texts: Upper bound for the length of non-interactive zero-knowledge proofs of knowledge

texts:
In a hybrid protocol $\pi$ for which I want to proof uc-security in the absence of corrupted parties, there is an ideal functionality $\mathcal{F}_{SMT}$ for secure message transfer that leaks the message length to the attacker.

Also, there are non-interactive zero-knowledge proofs of knowledge that are built using $\Sigma$-protocols and the Fiat-Shamir heuristic.

In this protocol there is an exchange of messages via $\mathcal{F}_{SMT}$ that include an instance and a corresponding NIZK proof of knowledge.

The instance includes some constant-size values, a commitment to a value (which is also assumed to be of constant size) and a list of party identifiers of variable size $l$, with $0 < l \leq MAX$.

I still can make some changes to the protocol, e.g. to add padding of messages.
Ideally, I want this kind of message to be of constant size. Therefore, I want to find an upper bound for the length of the possible proofs in this protocol and use this to pad all messages to the same, constant size.

So my question is: How do I find this upper bound for NIZK proofs constructed as mentioned above?


texts:
I am thinking about this problem:

The server has a two-column table $T=\{c_1,c_2\}$. A user has a query $q$ that is sent to server. The server find an item $x$ in the first column satisfying $x=q$ and return the item $y$ in the second column to the user ($x$ and $y$ are in the same row).

The requirements are that:

server should not learn $q$.
user should not learn other items besides $y$.

The above scenario is quite similar to those in Oblivious Transfer or Private Information Retrieval. However, there is a slight difference (to my understanding). The user does not know which item he wants to retrieve in advance. The index of the item to be retrieved is obtained by comparison with the items in the first column.

So, my questions are

how to modify OT or PIR protocols to fit with this situation?
What's the most efficient OT or PIR protocol (in terms of communication efficiency) to deal with this situation?
Are there any other ideas besides OT or PIR?

Thanks.


texts: What is the general justification for the hardness of finding preimages for cryptographic hash functions?

texts:
Since most cryptographic hash functions are simple, compact constructions does this simplicity impose a limit on the complexity and the size of a function that can generate preimages? That is, given a cryptographic hash function, H of some length and complexity can we lower or upper bound the complexity/size of a function that finds preimages of H. If not, why not?

If the upper bound on the size of a function that efficiently finds a preimage of H is smaller than the output size of H and then this has implications for the strength of the hash function. How can we justify that such an efficient preimage finding function must be larger than the output size?


texts: Decrypt Base64 Encoded Monoalphabetic Cipher

texts:
I'm attempting to decrypt a body of ciphertext which has been encrypted using a monoalphabetic cipher. The trouble I'm having is that the plaintext was base64 encoded before being encrypted. In this puzzle the encryption scheme uses an array containing a permutation of 0-63 as the key. It takes the plaintext and encrypts each char by taking its index in the base64 alphabet and using that as the index in the key. Then that key value  is used as an index to take the ciphertext character from the base 64 alphabet.

I understand the typical way to solve a cipher like this is through frequency analysis of the letters (knowing that e is the most common letter and so on). My confusion comes from how to do this given the plaintext is base64 encoded.

I have read though this post but am having trouble understanding how to actually apply it. I have been able to write some python to count the frequency of every 4th char in the ciphertext but I'm not sure what the next step is to get the plaintext/key.

One of the things I did attempt was mapping the results of the frequency analysis back to plaintext. For example e in binary yields 01100101. Then if you have an e as the 3rd char in the plaintext then the 4th char of the base64 encoded plaintext would be l (100101). From there I would look at the analysis of the ciphertext and see the most common letter was V meaning that V mapped to l. Then calculating the different in indexes in the base 64 alphabet of those to letters I get
$$64 - 37 = 27$$
(37 = the index of l, to get to the end of the alphabet)

$$27 + 21 = 48$$
(adding 21, the index of V).
This leaves me with the $key[30] = 48$, 30 being the index of e in the base64 alphabet. I repeated this for multiple letters but it didn't yield any readable text when attempting to decrypt with that key then unencoding the returned text.

Additionally I attempted to map the capital and lower case letter to the same result since I believe this will just yield a case insensitive plaintext. Continuing the example above, I would also set $key[4] = 48$ as well, 4 being the index of E in the base64 alphabet.

I'm not sure if this is signifigant but all the indexes in they key array that I did not map (some of the less common letters, 0-9, and '+' '/' I initialized to 0.

Any tips on where to go from here or how to approach this problem would be greatly appreciated.


texts:
I have three questions related to the use of IV within CBC mode of operation:

Why, exactly, is it so bad to have a fixed (or predictable) IV in CBC mode? An example would be great!
Given 1., why is a random IV better? And if the IV is "random", how are Alice and Bob boh supposed to know it? Isn't the IV part of the key in that case?
Why not only use the IV once (as in, keep on the CBC process forever and ever, without ever "starting again with a new IV")?


texts: Are newer crypto currencies intrinsically more energy efficient, or just newer?

texts:
There's a lot in the news about the energy cost of Bitcoin recently. Recently Elon Musk talked about "currencies using <1% the energy per transaction of BTC".
This page provides some values for comparison:
Kilowatt hour (KWh) consumed per transaction
XRP
0.0079
Dogecoin
0.12
Cardano
0.5479
Litecoin
18.522
Bitcoin Cash
18.957
Ethereum
62.56
Bitcoin
707
My understanding is that coin generation gets more difficult the more coins are mined, so I'm wondering is Ethereum for example actually 10X more efficient, or has it simply not been around as long so the calculations haven't grown in complexity?
Are energy costs per transaction for all these currencies going to scale with number of transactions in some well-defined way, or have I misunderstood?


texts: Software package to create a basis of the q-ary lattice $\Lambda_q(A)$

texts:
Consider a matrix $A \in \mathbb{Z}_q^{m \times n}$ and its respective lattice
$$\Lambda_q(A) = \{x \in \mathbb{Z}^m : \exists z \in \mathbb{Z}_q^n, x = Az \mod q\}$$
The basis for such a lattice is different from $A$ as shown in this answer. I am looking for a software package/library that construct such a basis, so I can then for example run the LLL algorithm on it. Does any such package already exist?


texts: Correlate HMAC key and MAC without message

texts: If I have a HMAC_SHA1 MAC and a potential key, can I check whether this key could have produced this signature without knowing any of the message body plaintext?


texts:
I would like to understand the cryptography behind Wpa2. As far as I know, there are 4 messages on the 4-way handshake and three of them are values concatenated with hashes.
First, I am trying to understand how the PTK is generated. I believe that it is:

H(an||stn||amac||stmac||PSK)

Where "h" function is sha1, "an" is the ap nonce, "stn" is the client nonce, "amac" is ap's mac address, "stmac" is client's Mac address and PSK is the shared key,
But I might be totally wrong.
Second, the second message on the handshake is

Stn || H(an || KCK)

Right?
My question is if it is the way I wrote or it is different.

Thanks in advance


texts: Why is OCB-AES mode not becoming a standard for authenticated encryption?

texts:
The OCB mode of authenticated encryption (used for example with AES) is the fastest way to provide authenticity and confidentiality without having to strive into questions like: Encrypt then MAC, MAC then encrypt, Encrypt and MAC.

So why it is not widely used and didn't become a standard?


texts:
I am currently attending a IT-Security course at the Tel Aviv University and I stuck with the an assignment task.

Please DO NOT post the solution if you know it. But I would be very grateful for any hint that leads me to the correct result.

Task:

"Eve has managed to intercept the following messages, encrypted by Alice using a XOR cipher:

c1 = 0 0 1 0 0 1 1 1 0 1 0

c2 = 0 1 0 0 1 1 1 0 1 1 0

c3 = 1 1 0 1 0 1 1 0 1 0 1

Eve suspects Alice has been using the same key to encrypt all three messages; moreover, she suspects that the third message (m3) also happens to be m1 XOR m2.

Can you find the key k and the deciphered messages m1, m2, m3?"

Thank you very much in advance for any helpful hint!


texts: Why was Davies–Meyer chosen over Miyaguchi–Preneel most of the time?

texts:
The only Miyaguchi–Preneel MD hash I know is Whirlpool. I suppose there are likely others.

Why do most MD hashes choose Davies–Meyer?

If anything, Davies–Meyer relies on related-key resistance while Miyaguchi–Preneel relies on chosen-plaintext resistance. The former ought to be far more difficult to achieve.

So I'm curious about the rationale.

Edit:

After some further research all I could find was the fact that Davies-Meyer is more efficient because it allows you to stretch the message block based on how the key schedule of the underlying block cipher works. Whereas Miyaguchi–Preneel forces you have

length(key) = length(message block) = length(output)

and deviating from that while possible (with padding) complicates security. So I guess the question is whether that the only reason? Performance? Flexibility? SHA2 may not be able to have variants (eg: 256, 512) as easily with Miyaguchi-Preneel.


texts: what if the S-boxes in DES were "optimal"

texts: if we assume that the s-boxes in DES were optimal. that is for each s-box, every cell in the DDT equals to 4. is there a differential characteristic in a good probability?


texts: Creating cryptographic algorithms at runtime

texts:
Would it be possible to create a program with which to create a cryptographic algorithm (i.e. encryption or hash) using well-known elements of other algorithms in the same way that algorithms "reuse" systems such as Feistel's structure? That is, eventually decide to use an algorithm that combines the Rijndael KeySchedule, and the Pseudo-Hadamard Transform. All this correctly applying the concepts of diffusion and confusion of Shannon.

The objective of this would be during a communication to change cryptosystem repeatedly, so that if you want to do cryptanalysis of the messages you have to do cryptanalysis on several different algorithms. In this way a kind of PFS (Perfect Forward Secrecy) would also be obtained.

EDIT: I wasn't proposing the use of security by obscurity, in fact I thought the negotiation of the new cryptosystem as public, in the same way the negotiation of the cryptosystem in TLS is public, and only the key is confidential (being shared using a well-known key distribution algorithm, like DH or RSA). On the other hand I know the definition of Forward Secrecy, that's why I said "a kind of". I was referring to the scenario in which an attacker discovers a vulnerability in a previous algorithm, but because currently is being used another totally different, the cryptanalysis is different now, and the information transmitted before and after the broken algorithm would remain unrevealed, similar to the concept of PFS.

Regarding the use of algorithms already used (and therefore proven in theory their safety), I do not plan to create a new system that is adopted worldwide (or even on a small scale), I only played with the possibility of creating a system like this so that, for example, the AES is found to be ineffective, not all communications made since the adoption of the AES (or any other algorithm) are disclosed. I mean, I propose the possibility of not trusting a single algorithm, and given the problem of the existence of infinity of communications, the solution would be to generate infinity of algorithms.


texts:
I've been reading a bit about block cipher modes and I have a relatively straightforward question regarding CTR.  In essence, I was hoping you guys would be kind enough to validate my understanding of things.

As I understand it, CTR does the following:

Take the first output of the nonce (let us assume an incrementing int for our purposes)
Encrypt the nonce with the key.  CTR requires that the key and the nonce be of identical size.
Perform some lossless operation between encrypted nonce and a portion of plaintext (e.g.:  XOR)
Increment nonce
Repeate ad libitum

Here's what I don't understand.  CTR is supposed to transform a block cipher into a stream cipher, but don't you still have to operate block-by-block for step 3?

What am I missing?


texts: What is the diffrence between Feistel networks and SPN?

texts: I recently read about the concept of Feistel Networks and Substitution Permutation Networks but what is exactly the difference between the two ?


texts: How to securely use Elgamal encryption in libgcrypt?

texts:
How secure is libgcrypt's Elgamal implementation of encryption (how different it is from textbook Elgamal), and how can I tweak padding and other preprocessing actions?

For example, I know that usign RSA I can use this S-expression to the function gcry_pk_encrypt:

(data
  (flags pkcs1)
  (value BLOCK))

And I can use oaep or pss instead of "pkcs1". But what do I use with Elgamal? I can encrypt and decrypt using Elgamal, using

(data
  (value BLOCK))

but then I have no idea if raw Elgamal was used or if it's actually DHAES or some padded-Elgamal variant.

What is the proper way to use Elgamal in libgcrypt, and what options can I pass? Or would it be better to switch to RSA?

edit: I think that what I wanted to ask is "what is the intended use of Elgamal as implemented in libgcrypt?"


texts: Does the initial exchange of random tokens in SKID3 authentication assure against replay attacks?

texts:
As the question suggests, I wanted to get a sanity-check on this issue...  is it the case that the use of a random token exchange during SKID3 authentication itself constitute a prevention of a replay attack, or is there a window of vulnerability in this process (and post-authentication) to this particular attack as well?

Slides 18 through 23 on this presentation provides an excellent overview of SKID3 authentication:  http://www.slideshare.net/sriprasanna/authentication-distributed-computing


texts: Why is SSL not under TCP (the Transport layer)?


texts: Is it possible to crack the trifid cipher without the keyword?

texts: I was learning about the classical ciphers and was looking up the methods to break them without the keywords and when I searched up "cryptanalysis of the trifid cipher" I couldn't find anything. I would be greatful for any help.(Find the outline of what the trifid cipher is here if you are unaware what it is)


texts: What does "running in polynomial time" really mean?

texts:
I'm currently learning private-key cryptography. I've been able to see that perfect secrecy is achievable if no assumption is made about the computational power of the attacker.

However, perfect secrecy is quite heavy to use, so we relax our assumptions to achieve the so-called computational secrecy, by assuming that the computational power of the adversary is bounded.

Then they speak about "efficient adversaries". They are defined as "running in polynomial time". I'm sorry, I know what asymptotic time-complexity is, but here I have no idea of what it means.

I'm confused because there seem to be a restriction. Security is said to be preserved only against efficient adversaries, that run in a feasible amount of time. In other words, they seem to say that polynomial time is a limitation on the adversary, and I don't understand that because to me it is the best complexity that can be achieved by an algorithm. If we are protected against polynomial adversaries, shouldn't we be protected against ALL adversaries ?

So maybe I'm missing something... Can someone explain what an efficient adversary really is ?


texts: Is XChacha20 - Poly1305 Quantum resistant?

texts: This is a question just out of curiosity, as I am a newbie to Post Quantum Cryptography. I have read several articles where they emphasize that current standardised symmetric encryption algorithms (that uses 256 bit keys e.g. AES) are Quantum resistant by default. But security of AES 128 can be compromised by Grover's Search algorithm to a complexity of $2^{64}$. Does Grover's Search Algorithm weaken the XSalsa20 / XChacha20 stream ciphers? Also, what about Poly1305 ?


texts: Pseudo random permutation for arbitrary size domains

texts:
Popular block ciphers like AES or Twofish are keyed pseudo random permutations on the domain $\{0,1,\dots,2^{k}-1\}$ with $k\in\{128,192,256\}$ or similar.

I'm interested in pseudo random permutations on domains whose size is not a power of two: Are there any fast (in the ballpark of AES) keyed pseudo random permutations that operate on $\{0,1,\dots,n\}$ with $n\in\mathbb{N}$ being an adjustable parameter?


texts: According to the article "Lest We Remember: Cold Boot Attacks on Encryption Keys" there is a quick and dirty entropy test that can help to find possible AES Key Schedules in memory dumps. Although there are references to this algorithm in blogs of other famouse cryptographers (for example, this post), I haven't been able to find any explanation why it works and why this algorithm is correct. Is there anybody who can provide me with a proof of correctness of this entropy test or can just explain me why it actually works?


texts: Why is LCG PRNG chosen to be as c++ rand() function?

texts:
The C++ rand() function is an  Linear Congruential Generator (LCG) PRNG. my questions are:

Why was this algorithm  chosen?
What are the pros and cons?
Is it good for cryptography?


texts: Probability for collisions of a one-way compression function

texts:
Given a one-way compression function $h:\{0,1\}^n \rightarrow \{0,1\}^m$ and an attacker that picks $x_1 \ldots x_t \in \{0,1\}^n$ (uniformly distributed), I have to show that the probability to find a collision in the picked elements is smaller than $\epsilon$ if $m > log(\frac{t^2}{2 \epsilon})$.
Assumption: $h$ is surjective and has the same number of inverse images for each image.

What I found out already:
Because a binary alphabet is used, I have to show that the probability is smaller than $\epsilon$ if there are at least $\frac{t^2}{2 \epsilon}$ elements that the compression function can map to. And because I want to find a collision between two elements, there are ${t \choose 2} \le \frac{t^2}{2}$ possible combinations for a collision pair in the set of picked elements.

Question:
How can I go on from here and how do I handle the $\epsilon$?


texts: How can we formally define a Pseudo-Random Shuffle function?

texts:
My question is related to: When we turn Random shuffle to Pseudorandom Shuffle

The idea is to permute the elements in vector $\mathbf{v}$ pseudorandomly, where $|\mathbf{v}|=n$;

I am aware that we can use Fisher-Yates shuffle for pseudorandom shuffle (in fact we replace the random generator with a pseudorandom one). So we can use a key: $k$, when we want to pseudorandomly shuffle the vector.

Let the pseudorandom shuffle be: $\pi (k,\mathbf{v})$

How to formally define the pseudorandom function? For instance, do we need to say pseudorandom shuffle must be indistinguishable from random shuffle?
Is there any textbook or paper has already defined it?


texts: How does one ensure that a handshake protocol is secure assuming all underlying cryptography used are secure

texts:
Suppose one have to design handshake protocol using known secure cryptographic algorithm. The designer of implementer can assume that crypotography is secure but how would they ensure protocol itself is secure. so far, I can think of few way to go about it but not sure if I am on the right path intuition wise.

1) Have the protocol as close as possible to well know protocol like TLS. So we will benefit from any discovery of weakness.

2) Use symbolic modeling. So far I know of tools like Proverif and Tamarin but not sure how widely they are used in industry. I know Tamarin was used in verification of TLS 1.3. This allow more flexibility in protocol design but symbolic modeling will not find any side channel attack.


texts: Quantum Resistant Algorithms and types: PKE vs PKEs vs KEM vs KEMs vs DSS

texts:
I am trying to wrap my head around the second round Quantum Resistant Algorithm candidates currently under the NIST PQC Effort.

Can someone verify if the following is a correct summary of the 17-Public Key Encryption and Key Establishment Mechanisms versus 9-Digital Signature Algorithms and their types? Specifically, I am asking if I got the classifications of either KEM, KEMs, PKE, PKEs, PKE & KEM, PKEs and KEMs and DSS all correct as defined below.

We have Key Encapsulation Mechanism (KEM) (KEM for a single one and KEMS for multiple), Public Key Encryption (PKE for a single one and PKEs for multiple) and Digital Signature Schemes (DSS).

PKEs and KEMs (17):

BIKE - KEM
Classic McEliece - KEM
CRYSTALS-KYBER - KEMs
FrodoKEM - KEM
HQC - PKE
LAC - PKE
LEDAcrypt (LEDAKem / LEDApkc) - PKE and KEM
Newhope - KEMs
NTRU - PKE and KEM
NTRU Prime - KEMs
NTS-KEM - KEM
ROLLO (LAKE, LOCKER, Ouroboros-R) - KEMs
Round5 (HILA5 and Round2) - PKE and KEM
RQC - PKE
SABER - PKEs and KEMs
SIKE - KEM
Three Bears - KEM

DSSs (9):

CRYSTALS - DILITHIUM
FALCON
GEMSS
LUOV
MQDSS
Picnic
qTESLA
Rainbow
SPHINCS+


texts:
Every now and then, we read that some hashing function has been weakened or broken, but we almost never hear this for asymmetric cryptosystems like RSA or ECC. That's because while asymmetric encryption uses mathematical impossibilities (discrete logarithm or prime factorization computation in polynomial time), hashing functions obfuscate their working by complexification, but it seems impossible to make a collision-free hashing function (that is, there is no algorithm to find collisions faster than bruteforce). Symmetric encryption is in the same case than hashing functions, because these algorithms (like DES) seem to have a shorter lifetime than RSA for example, which has been used for more than 40 years.

My assumption is that there is a difference of nature (and not degree) between on the one hand asymmetric encryption (that isn't vulnerable to cryptanalysis) and on the other hand hashing and symmetric encryption (that are vulnerable to cryptanalysis).

But can we use asymmetric encryption to create a collision-free hashing function? To hash some content, we would encrypt it using a public key that everyone would know (something easy to remember, 55555555 for example), but no one would know the correponding private key. But the result would be of variable length, so to reduce it to a fixed size we would hash it using another hash function. We can use an unsafe hash function, like MD5 for example, in fact it is just the compression feature of the hash function that we want to use here. It is a bit reminiscent of digital signatures, but the other way around. So to summarize, the hashing function would do this:

input —(RSA)—> cyphertext —(MD5)—> hash (128 bits)
         ↑
 key: 55555555

Would such a hashing function be really safe and collision-free?


texts:
I have a question about attacks on the
implementation of cryptographic code that are enabled by compilation and compiler-optimisations. I am aware of this. Would
anyone be able to point me to other examples? In particular, are there examples of timing attacks that are enabled by compilation (in particular by compiler optimisations) that are not possible w.r.t. the semantics of the source language?

$\mathbf{Edit:}$ Let me illustrate what I mean by this in two ways.

First, sometimes the semantics of a programming language is given using a one-step reduction relation. In particular, the one-step reductions of equality might be specified like this.

For all values $x$: $x = x \rightarrow \mathtt{true}$.
For all values $x, y$ such that $x$ is not equal to $y$: $x = y \rightarrow \mathtt{false}$.

You can see the one step reductions as taking one unit of time, so in this model, all computations of equality take the same amount of time. But for complex data-structures like strings, lists or arrays, compilation would typically be to code that has data-dependent run-time (or power consumption or EM radiation or whatever is your favourite side-channel).

Second, I know that not all programming languages have nice, simple operational semantics like that. So another way of looking at the same problem is: if I compile a program twice, once with little/no optimisation turned on, and once with a high degree of compiler optimisation, would the latter open my executable vulnerable to attacks in ways that the former does not? I'm thinking in particular of the optimisations (tracing) JIT compilers do.

PS I don't have enough reputation to give more/better tags to my question. Please feel free to do so.


texts: How to estimate the computation overhead of ECDSA?

texts: I am using ECDSA as a digital signature scheme. Using Charm, I got the timing for the multiplication, exponentiation, and pairing operations; they take 0.005,  9, and 4.4 ms respectively. I want to estimate the computation overhead to sign and verify a message. Any suggestions please.


texts: Stream Ciphers -- Need clarification on their benefits in practice

texts:
Compared to a block cipher which encrypts 16 bytes at a time, stream ciphers can encrypt a byte at a time. I am curious about which applications would immensely benefit from the ability to encrypt a byte at a time.

Realtime applications such as chatting or voip always have several bytes at a time to send -- which means only a little bit of padding would be needed every now and then if a block cipher is used. Leaves me curious where the ability to encrypt a byte at a time comes off as a big PLUS for stream ciphers.


texts: If nG and 2nG are known how to find generator point G


texts: AES. Algorithm of multipication in finite field

texts: I multiply 2 numbers using their polynomial representation and addition via XOR. Do I need to find the remainder of the division by $x ^ 8 + x ^ 4 + x ^ 3 + x + 1$, using the operator "%" or by division, using the rules of finite fields?


texts: What hash functions can be (efficiently) computed over GF(2^m)?

texts:
Given an arithmetic circuit over a finite field of characteristic 2, what families of cryptographic hash functions can be efficiently computed with this circuit?

Can standard hash functions be computed? To do so, standard bit operations would be necessary. XOR is possible via addition, but are there any arithmetic operations corresponding to other necessary bit operations like SHIFT, AND, NOT, etc.? An explanation of what bit operations are possible would be great.

If standard hash functions are not suitable, are there specialized hash functions developed for use over finite fields? If so, please reference any related papers.


texts: Why do we encrypt-then mac but sign-then-encrypt?

texts:
This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so:

The general advice for applying MACs seems to be that we should encrypt first, then MAC. However, the general advice for signatures appears to be diammetrically opposed.

Why is this the case? Aren't these the same ideas? If so why are they so opposite.

I have answered this myself but feel free to improve upon this answer.


texts: Can you provide an example in relation to Hidden Field Equations Multivariate?

texts:
I'm reading about Hidden Field Equations Multivariate scheme. My lecture states that the central map is a univariate polynomial $$P(X)=\sum_{i=0}^{r-1}\sum_{j=0}^{r-1}p_{ij}x^{q^i+q^j} \in K[X]$$ where $K$ is a extension field of the finite field $k=\mathbb{F}_q$ of degree $n$ and $r$ is a small constant chosen in a way such that $P(x)$ can efficiently inverted.

  $r$ is a small constant chosen in a way such that $P(x)$ can efficiently inverted.

I would like an example about the last claim please.


texts:
I don't want to utilize RSaCryptoProvider available in .NET to encrypt data.

I would like to encrypt data using the RSA keys, allowing me to send a message to Alice using his public-signature and allowing Alice decrypt it using its private one.

My problem is focused in an application which people can select the symetric algorithm to encrypt the data (among many of them), not only 3DES, AES... I mean, algorithms not provided neither by RSACryptoProvider nor DSACryptoProvider.

Questions:

1) So, I understand I have to get RSA parameters D, Q, p, n to create the "secret-key" which allow me to encrypt/decrypt data in my symmetric algorithm. Is it correct?

2) Supposing I have a number to work, based on the RSA formula (C = M^e mod n and D= C^d mod n) what exactly is M and C: a byte, a word, a double-word?

3) To make my job easier, I think to utilize a padding schema (like PKCS#1). In this case, the above question should be automatically answered? Is PKCS#1 matching the necessary lenght to operate with RSA formulas?

In fact, I would like to utilize RSA keys to provide a symetric encryption in a true manual way.

I will appreciate any help.


texts: A set of key pairs and one hash to secure them

texts:
I have a simple problem: I have a set of users' ECDSA key pairs, and say I want to encrypt them with a simple algorithm. I have access to one variable that uniquely identifies the user, so I hash it with a SHA-2 algorithm and have a string of bytes longer than each of the keys.

Is it safe to XOR a key pair, or XORing both of the keys together will make it easier to decode the original value?

What if I hash the entire key chain, does that make it much easier to get the data?


texts: How to ensure that a cryptographic implementation is reasonably sound/robust?

texts:
I know from the bottom of my heart how bad the idea of custom-crypto is. I absolutely concur with the recommendation that it should only be done by professionals who specialize in implementing crypto safely.
However, exactly because it's a Bad Idea ™ it's really hard to find good information on this topic. Say one of the aforementioned professionals is looking at a crypto implementation and they want to judge how safe it is. Some things that come to mind:

Constant-time implementation (to protect against timing/side-channel attacks)
Randomness

Source of randomness (true vs. pseudo RNGs)
Bits of entropy

Zeroing intermediate buffers
Appropriate test coverage with test vectors (e.g., NIST, Wycheproof)

What are other areas like this that need to be probed? Is there any documentation/checklist/book that can shed further light on the topic -- something like 1 but more comprehensive?


texts: Is there an encryption scheme that is url-safe AND compact?

texts:
I want to be able to encrypt some data like JohnSmith@domain.com|1234|A in a form that I can send to a user as a clickable link like:
https://example.com/click/this/NiUGgvamNOVmI1SzlTN0ZIRlQ0WklCazI3LzRxY09RVFRjOTByZ1o1OFJyT0lUeWd3PQ2....

Then the user clicks the link and when I receive the token, I can decrypt it and operate on the data.
I'm using the RijndaelManaged cipher, with a password and salt, and then Base64 encoding and then UrlToken encoding it, to avoid characters that would cause trouble in a url.
This all works fine, but it creates really long tokens, about 4 times the length of the original data, which makes sense, as it's smearing the information across all 256 possible bytes and then reducing to only 64 possible bytes for output.
What I am wondering is if there's a way to encrypt the data, possibly not as securely, but enough for limited application, that would not be 4 times longer than the input string. Could there be an algorithm that encrypts text AS text and without requiring vastly more size?


texts: Steps to determine the single element generators for a multiplicative group

texts:
As student I've been asked the following question:

  Consider the specific prime $p=17$. Determine the single element generators (by hand or by Java program) of $F^*_{17}$. Recall $F^*_{17}$ is the multiplicative group of size $16 = 17−1$ formed by removing $0$ from the field $F^*_{17}$.

Can anyone explain what the steps are in order to attempt the question?


texts: I am trying to implement ECIES (using BouncyCastle and FlexiProvider) across mobile app and server communication whereby the mobile app will encrypt a data and server will decrypt the same. Now how should I pass the public key of ECIES to the mobile app for encryption.


texts:
RFC 5959 specifies the encrypted storage of private keys based on PBKDF2-HMAC-SHA-256 and AES encryption (in ECB mode).

Is there a particular reason AES is used, instead of simply XORing the key material with the PBKDF2 output? Is it simply to make storage of long keys faster, because a long PBKDF2 output takes long to derive?

When storing a short key, e.g. a 256-bit ECC private key, is there a good reason to use AES or is the XOR with a single PBKDF2 (or other KDF) output block sufficient?


texts: Is this modification in Merkle-Damgård collision-resistant?

texts:
We modify Merkle-Damgård construction by setting $z_0:=L$ (the length of the message), computing $z_i:=h(z_{i-1}||x_i)$ for $i=1,...,B$ and defining $H(x):=z_B.$ Is this construction collision-resistant?
I think that it can not be collision resistant, because by adding the input length in the beginning after many steps two different messages may have the same output, but I can not find a counterexample to refute the assumption.
Collision resistant definition (from Katz&Lindell Introduction to Modern Cryptography): it is difficult to find $x$ and $x'$, with $x \neq x'$ such that $H(x)=H(x')$.


texts:
I have a plaintext and a hash output, two hash outputs to be precise.
One is HEX encoded, and I have no idea on the other one.

plaintext=halflife

hash=1e4dfacf77efceb3076bb551932e6e40

hash2=PN[6O265X^W6YEIK`/YJNVX54N\HY

I can't be actually sure which hash is output derived from my plaintext, and which isn't.
Is there a tool I could use to figure out how was my plaintext hashed, so it would come out like this?
If not, what procedures would you recommend?

UPDATE:
I now know that the hash2 is actually not the hash of the plaintext, but something else. I also know that if I change the plaintext > hash gets updated, and if I change hash back to it's original state > original plaintext is considered correct.


texts:
I am new to cryptography esp, homomorphic encryption. I would like to know if the following is possible using something similiar to additive homomorphic secret sharing. Please apologize me if its too vague. I will try my best to explain my ask.

Alice has a secret that she wants to homomorphically encrypt. However Alice does not have enough resources to perform FHE. Hence Alice reaches out to a quorum of powerful devices, that say theoretically, can encrypt the data homomorphically for Alice. However since Alice cannot share the secret directly with the quorum, she decides to use a secret sharing scheme. But if she splits the secret directly and shares it, then a few members of the quorum can combine their shares and reconstruct the secret. Hence Alice wants to perform some operation on the secret and split it into shares for each of the member of the quorum such that even if the quorum members combine their share they wont be able to reconstruct the secret. But if they homomorphically encrypt their share ( or perform some operation on their share and then encrypt their share homomorphically ) and then combine their homomorphically encrypted shares, they will be able to produce the homomorphic encrypted cipher of the secret that Alice had.

Thanks in advance !


texts: Ring Signatures: Why is the combination function easy to solve?

texts:
I'm reading Rivest's How To Leak A Secret and am on the part where they describe their signature scheme ("Generating a ring signature").

Why is computing $C_{k, v}(y_1, ..., y_r) = v$ easy? The computation seems to be "linear" or single-threaded, i.e. of the form $E_k(y_r \oplus E_k(y_{r-1} \oplus E_k(...E_k(y_1 \oplus v))))$. So let's say $r_i=s$ -- we require the value of $y_i$ to proceed with the computation (i.e. we can't continue to encrypt if we don't know its value), and so wouldn't we just be stuck trying all values of $y_i$ until we hit one that results in $v$ when the computation finishes?

Wikipedia also says that $C_{k, v}$ is trivially invertible given $r - 1$ parameters. I'm blanking out - why is this the case?

I did look at this answer but I didn't understand the line

  Start again at 12 o'clock and calculate going counter-clockwise until you arrive at 6 o'clock.

How can you "go counter-clockwise" when all the computations counter-clockwise have inputs dependent on all previous computation? All of the XORs have the previous computation as input.

Sorry if I've made any gaffs, this is my first *Exchange question.


texts:
Suppose Alice shares a secret block cipher key, $K_{AB}$ with Bob, and a different secret block cipher key, $K_{AC}$ with Charlie. Describe a method for Alice to encrypt an m block message such that it can only be decrypted with the cooperation of both Bob and Charlie. The ciphertext should only be a constant size greater than m blocks. You may assume that Bob and Charlie have a pre-established secret channel on which to communicate.

The answer given is:

Alice can first pick a random key $K$ to encrypt the message $M$, and then she encrypts the key $K$ with both $K_{AB}$ and $K_{AC}$. In other words, Alice does the following:

$$E_{K_{AB}} [E_{K_{AC}}(K)]  || E_K(M)$$

May I know if in this case, that Bob wants to decrypt  $E_{K_{AC}}(K)$, can he complete this solely without the help from Alice? Thanks for the answer.


texts: Unable to understand the concept of a 1-bit PRF

texts:
In his lecture on building Block Ciphers from PRGS, Dan Boneh says this

Let’s start by finding out if we can build PRF from a PRG?
Let $G:\ K \to K^2$ be a secure PRG
Define 1-bit PRF $F:\ K \times \{0,1\} \to K$ as $F(k, x\in\{0,1\}) = G(k)[x]$
$\quad F$: if $0$ choose $G(k)[0]$, if $1$, choose $G(k)[1]$

I am unable to understand what is a 1-bit PRF. A PRG takes only the seed as input. So what is the $\{0,1\}$ in $F:\ K \times \{0,1\} \to K$ - considering that $K$ is the key/seed of the PRG.
And what does $G(k)[x]$ in $F(k, x\in\{0,1\}) = G(k)[x]$ mean?


texts: What impact could general quantum computing have on BCrypt?

texts:
While discussing the 72 character limit of BCrypt, the question of resilience to quantum cryptanalysis came up. A search online didn't give me much of a lead as to what research has been done in this area.

So my question is, are there any candidates for algorithms that would decrease the security of Blowfish, and by extention of BCrypt? If so, by how much?


texts:
I'm looking at using HMAC + CBC. The combination looks like this:

ciphertext = AES256(text, k1)
data = HMAC-SHA256(iv | ciphertext, k2) | iv | ciphertext

Where:

k1 = 32 byte key - Randomly generated, once
k2 = 32 byte key - Randomly generated, once
iv = 16 bytes - Randomly generated, for every message

The purpose is for storing sensitive information in a database.

Is the above approach cryptographically secure for sensitive information? Would there be any reason to consider a stream-cipher mode verses a block-cipher mode like CBC?

Would an AEAD mode like OCB or CCM be more appropriate?

If an AEAD mode is not available for the platform we are using (specifically Go), is it worth the effort trying to implement these modes?


texts: If I know the salt, can I decrypt the commitment?

texts: Say, I salt my key(K) with y. So, my new Key is K' = Salt(K+y). Now, Alice sends commitment = E[K',M] to Bob. Bob knows the salt(y), but not K nor K'. Can Bob decrypt the message?


texts: Any problems with this secure time synchronization scheme?

texts:
I have a time authority and I want to securely set a client's time to this authority's time/date within a precision of $\delta$ seconds. The authority's public key is known to the client. This was my idea:

A client sends a request with a 128-bit randomly generated nonce to the authority, and starts a timer.
The server replies with $time\_data$ and $sign(time\_data || nonce)$. $time\_data$ is some representation of time with a high precision and constant length (for example 16 bytes).
The client waits until a response is received or until $2\delta$ seconds have passed.
The client stops the timer, having measured $\Delta t$ since it started, and verifies that ${\Delta t \over 2} < \delta$. Then it verifies the signature using the given time data and the latest sent nonce. If everything passes then it sets the time to $time\_data + {\Delta t \over 2}$. If not go back to step 1.

As far as I can see there is no attack on this scheme that allows any adversary to let the client accept a time that is not within $\delta$ seconds of the actual time of the authority. Am I missing something?

I'm also wondering if there's any way to improve precision above the minimum delay $\Delta t$ of the network without losing security of the synchronized time, similar to what NTP does with estimating network latency.


texts: Why does the modulus of Diffie–Hellman need to be a prime?

texts: I read a lot about Diffie-Hellman, but there is one thing I dont understand: why does the modulus p need to be a prime? What if it would not be a prime?


texts:
$f_{p,g,h}(x_1,x_2)=g^{x_1}h^{x_2}\bmod p$ where $g$ is a generator of $\mathbb Z_p^*$; $h\in\mathbb Z_p^*$; $x_1,x_2\in\mathbb Z_{p-1}$
Is this a One Way Function? (Assuming DL is hard)
Anyone has an hint for me?


texts:
Recently I've been reading the paper “A New Family of Implicitly Authenticated Diffie-Hellman Protocols”. It's very hard for me to go further. Especially when it comes to the proof of knowledge. Actually, I never meet this concept before.

There are two extended concepts to the proof of knowledge in the paper, i.e. “joint proof of knowledge” and “non-malleable joint proof-of-knowledge”, which are abbreviated to JPOK and NMJPOK respectively in the paper. Can someone help me understand them (in a plain and simple way)?


texts: Missing operations in last round of DES and AES

texts:
Why doesn't last round of DES have swapping?
Why MixColumn is not included in last round in AES?


texts: AES implementation for non-password multi-document decryption usecase

texts:
I am trying to encrypt/decrypt multiple user documents (consider text) in an application. Unlike the use case of passwords where decryption happens once during an API call, in this application during each API call the server has to decrypt multiple documents. Currently, I am using AES-256 with random salt and PBKDF2 (1000 iterations). As it turns out, this is quite slow because PBKDF2 is designed to be slow for the password use case where doing this operation once is fine from the performance standpoint. To put this in context, during decryption of a single document out of the total decryption time of 1.78ms for this single small text document, it takes 1.45ms to create the key using PBKDF2 with 1000 iterations.

I'm trying to improve the speed of this system. I'm looking at various ways of modifying the system. Which of the following would be the best choice for the given use case (where the server has to decrypt multiple documents in a single API call)?

AES-256 with a fixed (secret) key and random salt added to the content
AES-256 (with a fixed (secret) key + random salt to generate) PBKDF2 on very low iteration count (1 or 10)
AES-256 with a fixed (secret) key

Here's a code snippet to clarify the meaning of secret key + random salt:

func deriveKey(secretKey string, salt []byte) ([]byte, []byte) {
    if salt == nil {
        salt = make([]byte, saltLength)
        _, _ = rand.Read(salt)
    }
    return pbkdf2.Key([]byte(secretKey), salt, 1000, aes256KeyLength, sha256.New), salt
}

As per my understanding, both 1 & 2 are equally secure in this situation. Is this true?

Is there still any purpose of using PBKDF2 at such low iteration count (like maybe it randomizes key better)


texts: Tweaking textbook RSA to make the encryption a Pseudorandom function

texts:
Lets say I want to tweak/alter the textbook RSA encryption function to create a pseudorandom function by pre-processing the input.

Suppose I do something simple like add 2 to the input before encrypting it:

$$c = (m+2)^e \bmod N$$

How do I know if this is not a secure pseudorandom function? Does this give any information about N?

I am aware that no tweak can make it a pseudo-random function. I am just trying to understand which values this setting cannot output so as to build a distinguisher. Sorry if I wasn't clear earlier. My question originally meant to ask which ciphertexts cannot be the output of this setting in order to distinguish it from a purely random function. I know 1 thing - This setting will never output 0 & 1 as the input is bounded $$0<=m<2^n$$


texts:
I was studying the Rijndael Block Cipher for an assignment. I am looking for a (layman-ish) explanation as to why the cipher is secure. Googling did not seem to be give any good explanations. The paper linked itself is a bit too high level for me to understand.
Could anyone explain the security or give a reference to where one could read about it?


texts:
Is it possible to figure out what $arg1 is if I know both $arg2 and $arg3 in addition to $hash?

$hash = hash('sha512', $arg1 . $arg2 . $arg3);


texts: What is difference among eavesdropper attack, multiple message attack and CPA attack?

texts:
What is/are difference(s) among eavesdropper attack, multiple message attack and CPA attack
in context of symmetric key encryption?

I only know that in eavesdropper attack there is an adversary which can send only 2 msgs to challanger and adversary has to distinguish between these in order to win the game but in multi. msg. attack & CPA, it can 2 msg vectors of same length and adversary has to distinguish between these in order to win the game.


texts: How can I find the original message of two encrypted (Vernam Cipher) text without the key

texts: Can I get the steps or the solution if possible?


texts:
A Gap-CDH group is such that, given group elements $g, a = g^x, b = g^y$, it is hard to compute $g^{xy}$, but, given a group element $c$, easy to verify if $c = g^{xy}$. While such groups have been proposed, and it is obviously feasible to define a group where Decision Diffie-Hellman is demonstratively easy, exactly what grounds exist for the conjecture that Computational Diffie-Hellman is hard in such groups, beyond the observation that no known algorithms for solving it yet exist?

Are there ways to reduce the hardness of CDH in a Gap-CDH group (in general or some specific group), to the hardness of CDH in a group that has received more thorough scrutiny over the years? For instance, does there exist a group $G$, such that DDH is easy in $G$, and there exists a proof that the ability to solve CDH in $G$ implies the ability to solve CDH in $Z_p^*$ for a suitably large prime $p$?


texts: What does "simulatable" mean in security proofs?

texts:
I am reading a security proof in a paper as follows.

Regarding the data confidentiality of users, all related public transcripts are simply the ciphertexts $\mathcal{C}_1,\ldots,\mathcal{C}_n$. The ciphertexts are easily simulatable according to the semantic security of the public key encryption.  How can I interpret this proof? In other words, what is meant by simulatable?


texts: Why, in general, are proofs of possession (POPs) "clearly" not sufficient for substantiating the knowledge of secret key (KOSK) assumption?

texts:
In Ristenpart, Yilek - The Power of Proofs-of-Possession: Securing Multiparty Signatures against Rogue-Key Attacks they have the statement:

  In general, such proofs of possession (POPs) are clearly not sufficient for substantiating the KOSK assumption.

Can someone explain this to me? It seems reasonable to me that if someone can sign a message for a POP, they must know what the secret key is.

What does the KOSK require that a POP does not necessarily provide?

Can you give a simple example?

Is a POP alone sufficient to prevent rogue key attacks?


texts: Possible to guess RSA public key $e$ using $n$ and $\phi$

texts:
We know that if $n$ and $\phi$ is known, then it is possible to find $p$ and $q$ (initial prime numbers). I have following the questions:

Assume the public key $e$ is not known, how difficult would it be to guess the public key using $n$, $\phi$, $p$ and $q$?
Assuming we have $c_1$, $c_1 = m^e \bmod n$ is it possible to find out $m$ without knowing $e$ and $d$ ?
From my point of view $ed = K*\phi(n) + 1$ it is difficult to guess $e$ and $d$ product. Will it fall into the factorization problem ? Is this the only equation with $n$ and $\phi$ that involves $e$ and $d$ ?
Can we use some algorithm for guessing $e$ and $d$ ?

I know $e$ needs to be published publicly but if $e$ is lost how can it be identified?


texts: Is it safe to re-use the same p and q to generate a new pair of keys in RSA if the old private key was compromised?

texts:
Say I selected two large primes p and q for RSA and computed my public key (e, n=pq) and my private key (d).

Now, I was careless and compromised my private key (d). p and q were not leaked. Taking into account that (e, n) were already public knowledge, would it be safe to generate a new key pair with the same p and q or are they somehow compromised by the leaking of the private key?

If it would not be safe, how could someone compute p and q from my public-private key pair?


texts: AES 128 GCM - dynamic key with static IV/nonce

texts:
I'm working on a project to upgrade an existing system that currently uses RC4 to encrypt a payload with a random session key. The session key is then encrypted with asymmetric public key encryption (RSA PKCS#1 OAEP). The encrypted pair are then transmitted over insecure channels as a token.

I'm looking to replace the RC4 part with AES-128-GCM. This is an interim solution on the way to using a standardised authenticated public key message exchange framework, such as OpenPGP or JOSE JWE.

To reduce the amount of work required to implement AES-128-GCM by keeping the message syntax the same, I was thinking of using a static IV/nonce shared by sender and recipient. As the session key is unique, I understand that this is as secure as using a random IV with a static key.

Is this an acceptable solution?


texts: Case insensitive verification of HMAC / Base64 signature

texts:
I am signing a short message using the base64 of an HMAC, like this (python):

import hashlib
import hmac
import base64

raw = hmac.new("key", msg="secret", digestmod=hashlib.sha1).digest()
base64.urlsafe_b64encode(raw)

That last line returns 'ux5F7Ye-rpwvysbzUBLu-wGaYXA=', which I use as the signature. To verify a signature we sign the data again, and compare with the user provided signature.

(The real implementation is Django's Cryptographic signing, the heart being salted_hmac. I'm simplifying a little for the question.)

How risky would it be to do the comparison case insensitive? e.g. the signature above would also allow 'ux5f7ye-rpwvysbzublu-wgayxa=' and many others.

Motivation is I am using the signature in an email address, which is case insensitive, which as you can imagine doesn't work. I can change to a different encoding (suggestions?), but that would require everyone updating the email addresses they use. I'm asking this question to see whether I can safely avoid making everyone do that.


texts: functional encryption over homomorphic encryption

texts:
I recently read about "functional encryption" which seems interesting, although I didn't understand yet how it works ... but is it possible to combine it or adapt it with homomorphic encryption in the context of neural networks particularly.
Suppose you have a neural network that you run over some data encrypted homomorphically (say paillier for example) ..
linear computations will be performed without any problem ..
but the only issue will be with activation functions which are non linear, and thus require to decrypt the intermediate results (weighted sums) in order to apply the activation functions ...
in case we don't want to disclose the private key, can we use something like functional encryption in order to allow the application of activation functions only, something like a special private key that allows only a specific activation function to be performed, and do not allow to decrypt any other information ?!


texts: Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)

texts:
I have a question about Pseudo Random Functions.

Let $f:\{0,1\}^m \times \{0,1\}^n → \{0,1\}^n$ be a secure PRF.

Define $F(k,x) = f(k,x) - f(k, x-1 \bmod 2^{n}) \bmod 2^{n}$.

Is $F$ is a secure PRF?


texts: RSA-blind signatures vs. DSA-blind signatures

texts:
I see that the RSA blind signature scheme tends to be implemented more often than others, e.g., DSA blind signatures. Isn't the RSA blind signature scheme a 'lesser' scheme, if you may, compared to DSA? DSA appears to be about 6x more performant and is not prone to attacks like timing attacks. The security of RSA scheme isn't even proven, right?

Thanks


texts: How to combine $n$ 'less random' bits to generate one 'more random' bit?

texts:
Suppose we have a random number generator badrand() generating 1 with probability $0.9$ and 0 with probability $0.1$.
How can we combine $n$ bits from badrand() to get one bit of betterrand()? What will be its probability of giving a 0 or 1?
I assume that this is possible since the entropy of the combined output increases with each call to badrand(). Please guide me if I am wrong.


texts:
First off, I'm extremely sorry if this comes off as a "homework dump", but to clarify, it isn't. I don't want the answer, I want to know how to get to the answer. My cryptography professor gave us an assignment to do, and without explaining this concept, he believes we all understand how to do it, and I definitely don't.

The problem is in two parts:

The one-time pad encryption of the message attack at dawn is 6c73d5240a948c86981bc294814d (the plaintext letters are encoded as 8-bit ASCII and the given ciphertext is written in hexadecimal) What would be the one time pad encryption of the message attack at dusk under the same OTP key?
The one-time pad encryption of the message attack at dusk is 6c73d5240a948c86981bc294814d (the plaintext letters are encoded as 8-bit ASCII and the given ciphertext is written in hexadecimal) What would be the one time pad encryption of the message attack at noon under the same OTP key?

Thanks for any/all help


texts: What is the purpose of the middle-man actor in chaffing and winnowing?

texts:
Chaffing and winnowing is presented as a form of confidentiality without using encryption. This is beneficial for countries where encryption is regulated.

Below is a diagram from Wikipedia showing Alice sending "1001" to Bob.

My question is what is the purpose of Charles in this picture? Why can't Alice just chaff the data herself before sending it directly to Bob?

Additionally, if this assumes that traditional encryption methods aren't available, how are Alice and Charles talking over a secure channel?


texts: Multi-Party Offline Key Exchange Using Public and Private Keys

texts:
I hope the title already explains the problem I have in mind; but let me lay out some more details.

Given public-private key pairs $P_A, P_B, P_C, ... P_Z$, (first $3$ of which are owned by our usual suspects $A$lice, $B$ob and $C$harlie; we want to be able to do a key exchange as defined below:

Alice, Bob and Charlie are part of the same security group $ABC$, they need to agree on a symmetric encryption key, in offline mode. Everyone naturally has access to the public keys of every other party.

When Alice wants to calculate the $K_{{ABC}_R}$ with some random seed $R$ she should be able use her private key along with the the public keys of the group such as:

$K_{{ABC}_R} = Exchange(R, P_{A_{public}}, P_{B_{public}}, P_{C_{public}}, P_{A_{private}})$

Whereas if Bob wanted to calculate the same $K_{{ABC}_R}$, he would be able to do the same calculation as follows:

$K_{{ABC}_R} = Exchange(R, P_{A_{public}}, P_{B_{public}}, P_{C_{public}}, P_{B_{private}})$

Please think of $R$ having the similar functionality as it's in the public base in the Diffie-Hellman key exchange.

Can such key-exhange be achieved?


texts: Using a PRP $\pi: \{0,1\}^{16} \to \{0,1\}^{16}$ to construct an ideal cipher

texts:
Say we have an ideal 16-bit PRP. Since it appears that a permutation with a small domain can be used to turn it into a PRF, which can then be used in a Feistel network. On the surface, it makes it look like this means a trivial random permutation implemented using nothing more than a lookup table could then be used to create an ideal cipher with an arbitrary block and key size, which is obviously not the case. There must be something I am missing.

The way I see it:

A small, random permutation can be implemented in practice using a lookup table.
A random permutation can be used to implement a keyed PRP, e.g. $C = \pi(P \oplus K) \oplus K$.
A PRP with a small domain can be used to construct a secure PRF.
A secure PRF in a Feistel network can be used to create a secure block cipher.

A random permutation with a small domain can be implemented easily using a lookup table. Were I any more naïve, I would have proclaimed that I had just discovered an information theoretic secure cipher that fits the ideal cipher model, but obviously that is not the case. Why is this?

This is not a cryptosystem review question in disguise. I am simply curious to know the reason why an ideal but small PRP cannot be used to construct a cipher that fits the ideal cipher model.


texts: Is using Euler's Totient/phi in Tonelli-Shanks (used to recover EC coordinate) safe?

texts:
I'm implementing an algorithm in order to recover the $y$ co-ordinate from $x$ in order to construct a co-ordinate pair that satisfies secp256k1's elliptic curve equation, which is:
 $y^2 = x^3 + 7 \bmod q$.

$q$ is a prime and $q \equiv 3\bmod 4$ (I've checked) so we should be able to use:

$y = (x^3 + 7 \bmod q)^{\frac{q+1}{4}}.$

However, the size is limited to 256 bits and so $\frac{q+1}{4}$, which I'm calculating by $(q+1) \times 4^{-1}$, will be taken modulo $256$. I'm scared of this making the overall result wrong, so I was thinking of using Euler's totient and taking $\frac{q+1}{4} \bmod (q-1)$, as $\phi(q) = q-1$ due to $q$ being prime.

Is this safe? I can't find it recommended anywhere and I feel like it would be a good optimisation if it was actually safe to use, and so would be noted somewhere?


texts: SHA-256 : Finding two strings that the first n bits of hash value are same

texts:
How can I find two strings that have the same hash value for first $n$ bits in SHA-256? I'm implementing it by Python and I have the following ideas and problems:

Keep generating two random string

What is the length of the string that I need to generate?
How to avoid generating the existing string again?
How many string should I generate in total?

Hash the two random string and store in a dictionary

import hashlib in python
{random string : hash value}

Loop the dictionary to check if there is two hash value share the same first n bits and return the two strings as a result

Please give me some advice on it.


texts: How does one calculate the scalar multiplication on elliptic curves?

texts:
I found this example online:

  In the elliptic curve group defined by
  $$y^2 = x^3 + 9x + 17 \quad \text{over } \mathbb{F}_{23},$$
  what is the discrete logarithm $k$ of $Q = (4,5)$ to the base $P = (16,5)$?

  One (naïve) way to find k is to compute multiples of $P$ until $Q$ is found.
  The first few multiples of $P$ are:

  $P = (16,5), 2P = (20,20), 3P = (14,14), 4P = (19,20), 5P = (13,10)$,
  $6P = (7,3), 7P = (8,7), 8P = (12,17), 9P = (4,5)$

  Since $9P = (4,5) = Q$, the discrete logarithm of $Q$ to the base $P$ is $k = 9$.

How do we get to these scalar multiples?

  $P = (16,5), 2P = (20,20), 3P = (14,14), 4P = (19,20), 5P = (13,10)$,
  $6P = (7,3), 7P = (8,7), 8P = (12,17), 9P = (4,5)$

How can I check that $9·(16,5) = (4,5)$?


texts: Can Pedersen commitment be used in pairing groups?

texts:
For bilinear groups: $(p,\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T,e,g_1,h_1,g_2,h_2)$, where $\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T$ are groups of prime oder $p$. $g_1,h_1$ are generators of $\mathbb{G}_1$, and $g_2,h_2$ are generators of $\mathbb{G}_2$

Is it possible to use Pederson commitment over all these three groups?

For instance:

In $\mathbb{G}_1$: $c_1(m_1,r_1)=g_1^{m_1}h_1^{r_1}$

In $\mathbb{G}_2$: $c_2(m_2,r_2)=g_2^{m_2}h_2^{r_2}$

In $\mathbb{G}_T$: $c_3(m_3,r_3)=e(g_1,g_2)^{m_3}e(g_1,h_2)^{r_3}$


texts: Paillier scheme : Encoding floats into integers impact on computations

texts:
In Privacy Preserving Processing Over Encrypted Images, I could understand that appropriate encoding of floats into integers (required in Paillier) only incur negligible error in computations.
Any other references supporting this ?


texts: Is PBKDF2/RFC 2898 broken because SHA1 is broken?

texts: I was attempting to re-implement the ASP.NET Identity password hash algorithm in PHP. It uses RFC 2898, which uses HMAC SHA1. SHA1 has been broken by google. Does this mean that RFC 2898 in general and the current ASP.NET Identity password hash format in particular are broken?


texts:
I'm trying to figure out how to verify an XML digital signature.

I have received a signed XML response (in string) in following format:

<?xml version="1.0" encoding="UTF-8"?>
<ROOT>
   <HEADER>
      <tag1 />
   </HEADER>
   <Body />
   <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
      <SignedInfo>
         <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
         <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
         <Reference URI="">
            <Transforms>
               <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
            </Transforms>
            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
            <DigestValue>hTKE4DcevU+1LWf78hwVjGJvjwA=</DigestValue>
         </Reference>
      </SignedInfo>
      <SignatureValue>tmuTneoW6tHNAv13Z2mybXx/8M+AfF8Qa44DUFZEVk2kdztUiEjk589WJVDecEBsRA2tTQEBhKol/5Bv8bS9Nc1XrS8gKF5vjj14vnFKpSpsNvyooKfv3w50jrOaZeYd5PXWTxB4BT9wL8ogU51/plT6T8A8EdMoLw5zOPO6noTLdi2tAGF3OzLQla+BOtlrxliCfwWkWisBOwWO0kpgsQjxqx2dIS69JHuz5V/aj3tCXLzr2lX9P/S+urn6NU1YEHlVYYs+fFXnKCeHtBhwnz7hDLEB2bovW0rfft3bSNkvylrOfuGbAhRE/ey8g4M3pA5wpufu3eqZv0s4e1uYag==</SignatureValue>
   </Signature>
</ROOT>

I have the RSA public key of the sender in .pem format and the digital certificate in .cer format. This is what I've tried till now to verify the signature by reading various resources online:

Converted the <SignedInfo> root element into canonical format
Computed the SHA1 digest of the canonicalised XML
Encrypted the digest with the public key available with me as mentioned above
Compare the encrypted value with the value present in <SignatureValue> element in the above XML

However, the two values do not match. Does this mean that the verification has failed? Or am I doing something wrong? (I have a feeling the latter is true)


texts: Is jacobian to projective conversion unique?

texts:
I am doing a small project in ECC. I have used the following equation for converting Projective to Jacobian coordinates:

$$D = AC\\
E = BC^{2}\\
F = C$$

and also the following equation to convert Jacobian to Projective coordinates:

$$A = DF\\
B = E\\
C = F^{3}$$

where $(A,B,C)$ represents a point in Projective coordinates and $(D,E,F)$ represents a point in Jacobian coordinates.

What I’m having doubts about: if I convert a point from Projective to Jacobian coordinates using the first equation and also use the second equation to convert back to projective, then how will the first and last point be related? Or will it be the same?


texts: Are there any security issues when replacing the SHA-256 initialisation values?

texts:
As RFC 4634 describes in section 6.1, SHA-256 is initialized using eight 32-bit words.

These were obtained by taking the first 32 bits of the fractional parts of the square roots of the first eight prime numbers:

H(0)0 = 6a09e667
H(0)1 = bb67ae8
H(0)2 = 3c6ef372
H(0)3 = a54ff53a
H(0)4 = 510e527f
H(0)5 = 9b05688c
H(0)6 = 1f83d9ab
H(0)7 = 5be0cd19

These are obviously meant to be "nothing up my sleeves" numbers.

Assuming interoperability — read: compatibility between users — isn't an issue, I've got the following questions:

Are there any security issues related to replacing those SHA-256 initialisation values?

The plan is the one-time use of a CSPRNG to get alternative values for a specific (in-house) implementation; which I presume to be a safe way to get good alternative values. Please correct me when this assumption is wrong.
Are some initialisation values worse than others?

In other words: is the Merkle–Damgård construction, and/or the SHA-2 algorithm design as a whole, susceptible to weak initialisation values along the lines of 0-key problems as applicable to cipher analysis? Or could we set them all to zero without any impact on cryptographic security?

NB: pointers to related research paper(s) welcome, but not a "must".


texts: Recommended way of adding a pepper/secret key to password before hashing?

texts:
There have been several questions regarding password hashing here and on Security.SE.

A "pepper" is sometimes mentioned – an application-specific secret key. The canonical answer on password hashing implies that a adding pepper brings the composition close to a MAC, and that cryptographic MAC function should be used rather than concatenating a pepper together with the salt and password.

My question is: Where applicable, what would be a generally recommendable, sound, well understood way to MAC a user password and a secret key, in the context of password hashing?

I want to MAC the password using a secret key, then feed the output of the MAC to a slow hash function (like bcrypt, scrypt, or PBKDF2).  I want to know what kind of MAC to use.
To represent the MAC, I'm using this notation

HMAC-SHA256secretkey(message) and HKDFsalt(password)
password is the low-entropy user password
key is the high entropy secret key (the "pepper")
salt is a per-password random value, optionally reused by the subsequent computationally expensive hash such as bcrypt, PBKDF2, or scrypt

Would any of these constructs be more recommendable? Or is there an even better way? And if so, briefly why?

HMAC-SHA256 key(password)
HMAC-SHA256password(key)
HKDFpassword(salt)

NB: This question is in relation to the "pepper" section near the end of the accepted answer to "How to securely hash passwords". Thus the output of the MAC will be fed to a slow, computationally expensive KDF like bcrypt, PBKDF2, or scrypt.


texts: Is it hard to recover $p$ from $k \phi(p)$?

texts:
Given $k\phi(p)$, is it hard to recover $p$? Here, $p$ is a large prime, $\phi(\cdot)$ is  Euler's totient function and $k$ is an unknown integer.

Or what's the complexity to recover $p$ from $k \phi(p)$.


texts:
I'm very (!) new to the world of cryptography, so pardon me if this question is very basic.

Related to hashing, something that hasn't become clear to me is the relation between data length and hash length.

If I understood correctly, any change in the data should also alter the hash, while still avoiding hash collisions. So my question is if it's possible to have a hash whose length is inferior to the data length and still avoid hash collisions.

My use case would be something like hashing data with less than 128 bits, but I absolutely cannot spare another 128-bit space to store the hash. I would be able to store maybe a 32-bit hash, if even that.

Are there any hashing functions that perform better in these scenarios over others?

Edit: To clear some confusion, here are some bullet points:

I have a set of data that is about 128 bits long. I can only fit another 32 bits in that same packet.
Ideally, the data should not be readable by anyone else other than the destination (there is a shared key), and it should be possible to identify 'fake' packets (modified or injected into the network)
My first idea was to create a 32-bit hash and then encrypt the whole 128+32 bit using the shared key
I'm looking for better suggestions/guidelines, since I'm a newbie in this area.

Thanks!


texts: salting with password hash to improve security?

texts:
Would something like the following improve security (against rainbow attacks, not brute force)? Assume that $P$ is a user-chosen password, and the objective is to obtain a hash $H$ for password checking.

Let $S$ be a random salt.
Let $A_1 = MD5(P || S)$
Let $A_2 = MD5(A_1 || P) || A_1$
Let $H = MD5(A_2)$.

The idea is to increase the ciphertext length and the number of MD5 iterations by "salting" the hash with another hash of the password. Does that really help?


texts:
I could not understand how multiplication is carried out in the BGW protocol for 3 parties. Reference: https://crypto.stanford.edu/pbc/notes/crypto/bgw.html

I've understood that in multiplication, we calculate r(x) = p(x)q(x) but this means that r(x) is a polynomial of degree 2t. How is this polynomial redistributed in the circuit to get an O(n^2) complexity in multiplication over BGW protocol?

Note that p(x) and q(x) are both polynomials of degree t and as I am taking the case of semi-honest adversaries, t < n/2.


texts: If you encrypt an image (AES), is it still an image and can you view it?

texts: Can you encrypt an image (with AES) such that you can open it as a png/jpeg?


texts: Patterns flaw to sign a counter with public key encryption protocol

texts:
In modern asymmetric encryption protocol, like secp256k1, are there any flaws if you want to sign a counter?
i.e: use a private key to sign from 1-n is that any chance make n+1 easier to guess?


texts: Trying multiple private keys against a pcap

texts:
I have 1000's of Private Key files "f0167f3d025582d6bb65d5ca501a50eb.key" etc to use against a PCAP file.

Only one of those private keys are valid and I am wondering what would be the easiest way to test against them and pull out the valid one?

Example of the key -

-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDjQfT7Awy8J44B
h1lddhMT8lN68Gg8xHyssIV2O9eO2g96RuBuhxOtbaNm2LvJe512vrrX1sL8LqJV
KZdAmR2SzVgnMc7oNcs+ZHOPIAZFrCL/m1RnnohA+1RFKm3LSH4eP8rvt6vZa2dZ
A8y8QZl9psnW5T84KWrWPSnuZDirBUehfWtRBdBJLlJkmUSu1+hr3BDq0pT1MnXO
8ZOX+FIb7yYCWWWGr4PH3IIokPm5sODbHB69RCMMLzpHXxR7dgnZycrz0SC+fMb1
moG/94XCDk3naQt48warHARno2rQ85ebIJDVEuIzmRmVqzt60gu7OFMxmr1f9n78
PEquGYmNAgMBAAECggEADuy1+gYpP/IZEWCiLdEjT5wKf3hqYBNHXM/689jaPzdy
7MTa2Gdmk20v3gE90+2aWcIM4z/nbkhhwNYKaOOlXY6+y1QqEnX18xMFw9CGmOzF
H6RD1spCiIH49tHihAcuwS3PVg7p6k1zbBUjzPlB606Y0tQbYsTVj1xU9KMAVbrT
VbIOijg30rwJiSyGPxntOj/bNoiOpyLEf6NEJ6xzUF+cHe2a2BJxvyZE8Jn25flu
qzRvjCz8r54dNCbj3wnO3+hvFyE62d4LEEYrgRIMZsI5gLX1eunS0LPaLtpjHgk0
FouzYHDdw2PhMRWicmUm4qYq0BGzNJGokraM8BViAQKBgQD6JzM8vYzuzRwrX48D
rtpWrEVl+6kVaIoalU18HihYPEpFCuWeG26+B1yhHzVTGIvUIwjy+uzVCh7laRvF
-----END PRIVATE KEY-----

The key is longer but i removed some


texts: How Secure is gpg Command Using Symmetric AES-256 From Being Cracked

texts:
How secure is any data encrypted using the following command:

gpg -o *encrypted_output_file_name* --symmetric --cipher-algo AES256 *file_to_be_encrypted*

Can anyone depend on this to encrypt and archive personal content in a public store?

Please provide details as to which attacks it is vulnerable to, and describe better encryption alternatives if any exist.


texts:
I had find a paper about VMAC algorithm:VMAC: Message Authentication Code using Universal Hashing.

Now I want to implement this algorithm, But i don't find test vectors about it.

Who can give some advise? Where can i find it's code ?


texts: Why are some key stretching methods better than others?

texts:
I'm trying to understand why some key stretching methods are better than others.
The wikipedia article presents 3 different key stretching methods:

  A collision prone simple key stretching method:

key = hash(password)
for 1 to 65536 do
key = hash(key)

  A better simple key stretching method. ("+" denotes the operation of concatenation):

key = ""
for 1 to 65536 do
key = hash(key + password)

  Even better method with a salt:

key = ""
for 1 to 65536 do
key = hash(key + password + salt)

So, I was wondering why #1 is the weakest of the 3 while #3 is the strongest. My understanding is the following :

The problem with #1

A != B // 2 messages
hash(A) = hash(B) // It's possible in theory
hahs(hash(A)) = hash(hash(B)) // Same thing again…

So, it is easier to find 2 hash that gives the same end result, because if at any time in the hash chain they get the same result that result will not change afterward.

How #2 solves it :

A != B
hash(A) = hash(B)
hash(hash(A) + A) != hash(hash(B) + B)

Since only the last hash matter instead of every hash, we are less likely to get a collision.

The problem with #2

It is still vulnerable to rainbow table attack. That's why we need to use a salt like in #3.

Now… Is there a problem with #3, and/or what makes password hashing like PBKDF2 and bCrypt better key stretching methods than #3?


texts: Why does facebook uses two secrets to secure API

texts:
I am working on a public API for my personal forum.
Concerning the authentification of the requests and responses I plan to hash the payloads with a secret, known to me and the API user, and send the result to the API user in response header. This way he can make sure, that the response really came from me.
An incoming request must have a hash in the header as well to make sure, it was send bei the API user.

When I had a look on how facebook deals with this problem in their graph API I explored, that they indeed hash their responses, but the requests must be sent via an access_token.
@see https://developers.facebook.com/docs/messenger-platform/webhook-reference#security

This way, there must be two secrets between client and facebook (access_token and app_secret).

What are the advantages of facebook's method AND why don't they use the hashing in both directions?

I hope I made my problem clear and am happy for your help! :-)


texts: Calculating amount of time for brute forcing ciphertext depending on the size of the key

texts:
I am a graphic design student and for my information graphic project I have chosen the topic of the history of encryption and how the security level developed over the centuries. It’s basically an information graphic to make people like me aware of encryption and its importance in times like these (see: news about the NSA et al.).

So I'm taking several encryption concepts like the Caesar cipher, the Jefferson Wheel and something more modern like AES to calculate the Brute-Force time of the maximum key size. The main point is that I want to show that the security level grew enormously and in which size they grew.

Now the problem:

I wanted to calculate the key size, so I did research on the key sizes of each specific encryption concepts. In addition to that, I wanted to calculate the brute force time of an attack for each encryption (to find out how long it takes to crack the individual encryption). I know, that is a simple approach but I wanted to keep it simple as possible.

Now I’m not sure if I calculated it correctly and I would really appreciate it if someone could explain what I did not understand about that.

For example:

The brute-force computer I found (www.orange.co.jp/~masaki/rc572/ratej.php) was 2096204400 keys/sec and it is set up like 1 brute-force PC vs. an PC which is using this specific encryption.

Everything was calculated with wolframalpha.com

Caesar Cipher

It got 25 possible combinations of characters (Wikipedia says its about 5bit) so that means the time 25/2096204400 seconds = 11.93 ns
Enigma

Wikipedia says it’s roughly about 77Bit long, so the possible keys are
20651321783174268000000 and 206651321783174268000000 keys/2096204400 (keys/s) = 3.124×10^6 average Gregorian years.

Are my calculations correct?


texts: Can someone give a clear definition of  what a perfectly nonlinear function is?  Can we say that AES s-boxes are perfectly nonlinear and why?


texts: Programming Interface: Preparing Key Schedule for Both Encryption and Decryption

texts:
Quick question (01): what is the uniform interface for a symmetric block cipher? Is it

$(f:k \to k', enc_{k'}:c \to p, dec_{k'}:p \to c)$ or
$(f:k \to k_e, g:k \to k_d, enc_{k_e}:c \to p, dec_{k_d}:p \to c)$?

Most nowaday symmetric-key block cipher algorithms require only one key schedule to perform both encryption and decryption (forward and backword permutation), for the few that require two, conversion are often very efficient.

My question (02) being, is there a symmetric-key cipher where preparation of decryption key schedule from encryption key schedule (or the opposite) require non-negligible effort that could hamper the performance?


texts: Bijection Between Real View and Simulated View

texts:
I have some basic idea about cryptography and trying to understand zero knowledge proof, so pardon my ignorance and stupidity. I am trying to formalize sigma protocol in Coq theorem prover, and so far everything is correct except the special  honest verifier zero knowledge proof. The definition of special honest verifier zero knowledge proof [1]:

  There exists a p.p.t. algorithm S (simulator) which given any v ∈ L_{R} and
  any challenge c ∈ C produces conversations (a, c, r) with the same probability
  distribution as conversations between honest P and V on common input v and
  challenge c, where P uses any witness w satisfying (v, w) ∈ R.

So, the definition roughly translates to:

Pr[Real_view (v, w, c)] = Pr[Simulator_view (v, c)]

But, say for the moment, if I do no want to do probabilistic reasoning inside Coq, and I write that there is a bijection between the real view and simulator view with making all the randomness explicitly:

f : Real_view (v (* statement *), w (* witness *),
               c (* challenge from verifier *),
               r (* random coin toss of prover *)) <->
    Simulator_view (v (* statement *),
                    c (* challenge of verifier *)
                    z (* response chose randomly *)

So my question is: is producing f sufficient for showing special honest verifier zero knowledge proof? The axiom would roughly look like this.

SHVZK : forall (v ∈ Statement) (w ∈ witness) (H : (v, w) ∈ R)
               (c ∈ Challenge) (r ∈ Randomness) (z ∈ Response),
  exists f : Real_view (v, w, c, r) <-> Simulator_view (v, c, z),
             verify (Real_view (v, w, c, r)) = true /\
             verify (Simulator_view (v, c, z)) = true.

[1] https://www.win.tue.nl/~berry/2WC13/LectureNotes.pdf


texts: How to encrypt files such that only certain people (changing over time) can unencrypt and view the file?

texts:
I am setting up a platform whereby data is stored on IPFS and then give access to some (or in some cases all) through a front-end UI.
Storing on IPFS is straight forward as is encrypting.
First I encrypt the file:
gpg --encrypt --recipient "myUserName" "myVideo.mp4"

Then I save the encrypted file:
ipfs add "myVideo.mp4.gpg"

So far so good. Recovering it is easy as is decrypting:
ipfs cat _hashcode > “myVideo.mp4.gpg”
gpg “myVideo.mp4.gpg”

My question though is, that only works if I want to encrypt the file such that only I can decrypt it, how can I allow a certain group of users to access any given file, possibly even ALL users on the platform, but not for people outside of the platform.
I know it is possible to set up Groups in the gpg.config file, but I won't know ahead of time who all of the users are that should have access and it may change over time as well.
Multi-sig would not appear to be a good solution as that would fine if I know everyone who can have access in advance, but I don't.
Can anyone help me with this please?
Thanks!


texts:
In GnuPG, there is the option of making keys which are "normal" (encrypt and sign) and sign-only keys . But what sense does that make in regards of DSA?
Correct me if I am wrong, but I think DSA keys can only sign anyway.
So what is the difference between sign-only and normal keys?


texts: An exercise to show that CBC Chain is insecure

texts:
The CBC-Chain mode of operation is a CBC variant in which the IV that is used for
the very first message to be encrypted is randomly selected, whereas the IV used for
each subsequent encrypted message is the last block of ciphertext that was generated.
Show that CBC-Chain is insecure by constructing an efficient IND$-CPA adversary.
My Approach: Designing an adversary
Query $0^n$, get $C_1=E_k(IV)$.
Query $C_1$, get $C_2=E_k(0^n)$.
Now if we query $C_2||m_1||m_2||\dots$
Then encrypted text will be $C_1'||C_2||C_3'||\dots$ where $C_2=C_1'$
Hence CBC chain mode is insecure.
This is what I have tried, don't know if it's correct, any help with the answer will be truly appreciated.
Here the Adv is 1 in terms of IND-CPA, Can anyone write down the IND$-CPA with Adv equals 1.
Added:
Adversary $A^{\epsilon_k(LR(.,.,b))}$
$M_{0,1}\leftarrow 0^n; M_{1,1} \leftarrow 0^n$
$M_{0,2} \leftarrow 0^n; M_{1,2} \leftarrow 0^{n-1}1$
$<IV_1, C_1> \stackrel{$}{\leftarrow} \epsilon_k(LR(M_{0,1}, M_{1,1}, b))$
$<IV_2, C_2> \stackrel{$}{\leftarrow} \epsilon_k(LR(M_{0,2}, M_{1,2}, b))$
If $C_1=C_2$ then return 1 else return 0.


texts: How to generate a unique numerical value for an alpha-numeric string?

texts:
I need to create a unique numerical value for every alpha-numeric string input. Size of output numerical value can be of any size like 32, 64 128 bits. The input string will always be a mongoID type if that helps.
Is there any hashing algorithm available for such purpose.


texts: Zero-knowledge identification of the majority commitment

texts:
Alice is communicating with $n$ people. We do not assume that the $n$ people don't trust each other or trust Alice. Alice doesn't trust them either, and needs to assume that they will not form a coalition against her, so we assume the $n$ people cannot communicate with each other (except through Alice, if she agrees). Each of the $n$ people owns a secret bit $0$ or $1$. Let $m$ be the majority value, i.e., the bit owned by the largest number of people. (We assume that it is unique.)

Is it possible to design a protocol so that the $n$ people can commit to their value to Alice, and Alice can find out which of the people committed to the majority value $m$ without knowing what the value of $m$ is or gaining any other information about the values?


texts:
So I'm trying to figure out if it's possible to extract the private key if you have the ciphertext and the IV corresponding to that ciphertext.
It's for some kind of a challenge, and can't really seem to figure it out.


texts: Modifying Mix Mode Modular Arithmetic in IDEA Cipher

texts: IDEA uses Mix Mode Modular Arithmetic that includes Addition Modulo $2^{16}$ and Multiplication Modulo  $2^{16}+1$. If Multiplication Modulo with  $2^{16}$ is used instead of $2^{16}+1$ (where $2^{16}$ is not a prime field) how this modification affects IDEA (specifically Decryption & Probability distribution).


texts: Do Curtmola et al.'s IND-CKA1/2 security definitions protect against search pattern leakage?

texts:
In the
article Searchable Symmetric Encryption:
Improved Definitions and Efficient Constructions, Curtmola et al. propose adaptive and non-adaptive (indistinguishability and simulator-based) security definitions for searchable encryption schemes, conventionally called IND-CKA1 and IND-CKA2.

My question is: Do the IND-CKA1/2 security definitions guarantee that the search pattern is not leaked (i.e., that an attacker can not distinguish whether two issued trapdoors are generated with the same keywords)?

In their article, they mention that

  [...] the  security  notion  achieved  for SSE is that nothing is leaked beyond the access pattern and the search pattern [...]

Further, in their article, Bösch et al. state that

  Curtmola et al. review existing security definitions for searchable encryption and propose new indistinguishability and simulation-based definitions that address the shortcomings of the existing
  definitions. At the same time they loosen the character of SSE by allowing the
  leakage  of  a  user's  search  pattern.

So it seems pretty obvious that the definition should not guarantee search pattern hiding. Nevertheless, taking a look at the IND-CKA2 definition:

$\mathbf{\mathrm{Ind}}^{*}_{\mathrm{SSE},\mathcal{A}}(k)
\\
\;K\leftarrow \mathrm{Gen}(1^k)\\
\;b\overset{\$}{\leftarrow}\{0,1\}\\
\;(\mathrm{st}_{\mathcal{A}},\mathbf{D}_{0},\mathbf{D}_{1})\leftarrow\mathcal{A}_{0}(1^k)\\
\;(I_{b},\mathbf{c}_{b})\leftarrow\mathrm{Enc}_{K}(\mathbf{D}_{b})\\
\;(\mathrm{st}_{\mathcal{A}},w_{0,1},w_{1,1})\leftarrow\mathcal{A}_{1}(\mathrm{st}_\mathcal{A},I_{b})\\
\;t_{b,1}\leftarrow\mathrm{Trpdr}_{K}(w_{b,1})\\
\;\mbox{for }2\le i\le q,\\
\quad(\mathrm{st}_{\mathcal{A}},w_{0,i},w_{1,i})\leftarrow\mathcal{A}_{i}(\mathrm{st}_{\mathcal{A}},I_{b},c_{b},t_{b,1},\ldots,t_{b,i-1})\\
\quad t_{b,i}\leftarrow\mathrm{Trpdr}_{K}(w_{b,i})\\
\;\mbox{let }\mathbf{t}_{b}=(t_{b,1},\ldots,t_{b,q})\\
\;b'\leftarrow \mathcal{A}_{q+1}(\mathrm{st}_{\mathcal{A}},I_{b},\mathbf{c}_{b},\mathbf{t}_{b})\\
\;\mbox{if }b'=b\mbox{, output }1\\
\;\mbox{otherwise output }0$

one sees that any algorithm able to distinguish whether two trapdoors encode the same words or not directly breaks IND-CKA2, which would mean that IND-CKA2 protects against search pattern leakage.

For instance, and very informally, in the first trapdoor query $\mathcal{A}$ can set $w_{0,1}=w_{1,1}=w_{1}$ for some fixed $w_{1}$ and receive $t_{b,1}=\mathrm{Trpdr}_{K}(w_{1})$. In the second query, it can issue $w_{0,2}=w_{1}$ and $w_{1,2}\neq w_{1}$. Then $t_{b,2}$ either encodes $w_{1}$ or some other word, and $\mathcal{A}$ can guess $b$ by guessing whether $t_{b,1}$ and $t_{b,2}$ encode the same word ($b=0$) or not ($b=1$). Continuing in this fashion, since $\mathcal{A}$ breaks the "search pattern challenge", $\mathcal{A}$ has a non-negligible advantage in distinguishing $b$.


texts: What's the difficulty of using elliptic curves to design homomorphic encryption protocols?

texts: I have recently been very interested in elliptic curves because they are a powerful tool in crypto, ECC, pairing, etc. However, it seems that elliptic curves are not popular in homomorphic encryption. I understand that lattice-based crypto is currently the only way to construct FHE, like LWE. Elliptic curves can only be used to construct PHE; for example, BGN. After doing some research as a freshman in HE, I found that there is not much effort in trying to use EC to construct FE. So, I'm just wondering why. Is it because elliptic curves have some issues in their structure, making it hard to construct HE? Or is it because lattice-based construction is a hot topic, so researchers prefer it over EC?


texts: Can somebody help me understand RC4 Spritz? (Three Questions)

texts:
So ever since I first took a stab at understanding stream Ciphers, not one stood out more than RC4, because it's so fantastically simple. As most people reading this will know, with its fantastic simplicity comes with easily done cryptanalysis and RC4 has certainly been subject to plenty of it (leading to RC4's total failure, more or less).

Now, when breezing over the wikipedia article on alternative constructions of the PRGA stage of RC4, we get this rather neat little alteration, dubbed spritz:

#// All arithmetic is performed modulo 256
while GeneratingOutput:
    i := i + w
    j := k + S[j + S[i]]
    k := k + i + S[j]
    swap values of S[i] and S[j]
    output z := S[j + S[i + S[z + k]]]
endwhile

Now a bunch of things spring to mind about this alteration (that is seemingly far stronger, albeit, unfortunately much slower) but what's at the forefront of my mind is:

THREE Specific questions I'd like to know the answer to are:

Can we safely assume that from any given setup of S[], we can get to another set up of s[]? Or does it follow, that there will be some impossible states, like the Finney States of RC4?
Can anybody actually link me to any paper attempting any cryptanalysis of spritz, being as a DRBG, Stream Cipher or Cryptographically Secure Hash?
Finally: I know the question should be more specific: But given it's similarity to RC4? How many problems from RC4 could we expect to pop-up in Spritz?

There's a few questions here, the reality is I'd be grateful to get an answer on any of these, as papers on this algorithm, don't seem to be an easy google search away... but my own limited tests (and thought experiments), make me think we're certainly onto a better version the PRGA for RC4 (apart from the fact, it's 40-50% of the speed).

All input appreciated!

(edit: I removed the question about what values of W can we use: the answer is 1..3..5..7, up to 255, presuming the range of S, is 256)


texts: Could scrypt salts contribute to entropy if passwords & salts are only stored in human memory?

texts:
I'm unsure of how exactly the salt is manipulated by scrypt and its potential contribution if any to overall password entropy if passwords & salts are stored only in human memory for a decentralized implementation.

For this implementation, a cryptocurrency login where the salt does not exist in any repository such as a user table because the resulting hash is the accountholder's signing key, a user would be responsible for generating a "username" as the salt and a password.  Both would be checked for minimum combined entropy such as naive entropy / 2 > 80 to push the user toward Diceware.  There are currently no other requirements.

The username approach was selected because of statistical evidence showing that their distributions possess more than 35 bits of entropy, but I do realize that this set is probably skewed because of users wanting taken names and settling for besthashcracker11 which of course will be impossible to enforce thereby reducing that number.

If that scheme is more vulnerable to the average user than the risk of a weak password/passphrase alone, should a single passphrase be broken arbitrarily into two parts?  If so, how?  What percentage should be the password, and what for the salt?

If salts do contribute to entropy for this implementation, how can total entropy be calculated as a function of password entropy and salt entropy if an attacker has no access to the passwords, salts, or resultant hashes?

Users can be expected to be almost totally anonymous to an attacker.


texts: Leaking information when a value is blinded

texts:
Assume all values are defined over a field $\mathbb{F}_p$ where $p$ is a large prime number.

Given a fixed value $a,b$ we compute $v_i=a\cdot b+r_i$, where $r_i$ is picked uniformly at random from the field. For the sake of simplicity let all the values be none zero.

Assume the adversary knows $b$.

Question 1: Given $v_i$, can the adversary learn anything about $a$ (or $r_i$)?

Assume $p(x)$ is a monic polynomial whose coefficients are picked uniformly at random from the field. Let $x=\{x_1,x_2\}$ where $x_i$ are public values. Let $b_1$ and $b_2$ be known by the adversary. By $p(x_i)$, we mean polynomial is evaluated at $x_i$.

We compute $v_1=p(x_1)\cdot b_1+r_1$ and $v_2=p(x_2)\cdot b_2+r_2$, where $r_i$ are picked unifromly at random.

Question 2: Given $v_1$ and $v_2$ can the adversary learn anything about $p(x)$ (or $r_i$)?

Please note that the adversary knows $x_i$.


texts: Can a block cipher be used to encrypt wireless communications?

texts: Would it be possible to use a block cipher such as CBC in order to encrypt a wireless communication? For example, could I use CBC-MAC, on each block, for encryption for WiFi?


texts: Is PKCS #1 v1.5 RSA encryption padding secure under these conditions?

texts:
The PKCS #1 v1.5 padding scheme for RSA has been proven to have some weakness when used with TLS for example.

My question is: is it still secure under the following conditions?

Alice sends a message to Bob encrypted with RSA using PKCS #1 v1.5 padding scheme.
If Bob figures out that the message is correct, he will send an answering message back to Alice, otherwise, he will discard the message and won't send anything to Alice. Alice cannot know if Bob accepted the message nor how much it took to bob to decrypt it (and this makes timing attacks impossibile) because Bob may decrypt it after one day, one week or one year.


texts: What is the "purpose" byte in Crypto++ PBKDF2?

texts:
Does anyone know the purpose of the "purpose" byte in the PBKDF2 implementation in Crypto++?  It appears that the PBKDF2 does not use this byte, but I want to make sure I am not setting the option to some stupid default.

Here is the method signature.

If you look at line 42 of the pwdbase.h file, it seems to indicate that this parameter is ignored by PBKDF2 implementation.


texts: Decoding the Playfair cipher with a crib

texts: I have a Playfair cipher text and I know a portion of the text (one world). How can I decode the cipher from here? Thanks.


texts:
I have a 16-byte ciphertext, 16-byte key, and 16-byte IV. The key and IV I was able to set myself, and all I know about the ciphertext is that when I decrypt it, it will be human-readable.

I have tried PyCrypto and OpenSSL methods to decrypt the ciphertext with no luck. This is leading me to believe that it may be a custom implementation of AES. My background is not in cryptography so please excuse my ignorance.

Is there a standard way to implement AES-128? Is it uncommon to implement your own version of AES? I'm familiar with the AES algorithm, and it seems like it would be possible to implement your own way of scrambling the bits in the individual rounds.

I also noticed the NIST gives out certifications to individual companies for their AES encryption (ie. Google, Cisco, HP, AWS, etc.). Is this because it's a custom implementation?


texts: Is the key schedule of Serpent a circle?

texts:
The creation of the prekeys for Serpent works by XORing some previous values with a counter and a fixed value. Every word is 32 bits big and 4 words form a round key (after applying a S-Box, but this shall not be part of this question).

The original raw key of 256 bit is $w_{-8}$ to $w_{-1}$, $\phi$ is a constant term with the value hex $0x9e3779b9$. $\lll$ equals the left rotation and $\oplus$ is XORing every individual bit. The equation for the value $i$ is:
$$ w_i = (w_{i-8} \oplus w_{i-5} \oplus w_{i-3} \oplus w_{i-1} \oplus \phi \oplus i) \lll 11 $$
The creators of Serpent mention that this bases on the primitive polynomial $x^8 + x^7 + x^5 + x^3 + 1$

  …to ensure an even distribution of key bits throughout the rounds, and to eliminate weak keys and related keys.

(Source: http://asmaes.sourceforge.net/serpent/serpentSpecification.pdf)

My question: Does this equation form a cycle across all possible values? I am asking, because a linear feedback shift register with a primitive polynomial has the feature that every possible value (excluding all bits set to 0) will be reached and then it starts again at the first value.

If the answer is “yes”, will this "feature" hold with other constant terms than the given $\phi$?
If the answer is ”no”, would it be enough to remove the constant term $\phi$ and/or the applied round counter $i$ from the equation?


texts: How (in)secure is a signature based on DSA with DSS1 (SHA1) in reality?

texts:
As I found out the OpenSSL implementation provided by PHP (openssl_sign) only allows DSS1 as the hashing algorithm for DSA signatures (see also my related question).

I’d prefer DSA over RSA in my use case because of the significantly shorter signatures. However, I have doubts regarding DSS1 which is basically SHA1 and therefore considered vulnerable.

The question is: Does this vulnerability also apply when used with DSA? After all the security of a signature is not (only) about finding a hash collision or fast brute-force hash calculations...

How secure or insecure would you say is using DSA with DSS1 when signing a license file for a software? Is it possible that someone can calculate the private key within a reasonable amount of time (having the public key, a message and its signature) or what’s a realistic risk?
I’m aware of the fact that calculations are getting faster and faster (GPUs, cloud based services, etc.) so please include your estimation for the next couple of years.


texts: Why is g is less than p in Diffie-Hellman?

texts: In non-authenticated DH, p and g are made as public record. p needs to be a large prime number and g should be smaller than p.  Why does g need to be smaller than p?


texts: Selective Forgery of a Digital Signature - Goldwasser et al

texts:
I am working though the paper of Goldwasser, Micali and Rivest ''A Digital Signature Scheme Secure Against Adaptive Chosen- Message Attacks''

In the hierarchy of the severity of breaking the signature scheme, what does the ''a priori'' in the definition of Selective Forgery mean?

  Selective Forgery: Forge a signature for a particular message chosen priori by the enemy.