texts: Efficient Symmetric Mutual Entity Authentication Protocol

texts:
I am looking for an Authentication protocol for access control. Let's say both the client and server would share a symmetric secret (256 bit key) and the client wants to access the server. Access should only be granted to a registered client the server shares a key with and both parties should know whom they've talked to.

It should provide:

mutual authentication (client and server are both sure to talk to server resp. client)
freshness property to encounter replay attacks
efficiency: both parties should only have to execute a few cheap computations
the authentication token should change for every authentication attempt
the server should be prone (as much as possible) against DoS-attacks
no replay or pre-play attacks

I couldn't find any protocol like this except Janson-Tsudik's 2PKDP which is patented.
Thus, I had the idea to construct an own protocol from the protocols I have seen so far.
I know this is probably the worst idea, especially because I am not a professional cryptographer.

But nevertheless I want to share my idea to know the pros and cons.
I like the idea about Lamport's hash chains and want to use their hash values as one time authentication tokens (tickets). The advantages are mainly that the verification is really fast (just a hash-function) and the client needs to bring some information not yet known into the server.
Unfortunately the major disadvantage is that the client has to precompute all N tickets. Thus I looked up one-way permutations with a trapdoor like for instance chameleon hash functions to be able to go in both directions of the hash chain (also known as infinite, re-initializable or renewable hash chains).
Since I couldn't find any good implementation for such a function, I thought about just using RSA signatures: Client has a private key and the server his authenticated (beforehand) public key. The client initially generates a pseudorandom seed value which is then encrypted with the RSA private key (d, N), resulting in my first authentication ticket.
Given that the server has also received the initial seed value, it can then upon receiving the first ticket check it by verifying it, i.e. decrypting it with the RSA public key.
If the knowledge of the new ticket refers to being granted access, the
open problems are how to accomplish mututal authentication and freshness and how to securely transmit the newly generated ticket to the server each time you log in.
So far, I thought about something like:

client sends its client_id to server
server generates nonce N and sends it back
client calculates HMAC_T(N, client_id) xor T_new  (where T is the last ticket and T_new the new one - and T is used as key for the hash-keyed MAC function)
server can compute the HMAC_T(N, client_id) since the old T is still available
server can thus deduce T_new
server can verify T_new by calculating: RSA_verify(T_new, (e, N)) == T
(or in other words: decrypting T_new with the client's public RSA key and check if that yields in T.

Please note that the server needs to keep the last ticket saved because it's used for verifying the one handed with the next authentication request.

Please tell me in a merciless way which problems you see about it and where I haven't thought it through enough. Also if there is already a protocol/scheme that does what I want to, please point me into the right direction.

Thanks ahead


texts: Is it possible to re-generate ECPublic key from raw private key and curve params?

texts:
As per my understanding, in Elliptical curve cryptography, the EC PrivateKey is nothing but a bigInteger value. If you know the curve specs and you have this private BigInteger value (which I am referring as raw private key), then you can re-create PrivateKey and use it for generating the signature.

Now, my question is, if you know the raw privateKey and curve name (aka specs), can you generate the corresponding public key?


texts: AES-CTR authentication salt+HMAC(ciphertext) OR HMAC(salt+ciphertext)

texts:
Which one of these functions are preferred for authenticating AES-CTR?

function encrypt(msg, key) {
    encryptionKey, encryptionSalt = newPBKDF2(key)
    hmacKey, hmacSalt = newPBKDF2(key)
    ciphertext = aesCTR(msg, encryptionKey)
    hmac = generateHMAC(ciphertext, hmacKey)
    salt = encryptionSalt + hmacSalt
    return hmac + salt + ciphertext
}

VS

function encrypt(msg, key) {
    encryptionKey, encryptionSalt = newPBKDF2(key)
    hmacKey, hmacSalt = newPBKDF2(key)
    ciphertext = aesCTR(msg, encryptionKey)
    salt = encryptionSalt + hmacSalt
    hmac = generateHMAC(salt + ciphertext, hmacKey)
    return hmac + salt + ciphertext
}


texts: How resilient to attackers with extreme resources available is this encryption method?

texts:
How could the following scheme be made more resilient to attacks capable of utilizing massive amounts of resources?

Assume all random values are cryptographically secure.

Key derivation: scrypt using a random 16 byte nonce. The work factor is 1048576 which takes a GB of memory and ~3 seconds to compute on a 2500k.

Authentication: HMAC with SHA-512 as the hash function. Authentication key is the SHA-512 of the AES key. HMAC checks are done using equal time compare.

Encryption algorithm: AES-256 in CBC mode using a 16 byte random IV.

Asymmetric keys are used in TLS which allows access of the encrypted data over a network.
4096 bit RSA is used due to ease of generation.

The end result of the cipher text can be described like so:

nonce | iv | cipherText| HMAC Digest

Thanks!

EDIT: Sorry guys I should have described my use case. This is for encrypting a specific file.

The authentication is used to securely ensure that the file hasn't been tampered with as well as check the key before decryption.


texts: Authenticated encryption using asymmetric keys

texts:
I know this may be marked duplicate. It is based off of this question and this answer.  However, I feel like I'm missing something...
My example:
Bob wants to encrypt a message and send it to Alice using Alice's public key.
However, Bob also wants to sign the message using his private key before encrypting the (message + signature).
For sake of argument lets assume Alice and Bob are using RSA2048. According to PKCS #1 v2.2, both, RSASSA-PSS and RSASSA-PKCS15 signature schemes produce an output the size of the key's modulus (in this case 256 bytes).  However, both OAEP and PKCS15 encryption schemes require the message size to be less than the modulus size (less than 256 bytes).
How can one sign and then encrypt a message according to this spec?  Would the plaintext just be broken into two chunks?  Hybrid encryption seems like overkill if the message is small.  Even a single ASCII character would be too large to sign then encrypt this way...


texts: Encrypt a big file in blocks with AES-GCM: how many nonce do we need?

texts:
I need to encrypt big files using AES-GCM, potentially 10 GB or more. For memory (RAM) reasons, I need to processs them by blocks (let's say 16 MB), rather than doing encrypt(plaintext) in one pass.
By reading the answers of this security.SE question:
Should I chunk or not for AES-GCM file encryption, I have the feeling that I read all and its opposite.
Which one is the correct approach?

Method A: Since "a counter mode converts a block cipher into a stream cipher" (quote from the linked post above), we can do this:
nonce = Random.new().read(16)
out.write(nonce)
cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
while True:
    block = f.read(16*1024*1024)
    if not block:  # EOF
        break
    out.write(cipher.encrypt(block))  # we encrypt multiple blocks with the same
                                      # "cipher" object, especially the same nonce
out.write(cipher.digest())  # we compute the auth. tag only once at the end

Here we encrypt multiple 16MB blocks with the same "cipher" object, same nonce.
I read some criticisms about this approach in the article AEADs: getting better at symmetric cryptography, paragraph "AEADs with large plaintexts".
But on the other hand, I noticed that:
print(cipher.encrypt(b'hello'))  # 4cadd813be in hexadecimal
print(cipher.encrypt(b'hello'))  # d3585e3471, different, fortunately!

so it seems ok (like a stream cipher).
Is it true that GCM (counter mode) converts a block cipher into a stream cipher?

Method B: we have to choose a new nonce and tag for each 16 MB:
while True:
    block = f.read(16*1024*1024)
    if not block:  # EOF
        break
    nonce = Random.new().read(16)
    cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
    out.write(nonce)
    out.write(cipher.encrypt(block))  # new "cipher" object, new nonce for each 16 MB block
    out.write(cipher.digest())  # we compute the auth. tag only once at the end

Drawback with this method: we have to save to disk nonce, tag metadata for each block.
This looks like the method detailed in Proper way of encrypting large files with AES-256-GCM. Obviously a malicious user could swap the order of blocks (including their nonce and tag) and the file would look ok, whereas it's not. So this solution seems not ok, as suggested by this answer.

TL;DR: Isn't it a problem that we use only one nonce in Method A above?
Note: I also read this method which chains and blocks (and tags).
Is there a general consensus/normalization for a good way to work with big files by blocks with AES-GCM?
(For implementations with Python, such as pycryptodome, I'll ask later on SO, but first, I wanted to read about the background).


texts: Is there any way to have a coded string such that it can be decoded in multiple ways?

texts:
This is more out of curiosity than anything, having no knowledge of cryptography.

But say I have strings "test1" and "test2", is there any way/algorithm to encode the two strings to an encoded string "string" such that when "string" is decoded with "key1", it returns "test1", and likewise for "key2" and "test2"?

Thanks!


texts:
Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?

in this link, we use EDE Mode usually.

when we use one key, in this case, Encryption -> Decryption result will be Plain text. so as a result, we just do one DES encryption.

and other case, we use two key, (k1-k2-k1) or three keys, in this case each result of E D E will different, so there is no vulnerability use 'EDE' or 'EEE'.

http://des.online-domain-tools.com/ in this site we can do DES encryption or decryption, and i test all case refer above.

encrypt test. it is EDE 's first 'E'.

decrypt encrypted test. it is EDE 's middle 'D'.

as you can see, the result is plain text.

I know that i am newbie and this article is wrong. but i can't understand why we use EDE and which part i missed.

thanks for your help :)

in single key, EEE mode. encrypt encrypted test. it is EEE 's middle 'E'

result of EEE's middle 'E' is not plaintext. so EEE isn't just do one time DES algorithm.


texts: How can a key pair be derived from an arbitrary hash?

texts:
If I correctly understand the concept of a "brain wallet" in BitCoin, you start with a passphrase, generate the hash of the passphrase, then somehow derive a public / private key from that to use as your BitCoin identifier.

This conflicts with what I understand about key pairs... namely that they are special... not every number is qualified to be part of a key pair because there are requirements related to prime factorization.  So how can the "brain wallet" algorithm work, since the hash could be any number?


texts: Constant Time algorithms for $\mathbb{Z}/m\mathbb{Z}$, $\mathbb{Z}/m\mathbb{Z}[x]$, and $\mathbb{Z}/m\mathbb{Z}[x] / (f(x))$?

texts:
I want to implement some (lattice based) protocols to better familiarize myself with a programming language (Rust). These tend to do arithmetic over rings like $\mathbb{Z}/m\mathbb{Z}$, or "extensions" of this ring (meaning $(\mathbb{Z}/m\mathbb{Z})[x] / (f(x))$. Since it seems like I'll need to implement the ring arithmetic myself (there are finite field libraries, but this stops certain optimizations I am interested in exploring such as double-CRT arithmetic), I might as well do something slightly-more-than-naive, and use constant time algorithms (which I am assuming are quite well-known at this point).
I am somewhat interested in algorithms that assume special structure of $m$ and $f(x)$ (say $m = 2^k \pm c$ for small $c$, or $f(x)$ a cyclotomic polynomial), but my primary interest is of algorithms that make no special assumptions on the structure of $m$ or $f(x)$.
Is there a particularly good reference for these algorithms? Chapter 14 of Handbook of Applied Cryptography seems to be a good start. It doesn't appear to discuss polynomial arithmetic directly, but it seems like you could piece together something by using their MPI arithmetic section. Additionally, this chapter doesn't discuss constant time algorithms directly, but quickly glancing over their algorithms I don't see anything that is too obviously variable time.
Still, is there some better reference for the task I am interested in?


texts:
Please pardon my question if it seems silly, but I am very keen on knowing: in applied cryptography, there is such a thing as a one-way function, which given an input would generate an output that is unique for that input.
Discrete logarithms and factorials are, as far as my knowledge goes, necessary to create one-way functions.
That being said, is there a way to create random one-way functions, so that:

each of them would give the same output for the same input
and, each of them would be sufficiently unique to the others?

Many thanks


texts: How to convert roots of Weber polynomial to Hilbert class polynomial over modulo prime?

texts: Using any non square root discriminant $D$, we should be able to find the Weber class polynomial. How can I convert the roots of a Weber polynomial to a Hilbert class polynomial over modulo prime?


texts: How to build an electro-mechanical public key cipher machine?

texts:
It is generally assumed that asymmetric encryption schemes were invented in 1973 at GCHQ in Britain and, independently, in 1976 at the MIT.

Imagine, if the abstract idea of having a public key and a private key that can only decrypt what has been encrypted with the other, respectively, had been around forty years earlier. Would it have been possible to build a working (rotor) cipher machine using this principle with WWII technology (think public key enigma)?

Are there any public key encryption  schemas that have sound mathematical basis and can also be implemented using electro-mechanical machines without transistors?


texts:
Let’s assume Bob is some algorithmic stock trading machine. Bob takes commands from Alice, who sends messages to Bob.

For example: Alice could be sending a message to Bob to stop trading. But if Mallory is able to capture cipher and figure out the effect of sending that cipher to Bob, Mallory could send the captured cipher to Bob and make him stop trading at arbitrary times.

How do cryptographic systems handle such situations?

One way I could think of is to append the current epoch time to message before encrypting it. Then Bob can choose to discard the message if the time shown in the decrypted cypher is far off in the past. But this is not foolproof. What actually is done in real life?


texts:
I read that TLS does PFS using Diffie Hellman. However, DH can be used even without certificates - so how is DHE-RSA better than plain DHE?

Is DHE a insecure algorithm, that DHE-RSA is needed?


texts:
In discrete log we employ sophie germain primes $p=2q+1$ where $q$ is a prime.

Then we know least significant bit $x_0$ in $$g^{2x+x_0}=h\bmod p$$ where $2x+x_0$ is discrete logarithm of known $h\bmod p$ with respect to known generator $g$.

Suppose $g^2=r\bmod p$ then why cannot I reduce the problem to $$r^{x}=hg^{-x_0}\bmod p$$ and let $x=2x'+x'_{0}$ where $x'_0$ is lsb of $x$ and recursive solve the problem of finding $2x+x_0$ which is discrete log of $h\bmod p$ with respect to generator $g$?
Suppose I know $x_0$ in $g^{3x+x_0}=h\bmod p$ where $x_0\in\{0,1,2\}$ holds (that is if it were easy to solve for the last ternary digit of discrete logarithm when $p=2q+1$ would the problem be any easier?


texts: Where is the SSH RSA modulus actually sent?

texts: This might be a stupid question but: When RSA key pairs are generated, there is a pubkey and a private key file. Where is the modulus? Is it appended to the keys? I can't find any information about that.


texts: Is there a secret sharing scheme which allows delegation/re-sharing without reconstructing the original secret?

texts:
EDIT: Ilmari Karonen's answer below well not exactly what I want, gives a very good idea of what I am trying to accomplish.

Are there any known secret sharing schemes that allow new parties to be read in on a portion secret, preferably without all parties having to be online at the same time?
I don't want to have to keep the original trusted authority around. The question is, is this possible without reconstructing the original secret?

My idea is that I divide a secret between $N$ of $k$ people at time $T$. At time $T+1$, I want to change it to $n$ of $k'$ people. This may or may not be strictly possible, but is there something possible along those lines?


texts:
Suppose I intercept the same message m sent to 2 friends. I know what the message is and I know the used modulus n, as well as the ciphertexts but I don't know the respective public exponents. I.e. my system of equations is:

$c_1 = m^{e_1} \ mod \ n$
$c_2 = m^{e_2} \ mod \ n$

Is there a way to retrieve the public exponents, without using bruteforce?

A practical example:

$n = 221$
$m = 127$
$c_1 = 155$
$c_2 = 43$


texts:
I'm developing a messenger application with encrypted chats.

In the first version of the app I've used PBKDF2 (10000 iterations, SHA1, random salt) to extend a short user password and generate keys to encrypt (AES256) and sign message (HMAC).

In the current version of the app I generate a random 130-bit key and use it instead of a user password. I think that using PBKDF2 with such a key has some overhead.

I see 2 possible ways to improve the current approach:

Keep using PBKDF2 and decrease iterations to 1 or 10.
Don't use PBKDF2 and use HKDF instead.

What are the advantages and disadvantages of each approach? Are there any other options?


texts: Closest Keccak256 hashes by Hamming distance?

texts:
What are the two "closest" known Keccak256 (not SHA-3 256) hashes in terms of the Hamming distance between the pair of hashes?

EDIT: This was marked as opinion based, so to clarify, when I asked this question, I was hoping that people responding would provide two hashes that had a close Hamming distance, as well as the data hashed to generate those hashes. I hope that removes any ambiguity that could result in this being seen as opinion-based.


texts: Digital signature from hashing encrypted webpage

texts:
I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private key and then hashing the result. The digital signature is then verified by encrypting the webpage with the sender's public key, hashing the result and then "comparing" with the other hash.
Not only is this explanation rather vague on the final steps of verification but I think it's straight up wrong. Doing some independent research I find this page that says "Digital signatures do this by generating a unique hash of the message or document and encrypting it using the sender’s private key."
This claims that the process happens the opposite way and it makes way more sense. However in the comment section of this particular video is a course moderator arguing with many commenters saying that the presenter hasn't gotten it wrong and that it "just works".
Can someone please settle this debate?


texts: partial-domain permutation and strong assumption

texts:
Quoting "Verified Security of Redundancy-Free Encryption
from Rabin and RSA", Chapter 2 (on page 4):

  OAEP was proved IND-CCA-secure by Fujisaki et al. [28] under the assumption that the underlying trapdoor permutation is partial-domain one-way. This is in general a stronger assumption than just one-wayness, but fortunately both assumptions are equivalent in particular for RSA.

What is exactly are full-domain (and partial-domain) one way permutations?
Which is the stronger assumption?
Which is it more secure or efficient?


texts: What are some hashes that do not exhibit the avalanche effect?

texts: I do not know much about cryptography. But, I'm in a situation where I need a hashing method that does not exhibit the avalanche effect. I tried Googling but couldn't find anything.


texts: Proof that a given function is not a OWF

texts:
I'm currently learning about one-way functions. I have a book with the following exercise (Sadly there is no solution in the book...)

  Let $g\colon \{0,1\}^n \to \{0,1\}^n$ be a one way function.
  Prove that $f\colon \{0,1\}^{2n} \to \{0,1\}^n$ with $f(v,w) := g(v)⊕w$  is NOT a one way function.

I don't really get how I can solve this exercise... because if $w$ is, for example, $0^n$, it would be a simple reduction to show that it is in fact a one-way function, right?

How can I get an advantage $>\mathit{negligible}(n)$ ?


texts: How do I calculate the private key in RSA?

texts:
Given $n=pq$ for $p,q$ known, I can calculate $\phi(n)$.

$e$ is selected such that $\gcd (e,\phi(n)) = 1$.

Using this, how do I calculate the RSA private key?

Example:

  I have $n = 35$, with $(p,q)=(5,7)$.
  I have also computed $\phi(n)=24$, and selected $e$ such that $\gcd (e,\phi(n)) = 1$ by taking $e=23$.

  Calculate the private key.


texts: Converting Letters into Numbers for Creating an Authenticator

texts:
In Section 2.2 of DJB's Polynomial Evaluation and Message Authentication, he describes the construction of the first provably secure authenticator, which was the work of Gilbert, MacWilliams, and Sloane.

Fix a finite field $k$. The legitimate sender generates 9 independent
uniform random secrets $r1, r2, . . . , r8, s ∈ k$. The sender meets
the legitimate receiver in private and tells the receiver the same
secrets $r1, r2, . . . , r8, s$. Later the sender wants to send a
message $m$ to the receiver through a public network, where $m$ is a
sequence of 8 components $m1, m2, . . . , m8 ∈ k$. The sender
transmits $m$ together with the authenticator $a=m1r1+···+m8r8+s ∈ k$.

Fine.  Let's say the entire message looks like this:

sorry mrjoh nsony ourf light hasbe encan celed

This message is conveniently broken into a sequence of eight components.
What I cannot figure out is the simple question of how to represent the letters/blocks numerically for the computations shown above.
What is the best way?


texts: Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?

texts:
I've asked some other questions before about Rijndael's S-boxes, and step by step I'm coming to an understanding; but those steps often guide me to new questions.

I did some lines of code to understand how these S-boxes work implementing $S(z) = f(g(z))$ where $g(z)$ is the transformation by multiplicative inverse in a polynomial field and $f(z)$ the affine mapping understanding a word as element in a polynomial ring following the expression.

\begin{equation}
    \begin{aligned}
        b(z) &= \mu(z) \cdot a(z) + \nu(z) \\
             &= (z^4+z^3+z^2+z+1) \cdot a(z) + (z^6+z^5+z+1) \;\bmod{(z^8+1)}
    \end{aligned}
\end{equation}

In the "AES proposal"(version 2 from 1999), section 7.2 explains that $\mu(z)$ was chosen from the set of co-primes with $z^8+1$ as the one with the simplest description. But what can be understood as "simple description"? The condition to select $\nu(z)$ looks to be much clear (no fixed points, neither opposite fixed points, isn't it?).

If I did it well, there are 129 co-prime polynomials to select 1 (and its inverse) and I cannot see what makes this special. $\mu(z)$ has 5 ones and its inverse $\mu^{-1} (z)$ has 3, and there are other pair candidates with a relation 3-3 or 5-5 of 1s. Another description of simplicity perhaps was palindromic representation, but it's neither the case. They are not the shortest or longest ones to highlight them over the others. What makes them special to be chosen?

Ps: In the mentioned "AES proposal" the $\mu(z)$ and $\nu(z)$ are not the ones above, neither are the ones shown in section 3.4.1 from "The Design of Rijndael" but with the 2 shown here I've reproduced the official S-boxes and the tables of the section C of the mention book. Would I be wrong?

Update 20150320 based on the comments received:

Based on the definition of the "simplicity" criteria to select $\mu(z)$, it cannot be evaluated what makes $z^4+z^3+z^2+z+1$ special. The only known requirement of this polynomial is that it must have a multiplicative inverse in the ring defined by $z^8+1$: there are 129 elements invertible.

The other parameter $\nu(z)$ has an evaluable criteria to do a selecting: it must not produce any fixed point, neither opposite fixed point. Checked this, the number of polynomial pairs that satisfies that in the ring are 21717. A big number. In a shorter view like fixing $\mu(z)$, the number of possible $\nu(z)$ that satisfies the seconds criteria are 223.

Even Rijndael usually is implemented storing the S-Boxes, the calculation times looks not very relevant, but perhaps they are, aren't it?

In those boxplots are represented average calculation for each of the candidate pairs. On the left using doing the modular product and on the right using the MDS matrix suggested in the Rijndael's documents.

Apart from the think that the matrix method is not better in general, the times for the official pair are represented by coloured dots. There are very many better candidates.

I did a seconds figure as a branch that assumes that the official $\mu(z)$ has something special I cannot see.

Here that data set are the 223 different $\nu(z)$ having $\mu(z)=z^4+z^3+z^2+z+1$. Again be careful with the scales on the y axis.

The calculation time for the official pairs have been also draw as coloured points. And here the official $\nu(z)$ doesn't show any timing property.

The code of this test is in a Rijndael project in github. From a command line it can be repeated by call $ python Polynomials.py --test-ring=8 and the basic things make with R are in a Polynomials subdirectory.


texts: How to check the signature without the predetermined function in ECDSA from openssl?

texts:
I'm developing a client for a two-factor authentication in Qt/C++ under openSUSE 13.2, 64bit. I've got the FIDO U2F Security Key from yubico/fido.
I'm using the classes from openssl, in particular ecdsa.h and bn.h.

The registration went smoothly, so I can get the $r$ and $s $from the signature. I can also check whether the point lies on the curve (so I've got the public key, too).

My actual problem is to verify the signature. I have to use the curve P-256 from NIST. I've tried it with ECDSA_verify and ECDSA_do_verify, but I don't know how to set my public key. Also, I think I will not get the private key. So, I think that this methods are not useful for me. Therefore I want to develop own methods to verify my signature. I've studied the ECDSA algorithm, but I don't know where I should begin. I know what to do, but I'm unsure how to implement in my program.

I'd be very glad if anyone has an idea which could help me.
Thanks a lot :)


texts: What is the advantage of AES-GCM against CPA attack

texts: This questions is re GCM block-mode of AES. Assuming the TAG is cut to t bits, how can the strength of the cipher be calculated, that is, what is the Advantage of the cipher against CPA attack, and after how much authenticated data a new key has to be exchanged?


texts: How we can create a protocol using Schnorr as identification scheme and a hash function as a puzzle?

texts:
My question has to do with the creation of a PoWorK( Proof of Work or Knowledge) protocol.How we can create a protocol like this ,using Schnorr as the underlying CVZK protocol and using a hash function (lets say sha256) as the puzzle that is being solved?

In other words :

1) How a P can prove to V that he knows witness w (without revealing), by solving the hash256 and afterwords the V can verify the solution.

2) How a P can prove to V that he did a Proof of Work procedure by solving the hash256 afterwords the V can verify the solution.

It is not clear to me how the P computes the outcome and how the V verifies based on the receiving outcome.


texts:
Trying to find related answer for a long time, but not convinced yet.

What I am trying is to encrypt using RijndaelManaged. To create Key, I am passing password, salt and iteration to Rfc2898DeriveBytes.

I was thinking to add constant if user entered password is below specific length before passing it to Rfc2898DeriveBytes.

So far what I found that adding constant will not add any benefit to security. Let suppose attacker get an access to database containing encrypted data along with salt, but not to constant will give him a bit harder time. Although in the end he will find that constant.

Or it is "really and extremely" safe to pass any length password to Rfc2898DeriveBytes without getting worried?

Does passing shorter or lengthier password affect key derivation process in term of which one is better and most recommended?

So far what I know that random salt and more iteration is important.

Following is the code, should I remove adding constant to password or keep it?

(Note: password length restriction to user is not applied at GUI, user can pass 1 character or even more than 10 characters)

string constant = "AnyConstantToMakePasswordBigger";

if (password.Length < 8)
{
  password = password + constant;
}

RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
byte[] salt = new byte[8];
rng.GetBytes(salt);
Rfc2898DeriveBytes derivedKey = new Rfc2898DeriveBytes(password, salt, 1000);
aes.Key = derivedKey.GetBytes(keyLength);
.....

Welcoming any positive or negative comment and responses.


texts: Are My Answers to This AES Question Correct?

texts:
Question

I am extremely new to cryptography and AES and so I am not confident that I did this question orrectly. Please can you check my answers and let me know if anything jumps out as incorrect, Thank you!

Here is the Question:

Consider the key expansion procedure for AES encryption.

The given four subkeys are:
w4 = a0f afe17, w5 = 88542cb1, w6 = 23a33939 and w7 = 2a6c7605 using hexadecimal
notation.

(a) Complete the following procedure to generate the next subkey w8.

i. Generate the temporary subkey wt = w______.

ii. Rotate (round-end) the binary sequence wt to the left for 8 positions and obtain
wt =______.

iii. Substitute wt byte by byte using Table 1 and obtain wt =_______ .

iv. Generate the round constant r8 =________ for w8.

v. wt = wt ⊕ r8 =_________ .

vi. w8 = wt ⊕ w4 = ________.

My Answer

i)

wt = w4

   = a0fafe17

ii)

Eight positions in binary = two positions in Hex:

wt = fafe17a0

iii)

wt = adbbf0e0

iv)

r8 = [ rc8 00 00 00]

rc8 = 2*rc7

    = 2*2a

    = 54

r8 = [ 54 00 00 00 ]

v)

wt = wt ⊕ r8

   = f9bbf0e0

vi)

w8 = wt ⊕ w4

   = 59410ef7


texts:
I am implementing TLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit.

According to RFC 5246 finished messages have {verify_data[verify_data_length]} and verify_data = PRF(master_secret, finished_label, hash(handshake_messages)

Some people said client finished contain Authentication tag and nonce along whit verify data. Can anyone tell me the structure of finished message in this cipher suit and exactly the size of verify data, authentication tag and nonce.

Below is my Client Finished message @Makif can you tell me how may bytes are encrypted and where is authentication tag in this message?

@Makif, Got it.

-8 byte nonce

-16 byte ciphertext

-16 byte authentication tag

Total is 40 byte but my finished message contain 48 bytes. What is about last 8 byte?


texts:
Here SIM means the simulation based security

Consider a two message encryption scheme:$$Enc:K \times M \times M \rightarrow C \times C$$

and $Enc(K, m, m')=(K \oplus m, K \oplus m')$,
In the real world experiment, the adversary $Eve$ gets $(K \oplus m, K \oplus m')$ as ciphertext, and thus, the information leaked to $Eve$ is $(K\oplus m)\oplus(K \oplus m')=m \oplus m'$, now how should I modify the original ideal world experiment so that in the ideal world, the adversary $Eve$ also gets $m \oplus m'$?


texts: Recovery of private key in AES-CBC from two ciphertexts with different IV, but identical plantext

texts:
I have a system that encrypts messages for a given user using key K using AES-CBC in response in an external stimulus.  Each message has a randomly generated IV.  The user never decodes these messages, they are used as opaque token.

Under certain circumstances it is possible Mallory can observe the system and infer that two messages (M1, M2) have identical plaintext (P).  My concern is given two messages that are known to have identical plaintext and same key, is it possible to recover the K?

E: AES-128-CBC

IV: randomly generated IV one block size.

IV1 + E(K, P, IV1) => M1

IV2 + E(K, P, IV2) => M2

If it possible to recover K, what mitigations could I put in place?  For example would a nonce within the plaintext help, i.e.:

IVx + E(K, (Nx + P), IVx) => Mx

How would I calculate the size of nonce determine computational difficulty for recovery (within P there is a CRC32 to determine tampering)?


texts: Is any decent RNG acceptable as a stream cipher?

texts:
I have a function f(x,n) that takes a 128-bit key x, and generates n bytes of pseudo-random data. I've tested the output bytes this function for various keys with the NIST RNG testing suite (NIST Special Publication 800-22 A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications) and the results were very good. What concerns are there before simply using the random bytes XORed with the plaintext as a stream cipher?

Edit:

I figured I'd add some more details. The best analogy I can come up with is that the bytes are random in the same way the digits of pi are random.

To be able to withstand cryptanalysis, are there any standard attacks that I should try, or should I just sit down and try my best to expose a weakness, then give it to someone who has more experience in cryptanalysis and ask them to do the same?


texts: Increase number of rounds for SPN and Feistel ciphers

texts:
Read a post on Schneiers blog (and again 2011) about increasing the number of rounds for AES from to "AES-128 at 16 rounds, AES-192 at 20 rounds, and AES-256 at 28 rounds" to raise the security. However, I did wonder where these figures came from. According to Schneier "hey're off the top of my head, and certainly not the last word on the topic", and a previous topic on stackexchange "more rounds means more security against cryptanalysis, simply, since there is more confusion and diffusion".

My question is:

Could any high number of rounds do for SPN and Feistel ciphers like
AES, Serpent or Twofish? Or would/could the ciphers end up being
weaker after a certain X number of rounds? Or maybe even repeat some
patterns?
How much more secure can AES, Serpent or Twofish become if the
    rounds increases? Would AES, for example, be strong as whatnot if
    the number of rounds were to be ridiculously increased?


texts:
I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a single file encryption. I did a chart for you:

cryptomator stores salt/ parameters in a config file, but as I want to encrypt and decrypt single files, they have to be stored with the file.
It should as safe as the boxcryptor encryption when I store the salts for the key derivation (for MAC & content) in the ciphertext, is it?

Another question is: Do I really need two salts & keys? According to this thread there's no known interaction between SHA-256 and AES, but on the other hand, it seems just sloppy to me to use one key for both and also there are possible unknown interactions. I'm really interested in what you think about that.

Have a nice day and thanks :)


texts: Meet-in-the-middle probability of success

texts:
In page 358 of Bruce Schneier's Apllied Crypto, when explaining the meet-in-the-middle attack, he states that the success probability is «1 in $2^{2m - 2n}$» with two plaintext/ciphertext pairs, and «1 in $2^{3m - 2n}$» if one uses one additional pt/ct pair. $n$ is the key length, and $m$ the block length.

My question is: shouldn't $m$ and $n$ be reversed? I.e. «1 in $2^{2n - 2m}$» and «1 in $2^{2n - 3m}$»? As stated in the book, we would get a lower success probability when using 3 pairs, as «1 in $2^{2m - 2n}$» is a bigger probability than «1 in $2^{3m - 2n}$» (because $2^{3m - 2n}$ > $2^{2m - 2n}$).

Or is there something obvious that I am not seeing?


texts: Significance of Extended Euclidean Algorithm in Cryptography

texts:
I'm currently reading Paul Garrett's book "Making, Breaking Codes", where he goes through the standard textbook implementations of different crypto-systems (RSA, Elgamal etc).

When he talks about the different attacks that can be performed on these systems, he often uses the extended euclidean algorithm on different numbers to perform these attacks.

For example, when talking about an RSA attack where an actor sends the same cipher text to two different people with the exponent $e$ changed, he talks about how you can calculate the $\mathrm{Ciphertext}^{-1} \mod n$ (along with other operations) to find the plain text message. I understand that using the extended Euclidean algorithm will give you an $a$ and $b$ such that $ax + by = 1$, however I'm unclear as to how this can help one solve different problems in cryptography.

How does finding this $ax + by = 1$ help in the solution to different cryptographic problems?


texts: is it safe to do public key to public key derivation with Ed25519?

texts: Deriving a public key from a public key in Ed25519 is possible, some algorithms are available. My question is why there are so few implementations compared to secp256k1 for example. The extra checks necessary to implement it look at least more error prone than with other curves.


texts:
I am fiddling around with the JS Web Crypto API and creating a hybrid encryption system that uses a symmetric key to encrypt form data with AES256-CBC and and a public/private key-pair to wrap/encapsulate the symmetric key using RSA-OAEP.

Currently I am simply generating a random 256bit key that will get padded and wrapped by RSA-OAEP.

I stumbled across RSA-KEM in RFC 5990 and love the fact that I can derive both the encryption key and iv (and many other keys) from it via HKDF. HKDF is a supported algorithm in the Web Crypto API but RSA-KEM says I should use "simple RSA" without any padding to encrypt the random element for key derivation which is surprisingly an algorithm not mentioned in the W3C specifications.

Can I encrypt the random element used for key derivation with RSA-OAEP (even the padding is not needed) or are there any security concerns? Should I stick to my current implementation?


texts:
I got a lecturer with a slightly way of writing down the padding oracle attack equations than what's considered to be the standard definition on the internet site like Wikipedia, and I wondered if all the equations are still cryptographically correct.

So it's using uppercase P and C for the plaintext and ciphertext blocks, and lowercase p and c for the plaintext and cipher-text bytes.

PKCS #5 padding is used.  c7 denotes the 8th byte with index 7 of the first block, which is first XOR-ed with a chosen number b and the result of this is sent instead of just a chosen number b:

And to calculate the last byte with index 15 of the second block, it just calculated p15 = 1 XOR 2. Without having to do p15 = 1 XOR 2 XOR c7, because the XOR-ed result of c7 and b was sent to the server and not b itself.

Then it knows the decrypted padding number according to PKCS#5 is 0x03 and skips trying to decrypt the byte before the last byte. So there wouldn't be a need to try to pad with the padding lengths 0x02 and 0x03 first like on the Wikipedia example. And directly goes to 2 bytes before that (because of the decrypted 0x3 padding at the last byte) and make the new padding length 0x04.

It will XOR the last 3 bytes (c5, c6 and c7) wit 0x07, because that's 0x03 XOR-ed with 0x04. And when you XOR with 0x03, it would cancel out the 0x03 already there and then XOR it with 0x04, making the result a 0x04 padding in the modified version.

And then XOR c4 positively with 0x36. And then concludes c4 = 0x36 XOR 0x04 = 0x32

And then the same thing for c3:

Is this a valid alternative way to calculate plaintexts for a padding oracle attack?


texts:
I am designing a distributed system, composed by a set of physically distributed embedded devices (8 bit cores with less than 1 KB of RAM). The devices need to be able to authenticate the originator of the commands they receive, and for that purpose I chose HMAC.

Each device has a secret key, and a central server knows all of the keys (somewhat similar to a RADIUS server). When a user wants to send a command to a device, it first sends the message to the central server which will append the correct HMAC to it. The user then sends the authenticated message to device, the HMAC is sucessfully verified and the message processed.

My question: is it possible to update the secret key on the device using only this scheme? Since there is no encryption, the new key would be sent in plaintext. I was wandering if a secret sharing mechanism would work for this case.


texts: What is the maximum number of zeros, which are appended at the input- padding in messages? How large must the message be for this?


texts: How to apply lagrange interpolation on bilinear pairings?

texts:
I have seen in some places applications of Shamir secret sharing and lagrange interpolation mixed with bilinear pairings, however I fail to understand how this works. For instance, here I find the statements:

$pk_{common} = \sum_{i=1}^{t+1} l_{i}*pk_{i}$
$e(h, pk_{common})$

If $pk_{common}$ is a point in some $\mathbb{G}$, how can a lagrange interpolation result (the polynomial or an evaluation for $x=0$) transform into a suitable point that can be used in the pairing function?


texts: Post-quantum asymmetric encryption algorithms

texts: One could use Falcon-512 for establishing a private and public key for an asymmetric context. Whereas in a symmetric context, we could use firesaber/saber/variants in order to obtain a shared secret that can later be used in an AES-GCM context. My question is: what encryption algorithm do we use when we want to encrypt plaintext when using a public key instead of a shared key? What post-quantum encryption algorithms (i.e., a map from plaintext to ciphertext) exist that are compatible with asymmetric schemes such as falcon? If I were to try using the public key to encrypt data, using the private key to decrypt would fail if using a symmetric encryption algorithm such as AES-GCM


texts:
Hi I have a problem with moving my blind signature implementation from educational (textbook RSA) to more practical (padded RSA) side.

David Chaums paper gives a following figure:

$r$ - blinding factor

$e$, $d$ - public & private exponent

$Blinded\ message = Message \cdot r^{e}$

$Signature\ of\ a\ Blinded\ message = Blinded\ message^{d} = (Message \cdot r^{e})^{d} = Message^{d} \cdot r^{ed} = Message^{d} \cdot r\ (\bmod\ N)$

now to unblind a blinded message we should remove the blinding factor:

$Unblinded\ signature = Signature\ of\ a\ Blinded\ message \cdot r^{-1} = Message^{d} \cdot r\ \cdot r^{-1} = Message^{d}\ (\bmod\ N)$

It is clear that real-world RSA implementation shouldn't use plain textbook for encryption or signature purposes as it is vulnerable to a range of attacks. To overcome these attacks a textbook must be armoured with "padding", prior encryption or signature operation.

Now, as far as I understood (in simple English): a "padding" process "changes" the plain text prior encryption to make it more durable to known attacks.

Mathematically speaking, the whole process would look like:

$Signature\ of\ a\ Blinded\ message = pad(Message \cdot r^{e})^{d} (\bmod N)$

In other words "padding" destroys blind signature, because there is no such "$unpad$" function that would satisfy the following equation:

$unpad(pad(Message \cdot r^{e})^{d})\ (\bmod N) = (Message \cdot r^{e})^{d}$

So this means blind signatures can not be used with padding.

Question Am I correct that using blind signatures in practice, one should never use a public/private key pair for both encryption and blind signature purposes together, and to actually use a blind signature that person is obligated operate on a plain textbook making the whole process vulnerable to a range of attacks?

EDIT

As far as I understood the whole process, there are two sides A - Applicant, B - Bank. For example Applicant creates a token that represents 10\$ with serial number AH43S, then Applicant blinds the token with random R so that the Bank is not able to discover token's serial number. Then applicant sends blinded token to Bank, and asks it to sign with 10\$ key. Now Bank needs to pad a blinded version of token, to prevent any attacks on it's key, and after the blinded token is padded there is no way to unblind it...

The padding is applied on the bank side(side that signs the message), am I correct? And if so, it would break blinding factor presented by the side that asked to sign a token...


texts:
First off, if you're doing William's p+1 test, then also doing Pollard's p-1 is redundant, since the p+1 test covers both cases, right?

Second, why is the recurrence $V_{n+1} = aV_n - V_{n-1}$ used? Using $V_{n+1} = V_n + bV_{n-1}$ instead would give you a provable $\frac{1}{2}$ chance of getting a quadratic nonresidue for each choice of $b$. But no reference I've ever seen uses this variation.


texts: Deterministic Authenticated Encryption with AES-OFB and HMAC

texts:
I have an encrypted column in a database that stores sensitive information. The existing encryption scheme is deterministic and a database index exists on the encrypted value to allow searching.

I am upgrading the encryption scheme to use authenticated encryption, so the obvious choice seems to be AES-SIV. However, the data is accessed both from a Java app and from PL/SQL stored procedures so I am limited to the cryptographic primitives supported by Oracle's DBMS_CRYPTO package (SIV is not supported).

I read several questions on this site, mainly Why is synthetic IV (SIV) mode considered deterministic authenticated encryption (DAE)? and Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography? and I have come up with the following design:

Use a 64 byte key, where there first 32 bytes are the HMAC key and the remaining 32 bytes are the AES cipher key.
Use HMAC-SHA512 on the plaintext to generate a the initialisation vector (use first 16 bytes only).
Encrypt using AES in OFB mode (since CTR mode is not available). OFB mode will preserve length and (I believe) avoid padding oracle attacks.
Concatenate the 16 byte IV and the ciphertext in the database column.

My questions are:

Does this design provide deterministic authenticated encryption?
Is there a better design that would allow searching on the encrypted data?


texts:
In a substitution cipher, I recieve 3 bits and than I return another 3 bits.
The key of this cipher could be a matrix represented as:

(0) 0 0 0 => 0 1 1

(1) 0 0 1 => 1 0 1

(2) 0 1 0 => 1 1 1

(3) 0 1 1 => 0 1 0

(4) 1 0 0 => 0 0 1

(5) 1 0 1 => 1 0 0

(6) 1 1 0 => 0 0 0

(7) 1 1 1 => 1 1 0

So, when we receive 000, the cipher will return 011.

When we receive 101, the cipher will return 100.

The key itself can be represented as a stream of 24 bits like this:

0 1 1 1 0 1 1 1 1 0 1 0 0 0 1 1 0 0 0 0 0 1 1 0

Is there a way to reduce the key to 15 bits?

I other words, can that matrix representation of 24 bits, could be represented with 15 bits?


texts: Creating a message authentication scheme

texts:
I have such situation. I have a device like dongle. But it has certain limitations. For example, it can only have implemented encryption and decryption functionality.

The availability of ciphers which it can use it can use is also limited. Current option is 3DES.

Now, I need to create a message authentication scheme (which gives both integrity and authenticity) from this situation.
I know ideally HMAC, CBC-MAC, should be used, but we don't have that situation.

I am interested would such option be considered a somewhat secure MAC:

I want to authenticate message M
I apply hash on message M say SHA1, e.g. M' = SHA1(M). This I do from my PC which is more powerful than my dongle, HASP.
I feed the device-HASP, with M' (there is an issue here, please see below), it encrypts it with a key, e.g.,

TAG = 3DES_ECB_ENCRYPT(M', KEY)

The 3rd step is done because to avoid sending lot of data to the device.

My TAG is the authentication tag, which I will send together with message M.
This is the scheme basically:

My problems and questions are:

You know 3DES block size is 8 bytes, how can I feed it with output of SHA1 (in a secure way) which is 20 bytes? Or what workaround exists for it?
How secure is my MAC?

I know this is not the most secure, but like I said we have some limitations, and are ok with it if it is not catastrophic mac scheme.
e.g. our current MAC was just DEC ECB encryption, of XORED plain text.
So now instead of XOR ing plain text blocks between each other we use SHA1.
Old scheme is described here.

PS. Similar approach is mentioned here: https://cseweb.ucsd.edu/~mihir/cse207/w-mac.pdf, but there whole plain text is given to encryption function, here I can't do that - I can't give 200 bytes of data say to the dongle, that is why I want to hash it first, and give smaller amount of data to the device


texts: According to the original paper form Bernstein public/private keys and the shared symmetric key are stored in little-endian. However, the WolfSSL of WolfSSL supports both, little-endian and big-endian. What is the reason for this? May there be any security issues?


texts:
I'm looking for weak groups in discrete logarithm, that $x$ can be extracted from $Y$ in polynomial time where $Y \equiv g^x \pmod{p}$ .

I thought one way is to produce a prime $p$ that $p-1$ is an smooth integer which then makes discrete logarithm problem easy using Pohlig-Hellman algorithm but i couldn't find any algorithm for generating such primes. Trivially, we can generate random numbers and then check if it's prime and if it's prime, check if $p-1$ can be factorized to a set of small prime numbers. It can be done in another way, considering a set of small prime numbers and generating random exponents for every prime in the set, multiplying all primes powered to their exponent. By doing so, we have a number $r$ that can be factorized to small prime numbers and then we can check if $r+1$ is prime.

Clearly these methods are just trial and error and may take a long time to find such prime, specially when it comes to generating 256 bit prime numbers. Is there any better algorithm ?

What are other ways to generate a  256 bit long weak modulus?


texts: Finding multiple smaller collisions equal work as finding a bigger collision?

texts:
Problem A:
I receive two hash digests $H(x), H(y)$ and the corresponding preimages $(x, y)$.
$H$ is a 128-bit cryptographic hash function: $H: \{0,1\}^{*} \longrightarrow \{0, 1\}^{128}$
I need to find two second preimages $(x', y')$ such that $H(x) = H(x')$ and $H(y) = H(y')$, where $x \neq x'$ and $y \neq y'$.
Problem B:
I receive one hash digest $H'(x)$ and and the corresponding preimage $x$.
$H'$ is a 256-bit cryptographic hash function:
$H': \{0,1\}^{*} \longrightarrow \{0, 1\}^{256}$
I need to find one second preimage $x'$ such that $H(x) = H(x')$ , where $x \neq x'$.
Are problem A and B equivalent?  In other words, do both take $2^{256}$ work?


texts: With AES encryption and a known key and plaintext, can an attacker create a different key and plaintext resulting in the same ciphertext?

texts:
In short: with AES encryption can an attacker create a new key2 and plaintext2 so that AESkey1(plaintext1) = AESkey2(plaintext2)
If so, can it be solved by just applying for instance a MAC like AES-GCM or an AES-CTR with a SHA256 HMAC?
Intended application:
The encryption of a file. Every client having the key can decrypt the file. The encrypted file is handled blindly by a server (without knowing the key) by its SHA256 hash.
When a new client is handed over a false key with the hosted file, he should be able to detect it is the wrong key. And not getting any other (noisy) binary from the same encrypted file as a result. Noting that an attacker delivering the false key has access to the original key, the ciphertext and thus also the plaintext.
(The option of identical files being encrypted with different keys should be there. So deterministic encryption is not my intention)
An other possible easy solution I thought of would be to store the hash of the secret key together with the encrypted file on the server and send it to the client to verify. But I actually prefer using a well known out-of-the-box solution, and not something I came up with. Is applying a MAC / HMAC enough to guarantee only one key results in the given ciphertext.
Hope my intention is clear, and someone knowledgeable can point me in the right direction.


texts: Should I remove these use cases of MD5/SHA1 from my program?

texts:
I have a web app (a register and login system) written already but i am now improving it. One of its design goals was high security.

I have some use cases of md5 and sha1 in it and now i am in doubt if i seriously need to replace them (and with what and how).

I mention that uses here and please tell me if i should replace which cases  why and with what other algorithm (please also mention the necessary bit length that u think is the minimum acceptable). but consider that i don't want to get it too hard; e.g. concatenating the output of sha256 to 128 bits for replacing an md5 invocation seems ok too me (i have asked about that before and seems there is consensus that that is considered secure enough for most practical cases considering i am writing a php app running on real world web servers (I think NSA or hackers can breach via those layers, PHP and web server environment, more easily)), so i don't insist on the latest and top secure standards and don't want to use complicated/bulky algorithms just to reduce a hash output length from 256 to 128!

usage 1:

md5 is used to mix several independent keys to form a single 128 bit key to be used in AES128+HMAC encryption (same key is used for enc and hmac; yes i  know it is considered bad practice, but not really serious so far).

sample code:

$aes->setKey(pack('H*', md5($GLOBALS['pepper'].$GLOBALS['site_encr_key'].$GLOBALS['client_sess_key'])));

usage 2:

sha1 is used to mix several sources of entropy obtained from client request parameters to be used in the current crypto operation. this extra entropy is stored too and later used in almost all other crypto operations. Neccessary to mention that, all crypto operations have their own newly generated sufficient entropy (at least 128 bits) and the clients' requests entropy is used only as an extra (it can be useful in case some main sources of entropy fail to provide sufficient real entropy for whatever reason or in the rare case that a good standard crypto random generator isn't available in the execution environment).

see my sample code for gathering request entropy:

$request_entropy=sha1(microtime().$pepper.$_SERVER['REMOTE_ADDR'].$_SERVER['REMOTE_PORT'].$_SERVER['HTTP_USER_AGENT'].serialize($_POST).serialize($_GET).serialize($_COOKIE));

this entropy is then combined with the entropy of the past clients' requests and stored in database:

$query="update `site_vars` set `value`=sha1(concat(`value`, '$request_entropy')) where name='entropy'";

usage 3:

sha1 is used in my crypto random number generator function to get a random integer (random numbers generated by this function are then used in other more useful sub-functions, random_bytes and random_string, to generate random strings/tokens and crypto keys in my program).

see the code excerpts for details:

extract(unpack('Nrandom', pack('H*', sha1(openssl_random_pseudo_bytes(4).$entropy.microtime()))));
    return abs($random) % ($max - $min) + $min;

...

extract(unpack('Nrandom', pack('H*', sha1(fread($urandom, 4).$entropy.microtime()))));
// $urandom is an open file handle to /dev/urandom
    return abs($random) % ($max - $min) + $min;

...

if(function_exists('mcrypt_create_iv') and version_compare(PHP_VERSION, '5.3.0', '>=')) {
    @$tmp16=mcrypt_create_iv(4, MCRYPT_DEV_URANDOM);
     if($tmp16!==false) {
        extract(unpack('Nrandom', pack('H*', sha1($tmp16.$entropy.microtime()))));
        return abs($random) % ($max - $min) + $min;
    }
}

...

extract(unpack('Nrandom', pack('H*', sha1(mt_rand(0, 0x7FFFFFFF).$entropy.microtime()))));
    //mt_rand is only used as a fallback in case other CSPRNGs (openssl_random_pseudo_bytes, /dev/urandom, mcrypt_create_iv) aren't available in the environment
    return abs($random) % ($max - $min) + $min;


texts: Are Barreto-Naehrig Curves suitable for pairing-based cryptography?

texts: If Barreto-Naehrig Curves are suitable for pairing-based cryptography, can I use the library available at Optimal ATE Pairing?


texts: help understanding part of Wiener's attack on RSA w/ small d

texts:
In this paper, the author writes:

  Now $k\phi(N) = ed - 1 < ed$. Since $e < \phi(N)$, we see that $k <d < \frac{1}{3}N^{\frac{1}{4}}$. Hence, we obtain:

   $\mid \frac{e}{N} - \frac{k}{d} \mid \leq \frac{1}{dN^{\frac{1}{4}}} < \frac{1}{2d^2}$

I am having trouble seeing how these last equalities were found. I see how to get the following:

$\mid \frac{e}{N} - \frac{k}{d} \mid$ = $\frac{k}{d} - \frac{e}{N}$ $< \frac{3d}{dn^{\frac{1}{2}}} $

I do not see how to get from here to $\frac{1}{2d^2}$.
Is anyone willing to explain this to me?


texts: Is there a cryptographic function or system in which it becomes HARDER to break as time passes?

texts: Is there a function or system which is time depending in which the effort required to brute force the decryption increases with time? It is easy to break encryption from many years ago because computers are so much faster. Is there a system in which time is a component and as time passes then it gets harder & harder to decrypt? Perhaps there is a physical entropy component which degrades after time? Something akin to disappearing ink, but digital.


texts: Save the last cycle in GCM GHASH calculation

texts:
I need to implement GCM GHASH in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size is fixed and AAD is 0.

A little example: message = 5 x 640 bits.

cycle 1: process 640 bits (add/multiply)
cycle 2: process 640 bits (add/multiply)
cycle 3: process 640 bits (add/multiply)
cycle 4: process 640 bits (add/multiply)
cycle 5: process 640 bits (add/multiply)
cycle 6: process Len 0||C (add/multiply) and xor all results

In the above example, for 5 cycles of data I need 6 cycles to calculate GHASH. The extra cycle is necessary to insert LEN(0||C) in the data flow.

Problem is, I have a continuous data flow and I cannot interrupt it to insert LEN 0||C.

Is it possible to manipulate the GHASH in a way that the processing of LEN(0||C) could be made in advance and just added to the end of processing, saving one processing cycle?

Just to explain better, my architecture is based on this paper:
http://ieeexplore.ieee.org/xpl/articleDetails.jsp?tp=&arnumber=5619894&queryText%3DFPGA+parallel-pipelined+AES-GCM+core+for+100G+Ethernet+applications

The add/multiplied data from each adder/multiplicator is saved on a Q memory that have 4 positions. So, at the end of the data, the Q memories positions are xored. The 5 results are then xored and we have the GHASH(CYPHER_TEXT).
I have a C model that processes the len_C adding it to the end of the flow, so I know the GHASH(CYPHER_TEXT) result.

In my verilog model, I have almost the same Q memories contents at the end of the data processing, the only difference is caused by the len_c processing.
The values are:

C model ghash: 0x72a61c9521a6f05da7b16d8fb6b2e115
Verilog model GHASH without processing Len_C: 0x3f1cdbad43034cbfc4d09060e08678e7
My Len_c (bit mirrored to work with my architecture): 0x00980000000000000000000000000000
H: 0x6909696eb6211e31212d7d0a3e07b836

I tried the calculations you proposed but it not works. You guys could please take a look?


texts: Optimal MDS matrix - circulant or recursive?

texts:
One of the special matrix in $GF(2^q)$ is MDS matrix which can be used in the cryptography like mix column of AES. Two forms of MDS matrices are circulant  and recursive.

Which form of MDS matrix (circulant or recursive) is suitable for a cryptographic hardware implentation? Meaning: which of them is optimal?


texts: (Enhancing Linear-Differential Cryptanalysis - Biham et al.) Diff-Lin Extension Characteristic and Characteristic Probability

texts:
I studied Langford and Hellman's Differential-Linear Cryptanalysis and moved on to Biham, Dunkelman and Keller's Enhancing Linear-Differential Cryptanalysis.
In the paper, although I've read many times, I couldn't understand their characteristic and how they computed the total probability. As far as I know, the attack is based on concatenating a linear part to a differential part, but Biham et al. proposed a different notation, and I am really confused with what they meant, and also how they calculated the total probability, based on picking the probability of differential part to be not equal to 1.
The exact part of the paper that creates my confusion is:

So, I don't get why their characteristic involves a linear part (which seems it is some kind of decrypting since it begins at 6th round and goes back up to 4th round, and I couldn't understand the reason of this too), then a concatenated differential part which is followed by another linear part, where the subscript says it is the second encryption. I guess subscripts somehow impose "differential pair" concept but have no idea how..
If I were to write the flow, I would express it basically as:
differential -- linear(round4-- rounnd 5 -- round 6).

My second question is, how they ended up with total probability
$$1/2 + 4pq^2$$
in this case?


texts:
I'm trying to implement Private Set Intersection using the additive ElGamal public key encryption system. The code I've written can encrypt and decrypt numbers using the ElGamal system, so far so good. Adding and multiplying the cipher also works. Or at least, it works with positive numbers.
As I understand modulo arithmetics negative numbers can be think of by the following: $x + a = 0 \mod q$ where $a$ is a negative number. So if I have the group order set to 8009 minus one can is 8008, because $1 + 8008 = 0 \mod 8009$.
Now I noticed that no matter which generator I use, when I use power-mod such that $g^{q-1} \mod q$ the result always 1. I didn't dig much in the math of encryption yet, but it seems to a consistent result. $2^6 = 1 \mod 7$, $1151^{8008} = 1 \mod 8009$ and so on. Which then brings me to a problem. The whole 'additive' part comes in due because of using exponentials, such that $g^x g^y = g^{x+y}$ But would this be true in modulo arithmetic here? $g^{-1} g^{+1} \mod q$ should evaluate to 1 to have the $x + y = -1 + 1 = 0$, yet if $g^{-1} \mod q$ is always 1 then the result of $1 * g$ will be just $g$, so I would be off by one. In fact, the $g^{-1} \mod q$ is always one, but then $g^0 \mod q$  is also 1. What's going on here? I'm really confused.


texts:
I can find descriptions of using CFB mode to create a MAC and even implementations, but cannot find any standard or papers analyzing its security bounds.

Is there a standard for CFB-MAC?

Where can I find an analysis of its security bounds?


texts: In RSA. Why is $\phi(n)$ kept secret and $n$ is public?

texts: I mean, $n$ can also be easily used to find the factors $p$ and $q$ right?


texts: Shamir Secret Sharing Scheme - leak of information

texts:
After going through some literature, I've convinced myself that to recover the exact secret using Shamirs Secret Sharing scheme, we must have S(the secret converted into a number) < p (choice of prime) and n (total number of parties) < p.

I understand that the reason for incorporating modular arithmetic and the prime p is to ensure that there isn't any leak of information. However, since the prime p is a public number, isn't there anyways a leak of information that the secret S < p? (i.e. not all real numbers have the same probability of being S)

Thanks very much in advance.


texts: Would it matter if my miner was hashing random vs incremental values?

texts:
I'm working on my miner for my "game" site that's basically a pre-image attack from a hash posted online. You submit a hash input, it's hashed, and your score is the hamming distance (the number of bits that differ) between the two values. If it matters, I'm using Skein-1024 v1.3

My miner up until now has been incrementing a value and hashing it. Increment, hash, increment, hash ad infinium. I wrote it so that when I close the miner, it saves it's current highest value that way when I restart it I won't start back over at 1 and hash all the same inputs again. I can pick up where I left off. This has proven to be some what successful. However, I'm curious if the miner might be more fruitful by generating random numbers instead of incrementing.

It seems to be a hard metric to measure. I know that most hashes will output wildly different values if their inputs are off by only a bit or two, but I feel that by incrementing the value I hash I'm usually only a few bits off. If I randomly generate values I'll probably do fewer hashes (because random number generation is more intensive than a simple num++ increment) but my gut tells me that I'll have a more diverse set of inputs and that it might produce a more diverse set of outputs. I know not to trust my gut without reason about this. I feel crazy just typing it out.

I also know that if I increment I'll never end up hashing the same value twice. Random is capable of that although the odds of generating the exact same 64 bit number twice is slim.

Can I expect different qualities of outputs from my miner by hashing random values instead of an incrementing value?

FULL DISCLOSURE: I am the owner and operator of the site above. There are no ads or even analytics on the page.


texts: How to compare different signature scheme's performance?

texts:
I am interested in comparing the computational performance of two signature schemes. However, I am unsure how to do that. My candidates are RSA and Shamir's ID Based Signature scheme. To get a fair comparison, I want both schemes to be parametrized in a way ensuring a "comparable level of security". However, the question remains, what that is.

My first idea was to have a look at the verification condition of both schemes assuming an attacker wants to forge a signature for a given message $m$. It seems fair to choose the parameters in a way that the size of the problem to be solved to do so is equal.

RSA verify: $s^e = f(m) \mod n$

=> $f$, $m$, $e$, $n$ is public

Assuming the attacker wants to calculate $s$ for known $m$, the discrete logarithm has to be solved, which is difficult depending on the size of $n$, which is an RSA modulus.

IBS verify: $s^e = i * t^{f(t,m)} \mod n$

=> $m$, $e$, $i$, $f$, $n$ is public

The signature consists of $(s,t)$, so there are two parameters the attacker can choose. If the attacker randomly chooses $t$, the problem reduces to RSA verify with the same conclusion. However, what happens, if the attacker chooses $t$ and tries to solve for $s$? Can this case also be reduced to solving the discrete logarithm?

This question can also be boiled down to this one: does the size of the RSA modulus used in both schemes lead to a comparable size of the underlying discrete logarithm, if the secret is not known?


texts: What is the most secure way to check that a given masterkey is valid?

texts:
For the purposes of learning, I'm writing a small utility that allows encrypting a list of passwords using a single master key (using AES-256 and PBKDF2)

Before encrypting or decrypting any password user has to enter the master key (which will be used to derive a key for AES).

I would like to know what is the best option to know if a user has entered a valid master key :

To salt and then hash the master key (once). The resulting salt and hash are stored somewhere - for instance in a DB. Later on, when the user has entered his master key, I add the stored salt and compare the computed hash with hash stored in DB.
To generate a salt. The salt is encrypted using the master key. I store both the salt and the encrypted salt in a DB. Later on, when the user enters the master key, I try to decrypt the encrypted salt value with the master key and compare it with the salt stored in DB.


texts: Salsa12 is in eStream portfolio. How many random bits one can generate in Salsa12 using single key? Is it $512\times 2^{128}$?


texts:
To get a public key of some organization or someone we want to send an encrypted message to, we need to make a request to CA asking that organization's public key. CA then returns X509 certificate. It contains CA's signature. To decrypt it we need to have a CA's public key. How can we securely obtain CA's public key?

Related:
- How can we get CA's public key?
- I've got my private key compromised. How does CRL work?
- What happens when a root CA has its private key compromised?


texts: A formal proof obfuscator is a mapping $\mathcal{O}$ such that whenever $P$ is a formal proof of a theorem $T$, then $\mathcal{O}(P)$ is a distribution of formal proofs of the same theorem $T$. An indistinguishability formal proof obfuscator is a formal proof obfuscator $\mathcal{O}$ such that whenever $P_{1},P_{2}$ are proofs of of a theorem $T$ the distributions $\mathcal{O}(P_{1}),\mathcal{O}(P_{2})$ are indistinguishable. Does there exist an indistinguishability formal proof obfuscator? Are there any references for an indistinguishability formal proof obfuscator or any formal proof obfuscator in general?


texts:
for an embedded device I need to sign a 14-byte string and want to verify that string on the device.

Since there is already an AES-Library on the device, I thought about using the following scheme:

Use AES with a fixed IV and a fixed secret key to encrypt the following string:

  "2byte Random Padding | 14byte data"

And send the 14byte data followed by the 16byte result of the encryption.

Is this scheme totally dumb?

Thanks!

Regards,
Philipp


texts: Is the idea of a known plaintext attack really that new?

texts:
As you can probably guess, I just watched The Imitation Game, which hasn't really gotten points for historical accuracy...

During World War II, Turing and his team fret that they can't know the plaintext of the Enigma messages they intercept. In a Eureka moment, it occurs to Turing to try a message that probably contains the words "Heil Hitler."

My question is then: Hadn't it occurred to anyone in the past, say, during the Civil War or World War I, to try something like this to break a code? (I might be mixing up known plaintext and chosen plaintext attacks, please let me know).


texts:
Is the SWIFFT hash function described in:

https://en.wikipedia.org/wiki/SWIFFT

still considered a provably secure one way function?  Is it also considered secure against attacks by a quantum computer?  Would it be a good candidate for a post-quantum (quantum safe) hash?


texts: How to verify most appropriate cleartext?

texts: So basically I was implementing a decryption tool (just for fun) and the first encryption logic I decided to implement was Caesar Cipher. So if I  have the input as cvggbmp and I have to find what the cleartext is, I would pass this through the decrypt function 26 times. I get 26 outputs. Is there some way I match each of these outputs against a words.txt for like legible word density and then display the output with the most number of legible words ? Or is there a better optimized way to do this ?


texts: Is it possible to work out the hash using length extension attack but with different hashes type?

texts:
For example, I have:

Unknown: A secret variable, lets call it secret, that is unknown to me
Known: The length of secret, (lets say 128 bytes)
Known: The hash of secret, in hash1 (lets say hash1 is sha512, this is an important part of the question since hash1 isn't hash2)

My objective here is to get hash2(secret || data_that_I_know), but hash2 being different than hash1, (lets say hash2 is sha1).

With my current understanding of the length extension attack I believe I can obtain the digest of hash1(secret || data_that_I_know), but, is it possible to get the digest from another hash type (like sha256, md5 etc.)?


texts: What's causing the poor randomness in this program: the LCG, or the program logic itself?

texts:
(Crypto Gods, I should begin by stressing that I haven't lost my mind: I'm not doing this in real life, I'm just trying to understand the theory behind what's happening. With your help, hopefully I can do that.)
Let's say I choose the parameters for a linear congruential generator $L$, and pick a seed $L_0$. I then use the LCG to generate sequential pseudorandom numbers $L_1, L_2$ for the following program (which, for the sake of argument, picks two different indices in a 52-element array):

$x := L_1 \bmod 52$
$y := (x + 1 + (L_2 \bmod 51)) \bmod 52$

Let's say I choose $m = 8192$, $a = 4801$, and $c = 83$. By looking at the value of $x$, I can learn quite a lot about the value of $y$: for any $x$, there are only about nine or ten possible subsequent $y$s, and they're very unevenly distributed.
Then I tried other values of $a$ and $c$, and got very different results: for instance, $a = 2049$ and $c = 8141$ gives a distribution that produces all possible values of $y$ for a given $x$, and the distribution is much more uniform. It's still poor, but compared to the first set of parameters, it's a huge improvement.
My question is this: what's causing this drastic variation? I initially thought it might be because $m = 8192$, $a = 4801$, and $c = 83$ didn't satisfy the maximum period length theorem, but then I realised that (a) they do, and (b) that would be unlikely to cause this effect on this scale anyway, since I'm only generating two numbers sequentially. Is it some property of the way that the LCG output is being used that leads to this behaviour, or is it intrinsic to the LCG itself? If it's the latter, is there a theorem that states some properties that must hold in order for the joint distribution of $x$ and $y$ to be uniform (as far as possible, given that the program guarantees $x \neq y$)?


texts: How long would it take to brute force an AES-128 key?

texts: How long would it take to crack a AES-128 key using the most advanced technology currently available? The hardware can be anything, be it a high-performance CPU, GPU or even FPGA?


texts: Noise budget stops decreasing further, while running simple additions

texts:
I'm experimenting with Microsoft SEAL 3.4.5. I've a simple addition, which I run within a for-loop.

for( int i = 0; i < count; i = i + 1 ) {
    outfile << i + 1 << ",";
    evaluator.add_inplace(current_encrypted, add_encrypted);
    outfile << decryptor.invariant_noise_budget(current_encrypted) << ",";
    decryptor.decrypt(current_encrypted, decrypted_value);
    outfile << "0x" + decrypted_value.to_string() << endl;
}

Basically I'm adding up fives 10000 times. While doing this I return the noise budget after every calculation. Why the noise budget decreases quicker in the beginning?

I used the following parameters:

poly_modulus_degree: 2048
plain_modulus: 65536
coefficient_modulus: 54

According to the source code of Microsoft SEAL the noise budget is defined as follows:
$ \text{noise_budget} \approx log_2(\frac{\text{coeff_modulus}}{\text{plain_modulus}})$


texts: How to prove that a SKE scheme is IND-CPA secure

texts:
There's an IND-CPA SKE scheme 1 $(\mathsf{Gen}, \mathsf{Enc}, \mathsf{Dec})$. Scheme 2 is defined as $(\mathsf{Gen}', \mathsf{Enc}', \mathsf{Dec}')$, where $\mathsf{Gen}' = \mathsf{Gen}$, $\mathsf{Enc}'(k, m) = 0||\mathsf{Enc}(k, m)$ if $m\ne k$ and $1||k$ if $m=k$,
$\mathsf{Dec}'(k, 0||c) = \mathsf{Dec}(k, c)$ and $\mathsf{Dec}'(k, 1||c) = c$. How do I go about proving that the scheme 2 is IND-CPA secure?

I'm also having trouble understanding if the adversary can guess the correct bit on a chosen plaintext pair given the ciphertext, given that when $m = k$ the ciphertext always starts with $1$, but for the scheme to be IND-CPA secure I know that the adversary should only be able to guess with negligible probability. What am I missing here?


texts:
RANDOM EXCURSIONS TEST
    --------------------------------------------
    COMPUTATIONAL INFORMATION:
    --------------------------------------------
    (a) Number Of Cycles (J) = 0106
    (b) Sequence Length (n)  = 10000
    ---------------------------------------------
    WARNING:  TEST NOT APPLICABLE.  THERE ARE AN
          INSUFFICIENT NUMBER OF CYCLES.
    ------------------------------------------

Why is this showing up ?  I used the recomended control set from the user guide in   http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf


texts: How to crack Vigenere ciphertext if multiple keys of coprime length are used?

texts:
I came across the idea of using multiple Vigenere keys of coprime lengths here.  The idea is, what if you use multiple keys, whose lengths are all co-prime?  Then your effective key length would be the product of the length of all keys since they never line up with each other until that point.

It would be fantastic for key management since with keys of lengths 29, 31, and 37, your effective key length would be over 33,000!  You could reuse them for many messages as long as you keep track of effective key length usage.

How would one go about cracking such a ciphertext, when its length is shorter than the product of N keys, whose lengths are all co-prime?

I posted this same question on Reddit here and got this apparent solution, but it's too vague for me to follow since the author didn't have the time to go into more detail.


texts:
Let $E$ be a random even permutation of the set $\{0\dots n-1\}$. We construct a permutation $P$ of the set $\{0\dots m-1\}$, for some $m\le n$, using cycle-walking; that is, computing $P(x)$ is as follows:

repeat

$x\gets E(x)$

until $x<m$
output $x$

What is the probability that the parity of $P$ is $n-m\bmod 2$, as a function of $m$ and $n$? How low should be $m$ so that this is withing $\pm\epsilon$ of $1/2$?

The motivation was to decide if cycle-walking is enough to transform a small Feistel Cipher into a pseudo-random permutation of a smaller domain, in the cipher of this question. Poncho rightly pointed out that in a Feistel cipher, using modular addition rather than XOR also achieves this goal.

I observe that when $n-m\ll\sqrt n$, probability that $P$ has parity $n-m\bmod 2$ is high, because for most $E$, there are $2m-n$ values of $x<m$ such that the repeat loop is executed once, and $n-m$ values such that the repeat loop is executed twice.


texts: How to define the statistical distance between two functions?

texts:
The statistical difference between two families of distributions of random variables:

  Let $\mathrm{\mathbf{X}} = \{ X_{l} \}_{l}$ and $\mathrm{\mathbf{Y}} = \{ Y_{l} \}_{l}$ be two families of distributions of random variables, the statistical difference of $\mathrm{\mathbf{X}}$ and $\mathrm{\mathbf{Y}}$ is defined as
  $$d^{\mathrm{\mathbf{X}}, \mathrm{\mathbf{Y}}} ( l )= \frac{1}{2}\sum_{s} \left\vert \Pr[X_{l} = s] - \Pr[Y_{l} = s] \right\vert$$

The computational difference between two families of distributions of random variables:

  Let $\mathrm{\mathbf{X}} = \{ X_{l} \}_{l}$ and $\mathrm{\mathbf{Y}} = \{ Y_{l} \}_{l}$ be two families of distributions of random variables, for any PPT algorithm $A$, the computational difference of $\mathrm{\mathbf{X}}$ and $\mathrm{\mathbf{Y}}$ is defined as
  $$d^{\mathrm{\mathbf{X}}, \mathrm{\mathbf{Y}}}_{A} ( l )=\left\vert \Pr[s \leftarrow X_{l} : A \left( 1^{l}, s \right) = 1] - \Pr[s \leftarrow Y_{l} : A \left( 1^{l}, s \right) = 1] \right\vert$$

This notion can be used to define the PRGs.

The computational difference between two families of distributions of functions:

  Let $\mathrm{\mathbf{F}} = \{ F_{l} \}_{l}$ and $\mathrm{\mathbf{G}} = \{ G_{l} \}_{l}$ be two families of distributions of functions, for any PPT algorithm $A$, the computational difference of $\mathrm{\mathbf{F}}$ and $\mathrm{\mathbf{G}}$ is defined as
  $$d^{\mathrm{\mathbf{F}}, \mathrm{\mathbf{G}}}_{A} ( l )= \left\vert \Pr[f \leftarrow F_{l} : A^{f(\cdot)} \left( 1^{l} \right) = 1] - \Pr[g \leftarrow G_{l} : A^{g(\cdot)} \left( 1^{l} \right) = 1] \right\vert$$

This notion can be used to define the PRFs.

I am thinking that there should be a definition about the statistical difference between two families of distributions of functions. (It is denoted as $d^{\mathrm{\mathbf{F}}, \mathrm{\mathbf{G}}} ( l )$).

There is a possible way:

For every input $x \in \{\ 0,1 \,\}^{*}$, let $F_{l} \left( x \right)$ denotes the distribution of $f(x)$ where $f \leftarrow F_{l}$.
Maybe one can use
$d^{\mathrm{\mathbf{F}}(x),\mathrm{\mathbf{G}}(x)} (\cdot)$
to define the statistical difference between $\mathrm{\mathbf{F}}$ and $\mathrm{\mathbf{G}}$, where $\mathrm{\mathbf{F}}(x) = \{ F_{l}(x) \}_{l}$ and $\mathrm{\mathbf{G}}(x) = \{ G_{l}(x) \}_{l}$.

However, $d^{\mathrm{\mathbf{F}}(x),\mathrm{\mathbf{G}}(x)} (l)$ depends on both $x$ and $l$.
Thus, there exists a problem, $d^{\mathrm{\mathbf{F}}(x),\mathrm{\mathbf{G}}(x)} (l)$ may not be consistency for $x$. If I define
$$d^{\mathrm{\mathbf{F}},\mathrm{\mathbf{G}}} (l)
=\sup_{x \in \{\, 0,1 \,\}^{*}} d^{\mathrm{\mathbf{F}}(x),\mathrm{\mathbf{G}}(x)} (l)
=\sup_{x \in \{\, 0,1 \,\}^{*}}\frac{1}{2}\sum_{s} \left\vert \Pr[F_{l}(x) = s] - \Pr[G_{l}(x) = s] \right\vert$$
Then $d^{\mathrm{\mathbf{F}},\mathrm{\mathbf{G}}} (\cdot)$ may be not negligible even if for every $x$, $d^{\mathrm{\mathbf{F}}(x),\mathrm{\mathbf{G}}(x)} (\cdot)$ is negligible.


texts: Constructing efficient zero knowledge proof card game

texts: I had asked an unanswered question earlier and now, I think I have an answer (sort of), not really but I think I know where to look for it. We assign each type of card combination a score such that a winning card combination always has a higher score and a tie always have equal score.The two players then play Yao's millionaire's problem to decide who is winner. With mapping known, a player who reveals the secret exponentiations (or cards) and the secret data used to provide his/her input to the problem, one can easily verify that they have shown scores honestly. Which means that the problem is in NP and thus the player should be able to construct zero knowledge proof showing that the score really reflects his card rank without revealing either the cards or the score according to a 1987 paper.That way two players can check who won without actually revealing his/her cards.


texts: What are the properties of secure Elliptic Curves?

texts:
I have heard about the standard elliptic curves called NIST curves. What are the properties of such cryptographically secure elliptic curves?
Are they standardized according to certain protocols? Also, does the attacker get any huge benefits from knowing which curve was used?


texts: Privacy preserving aggregation of encrypted data

texts:
I have the following problem: I have $t$ servers $S_1, S_2, S_3, \ldots, S_t$, each of them storing some $key : value$ list. They have to upload this data into a big dropbox server $D$, but in such a way that $D$ doesn't know which $key:value$ pair comes from which $S_i$. My idea was that each $S_i$ would encrypt its list into $c_i$, and then upload it to $D$. Once $D$ obtained all $c_i$ from each $S_i$ it would aggregate all of them into $c = Aggr(c_1, c_2, \ldots c_t)$. Once the aggregation is finished, $D$ would be able to decrypt $c$ using some threshold-key decryption. In general, the security requirements would be: $D$ can decrypt only the aggregated data, not any of the partial $c_i$. That should hold even if some of the servers are malicious and would like to help $D$ decrypt any of the single $c_i$.
Would it be possible to construct such a schema? If yes, can someone point me to some literature which can guide me?


texts: DES Encryption: Looking for results for each round of encryption/decryption to debug code

texts:
I've been searching for a few days in different forums trying to find an example of DES that gives the key/output values for all 16 layers. I found one that gives the encryption which helped me fix that part, but my decryption isn't working correctly. It's easier to debug if I know what I'm aiming for.
Is there someplace that has all the encryption/decryption round outputs that I can look at?
Should they be the same only backward? Decryption round 1 output = encryption round 16 output?
Thank you for any help you can give.


texts: What's the difference between "HashX-512" and "HashX-1024"?

texts:
I need to make a Skein hash's, specifically, Skein-1024; however, I only have access currently to Skein-512.  Is there any way to utilize a Skein-512 function to get the result of a Skein-1024 hash?

What's the difference between the two?


texts: I know about VIC and Solitare but as I understand they are not quantum resistant ciphers. Is there any quantum resistant pen-and-paper or mind cipher?


texts: If p mod 4 = 3, does choosing a=1 in the parameters of EdDSA really achieve best performance?

texts:
I am implementing Ed448 in my crypto library. I found that if $a=-1$, I can use the formulas describing in this webpage, which saves some multiplications.

However, in the page 6 of RFC 8032, it says

  A non-zero square element $a$ of $GF(p)$.  The usual recommendation
  for best performance is $a = -1$ if $p \bmod 4 = 1$, and $a = 1$ if
  $p \bmod 4 = 3$.

Why does choosing $a=1$ if $p \bmod 4 = 3$ achieve the best performance?


texts: Need some understanding on RSA public key exponent

texts:
I am new in cryptography domain and try to build some understanding on RSA key pair generation.

My doubt is on RSA public key exponent value . Can exponent be any value (prime or non prime numbers)? i am not getting proper answer for this.

if someone has useful link for this please help to share.

Regards
Nikhil


texts: Why does 3-way authentication need the 3rd nonce to be stored?

texts:
In the following 3-way authentication protocol:

A -> B: $N_a$ || B || Signature_KprivA

B -> A: $N_a+1$ || $N_b$ || A || Signature_KprivB

A -> B: $N_b+1$ || Signature_KprivA

($N_a$ and $N_b$ are nonces, A and B are Alice and Bob, respectively)

How does the presence of the 3rd message remove the requirement to store nonces? In 3-way authentication, if there is no 3rd message, then the nonces must be stored and must have time stamps and the clocks must be synchronized.

I understand that the 3rd message is required for B to be sure that she is communicating with A and not with a MitM. However, in the presentation slides of my class, it's stated that without the 3rd message nonces must be stored-- but with it the nonces don´t need to be stored. Why is that?


texts:
Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication:

Two keys are derived from the master key k (16 byte): SHA256(k) = k1 || k2 (k1 and k2 are each 16 byte long)
The plaintext x is encrypted using AES-128 and key k1: E_k1(x) = c
The CMAC is computed using AES-128 and key k2: CMAC_k2(x) = m
The result is the concatenation of the ciphertext and the MAC: c||m

We are asked to use this method and I am wondering if there are any problems with deriving the keys for the encryption and the MAC using SHA256 hash?

(I am aware of the discussion around authenticate-then-encrypt vs. encrypt-then-authenticate vs. authenticate-and-encrypt)


texts: Decision to Search LWE when modulus $q=p^e$

texts:
I am reading Applebaum et al..

In Lemma 1. (page 7), Applebaum et al. proved the decision to search reduction when the modulus $q=p^e$ for prime $p$.

In the proof, they define the hybrid distribution $A^i_{\mathbf{s},\chi}$ and say "By a hybrid argument and standard amplification techniques, we can use an algorithm $D$ that distinguishes between $A_{\mathbf{s},\chi}$ and $U$ to solve for $\mathbf{s^\prime}=\mathbf{s} \mod p$".

I don't understand this step clearly.

Also, I cannot find the full version that includes the "entire proof".

Could anyone please tell me the details about this step?

In particular, how to use the "standard amplification techniques"?


texts: Why are Random Oracle not achievable in practice?

texts:
I am not really sure where I read that, but I have been thought that Random Oracles cannot be used in practice.

Then, I stumbled upon this paper that says: "Random Oracles are Practical:  Paradigm for Designing Efficient Protocols" which totally confused my understanding

Why do they not exist in practice?
Why do we end up using them in practice anyway?


texts: Restricting output of key derivation function

texts:
Are there any suitable key derivation functions that allow the output to have certain constraints applied to them?`

I know you can choose a length in some functions (HKDF for example), but what about restricting the output to conform to a subset of the printable ASCII set, such as [a-Z][A-Z][0-9].

Thanks


texts: How to find/determine the Polybius Square Key and Additive Key, if only the Cipher Text is known, in Nihilist Cipher?

texts:
I was solving a Crypto Challenge in a CTF, and I got a Nihilist Cipher Encoded String. Luckily the additive key was given as a hint, and for the polybius Square key, I kinda bruteforced or I just got lucky somehow and found the word with which the polybius square was made able to decrypt the cipher text.

But what if only the Cipher text is given in a challenge, or what if I was not able to guess the right polybius Square key?

How should I approach the Nihilist Cipher to crack the Cipher text?

The Challenge cipher text for the reference:

42 24 44 30 28 70 110 66 43 34 48 26 90 100 63 55 64


texts:
GPG2 does not provide authentication. It still uses SHA-1 by default. It does not seem to get any stronger as time goes by.
If one were to pass a randomly-generated symmetric key (from a TRNG) over the
entire encypted and signed GPG data block + HMAC of that GPG data block
would there be any advantage, by a computionally unbounded adversary, to forge a message because they know the underlying structure of the GPG message in detail? Let's say they have known plaintext. Will they be able to flip any bits without the receiver knowing?
So, the user employs GPG2 normally, let's say with RSA and then AES-256 and SHA-512 to encrypt and sign a message. Then the user burns some of the key pad material with the HMAC, using SHA-512.  The symmetric key is just as long as this concatenated block. The symmetric key material has already been shared in a secure manner, of course (an OTP).
Let's say the adversary knows the entire plaintext. Will they be able to flip any bits without the receiver knowing; that is, at better odds than what the security of the HMAC promises? I think not, but I would enjoy hearing an expert opinion.


texts: Why is the output of a True Random Number Generator (TRNG) insecure after it has been compressed?

texts:
I came across the following statement regarding true random number generators (TRNG):
A “P1 medium” [AIS31] true random number generator (TRNG) may not be directly used due to cryptographic reasons. Even smart cards or other advanced security solutions which possess high-quality physical sources of randomness usually rely at least on a compression of the TRNG output.
My question is, what is it about the compression of the TRNG output that makes it insecure? I have tried searching, but I cant find anything more information regarding this point wither in the spec the above quote came from, or anywhere I have looked online.
The only thing I can think of is that somehow the result of the compression algorithm can be predicted based on the input. However, if the input was generated randomly, I don't understand how that could matter.


texts: decrypting el gamal encrypted messages in regards to k being used

texts:
i am trying to understand the differences of using k in the following scenarios to better understand the protocol and most importantly the consequences of using such k.

so i wonder, some user, call him A sends two messages to B using El gamal. some user C, is not happy he's not invited, so he listens and gets those two messages. he works really hard and gets the decryption of the first message sent. can he also the second in those cases:

first case: A sends two messages E(m) and E(2m), but uses a different random k each time. i think she should be worried, but the second message is still safe.

second case: A sends two messages E(m) and E(2m), but uses the same random k for both messages. however, C doesn't know that she didn't change this random value.

could you please elaborate on the safety regarding those two cases? i am pretty sure in the second case the message is not so confident and probably decrypted because he obtained a decryption of the first message, and same k was used twice, so he just needs to filter the message to make sense.

would really appreciate if you could give a mathematical explanation to help me understand the material better.


texts: Any ideas to make an Electronic Voter Machine more secure?

texts: EVMs are not secure they say. So how can we make it more secure tham the existing one using cryptography?


texts:
From a few documents I have read and a few questions about padding here, I think if I passed a encrypted text fewer than BLOCK SIZE, openssl would pad it per PKCS7. And use that padded encrypted text as IV for next data block.

But when I followed the example (changed method to cfb), I noticed that in decrypt, ctx->iv after EVP_DecryptUpdate was the last part of ciphertext padded in the way I could not figure out.

ciphered text (hex): db 11 d7 9c a8 f2 1c 29 07 dc 6d 62 13 7a 5e bf 3a c2 fa 2f a1 0f 73 90 ae bd cf 57 cf 1f 82 a2 24 ac d1 de 29 6a e2 95 9c 0f ec
IV after decrypt (hex): 24 ac d1 de 29 6a e2 95 9c 0f ec 9a 95 f0 e3 14

So where does "9a 95 f0 e3 14" come from?


texts: Method for getting encryption keys from U2F key

texts:
There are a number of questions on this site about how/can you use a U2F key to encrypt something. The main problems with doing this are that U2F keys were designed for authentication, so all they can do is sign data. We could try using this signature as a key (after passing it through a KDF), except that their signatures incorporate randomness, and are different every time when signing the same data.

But this blog post talks about one way to do it. Now my curiosity is piqued, and I'd like to know whether this would work. (Or at least some other viewpoints)


texts: Multiple sender single receiver Encryption

texts:
I had this article given to me by my teacher, and I would like to enhance it.
It's titled Modified El Gamal Algorithm for Multiple Senders and Single Receiver Encryption.
I planned on having the algorithm accommodate multiple senders and receivers.

But I got really confused, and I would like to ask for some help in the encryption part of this modified algorithm.

[Key Generation]

receiver generates {P,g,a}, and sends {P,g,b} to public(?) for the senders to get.
P = prime
g = generator
a = private key of receiver
b = g^a

[Encryption]

Sender 1
generate R1 (private key)
computes c11 = g^R1

Sender 2
generate R2 (private key)
computes c12 = g^R2

Sender 3
generate R3 (private key)
computes c13 = g^R3

Message(m) is encrypted using this formula:

c2 = m*b^R2 / b^R1*b^R3

The cipher keys {c11,c12,c13,c2} are then sent to the receiver.

[Decryption]

m = c2*c11*c13 / c12

I would like to ask: how did the other senders get hold of the private keys of the other senders? I think I'm missing something.


texts:
RFC 4253 "The Secure Shell (SSH) Transport Layer Protocol" states on page 18:

  server_host_key_algorithms
     A name-list of the algorithms supported for the server host
     key.  The server lists the algorithms for which it has host
     keys; the client lists the algorithms that it is willing to
     accept.  There MAY be multiple host keys for a host, possibly
     with different algorithms.

My question is,
In RFC 4253, "encryption_algorithms" is used for symmetric encryption and "mac_algorithms" is used for integrity protection, but what are "server_host_key_algorithms" used for?

I read RFC 4253, but still can't find possible uses for the algorithms.


texts: SHA256 HMAC brute force with chosen plaintext attacks

texts:
This is a follow up to Is It Possible To Reconstruct a Cryptographic Hash's Key

I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length is 128 bits, it does not change. The "word" is literally one short word.

Assuming an attacker knows "word" and "output" for multiple words (e.g., dog = "dsfwrw3r3r323211", cat = "3erwerwetwewer"):

Is it significantly easier for an attacker to identify the private key by brute force with the above word/output pairs, as compared to a situation where they do not have those pairs?
Is this brute force vulnerability (with word/output pair knowledge) an actual security concern?


texts: Are there any cryptographic methods which use multiple cyclic groups?

texts:
For some cryptographic methods you can construct them. e.g. elliptic curves (product of two cyclic groups) or Diffie–Hellman (can be product of n-cyclic groups). But they have no usage because at a possible attack you can reduce the problem to a single group.

So is there any cryptographic method which benefits (or equal) from multiple cyclic groups?

Interested in general but best case would be if their individual group size should somehow be changeable, independent and not too small. Their product should be the whole group size or a constant times bigger. The group number should be finite. In best case 3 or not that much more.

Given two group elements it should be unknown (hard to compute) how to compute one out of he other. The attacker has access to the program during runtime. He only don't know how those two elements were generated.