 1);;
     if (DateTime.IsLeapYear((int)encodedYear))
     {
         encodedDate.AddDays(1);
     }
}

However I'm encountering duplicate dates (i.e. for two plaintext dates result in the same encrypted date)  But with format preserving encryption this should not be the case, and I know it is because of the way I am emcrypting the year separate from the day of year.

Does anyone have any suggestion to overcome this?  I have tried introducing a tweak but the problem persists.

Ideally I would like to encrypt only one value.  But encrypting the day of year alone still requires me to place it in the context of a year when presenting the final encrypted result.

Are there other date representation besides day of year that might be useful?

EDIT:  The FPE library I am using at this time is called DotFPE located here https://dotfpe.codeplex.com/ (which is supposedly a port of the Format Preserving module of Botan Crypto)


texts: Can one implement AES on 4-bit microcontroller?

texts:
It is possible to implement AES on 4-bit microcontroller? As far as I know, AES on 8-bit microcontroller are common especially for light weight application such as the RFID.

I have yet to come across AES been employed on 4-bit microcontroller, therefore I have been wondering whether such implementation is feasible.


texts: Is the Couvreur et al. polynomial time attack on McEliece practical?

texts:
There's a new e-print out on arXiv titled "A Polynomial Time Attack against Algebraic Geometry Code Based Public Key Cryptosystems" by Alain Couvreur, Irene Márquez-Corbella and Ruud Pellikaan:

  "We give a polynomial time attack on the McEliece public key cryptosystem based on algebraic geometry codes. Roughly speaking, this attacks runs in $O(n^4)$ operations in $\mathbb F_q$, where $n$ denotes the code length. Compared to previous attacks, allows to recover a decoding algorithm for the public key even for codes from high genus curves."

Is this a practical attack against currently used implementations of the McEliece cryptosystem, with security parameters such as those recommended by Bernstein, Lange and Peters (2008)?

If the answer is yes, then how much do we need to increase the security parameters $n, k, t$ to be safe?  Or do we need to switch another code / curve entirely?


texts: What is the best way to store sensitive information on the client?

texts:
I am very inexperienced with cryptography and would like some advice on how to store some sensitive information on client machines.

I have some information stored in a central database on my server. A snapshot of this database is distributed along with my application. Every time the application is opened on the client, it checks for any new information on the server and downloads it via a web service. We need the information to be protected at all times, even when stored on the client. The only time it should be decrypted is while it is in memory and being used by the application.

I realize that the nature of our application means that no matter how strong our encryption scheme is, someone could still access our data by examining their machine's memory after the data has been decrypted. However, we have decided that we are OK with that scenario unless there is some magical way of dealing with this problem that I don't know about. We don't need absolute security for this data. We basically just need to raise the difficulty enough to deter most people from tinkering with it.

It seems to me that using a symmetric key is probably the best approach for this scenario. My concern is that if someone figures out the key, we'll have no way of knowing it. Even if we did manage to find out, it would be extremely difficult for us to change it since we would have so many clients using the old key. The natural way of solving this problem is to periodically change the key, but then how do we securely deliver the new key to our existing clients?

It is also worth noting that the user of the application doesn't know about this data and doesn't care about it. We can't ask for a password, require them to have a network connection, or impose any other limitations on them.

Looking forward to your thoughts on this. :)


texts: Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?

texts:
As I understand it, CTR mode essentially turns a block cipher into a stream cipher like so:

        _______________
       |       |       |
       | nonce |   i   |
       |_______|_______|
               |
        _______V_______
       |               |
       |  block cipher |
key -->|  (encryption) |
       |_______________|
               |
               V
plaintext --->(+)---> ciphertext

But by turning it to a stream cipher, one must be very careful not to reuse a nonce.  It seems like it would be safer to do it like this:

        _______________
       |       |       |
       | nonce |   i   |
       |_______|_______|
               |
plaintext --->(+)
               |
        _______V_______
       |               |
       |  block cipher |
key -->|  (encryption) |
       |_______________|
               |
               \---> ciphertext

While it still would be unwise to reuse a nonce, it seems like the effects would be less devastating if it were misused in this way.  I see one main disadvantage, and that's that with the first formulation, only the encryption part of the block cipher need to be implemented, whereas with this second formulation, both encryption and decryption need to be implemented.

My questions are:

Does this latter mode of operation have a name?
Are there any obvious weaknesses in this latter mode?
Are there any other reasons why CTR is defined the first way?


texts: Is it safe to reuse the password when using AES-CTR with scrypt?

texts:
I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does:

scrypt encrypted data format
----------------------------

offset  length
0   6   "scrypt"
6   1   scrypt data file version number (== 0)
7   1   log2(N) (must be between 1 and 63 inclusive)
8   4   r (big-endian integer; must satisfy r * p < 2^30)
12  4   p (big-endian integer; must satisfy r * p < 2^30)
16  32  salt
48  16  first 16 bytes of SHA256(bytes 0 .. 47)
64  32  HMAC-SHA256(bytes 0 .. 63)
96  X   data xor AES256-CTR key stream generated with nonce == 0
96+X    32  HMAC-SHA256(bytes 0 .. 96 + (X - 1))

AES256-CTR is computed with a 256-bit AES key key_enc, and HMAC-SHA256 is
computed with a 256-bit key key_hmac, where
  scrypt(password, salt, N, r, p, 64) == [key_enc][key_hmac]

Can I safely reuse the password for encrypting different files? I'm concerned that nonce is set to 0 and I know that reusing the key in the CTR mode is a big no-no. However, the key is generated by scrypt, which uses randomly generated salt. Is that enough to mitigate the problems with reusing the passphrase and having a fixed nonce?


texts:
I need to generate thousands of random 128-bit IVs per second and would like to amortize calls to /dev/urandom.

How can AES-256-CTR be used to construct a CSPRNG?

For example, would the following be acceptable?

Get 48 bytes from /dev/urandom.
Use the first 32 bytes as the AES-256-CTR key.
Use the next 16 bytes as the AES-256-CTR IV.
Encrypt 65536 bytes of zeroes.
Slice the ciphertext up into 4096 128-bit IVs (65536 / 16).
Rinse and repeat steps 1 to 6 every 4096 IVs.

Does it matter whether one encrypts 65536 bytes of zeroes at a time, or 16 bytes of zeroes at a time (i.e. should the size of the plaintext be no more than the cipher's block size)?

Would this scheme stretch the 256-bit + 128-bit entropy (initial AES key + intial AES IV) equally across the 65536 bytes of ciphertext? How does this translate to each IV sliced out of it? Would each IV have at least 128-bits of entropy or would the entropy of each IV be reduced in some way?

How could this scheme be improved?


texts: Encryption and decryption example using the Pohlig-Hellman Exponentiation Cipher

texts:
Let $n=11, d=3, e=7$ and $M=3$.

Encryption:

  M = BSK
  B -> 1 , S -> 18 -> k -> 10
  M1 => C1 = 1^7 mod 11 = 1
  M2 => C2 = 18^7 mod 11 = 6
  M3 => C3 = 10^7 mod 11 = 10

  C = 1 6 10
  <=>
  1=>B, 6=>G 10=>K

Decryption:

  C1 => M1 = 1^3 mod 11 = 1
  C2 => M2 = 6^3 mod 11 = 18
  C3 => M3 = 10^3 mod 11 = 10

  M = BSK

I would like to know that I am correctly doing encryption and decryption?


texts: Conditional probability with Vigenere Cipher given specific plaintexts and key sizes

texts:
Apologies if this should be in the Mathematics stack exchange, I just ask it here because the context is cryptography. Here is the question that I seemingly cannot get correct:

  Consider the Vigenere cipher over the lowercase English alphabet,
  where the key can have length 1 or length 2, each with 50%
  probability. Say the distribution over plaintexts is Pr[M='dd'] = 0.2
  and Pr[M='de'] = 0.8. What is Pr[C='ff']?

My starting assumptions are therefore that:

Pr[M=dd]    = 0.2
Pr[M=de]    = 0.8

I believe I can calculate Pr[C=ff] in the following manner:

Pr[C=ff]    = (Pr[C=ff | M=dd] x Pr[M=dd]) + (Pr[C=ff | M=de] x Pr[M=de])

From a notation point of view:

M = message
C = ciphertext
K = key
Pr[M=dd] = Probability that the message is 'dd'
Pr[C=ff | M=dd] = Probability the ciphertext is 'ff' conditioned on the message being 'dd'.

The convention for key notation is that:

K=a means 'shift by 0'
K=ab means 'shift first character by 0, shift second character by 1'
etc.

So:

For key length 1, M=dd: There is only one key that can produce C=ff (that is K=c).
For key length 2, M=dd: There is only one key
that can produce C=ff (that is K=cc)
For key length 1, M=de:
There is no key that can produce C=ff.
For key length 2, M=de:
There is only one key that can produce C=ff (that is K=cb)

Therefore:

Pr[C=ff | M=dd] x Pr[M=dd] = [1/26 + 1/(26^2)] x 0.2
Pr[C=ff | M=de] x Pr[M=de] = [0 + 1/(26^2)] x 0.8

Ergo:

Pr[C=ff] = [1/26 + 1/(26^2)] x 0.2 + [0 + 1/(26^2)] x 0.8
Pr[C=ff] = 0.009171598

Apparently this is incorrect, but I'm not sure where I'm going wrong, can anyone help explain what I'm doing incorrectly?


texts: What does this step in this protocol for the Yao's Millionaire Problem mean?

texts:
I was reading “An Efficient Protocol for Yao’s Millionaires’ Problem” (Ioannidis and Grama 2003). In the proposed protocol in section three, it is written:

  (Step 4) For every $i$, $1 \le i \le d$, Bob obliviously transfers $A^\prime_{il}$ where $l = b_i + 1$.

(Some context: $d$ is a security parameter, $A^{\prime}$ is a matrix of size $d \times 2$, and $b_i$ are the bits of Bob's number.)

I understand the definition of 1-2 oblivious transfer, however, I am confused exactly what Bob is obliviously transferring.  Is it referring to the bits of $A^\prime_{il}$? If so, the paper explicitly says that only 1-2 transfers are used, so does that mean that $A^\prime_{il}$ is no larger than $2$ bits?


texts: what is the current actual budget - as of 2015 - needed to build a DES breaker machine?

texts: EFF - Electronic Frontier Foundation - built a DES cracker for a budget of 250K$ in July 1998. I assume that as of 2015 - the cost of such a DES breaker would be less, are there any estimations about how it would cost? Re-using their 1998 design.


texts:
I was wondering, whether there exist such algorithms/enciphering procedures which both compress and encrypt the input data. That means, for starters, the output will be both smaller in size and difficult to decrypt...and if the compression algo is good, then the bits will be almost random.

Also any twin-encryption algo-s around?: by which I mean, suppose I have 2 data strings (alphanumeric only, say for now) -- Using them both, and an algo, I produce the encrypted output - I take in a pair, and produce a pair. The procedure is algo-based and not key-based. Any comments on this? And how this could relate to the earlier crypto-compression problem? (One way it would relate is, if the data is not just strings of characters, but a large multimedia file, it can be compressed fast and securely apart from being encrypted)

The FAQ says "please ask questions that can be answered, not merely discussed" but I can not be more specific, atleast not now: if it had some coding, I might have posted it on stackoverflow!

All comments, with links to other Q&A are welcome. Other forum addresses are also welcome!


texts: (RNG) For the Middle Square Method, is there a table of periods for various seeds?

texts: I'm interested in the properties of the original middle square method as articulated by John von Neumann and in particular in the relation between seed value and its period length (in cases where the sequence isn't destructive). According to Wikipedia "Nicholas Metropolis reported sequences of 750,000 digits before "destruction" by means of using 38-bit numbers with the "middle-square" method." Has anyone produced and made a table of such values available to the public?


texts: Is the CBC mode of operation a stream cipher mode?

texts: I am taking a class on security systems. My professor considers CBC to be a stream cipher mode, like CFB and OFB. Most sources I have read do not agree with this, so I asked my professor about this, and he claims it is usually called a stream cipher mode. Is this true?


texts: computing INV in boolean circuit for MPC

texts:
Is it feasible to generate an efficient MPC function that compute $a^{-1}$ for $a \in \mathbb{F_q}$, with Boolean circuit?

The naive way seems impossible since the depth of the computation might needed to be known in advance. (for example in computation of Extended GCD).

Edit: my intentions for the question were: Is there a more way to compute inverse instead of using EGCD (i.e a similar way to compute the INV that is more suitable to transfer to MPC)

Thanks.


texts: In DES : Matsui's notation(LC) vs Biham's notation(DC)

texts:
I'm doing linear attack for 8 rounds DES. And I just wondering about the difference between matsui's notation and Biham's notation. In Matsui's paper, numbers bits from 0 to 63 from right to left. In contrast, Biham numbers bits from 1 to 64 form left to right(Because of this, P-permutation, S-box, E-permutation, IP, IPinv.. all of them are differed as well).

I encrypted this Plaintext through DES Cipher(16rounds), and I got the result. This code is done by Biham's notation.
Plaintext : a57be5d89bedd673
Ciphertext : f6f43bfa4709a33b

My question is that If I use DES code made by matsui's notation(Sbox, P-permu, E.. all different), is the result same with above one?

I'm doing linear attack for 8 round DES, and I got stuck about notation..

That's way I ask this question.
Thank you.


texts:
What are the most authoritative papers on the security analysis of ECDSAs?

I`m mainly looking for comparisons of how secure different curves are considered to be, what potential methods are there of discovering a private key based on the public key, and possibly the methods of cracking the entire curve.

Moreover, papers that relate to Koblitz curves are preferred.


texts: Find plaintext from two ciphers encrypted with a one-time pad and the same key

texts:
I'm studying for a cryptography test and I came across this question:

  Assume a language has three letters: A=1111, B=0011 and C=1010. Two words in this language are encrypted with a one-time pad and by using the same binary key sequence. The first four bits for both corresponding cipher texts are, respectively: $C_1= 1110$ and $C_2=1000$. Determine the first letter of both corresponding plain texts as well as the first 4 bits of the key.

Isn't this question impossible to solve without additional information? Because:

  $C_1 = L_1 + K + P_1$

  $C_2 = L_2 + K + P_2$

  Where $C_i$ is the cipher text, $L_i$ is the encrypted letter, $P_i$ is the one time pad and $K$ is the key.

Seeing how $L_1, L_2, P_1, P_2$ and $K$ are unknown, it's not possible to solve this, right? Or am I missing something?


texts: The main differences between Sketch of Proof and Full proof

texts:
My question in general is:

Question 1: What are the differences between sketch of proof and full proof?

In simulation-based proof, in semi-honest model, we construct a view that is computationally indistinguishable from real view. Then we argue that the two views are computationally indistinguishable.

Question 2: Why is this approach "only sketch" of proof?

Question 3: What would the full proof be like (in reduction format)?

Edit: Why do most of papers in the well-known conferences provide only the proof sketch?


texts:
There are multi-key attacks against some AEADs. In other words, multiple keys can be used to decrypt a message since multiple keys can be valid for an authentication tag. How would one go about adding key commitment to an AEAD like AES-GCM or ChaCha20-Poly1305? The three ways mentioned by libsodium are:

Key identifier in the nonce.
Key identifier in the additional data.
Zero padding prepended to each message that gets verified after decryption.

However, 3 could be vulnerable to timing attacks (since this verification occurs after verification of the authentication tag), and 1 makes handling the nonce more complicated. That leaves a key identifier in the additional data, but what's the best way of achieving this?
Could you just use the encryption key as additional data? Should you hash the key and use it as additional data? How about a keyed hash using the key and some other data?


texts:
I read the following paragraph in a book about Elliptic Curve Cryptography, but didn't understand it:

  The primary security in ECC is the parameter $n$; where $n$ is Order of point $G$, that is $n$ is the smallest positive integer such that $nG = O$, where $G$ is a base point represented by $G= (x_g, y_g)\ on\ E (F_P)$

What does that mean?  Does a larger $n$ value imply a higher security level?


texts: How would I make a decoder agnostic steganographic file?

texts:
I would like to make a steganographic file that can be decoded on multi-platforms, now & 20 years from now.

I don't want to do so with software that may be out of date when the message decode is attempted.

How would I do this?


texts: Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?

texts:
A 2DES like cipher $c=E^{(2)}_{K_2}(E^{(1)}_{K_1}(p))$ where both halves have an $n$ bit key is vulnerable to a meet-in-the-middle attack.

Meet-in-the-middle using a big table

Create a table containing $E^{(1)}_{K_1}(p)$ for all possible $K_1$ and computing $D^{(2)}_{K_2}(c)$ for all values of $K_2$, looking for a matching result.

This approach requires a big table with about $2^n$ entries.

Meet-in-the-middle using cycle finding

An alternative approach would be to define a hash function that maps an $n+1$ bit value to another $n+1$ value:

Use $1$ bit of the input to decide between $E^{(1)}_{K}(p)$ and $D^{(2)}_{K}(c)$ and the remaining $n$ bits as key for this function.

A collision of this hash function can either have the same discriminator bit, in which case it's useless for our purposes, or different discriminator bits, in which case it's a successful meeting.

Now search for collisions of this hash function, applying the usual memory reduction techniques like cycle-finding and/or distinguished points. This should require only around $2^{n/2}$ table entries instead of $2^{n}$ table entries, while increasing computation cost only my a small constant factor.

Does this approach work?


texts: What makes this mixer function resistant to differential cryptanalysis?

texts:
I recently learned how differential cryptanalysis works, and decided to have a play around with testing various designs for resistance against attack.

My testing algorithm is essentially to loop through all $A$ and $B$ values for all potential input differentials ($\Delta A$ or $\Delta B$), and count how many distinct output differentials are seen for each input differential. To ensure its efficacy, I ran it against FEAL's gbox and got the expected value of 1 (0x02) at input differential 0x80.

Testing some other randomly conjured up designs resulted in all sorts of interesting weaknesses, until I stumbled upon this particular construction:

Where $S$ is a simple s-box built from fixed 8-bit lookup table. My results from this construction appear to be immaculate: every input differential has a perfect score of 255. I also noticed that removing any single instance of $S$ negates this property.

Am I correct in saying that this is resistant to differential analysis? What is it that produces this apparent resistance? Is there a classification for this kind of mixer construction?


texts: How can there be insecure elliptic curves if the discrete logarithm problem is hard?

texts:
The discrete logarithm problem is the mathematical trap door function underpinning elliptic curve cryptography. If it's naturally hard to climb back through the trap door, how can there be insecure elliptic curves?

Any answer would be most beneficial for me if it remained light on the math, if that's at all possible.


texts:
I would like to know what are the pairing parameters of PBC library and what are they used for? Here an example where they are used.

I noticed that we can give any file in the param subdirectory. Is there any difference or change if we use one file unstead of another?


texts: Is AES key and cipher distance measurable? Could this be translated into a cost function?

texts:
Given a plain-text, two keys, and two cipher-texts:

p: plaintext
k: actual key and k': predicted key
c: actual cipher and c': AES(p, k')

Can you calculate the degree of incorrectness of k' in NP-deterministic/NP-easy time? Does err(k, k') or err(c, c') exist?

The impetus of this question is to develop a cost function in a deep learning algorithm. Currently, there is the possibility for only one cost function C(k, k')= (k != k) or C(c, c') = (c != c'). This function shows zero cost for a correct guess and full cost for an incorrect guess—this cost function will never improve the learning of the network...


texts: Finding the n-th root of unity in a finite field

texts: I'm trying to find the n-th root of unity in a finite field that is given to me. n is a power of 2. The finite field has prime order. I know that if this were just normal numbers, I could find it using $e^{(2\pi ik/n)}$. I have no idea how to translate that into finite fields.


texts: How to properly AES encrypt a string, deriving the key from the same string?

texts:
Let's say someone has a list of names, e.g.:

'Batman'
'Batman'
'Super Man'

I am auditing this list, but I'm not allowed full access to all names. So they must be encrypted.

I should be able to:

Determine that one name appears twice in the list, and that one appears once
Get a clear text name (from the list owner) and use it as key to decrypt its encrypted version

One approach is for the list owner to encrypt the names with a pre-determined iv, and a pre-determined algorithm for generating a key. Just to illustrate, a simple algorithm could be to append 0's until the key is 32 bits:

batman_cipher    = SymmetricEncryption::Cipher.new(key: 'Batman00000000000000000000000000',
                                                   iv: '1234567890ABCDEF',
                                                   cipher_name: 'aes-128-cbc')
super_man_cipher = SymmetricEncryption::Cipher.new(key: 'Super Man00000000000000000000000',
                                                   iv: '1234567890ABCDEF',
                                                   cipher_name: 'aes-128-cbc')

batman_cipher.encrypt('Batman')         # => 'TYBaLlaS/8QogiyBt77LVQ=='
super_man_cipher.encrypt('Super Man')   # => 'aSrFGzbWjwXGpEf0VU8t4Q=='

The encrypted list would be:

'TYBaLlaS/8QogiyBt77LVQ=='
'TYBaLlaS/8QogiyBt77LVQ=='
'aSrFGzbWjwXGpEf0VU8t4Q=='

The only way for me to get the clear text names would be to guess or to ask the list owner for one of the names so I could test it:

batman_cipher.decrypt('TYBaLlaS/8QogiyBt77LVQ==') # => 'Batman'

My question: Unless there is a better approach, what would be the best strategy to strengthen the security, e.g. generating secure keys?

It seems that there are no specific security implications in deriving a key from the string you want to encrypt. And the best strategy I can find elsewhere is to hash the string and truncate its output to 32 bits


texts: OpenSSL supports AES, Camellia, ChaCha. How about Twofish, Threefish, Serpent?

texts:
If I understood correctly, some symmetric ciphers such as AES, Camellia, ChaCha are implemented in OpenSSL (along with several older ones) but some other commonly used and proven ciphers such as Serpent, Twofish and Threefish are not.
Any way or chance of these being supported by OpenSSL as well?
Or is there another de facto encryption tooling (with comparable solid reputation as OpenSSL) that implements these ciphers?


texts: Pseudocode for constant time modular exponentiation

texts: I'm looking to implement modular exponentiation (for RSA) in constant time, but most of the examples I've found are more mathematical descriptions of the operations. Are there any references with descriptions in psuedo-code, which are understandable (and implementable!) by someone without much of a math background?


texts:
What's the state of the attack to get the first pre-image on MD4?

Is it still $2^{102}$ as described by
Gaëtan Leurent in "MD4 is Not One-Way" ?


texts: Forgery attack against Textbook RSA with simple redundancy

texts:
I know how to forge vanilla Textbook RSA message signatures (easy).

I've learnt that by adding a good redundancy to the message, it cannot be forged anymore.

How can one add redundancy so that the message could be recovered from the signature (RSA with message recovery), and cannot be forged (meaning the redundancy function is "good")?

For example, a redundancy function which adds a 00...0 sequence in the beginning

of the message is considered not secure because it's easy to forge. (How?)


texts: Could BREACH be used to determine an HTTPS URL?

texts:
I was reading this article and had a question....

http://arstechnica.com/security/2013/08/gone-in-30-seconds-new-attack-plucks-secrets-from-https-protected-pages/

As I understand it TLS/SSL work in such a way that even the Requested URL is encrypted.  So, my question is...would it be possible to create an SSL proxy that could use BREACH to figure out the requested url from the encrypted response?


texts: Breaking Truncated Linear Congruential Generator with known parameters

texts:
There is an elaborate discussion on the breaking of TLCG on the link below, where they show how to break the generator with known parameters given the most significant bits.
Problem with LLL reduction on truncated LCG schemes

I tried to apply the same principles when given the least significant bits but with no success. On the paper by Frieze et al they discuss it briefly and mention substituting *x = 2s0*x(1) + x(2)*  that helps a little bit but I cant figure out what the value of s0 is supposed  to be. Is the anyone who can help.?


texts: SHA-256 Hash over multiple SHA-256 Hashes

texts:
I am trying to implement a checksum over multiple files.
We can assume, that i have a package containing N files. I want to identify such a package uniquely by following calculation:

SHA256-Hash over every file.

I save the result bytes of the hash-function for every file.

And then i calculate the sha256 hash over the concatenated file-hashes.
The reason, why i hash the file-hashes again is, that i want to provide a shorter footprint of the whole package.

From my point of view this should be enough to identify a package. But my knowledge concerning cryptography is really limited at all - so i wanted to ask the experts.

Thanks in advance


texts: How to get fixed m from different pairs of n, e and c in RSA？

texts: In RSA cryptosystem, if I have two (or more) pairs of public key and also the corresponding ciphertexts, can I get the fixed message from them? I cannot think up any good idea for now.


texts:
I'm trying to figure out the SSLv3 protocol for educational purposes and having hard time understanding mutual certificate authentication.

When the client requested to provide a certificate it also has to send a CertificateVerify message:
CertVerify = Sigclient(pre_master_secret, Msg1, Msg2)

Why the public key of the client is not used like it used for the server?


texts: Fixed vs variable memory access pattern in password hashing

texts:
What are, quantitatively, the pros and cons of fixed versus variable memory access pattern in Password-Based Hashing, Entropy-Stretching Key Derivation functions, and Proof-of-Work applications?

Modern PBH, ESKDF, and PoW techniques all leverage memory as a way to increase the investment cost (perhaps operating cost?) of brute-force search/attack. Some, like Balloon, use a fixed memory access pattern, with that rationale:

  Resistant to Cache Attacks. The memory access pattern of the Balloon hash function is independent of the password being hashed. Thus, an adversary who can observe the memory access patterns of a Balloon computation, e.g. via cache side-channels on a multi-user system, learns no information about the password being hashed.

Others, like Scrypt, make the indexes in memory strongly data-dependent. That can be as part of their argument of memory hardness, or/and with the rationale that it makes using cost-effective large but slow memory (or is it SIMD / GPU) less attractive to an attacker.

The winner of the 2013-2015 Password Hashing Competition did not chose:

  Argon2 has three variants: Argon2i, Argon2d, and Argon2id. Argon2d is faster and uses data-depending memory access, which makes it highly resistant against GPU cracking attacks and suitable for applications with no threats from side-channel timing attacks (eg. cryptocurrencies). Argon2i instead uses data-independent memory access, which is preferred for password hashing and password-based key derivation, but it is slower as it makes more passes over the memory to protect from tradeoff attacks. Argon2id is a hybrid of Argon2i and Argon2d, using a combination of data-depending and data-independent memory accesses, which gives some of Argon2i's resistance to side-channel cache timing attacks and much of Argon2d's resistance to GPU cracking attacks.


texts: Can the OpenSSL random number generator be considered cryptographically secure?

texts:
The OpenSSL Random Number generator documented here
uses an OS-provided entropy source coupled with a MD5 hash function.

Does it impact the quality of randomness to use a broken cryptographic hash such as MD5 for random number generation?  The topic is partially addressed in this question, with a focus on SHA1 rather than MD5 tough.

And if any impact, of which nature? Is it a risk of the RNG being predictable?

Back to OpenSSL: Though selecting another hash function seems to be doable at compilation time, there is no (apparent) configuration setting to change the MD5 to SHA2. So if there's any impact, I'd expect that most OpenSSL instances today are affected.


texts: Can CMAC be used as a 128bit Key Derivation Function?

texts:
I want to derive a key a number of times for a deterministic scenario, where I can get n keys from a single one.

The logic looks something like this:

masterKey = random 128-bit
For i from 0 to n:
    let key[i] = CMAC(masterKey, i)

Is this a proper way to generate a number of keys or does this have a flaw?


texts: Distinguishing generators of RSA primes and moduli

texts:
We are trying to distinguish two RSA prime generators:

Prime generator 1

draw uniformly at random an integer $p$ with $2^{1023.5}<p<2^{1024}$, until it is prime
output $p$.

Prime generator 2

draw uniformly at random an integer $p$ with $2^{1023.5}<p<2^{1024}$
while $p$ is composite, $p\gets p+1$
output $p$.

We can distinguish these generators from their output: the primes generated per 2 are on average farther away from the prime immediately below than are the primes generated per 1.

What advantage do we get from the above distinguisher?

Can we make a distinguisher with sizable advantage from the distribution of $p\bmod \mathtt{e221f97c30e94e1d}_{16}$ ? That 64-bit constant is the product of the odd primes to $53$. If yes, what's the advantage?

Now we derive two generators of RSA moduli, by multiplying two consecutive outputs of each of these prime generators. Can we make a distinguisher with sizable advantage, even though we can't factor the moduli? If yes, what's the advantage?

Motivation is recognizing if RSA keys are generated using this.


texts: Is Tiny AES algorithm any different from the standard AES algorithm? I have come across mentions of Tiny AES at a lot of places but none which define it's architecture.


texts:
Forgive the very novice question, but...

Given an algorithm which, upon inputting an unchanging 4-character string, generates a variable 6-character string, but having no idea what the algorithm is other than it is at least partially based on the date, is it possible/practical to discover the algorithm based on 15 or 20 previous results?  I guess this would be "known-plaintext"?

How would you go about experimenting with this?  Are there programs or calculators out there that would attempt to "crack the code" given a list of right answers?

Given the small number of input characters and output characters, each limited to the letters of the alphabet, it doesn't seem to me that it would be a terribly complex or unbreakable algorithm.  Still, I'm a novice, I don't know where to start.

Is it doable or am I wasting my time?

Additional info:  The four-character code is constant per machine; on another machine the four-character code would be different, but each machine would have an unchanging four-character code.  The six-character code, generated using the four-character code, allows a machine access to the device for a variable length of time, after which point another six-character code is required.

The four-character code is always four characters; the output code always six characters.  All alphabet, no numbers or symbols.  I don't think it's case-sensitive.  I do not know if the codes expire if not used immediately.

So give it up, huh?  So even if I had a thousand previous results, still not doable?

Are there additional clues I could try to find out that would turn it from not doable to maybe doable?


texts:
So because I am currently working on a Project in which I will use Argon2 I need some answers to questions about the options of Argon2.

I didn't find anything about them.

What exactly does the parallelism option do?
What exactly does the memory option do?
What exactly does the Iterations option do? How does it work? Is it just re-Hashing?


texts: This may seem an elementary question about LFSRs, and their link to Markov chains. LFSRs show Markov chain behaviour in that there can be a transition matrix defined over the LFSR, this follows from the very definition of the LFSR. Is there any formal formulation for the LFSR as a Markov chain?


texts:
I recently came across this (PDF) journal article, which describes what it calls "A New Design Of A Hybrid Encryption Algorithm" (which I must say, doesn't sound very novel, even in 2014!):

An AES key K is chosen
Encrypt message M using AES and key K

eM = AES-encryption(M)
AES key K is encrypted using RSA with the public key of the receiver

eK = RSA-encryption (K)
The cipher text eM is fed to SHA1, which generates a 160-bit message digest

mD = SHA1 (eM)
The message digest is signed using RSA with the private key of the sender

DS = RSA-sign (mD)
The encrypted message eM, digital signature DS and AES encrypted key eK are transmitted to the user over a network

So, basically standard AES-RSA hybrid encryption, but with the additional of an RSA signature (a signed message digest) that is intended to provide message authentication.

My question is whether signing the ciphertext actually provides any extra security (i.e. integrity or authentication) - doesn't encrypting the AES key with the receiver's RSA public key effectively provide message authentication?


texts: What is the difference between .pem, .csr, .key and .crt and other such file extensions?

texts:
I'm new to SSL / TLS and I want to work with the OpenSSL toolkit.

I don't know what .pem and .csr stands for?

I do know that .key is the private key and .crt is the public key.


texts:
In the article A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any multiple of φ(n).

Imagine I know the public and the private key. But what I really want is the factors of n, the p and q but I cannot use any factorization algorithm in a large number of n.

In the Miller's article it is suppose to say how I can find the two factors, knowing the public and private key. But I cannot understand how exactly it is done. Does someone know? Or have a small example?


texts: How does redundancy in a file effects performance and security of encryption?

texts:
Does redundancy in a file or data effect performance and security of encryption? (for example for AES, if not for general case)

Is it easier to encrypt something that has high redundancy or something that has almost no redundancy?

And does redundancy makes security weaker by any means?


texts:
Are there any proofs that cryptographic functions on an elliptic curve are any more difficult than the analogues over modulo arithmetic?

While at present, ECC appears to be more difficult, as it is not as advanced as research into RSA etc., it seems to me there should be no reason why ECC is much stronger than, say, RSA and that the advantage of shorter keys might just be temporary.

I was wondering if there were any proofs that ECC was at least as strong as RSA etc. such that if you use a 2048 bit ECC key, then it is at least as strong as 2048 bit RSA key? I.e., ECC is not weaker than RSA for a given key length?


texts: Using a product of a series of curve25519 scalars as a private key

texts:
There are a few systems like the GNU Name System and the Sphinx mixnet packet format that employ a series of curve25519 scalars all multiplied together as a private key.

Are there any caveats to multiplying several together like this?  What about adding them or doing other arithmetic operations on scalars?

Another form of this question is : There are a several bits twiddled when a scalar is produced for Ed25519.  What is the mathematical reasoning behind these modifications?  How does it translate to producing a private key scalar for curve25519?

I found a partial answer here.  At least the lower three bits are cleared to prevent a small subgroups attack, although there is debate over the effectiveness of this attack.   I presume the small subgroup attack is a threat to the curve formulations used in both Ed25519 and curve25519 equally.

Now if one of the scalars being multiplied together is a multiple of 8 then they all are, so that's good.  If all are multiples of 8, then addition looks good too, but addition with values that are not multiples of 8 could be problematic.  Is this correct?  What about the bit operations on higher bits?  Why are they there?  etc.


texts:
new to cryptography, i'm trying to learn the program veracrypt, and i'm now trying to understand the history of hash functions and how it applies to veracrypt.

so this is what i understand so far, the NSA made SHA2, which is one of the hash functions that veracrypt can use for it's "key derivation function" and the NSA made SHA2 because they wanted an improvement on SHA1, and they made SHA1 because they wanted an improvement on SHA0.

what i don't understand is, why did NSA make SHA0 in the first place? and when did hash functions start being used for password storing and "key derivation functions"?

did hash functions start with the need for network security for verifying package? or did they start with the need of hashing passwords or both or what was the deal?

thanks!


texts: Organizational Internal Man In The Middle Scenario

texts:
Question. I'm a software developer. I design and write secured systems for my customer. My customer recently downward directed that all traffic to/from my server be routed through a new appliance. I have no idea what the appliance is. All I was told was that it would impact routing and client certificates. I was given the name of a person to work with and off we went. We use client certificates for authentication and all traffic to/from the server is encrypted. Here is where things get weird. Previously, my server had it's own SSL certificate issued to it's current host name. Now when I hit the site, I see a host name of the new appliance for the site's SSL certificate, not my server's host name. Also. When a client certificate arrives at my server, it is no longer reading as having been issued by who I know to be the original issuer. But there are no negotiation errors during the handshake. Everything is green in the browser.

The only thing that makes any sense is that this appliance is decrypting the traffic from the client before it gets to my server so that it can be logged and inspected, before re-encrypting it and sending it along to my server. Then, when it gets the reply from the server, it likewise decrypts, logs, inspects the data, before re-encrypting it and the forwards the data.

Is my understanding of asymmetric and symmetric cryptography serving me correctly here? Mostly I stick to the logic of my applications and have sufficient understand of cryptography to be able to do what I need to do and ensure my systems remain secure. But I am not intimately familiar with the ins and outs of how it always functions. Seems like my organization just installed an internal man in the middle device for monitoring purposes and didn't tell me what was really going on.

Is this plausible?


texts: Meet in the middle attack: Why would it be easier to get elements of one of the 2 sets?

texts:
This is from Bruce Schneier's Book Cryptography Engineering. In his description of Meet-in-the-Middle attack, he writes (Chap 2, Page 35)

A meet-in-the-middle attack is more flexible than a birthday attack. Let’s
look at it in a more abstract way. Suppose we have N possible values. The
first set has P elements, the second has Q elements. There are PQ pairs of
elements, and each pair has a chance of 1/N of matching. We expect a collision
as soon as PQ/N is close to 1. The most efficient choice is P ≈ Q ≈ √N. This
is exactly the birthday bound again. The meet-in-the-middle attack provides
extra flexibility. Sometimes it is easier to get elements for one of the sets than it
is to get elements for the other set.

I don't understand the last line - why would it be easier to get elements for one of the sets? One of the sets is the set of transactions which you are snooping & the other set is the set of keys for which you have pre-computed the encrypted message for a header you expect at the start of the transaction. If this is right, then why would it be easier to get elements for one of the sets?


texts: Does changing the order of the steps within a round affect the security of AES?

texts:
I was trying to understand the internal structure of AES (Advanced Encryption Standard)

The Standard order of steps within a round:

Substitute Bytes
Shift Rows
Mix Columns
Add Round Key

Substitute Bytes, Shift Rows & Mix Columns satisfies the two most important properties required for a secure cipher i.e confusion and diffusion

Substitute Bytes provides Confusion i.e. that each binary digit (bit) of the ciphertext should depend on several parts of the key.

Shift Rows along with Mix Column provides Diffusion i.e. if we change a single bit of the plaintext, then (statistically) half of the bits in the ciphertext should change

Changing the order of Step 1 and Step 2 won't have any effect. But to what extent can we change the order of other steps? Does it weakens the security of AES, and if so, how?


texts: What happens if a nonce is reused in ChaCha20-Poly1305?

texts:
In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair.

However, is security affected for those messages encrypted with the same key but different nonces?


texts:
There is something intriguing me about this cryptosystem. That is :

Let $(S, G, P)$ be the secret key:
$S$ : invertible matrix
$G$ : generator matrix for some linear code $C$
$P$ : permutation matrix

And let $G'= SGP$ be the public key.

To encrypt $m$, we compute $Enc(m) = mG'+e$, with $e$ an error vector

The thing is, the basic idea about structural attacks, is that we brute-force the family of codes used (most likely, the code used is a binary Goppa code, but there are attempts to use other families, which are not yet broken).
So my question is, do we really need to reveal which family of code was used? wouldn't be more secure if we keep it hidden?


texts: Stretching a random seed to maximize entropy

texts:
I'm using a random number generator that requires me to pass it a big (several kilobytes) pool of random data for initialization.

I've gathered entropy from various system metrics (free memory, system clock, mac address .etc) and generated a 64-bit seed value which I need to "stretch" over the big memory pool.

Whats the best way to spread this small amount of entropy over the big pool? I've considered something like encrypting a null (0x00) buffer with a stream cipher using the seed as the key. Is that a safe approach?


texts: What is the probability of breaking the AES algorithm?

texts:
I am doing a project which requires the encryption to be done using AES. Is it really possible (technically) to crack AES?

If yes, please tell me:

What is the probability of breaking AES?
How does the round number influence this probability? Do more rounds really help in decreasing this probability?
What is the contribution of each round towards enhancing the security?


texts: Is it possible to recover AES-GCM plaintext when having everything but the additional data?

texts:
I'm using the window.crypto library in browsers.

I use iv from window.crypto.getRandomValues, key from window.crypto.subtle.generateKey, and additionalData from a user-input password.

After the encryption, I store iv, key, and encrypted_content in the local storage.

If someone gets these three things, is it possible for them to crack it without additionalData?


texts: Asynchronous Ratcheting Tree and modern group key agreements: Why left balanced-tres used?

texts:
Nowadays the group key agreements are based upon tree-based ones such as Asynchronous Ratcheting tree. Especially the latter one is constructed upon left-balanced tree.

So I keep wondering what benefits has a left-balanced tree from any other binary tree structure to this application?


texts: Effect of small secret attacks on non homomorphic encryption schemes

texts:
The new paper by Albrecht describes a new attack on "unusually" small secrets that are used in homomorphic encryption schemes.

In the paper the talk about binary secrets or LWE Normal form i.e $\sigma_s=\sigma_e$, error and secrets from the same distribution or secrets are in binary distribution. The online tool supports only the following distributions

  "normal": normal form instances, i.e. the secret follows the noise distribution (alias:True)
  -"uniform": uniform mod q (alias:False)
  -(a,b): uniform in the interval `[a,…,b]`
  -((a,b), h)`` : exactly h components are ∈ [a,…,b]∖\{0\}, all other components are zero

I am wondering what will be the effect of this kind of attack on when $\sigma_s<\sigma_e$ but not binary. I don't have concrete parameter but if $\sigma_e/\sigma_s\approx 1000$ will this attack very significant advantage? As far as I understood from the paper, they use combinatorial algorithms like BKW to decrease the complexity of the Dual attack. But is it applicable when the distribution of error is not binary but from a discrete Gaussian?


texts: When do we redo the Diffie-Hellman Exchange?

texts:
I'm planning on making a chat application for fun, in C++. I just have a few questions in order to maintain forward/future secrecy across messages.
If one party is offline, but the other isn't, what do we do in this case? I've been planning on storing it in a database until the other party comes online and reads it, in which case, it's deleted from the server.
When do we regenerate the exchange? When the user's original key is lost (whether that be from uninstalling/reinstalling, corruption etc.) or another time?
How do we efficiently generate keypairs between two clients? Should we be storing the public keys in a database table, and whenever the first message is sent we use DH?
I've been planning on using AES-256-GCM once the key is derived from the DH exchange. I'm just trying to wrap my head around it all. I managed to successfully use a Diffie-Hellman exchange on my local system (albeit in RAM) but it was successful and I'm looking to branch out and expand my knowledge/experience.


texts: I'm curious about the homomorphic properties of Paillier. So, basically if I have $\textsf{Dec}(\textsf{sk}, \textsf{Enc}(\textsf{pk}, \alpha) \cdot \textsf{Enc}(\textsf{pk}, \alpha^{-1}))$, I will get as result $\alpha + \alpha^{-1}$. But, does it also mean that if I have $\textsf{Dec}(\textsf{sk}, \textsf{Enc}(\textsf{pk}, \alpha)^{\textsf{Enc}(\textsf{pk}, \alpha^{-1})})$, then the result will be $\alpha \cdot \alpha^{-1}$, which will basically cancel each other, and will be left with 1?


texts: Considering the following encryption scheme where RSA is used to encrypt a plaintext m and then we choose a random r and compute: $$A = r + m^e \bmod N$$  and $$B = r^e \bmod N$$ So the ciphertext is a pair: $$(A,B)$$ and to recover m we compute: $$m = (B^d - A)^d \bmod N$$ IMHO This scheme has not randomized encryption since this padding approach is wrong, but i cannot figure out why. Can anyone give me a little hint?


texts: Why can't eavesdropper not make up own private key on diffie hellmann?

texts:
I try to understand diffie hellmann and I wonder why an attacker just can't make her own secret key and go along with the ride?

She'd be ending up with just the same shared key.

Let the private keys be:
$$sk_A = 14, sk_B=12, sk_E=8$$

Let's assume the base is $g=2$ and the prime is $p=17$.

Alice would have a public key of $pk_A=13$ ($g^{sk_A} \bmod p = 2^{14} \bmod 17 = 13$) and publish it and Bob would have a public key of $pk_B=16$ ($g^{sk_B}\bmod p = 2^{12} \bmod 17 = 16$). Eavesdropper would end up with $pk_E=1$ ($g^{sk_E}\bmod p = 2^{8} \bmod 17 = 1$).

Now Alice can take the public key of Bob to arrive at the shared secret ($pk_B^{sk_A}\bmod p = 16^{14} \bmod 17 = 1$) and Bob can do so as well.

But can't the eavesdropper not always do the same procedure with her private key? In other words won't $g^{sk_E} \bmod p$ always lead to the same shared key?

(I updated the numbers so that prime is bigger than the exponents).


texts: Could anyone explain me Direct Anonymous Attestation in general terms. I have been trying to read the paper but I really cannot seem to get my head around it. It may seem like a dumb question but I am not a cryptographer and would appreciate it if anyone could explain it simple terms.


texts: GCM encryption for 256-bit and 512-bit block ciphers

texts:
The Galois/Counter Mode of Operation (GCM)
This paper describe using GCM mode with 128-bit and 64-bit block cipher. Can we use this mode for 256-bit and 512-bit block cipher?


texts: collision resistance with added permutation

texts:
Suppose we have an $n$ bit ciphertext $c$ protected by a $k$ bit $MAC$, with $k < n$.
Generally, we expect collisions after $O(2^{k/2})$ ciphertext/MAC pairs are seen.
Consider the following modifcation:

Adversary chooses $m \in \{0, 1\}^n$ and
sends to oracle.
Oracle sends back $\sigma((c) || MAC(c))$, where $c=E(m)$ is a randomized encryption, and $\sigma$ is a permutation on $n+k$ bits. $\sigma$ remains unknown to the adversary.

Suppose $\sigma$ stays constant. It seems that we either attack the MAC/Encryption, or figure out the permutation. If the MAC and Encryption are perfect, then I don't see how we can find the MAC bits: any k element subset of the n+k bits will have the same birthday paradox probability of collisions. In fact, if we take $2^k + 1$ messages, the pigeonhole principle gives collisions to all subsets.
It seems our only help is if the MAC/Encryption has statistical biases that we can detect among the $O(2^{k/2})$ messages, but this seems that we must analyze all message k bit projections, which may be huge. Can we do better?
If we can't do better, what is the drawback of such a scheme? Is it impractical to have the hidden permutation be a shared secret? What about a set of such permutations?
Thanks


texts: Is it insecure to generate a key with your own public and private DH keys?

texts:
Is a secret key generated with its own public and private keys any less secure than a "normal" secret key generated using DH key exchange?

Example:

KeyPair keyPair = kpg.genKeyPair();
publicKey = (DHPublicKey) keyPair.getPublic();
privateKey = (DHPrivateKey) keyPair.getPrivate();

KeyAgreement keyAgreement = KeyAgreement.getInstance("DH");
keyAgreement.init(privateKey);
keyAgreement.doPhase(
    KeyFactory.getInstance("DH")
        .generatePublic(
            new DHPublicKeySpec(publicKey.getY(), P, G)
        ),
    true);

secretKey = keyAgreement.generateSecret();


texts: Steganography in speech by adding extra "filler" syllables

texts:
PREAMBLE

About 20 years ago, when reading a novel (set in late 1800) by some classic Russian writer I came across very curious example of steganography. The two main characters were peasants who got lost in the woods. Suddenly they come across wood cabin where a very dodgy forester lives. They have no other choice but to accept his "hospitable invitation" and stay in his cabin for the night. All three are in the same room in the cabin, but as they're scared of him harming them, they try to discuss between themselves a plan of how can they protect themselves. As their conversation happens "in the open" of the cabin room, they have to somehow ensure that the forester doesn't understand them.

THE STEGANOGRAPHY TRICK

Alice, Bob and Charlie all speak same language and are in the same room. But Alice and Bob do not want Charlie to be able to understand them, so they start speaking in this "steganographic variation" of their language. Method is simple: after every syllable they add an extra syllable "pa" or "la". (For simplicity I will use  Spanish language as example 'cos it has very syllabic and phonetic nature and you pronounce same way as you spell).

So for example:

HOLA would turn into HOpaLApa
or hopalapa!

AMIGO would turn into AlaMIlaGOla
or alamilagola!

(I don't think there were strict rules on when to put "la" or "pa", so speaker decides on the filler syllalble as he goes. Thus AMIGO can equally turn into ApaMIlaGOpa apamilagopa

Then a conversation

Hola Amigo!
Quiero una cerveza por favor.

Will turn into

Hopalapa Alamilagola!
Quieparopa ulanala cerlavelazala papor fapa

This method seems very interesting and I never ever had heard of such an approach ever again. Neither ever met anyone who had heard about it. Meanwhile, there's few amazing things about this method: from little practice I did, it seems that learning curve to be able to speak that way and to be able to understand this kind if speech is not very steep (maybe a week to master). Which makes sense - as peasants with little to no education in 1800ds would need a low barrier of entry into steganographic method. Of course when spelled out on paper and when meaningful syllables are capitalized, this method seems to be trivial, but when speaking - an untrained ear can't understand a word.

So I wonder if anyone has ever heard of this (or similar) method or any accounts in another cultures, languages or environments?

ps. I am not sure whether this method can apply well to English, because it is not as "syllabic" and "sing-a-songy" like languages like Spanish, Italian, Portuguese, Russian and pronunciation varies very strongly region to region.


texts: What if message is longer than keystream ?

texts:
I have read that stream ciphers can be used to encrypt messages/streams of arbitrary length (cf. the description of the stream cipher tag). However, there are stream ciphers that create a keystream of fixed length and XORs message and keystream bit by bit.

Therefore, I wonder, what happens if the message length is longer than the length of the keystream ? Is the keystream applied repeatedly to the remaining parts of the message in this case ?


texts: MAC size: Should MAC be shorter than cipher block size?

texts:
Many sources claim that (if possible) a length of MAC should be as long as possible. So it should have the same size as size of the block of used cipher.

However there is the following note in Bouncy Castle source codes (CMac.java):

  "Note: the size of the MAC must be at least 24 bits (FIPS Publication 81), or 16 bits if being used as a data authenticator (FIPS
  Publication 113), and in general should be less than the size of the
  block cipher as it reduces the chance of an exhaustive attack (see
  Handbook of Applied Cryptography)."

Should MAC really be shorter, and if so, what is the "sweet spot"?

Or is that true only under some special circumstances?


texts: Lenstra's ECM Algorithm - field requirement

texts:
In Lenstra's ECM algorithm, $\#E(\mathbb{F}_{p})$ is required to have small prime factors. Why is this so?

I understand that the p-1 method is efficient for factoring N with small factors. The ECM algorithm replaces the $\mathbb{Z}/p\mathbb{Z}$ group with points on an elliptic curve, both groups having finite cardinality. Why isn't there a restraint on the former?


texts: Steps to encrypt endorsements to a petition

texts:
I plan to circulate a petition, asking people to support it. This petition will reach a senior government official.

In regular circumstances, people would support such petitions by writing their name, their national ID number, and their physical or email address.

However, due to the nature of the petition, people may be reluctant to sign it because it would expose their name to other people. People may even be reluctant to provide their name to the person collecting the signatures (me).

Let us assume that we trust in the senior government official receiving the petition: that official has the right to know what our real names are, and we assume that our identities and contact info will be safe.

Let us assume also that people who sign have no incentive to fake their signatures (sign using the name of someone else, etc).

Assume that the senior government official has a public key.

I was thinking about this setup: I get this website, with the text of the petition. People can enter a piece of text there.

That piece of text would be their name, national ID and contact info, encoded if they wish. If it is encoded, the only person able to decode that text should be the senior official.

Is there a user friendly way in which people can get a set of keys, write a short text, encode it, and then copy-paste it to the petition website?

Note that I don't want to install a key generator on my own petition website, since people would be right not to trust it.


texts: Bouncy jdk 1.51 Serpent KAT tests vs Nessie vectors

texts:
Having a little trouble getting Nessie vectors working with the Bouncy Castle SerpentEngine. Do the Nessie vectors require a mode or some pre-processing?
Nessie Serpent 128, set 1, vector 0 reads:

key=80000000000000000000000000000000

plain=00000000000000000000000000000000

cipher=264E5481EFF42A4606ABDA06C0BFDA3D

http://www.cs.technion.ac.il/~biham/Reports/Serpent/Serpent-128-128.verified.test-vectors

Bouncy Castle SerpentTest.js, vector 10 reads:

key=80000000000000000000000000000000

plain=00000000000000000000000000000000

cipher=49afbfad9d5a34052cd8ffa5986bd2dd

http://grepcode.com/file/repo1.maven.org/maven2/org.bouncycastle/bcprov-ext-jdk15on/1.51/org/bouncycastle/crypto/test/SerpentTest.java#SerpentTest.0tests

Why the different expected output?


texts: Public Key Encryption with forward secrecy

texts:
Is there a known non-trivial system with plausibly secure public key encryption where:

the time function is efficiently computable;
the [pubkey,privkey] pairs are generated with time(privkey) = 0;
when encrypting under pubkey, the encryptor chooses a value of t in the appropriate range;
given privkey0 and t such that time(privkey0) < t and t is in the appropriate range, one can efficiently compute privkey1 such that time(privkey1) = t;
given privkey' generated from the original privkey by zero or more more applications of (4), and a message encrypted under pubkey with t = time(privkey'), one can efficiently decrypt the message;
given privkey' generated from the original privkey by one or more applications of 4, and a message encrypted under pubkey with t < time(privkey'), it is infeasible to learn anything about the message?

The trivial system is generating keys with privkey as 0 paired with a (randomly chosen) state for a forward-secure pseudo-random number generator, and pubkey as a list of public keys for an ordinary PKE system generated using the pseudo-random output from the state.

The time function is taking the first entry in the pair. The range for t values is non-negative integers less than the number of (ordinary) public keys in the list. Encryption under pubkey is the pair of t together with (ordinary) encryption under the t'th (ordinary) public key in the list.

The step 4 updating is changing the first part of privkey to t and changing the state to what it was after generating the first t (ordinary) public keys.

The step 5 decryption is by using the known state to regenerate the (ordinary) private key for the t'th (ordinary) public key in the list, and using that private key to decrypt the second part of the encrypted message.

The problem with the trivial system is that the size of pubkey grows linearly with the desired size of the range for t values.


texts: How can you produce visual cryptography?

texts:
I would like to be able to "code" images such as the one seen here on Wikipedia.

Is this generally produced with software, or does this require complex programming? Ideally, I would love to be able to batch encrypt images based on settings I pre-defined.


texts:
In wikipedia on Digital_signature:

  but rather, the message to be signed is first hashed to produce a
  short digest, that is then padded to larger width comparable to N,
  then signed with the reverse trapdoor function

I could not find the term reverse trapdoor function neither by web search not here on SE, what does it mean?


texts: Are HMACs based on hashes with larger bit-lengths also more secure?

texts:
When doing encrypt-then-mac, I can choose to use a hmac as the MAC. For example, I could use a hash like SHA-256 or SHA-512 (by using it as a keyed hash) to create that HMAC.

Does it increase security when choosing a hash with a larger bit-size? Is a HMAC based on SHA-256 weaker than a SHA-512, or doesn’t it really matter because both are cryptographically secure?


texts: Plaintext with 'T' and 'E' alphabets missing and encrypted with Vigenere Cipher

texts: I wrote the normal code to decrypt a Vigenere cipher encrypted text without knowing the key. But that won't work for this are two of the alphabets are missing and that would mess up the frequency analysis. Any idea on how to go about decrypting it?


texts:
Hypothesis: Let $z,a$ be uniformly random elements of a field $\mathbb{F}_p$ where $p$ is a large prime number. Also, let $(-z)$ be additive inverse of $z$.

I have a fixed secret value $x$. I mask it as $I=x+z$ and send it to a semi-honest server.

Later on, I send $w$ and $c=(-z)\cdot w+a$ to the server, and ask it to do as follows:
$K=I\cdot w+c=(x+z)\cdot w+(-z)\cdot w+a=wx+a$.

Question: Given $I, w,c$ and $K$, can the server learn anything about $x$?

Note 1: $z,a$ are secret values, too. So if the server learns about them it may learn about $x$.

Note 2: The above scenario is a part of protocol and it may not make sense for the readers at first glance.


texts: Bellovin 96' attack on IPsec ESP protocol on encryption only option

texts:
Can you explain the actual attack?

Why does the attacker need to firstly send some arbitrary UDP packet?
How can the attacker break the privacy between A and B?

Link: The article of Bellovin

I'm attaching the slide for a reminder:


texts: Compressing BLS signature with a hash function

texts:
It seems to me, that it should be possible to hash BLS signature to achieve significant space saving. Here is how it could work:

Assuming we have a pairing-friendly elliptic curve with two generator points $G_1$ and $G_2$. Let's say my public key is $P = p \cdot G_1$, where $p$ is my private key. The standard BLS signature of message $m$ would be:

$$
S = p \cdot H(m)
$$

where, $H$ is a hash function that maps the message into the subgroup defined by $G_2$. The verification of the signature is done using a pairing function $e$ as follows:

$$
e(P, H(m)) \stackrel{?}{=} e(G_1, S)
$$

If we use a curve such as BLS12-381, the size of the signature could be 96 bytes. But what if we redefine the signature as:

$$
s = H_2(e(G_1, p \cdot H(m)))
$$

where, $H_2$ is a cryptographic hash function (e.g. SHA256). The verification can then be done as follows:

$$
H_2(e(P, H(m))) \stackrel{?}{=} s
$$

Not only is the signature now only 32 bytes, but it also takes only 1 pairing to verify.

The obvious drawback is that signatures can no longer be aggregated, but I'm wondering if there are any other issues with using this scheme.


texts:
In [BN07, Subsection 4.3], the authors show that if a symmetric scheme $\mathcal{SE}$ is IND-CPA and a MAC $\mathcal{MA}$ is EUF-CMA (though they use the SUF-CMA notation, but I think it refers to the same notion?), then the symmetric scheme $\mathcal{SE'}$, constructed via the Encrypt-the-MAC technique, is IND-CCA secure.
Unfortunately, they show it the following way:

$\mathcal{SE}$ being IND-CPA implies $\mathcal{SE'}$ being IND-CPA
$\mathcal{MA}$ being EUF-CMA implies $\mathcal{SE'}$ being INT-CTXT
$\mathcal{SE'}$ being INT-CPA and INT-CTXT implies it being IND-CCA

I struggle to see how a game-based proof of this would look-like. For instance, let us say we have an adversary $\mathcal{A}$ that breaks IND-CCA security of $\mathcal{SE'}$, and let us consider a reduction $\mathcal{R}$ that has access to this adversary and tries to break either IND-CPA security of $\mathcal{SE}$ or the EUF-CMA security of $\mathcal{MA}$. How would the reduction proceed, since it does not have access to a decryption oracle?
Assuming we work in the real-or-random setup, I understand the reduction can record the queries that $\mathcal{A}$ does in order to know how it should answer on these particular queries. However, how is it possible for $\mathcal{R}$ to answer decryption queries which are not stored in its database? If we consider that $\mathcal{A}$ won't try to query the decryption of some $y$ without previously having asked the encryption of $x$ which resulted in $y=\mathrm{Enc}(x)$, then what's the point of giving a decryption oracle to $\mathcal{A}$ at all? Should $\mathcal{R}$ answer with a random $r=\mathrm{Enc}^{-1}(y)$, hoping that $\mathcal{A}$ won't ever query $x$ such that $r\neq y=f(x)$? In that case doesn't this potentially break $\mathcal{A}$'s strategy to break IND-CCA?


texts:
Why do we say that collision-resistance is a "harder" property than second pre-image for hash functions whereas if you have an attack on the second pre-image then you find a collision ?
Moreover, a collision has a good probability to be found in $O(\sqrt{N})$ where $N$ is the size of the hash function outputs, whereas second pre-image needs $O(N)$ ...


texts: What's wrong with an iterative (with counter) hashed salted KDF?

texts:
It seems like the brain-dead simplest KDF would have a key-stretching structure that is not substantially different from $\text{hash}(S | P | S | P |\dots|S|P)$, where $S$ is a salt and $P$ is a password. Other protocols generally require lots of hashes-of-hashes-of-hashes; this one builds up one big string to hash. This naive version has some obvious problems with timing (longer passwords require longer to verify), but it also might be easier to parallelize because the structure is perfectly repetitive, and it might "fall into a fixed point" of the hash function's compression-function, whereby further repetitions do not increase security.

The obvious thing to do, then, involves pre-hashing the password and incorporating a counter. Just to make this question 100% unambiguous, one implementation of this idea in Node.js would be:

function createKDF(work_factor, output_length, hash_algorithm) {
    var crypto = require('crypto'), hash_length, output_blocks;
    function hash(string) {
        var context = crypto.createHash(hash_algorithm);
        context.update(string, 'utf8');
        return context.digest();
    }
    hash_length = hash("").length;
    // needed to support arbitrary output lengths
    output_blocks = Math.ceil(output_length / hash_length);
    function output_transform(bin_data) {
        var buff = new Buffer(hash_length * output_blocks), i, bstring;
        bstring = bin_data.toString('hex');
        for (i = 0; i < output_blocks; i += 1) {
            hash(i + ':' + bstring).copy(buff, i * hash_length);
        }
        return buff.slice(0, output_length).toString('hex');
    }
    return {
        createSalt: function () {
            return crypto.randomBytes(hash_length - 4).toString('hex');
        },
        kdf: function (pass, salt) {
            var hpass = hash('nodejs-passwords-0:' + work_factor + ':' + output_length + ':' + pass),
                salt_buff = new Buffer(salt, 'hex'),
                buff = new Buffer(2 * hash_length),
                hash_state = crypto.createHash(hash_algorithm),
                round;
            assert(salt_buff.length + 4 == hash_length);
            // buffer: [32-bit counter][(N - 32)-bit fixed salt][N-bit hpass]:
            salt.copy(buff, 4);
            hpass.copy(buff, hash_length);
            for (round = 0; round < work_factor; round += 1) {
                buff.writeUInt32LE(round, 0);
                hash_state.update(buff);
            }
            return output_transform(hash_state.digest());
        }
    };
}

The reason I ask is that this approach seems simple enough that, if it is secure, the common advice of "don't roll your own crypto" is somewhat wrong: there are a variety of implementations of $$\text{key} = h_1(0|S|h_2(P)|1|S|h_2(P)|2|S|h_2(P)\dots)$$which you can easily program to create a password-storage system which suits your particular application, if something like PBKDF2 or bcrypt or scrypt is not available in your programming environment.

(Of course Node.js has PBKDF2, so the above implementation is more to clarify the question of "what's wrong with this general approach?" rather than it is to be useful to a JS programmer.)


texts: How is the re-encryption done in Path ORAM?

texts:
Path ORAM block headers store nonce that is used to re-encrypt the data on access. Every time a block is accessed, the nonce is updated.

If the header itself is encrypted, how's the decryption done when the block is fetched next time?

If the header itself is NOT encrypted, isn't it trivial for an attacker to recover the nonce from the header and decrypt it, thereby beating the purpose of ORAM?


texts: RSA Key generation: How is multiplicative inverse computed?

texts:
As per Wikipedia, RSA keygen goes like this:

Choose two distinct prime numbers p and q.
Compute $n = pq$.
Compute $\varphi(n) = (p − 1)(q − 1)$.
Choose an integer e such that $1 < e < \varphi(n)$ and $e$ and $\varphi(n)$ are coprime. $e$ is released as the public key exponent.
Determine $d$ as $d \equiv e^{−1} \bmod \varphi(n)$; i.e., $d$ is the multiplicative inverse of $e$ (modulo $\varphi(n)$). $d$ is kept as the private key exponent.

Thus the public key is $(e, n)$ and the private key is $(d, n)$.

According to this description, $d$ is determined directly from $e$ and $n$ (i.e. the private key is derived from the public key). I understand that finding the multiplicative inverse in that way is computationally difficult. If this weren't the case, then any attacker could determine the private key from the public key. What am I misunderstanding here? What does the key generator know that an attacker doesn't, and how is that used to determine the private key?


texts: Symmetric-keys algorithms with different keys for encryption and decryption

texts:
The Symmetric-key algorithm article from Wikipedia states:

The keys may be identical or there may be a simple transformation to go between the two keys.

I am not aware of any symmetric-key cryptosystem that uses different keys for encryption and decryption. What are some examples of such algorithms? Is this correct to call them symmetric-key algorithms?


texts: Given the anonymity in the blockchain under Mimblewimble - how would you identify whether a transaction had already been spent?

texts:
I have searched high and low, but can't see any explanation of an algorithm that could take a Mimblewimble based blockchain and identify the unspent transactions (so if someone tried to spend a transaction twice, it could be identified).
In everything I have found, everywhere double spending is discussed, it is just declared that each node tracks unspent transactions... with no explanation of how(!).
So I was hoping someone could explain the steps (detailed math not needed, just the logic) of checking if an input transaction has already been spent.


texts:
This question is purely hypothetical.

The idea is to generate variable sized hashes (multiple AES block sizes) like so:

encrypt plain text
encrypt plain text + cipher text from 1.
XOR cipher text blocks over hash blocks.

Step 1 and 2 can be programmatically done as one step.

Step 2 causes at least the second half of the cipher text to be different for each different plain text even if only the last block of plain text is different (changes in the plain text have no effect on cipher text blocks from before the change).

The key and IV are the same for each message.

Apart from being slow, is this a valid way to generate secure hashes?


texts: Does the IV need to be known by AES (CBC mode)?

texts: I was thinking about this today and thought I should ask. I think I understand IV's enough to say that they are basically the same thing as Salts when talking about hashes. They are there to improve randomness between messages. If the IV is simple appended, or prepended to the plain text, why does AES need to know the IV to decrypt it? Can't it just decrypt it, drop the first x amount of bytes and then it has the original plaintext or does AES do some special jizz-jazz with the first bytes in the stream?


texts:
During the mix columns step, getting the first element value is done using the equation

(1st*02)+(2nd*03)+(3rd*01)+(4th*01),

where *02 means shifting 1 bit to the right then XORing with 1b if the high bit for the 1st element is set.

What does (the first high bit of 'b4' for example) "is set" means?
Does the process change if it isn't set ?


texts: Can you help me understand this exam answer related to “breaking discrete logarithm over P256”?

texts:
I'm having trouble understanding the solution to a problem that tries to solve the discrete logarithm problem over an elliptic curve. It goes as follows:

  Consider an elliptic curve P256 generated by $G$ with size $n$. Consider function $H:P256 \rightarrow \mathbb{Z}_n$ that is used to build a random walk $P(i)$ as follows: $P(i) = W(P(i-1))$ with $W(P) = P + H(P)G$. Finally, consider a distinguisher function $D: P256 \rightarrow \{0,1\}$ (if $D(P) = 1$ we say that P is a distinguished
  point). Assume for all P and P' that $H(P)$ is independent from $D(P')$, $H(P)$ is uniformly distributed and $P[D(P') = 1] =\frac{1}{t}$.

  Consider the following algorithms:

Precom(t,m) -> L
for i = 1,...,m
 take P_0 = aG with a random
 compute P(0),...,P(l-1)
 until P(l-1) is in the set P(0),...,P(l-2) or D(P(l-1)) = 1
 if P(l-1) is in the set P(0),...,P(l-2) abort else add to L (P(l-1),log)

Dlog(Q)
loop
 set P(0) = aG+Q
 compute P(0),...,P(l-1)
 until P(l-1) is in the set P(0),...,P(l-2) or D(P(l-1)) = 1
 if P(l-1) is not in the set P(0),...,P(l-2) then
  (if (P(l-1),b) is in L then stop)
endloop

The question I'm trying to solve goes as follows:

  We assume that Dlog never finds a looping random walk (the condition "until $P(l-1)$ is in the set $P(0),\dots,P(l-2)"$ is never satisfied). We further assume that Precomp visited at least $\frac{nk}{t}$ points (for some value k, where t is the parameter of the algorithm). Show that the expected number of iterations of the loop in Dlog is at most $1+\frac{1}{k}$.

I even have the answer:

  An iteration repeatedly picks a new point. If new, this new point is distinguished with probability $\frac{1}{t}$. But the point is not new with probability at least $\frac{\text{number of visited}}{n} \ge k\frac{1}{t}$. So, each new point has a probability to be new and distinguished with less than $\frac{1}{k}$ times the probability of being not new. So, we reach a distinguished point from $L$ with probability at least $\frac{k}{k+1}$ and iterate with a probability less than $\frac{1}{k+1}$. So, the expected number of iterations is at most $1+\frac{1}{k}$.

What do I not understand from this answer? Well for starters how are they calculating the expectation? But the whole process is quite obscure. Also if you could comment on the usefulness of conditions of the kind:

  Assume for all P and P' that $H(P)$ is independent from $D(P')$,
  $H(P)$ is uniformly distributed and $P[D(P') = 1] =\frac{1}{t}$.

would be useful for me because I find them in many problem statements and I'm not always sure where I am using them.

Please feel free to enhance my $\LaTeX$ where needed. Also, if there is something you do not understand, don’t hesitate to post a comment asking for clarification. In case of doubt, you can see also take a look at the PDF describing the complete problem.