texts: Flaw in the security definition of *Stateful* Authenticated Encryption?

texts:
I'm in search of the correct definition of a stateful authenticated encryption scheme (sAE), and its related security notion. This has been treated several times in the academic literature, however, all the papers I've read contains a discrepancy between how they state the security goal in informal English and their formal security game. In particular, their formal specification of the security game always contains a flaw that allows for a trivial win for the adversary.

Formally, a sAE scheme $\mathcal{SE = (K, E, D)}$ consists of three algorithms, a key generation algorithm $\mathcal{K}$, an encryption algorithm $\mathcal{E}$ which is both randomized and stateful, and a decryption algorithm $\mathcal{D}$, which is deterministic and stateful. The encryption and decryption algorithms are subject to the correctness requirement that if they both start in the initial state, and for $i = 1, 2, \dots,$ if $C_i = \mathcal{E}_K(M_i)$ and $M_i' = \mathcal{D}_K(C_i)$, then it must be that $M_i = M_i'$ for all $i$.

The first paper to formally define a notion of security for sAE was Bellare et al in Authenticated Encryption in SSH: Provably Fixing the SSH Binary Packet Protocol.
They define the interaction between the encryptor and decryptor to be in-sync, if at any point in time, the sequence of inputs to the decryptor is a prefix of the outputs of the encryptor. They are out-of-sync if they are not in-sync. This is their informal statement of the security game capturing stateful privacy IND-SFCCA (note that this paper splits the security of an sAE scheme into an individual security requirements for privacy and one for integrity, whereas later papers merge these into one combined game. The game formulations are still very similar, and are also equivalent in terms of security: Appendix B):

And this is their formal definition (Appendix A. Def. A.2):

The flaw: In the formal definition, the $\mathcal{D}_K$ oracle returns something other than $\perp$ if: (1) $j > i$ i.e., $C$ is a proper out-of-sync message or (2) $C \neq C_v$, i.e., the submitted ciphertext was not the latest ciphertext output from the encryptor. Notice a flaw with this?

Assume the attacker first asks his $\mathcal{E}_K$ oracle for some messages $M_1, M_2, M_3$, say, and are given back $C_1, C_2, C_3$. He then calls $\mathcal{D}_K$ on $C_2$. Notice that $i = 3$ and $j = 1$, so (1) is not true, but (2) is, since $C_2 \neq C_1$. Hence we enter $\mathsf{phase} = 1$, and the adversary receives the decryption of $C_2$ and can trivially win the game.

Now you might simply dismiss this as a trivial "typo"/oversight, and that the authors really meant to write something equivalent to their informal description. However,
this security definition, with the same flaw, has been repeated in several other papers by different authors:

On the security of TLS-DHE in the standard model (Def.5, Fig. 1 and Fig. 4)
On the security of TLS-DH and TLS-RSA in the standard model (Def.7 and Fig.1)
On the security of the TLS protocol: a systematic analysis (Appendix B.1, and Fig. 6)

In addition, you have the paper by Brzuska et al Less is More: Relaxed yet Composable Security Notions for Key Exchange, who provides a summary of the above definition (Def.16, p. 29) in their own (and different) framework, recreating the same flawed behavior!

So what's going on here?


texts: Is the proof-of-work algorithm "Quark" insecure?

texts:
I recently found out about Quark here: https://en.bitcoinwiki.org/wiki/Quark_Algorithm

Apparently it is a proof-of-work algorithm used by several cryptocurrencies and is based on a single-level hash function, which consists of 9 different levels of encryption by six cryptographic algorithms. It also says that Quark provides a "64-bit" protection against hackers.

Isn't 64-bits of protection considered rather insecure? I'm sure a hacker with sufficient computing power can break 64-bits of security given enough time and money. Or am I missing something?


texts: Securing and authenticating messages is easy thanks to computers. Lately I've been thinking about something like Vigenère cipher with a OTP, how secure it is, and how easy it is to implement without the aid of computers. However, one thing it doesn't provide is any authentication. Decrypting a Vigenère cipher with pen and paper is trivial, but hand calculating HMAC-SHA256 is not something I'd like to attempt. Are there any authentication schemes which are simple; easy to compute without the aid of a computer? Any chance any of those schemes actually provide decent security?


texts:
It is a well-known fact that using the same key + nonce combination with a stream cipher twice breaks security. The NaCl library has different primitives for authenticated encryption (i.e., xsalsa20poly1305 and aes256gcm) and its website warns:

  Beware that some of these primitives have 8-byte nonces. For those primitives it is no longer true that randomly generated nonces have negligible risk of collision. Callers who are unable to count 1,2,3,..., and who insist on using these primitives, are advised to use a randomly derived key for each message.

Now, I'm wondering: what is a randomly derived key ?

If I use Argon2i to derive a key K from an user-entered password and random 32-byte (256 bits) salt, is the key K a "randomly derived key" ?


texts:
What is the correct way, if any, to do Multi-Prime DH?
From security point of view, is there any benefit to do it?
Multi-Prime is not about multi participants.
Multi prime is when we use two or more prime numbers and multiply them to get the modulus part in DH.
It is faster to find four 4096 bit safe primes and multiply them than to find single 16384 bit safe prime.
The question is if a multi-prime will yield valid and secure key exchange procedure.
And if so, what will be the procedure to get good g and p.


texts: Boneh DDH Paper - Sampling Integers in Random Reduction

texts:
I've been reading Dan Boneh's DDH paper, in particular section 3.1 which covers DDH randomized reduction.
The first two sentences of theorem 3.1 state: Let $\Bbb G = \{G_p\}$ be a family of finite cyclic groups of prime order. Let $s(p)$ be an
efficiently computable function such that $|G_p| \leq s(p)$ for all $p$.
If I understand this correctly, for a given group in practice we can set $s(p) = p$ if we know the order of the group.
In section 3.1, he describes a statistical experiment in which you can construct a DDH triplet or a random triplet from an existing DDH or random triplet respectively by sampling integers $u_1, u_2, v$ from the range $[1, s(p)^2]$ and following the formula given.
I am struggling to understand the purpose of sampling in the range $[1, s(p)^2]$. Why not just sample from $[1, s(p)]$?


texts: How does AWS service verify the identity of the sender?

texts:
My question is regarding to :
How does AWS Secret key and access key work

The point 5:

  AWS service verifies the identity of the sender and integrity of the message by recomputing the HMAC code.

How does the service verify the identity of the sender?
Does the AWS service know the secrete key? if so how does it get it?


texts:
I'm playing around with the CryptoPP library with DES/CBC and I've noticed that for some sets of data, if I decrypt the ciphertext with Key1, IV1, I get a good cleartext result -- but if I decrypt the same ciphertext with Key1, IV2, I get the identical good cleartext result.

I find this very surprising.  So much so, that I think I'm doing something wrong.

I want to check my assumptions: I've been under the impression that changing even 1 bit of the IV will alter the decryption result.  Is this not true?

Is there such a thing as an "equivalent" IV?


texts: Proving the knowlege of e-th root in an non-interactive way

texts:
Just like in this question: Protocol for proof of knowledge of $l$-th root

I want to prove that for $u^e = w$ I know $u$ without revealing it.
Three other requirements are:

e is small (65537)
The proof has to be non-interactive
The proof should be as efficient as possible (not several megabytes)

EDIT

So the best solution I have come up so far is to use the Guillou-Quisquater protocol together with a Fiat-Shamir heuristic to make it non-interactive.
This would work the following way:

The prover

Step 1.

The prover generates 10 numbers $T1,T2 ... T10$ where each number is calculated using the following formula and where $r$ is a secure random number:

$T = r^e$

Step 2.

calculate a hash $m' = h(T1||T2 ... T10||m)$ where $m$ is the message or challenge the prover wants to sign.

Note that if the hash contains 2 successive zero bytes or a zero byte followed by a byte of the value 1 of which the probability is low the prover has to go back to step 1 and generate new T numbers

Step 3.

The prover selects the 160 leading bits of the hash and splits them into 10 pairs of 16 bits numbers $d1,d2 .. d10$. Then for each of those 16 bits numbers calculates $t1,t2 ... t10$ such that

$t = u^d r$

Note that in this case to calculate $t1$ the prover will use the random number $r$ that we used to calculate $T1$, for $t2$ the number $r$ used in $T2$ and so on.

Step 4.

The prover publishes the signed message $m$, the hash $m'$ and the numbers $t1,t2 ... t10$

The verifier

Step 1.

The verifier starts by splitting the leading 160 bits of the $m'$ hash into the 16 bits number $d1,d2 .. d10$ then calculate the values $T1,T2 ... T10$ from it:

$T = t^e w^{-d}$

Step 2.

Using the T values calculated in the previous step verify that $m' = h(T1||T2 ... T10||m)$ if this verification holds the proof is correct.

I do believe that doing this with 160 bits (proof with ten 16 bits numbers) is very secure, but what about doing it with 80, 96 or 128 bits?
Is there another way to improve this implementation or is there an error in it?


texts: Is clientside encryption to hide data from server safe when using SSL?

texts:
I want to clarify right off that bat that I am using the SSL/TLS protocol on top of this, so I am NOT trying to implement my own protocol to send data securely. I simply want the server to be unable to read user data.

I'm trying to implement a web application that stores sensitive data. I was thinking about using some public key derivation function to generate two keys from a master password, the first key is sent to the server for verification, and the second key is kept in the browser, and is used for symmetric encryption/decryption, like AES.

The server sends the encrypted information, and JavaScript is used to decrypt that data with the second key.

I've read a lot of sources saying that clientside encryption, especially in-browser with JavaScript is very insecure, but I fail to see what insecurities this method could possibly have.

I really want to cover all my bases, so I just wanted to know if this method is still secure, and if it isn't, what I should do instead.


texts: Forward Secrecy with pseudorandom functions

texts:
Let $H_1$, $H_2$ be keyed hash functions (e.g. $H_i(x) = SHA_{256}(s_i||x)$ for pseudorandom $s_1$, $s_2$).

Let $s_n = H_1^k(s_0)$, $k_n = H_2(s_n)$, where $s_0$ is a secret (pseudorandomly chosen from a distribution).

Is using $k_n$ as a sequence of forward-secure keys secure (i.e., forgetting $s_n$ when changing to $k_{n+1}$), noting that $H_i$ are known to the attacker?

It seems that not being able to distinguish $k_n$ from random, knowing $s_{n+1}$, $k_j$ for $j<n$ is enough. When $H_i$ are modeled as random oracles, it seems that attackers would require $\Omega(2^K/n^2)$ oracle requests on average for this (where $K$ is the key length of $H_i$), because we lose a factor of $n$ on the reduction, and as long as the attacker's guesses are disjoint from $s_j$ ($j$<$n$) the attacker gains no information.

Is this intuition correct? Can you get a better bound (although $\Omega(2^K/n^2)$ is good enough, given that $n << 2^{64}$ and I am using SHA-256 for a 128-bit security level).


texts: Is a Test Vector feature a Security Hole?

texts:
I have a system where a block cipher key (likely AES) is entered via a 'command line' over a serial console, probably as hex. The system has no 'print key' feature, so the key is hopefully 'ingest only'.
I was considering offering a 'output of known test vector V with new key K and known/fixed IV is X', where X is printed over the console.  This would give the key installer confirmation that the key had been transcribed correctly, since they would compare X with a pre-computed version. V could be e.g. the standard AES test vector 00 01 .. 0F. Its length would be 16 bytes, matching the cipher's block length.
So, although the key itself is not readable from the system, an output that USED the key is, in X. V is then a 'known plaintext'.
Is such a feature a bad idea? Does it allow an adversary, who might snatch the system, to obtain the key any faster than if the feature had not been present?
For now, I don't want to consider any other avenues the attacker might have to physically break into the system, I just want to consider the known plaintext question.


texts: Key Agreement between two nodes of a Wireless Sensor Network

texts: Can there be a way to form a shared secret key between two nodes of a Wireless Sensor Network who are more than one hop away, simply on the basis of their IDs?


texts: How to calculate entropy of output of a PRNG

texts: Suppose the entropy of seed key is $H(n)$ which is $n$-bit long and random and the output bit length of the PRNG is $2^n$, which will be used as a long running key. Though it is obvious in that case, as output key sequence of PRNG is derived from input seed key, so entropy of output key sequence of PRNG never exceeds the entropy of the seed key. $H(2^n) \le H(n)$ in this scenario but how to prove it?


texts: Can RSA (theoretically) be used as a block cipher?

texts:
Assume AES gets a devastating attack making it unusable. Is it possible to use RSA in a secure way that can encrypt data in bulk?

I can't see how RSA (assuming OAEP padding) can be used in normal block cipher modes. Its output is likely not pseudorandom, so it can't be used in CTR, OFB, or CFB mode. Its output is too large to be fed back in, so it can't be used in CBC mode. Using it in ECB mode would have the problem that blocks can be moved, duplicated, deleted, and replaced just like if you use ECB on a normal block cipher.

I've seen this sort of thing asked before, but the answers are always along the lines of "RSA isn't a block cipher, so you shouldn't". This won't be used in practice, it's just a thought experiment.


texts: Encoding multiple fields with same AES key and vector?

texts:
I'd like some advice on cryptography best practices. I need to store on my web app the users' credentials (login & password) for 3rd-party sites.

I'm using AES-256 with random key and initialization vector (provided by the Net 4.5 framework, if that's relevant), and store the encrypted data in completely different system than the key and vector.
Along with the encrypted data record there's the id of the key/vector record in the other system. My question is, is it OK to use the same key and vector to encrypt the login and the password, which are encrypted and stored separately? Or that's a vulnerability and I absolutely need specific key/vector for each?


texts:
I am trying to solve this question and I have no idea how to find the value for $q$. I know that I am supposed to find the probability of $q>3q/512$ in terms of the equation $q$, but not sure how?

Any help is appreciated.

Alice has a function $$F: \{0, 1\}^k × \{0, 1\}^n \to \{0, 1\}^n$$
 that she intends to use as a PRF. However, this $F$ has a serious weakness: for any fixed key $K$, if we pick a random
message $$x \leftarrow \{0, 1\}^n$$, then the first byte of FK(x) will be $0^8$ with probability $1/128$, instead of the
desired probability $1/256$.

Adversary Eve wants to break the PRF security of F., Of course, it’s trivial to have advantage 1/128−1/256 =1/256 using just a single random query. However, being greedy, Eve aims for more. She makes q random
queries x1, . . . , xq to the oracle Fn to receive answers C1, . . . , Cq.

Let T be the number of ciphertexts
Ci whose first byte is 0^8
. Note that in the real world, E[T] = q/128, whereas in the ideal world, E[T]is much smaller, q/256. Based on that observation, Eve will output 1 if T ≥1/2[q/128 +q/256] =3q/512, and output 0 otherwise.
How big should q be so that Eve’s advantage is at least 0.99?


texts: How did someone discover N, order of G for SECP256k1?

texts:
Could someone please explain, in simple and easy terms, how the creators did (or should have) derived the N, order of G for SECP256k1?

Its my understanding its derived from

p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F

aka

p = 115792089237316195423570985008687907853269984665640564039457584007908834671663

and that the value itself, of N is

N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141

aka

N = 115792089237316195423570985008687907852837564279074904382605163141518161494337

I understand that (N-1) is the total number of valid points on the curve, but how was that determined without going through and trying to count them?

I have seen similar questions, but the answers are either using terminologies I don't understand and or don't contain a "simple" and "easy" explanation.


texts:
I am studying about RO model and just got this question that what are the factors that make it not possible to instantiate a RO with a Hash function. To give a reference on how far I know about them and other specification, I've followed this series of blog posts, so far. So, e.g. I know that one factor is that a RO size is exponentially grows on input but is this the only factor that one cannot instantiate it in the real world?

(hash functions are deterministic functions whereas RO is a random one, is this the most significant factor?)


texts: I know monoalphabetic ciphers are weak, but my message recipient doesn't like taking the time for the decryption process. I've tried Vigenere, Gronsfeld, Beaufort and Digraphic Ciphers, but he doesn't decrypt them. What is a good choice for speed and enough security against novice cryptanalysts? One-Time-Pad is highly impractical, and Solitaire takes too much time, what is the best bet? Your suggested answer gives me systems that are impractical and slow. I don't need high security, merely simple yet strong ciphers not mentioned above.


texts:
Can anyone show me a simple proof of work algorithm that I can use to stop spammers? I've looked at hashcat, but i think there's a bit too much specialized hardware for bitcoin mining.

That is, the time required to calculate one proof of work on a mobile device cpu is way too long compared to a bitcoin mining rig using asic-miners.


texts: How to design a moderated, group for private messages?

texts:
I’m trying to figure out how I could create a private group that was P2P yet still allowed someone to moderate members (no public access to messages). I’m assuming standard hybrid encryption (RSA/EC + AES) for actual messages.

I am thinking about having the owner create a master group keypair, then create a new subkey that is shared with all the group members. When the membership changes (user joins, leaves, banned) then the old subkey is revoked by master and a new subkey is sent out to all (currently valid) members.

Then when members want to share messages they simply send them to the group subkey with a signature from their own key so we know which member sent the message. People outside the group can’t read anything.

It would also be important to have transcript consistency: the assurance that all members of a conversation are seeing the same messages and in the same order. This would be harder if the individual members are all messaging each member separately (using the individual member keys). That was my reasoning for the shared group key which would have a shared storage location.

In order to minimize sending the new keys to the whole group on every membership change, logical key hierarchy (LKH) (a B-tree where every member is a leaf) can be implemented.


texts: In RSA, encryption time is usually much less than decryption time due to having a small public exponent. Can this be achieved in Elliptic Curve Crypto (ECC)?


texts: Secret key model for a compression function cryptanalysis?

texts:
How do we analyze the security of a compression function in the secret key model? More formally, let $H$ be a hash function and $F(IV,M)$ its compression function. Suppose we generate a MAC as follows:
$$
T=F(F(K,M),M_p),
$$
where $K$ is the MAC key and $M_p$ is the padded block. Can I say that if one observes the output of the inner compression function call, i.e., $F(K,M)$, and retrieves $K$, then this is a certificational weakness of the underlying compression function? (we do not consider it in any specific protocol)


texts: Is it dangerous to encrypt lots of small files with the same key?

texts:
I want to encrypt 1000s of old files on old hard drives before uploading them to the cloud. I'm planning to use AES-GCM with only one or a few keys. (I'm using Apple's CryptoKit library which provides this algorithm and a few others.) It would be convenient to encrypt and store the files individually, so I could download and decrypt them individually. Is this bad practice? I'm wondering if having many small examples of ciphertext could give an attacker an advantage.
A bit of background on my goals: I travel a lot and work with a laptop. Where some people would use an external drive, I want to use the cloud because 1) I don't want to be carrying around external drives, and 2) I want online storage in case of theft or damage to my devices.
I said "one or a few keys" because I don't want to store (in Keychain) or remember tons of keys. But if there is another way to generate multiple keys from a password or master key - appropriate to this situation - then I'd like to know about that.
I should break this into two sub-questions about two similar situations:
Situation 1: Lots of individual files, but no names or directory structures visible.
So an attacker sees a drive full of stuff like:

file0000001.enc             20 KB
file0000002.enc            123 KB
file0000003.enc         600 bytes
file0000004.enc             1.1MB
...

Situation 2: The directory structure, or maybe even file names, are preserved. So if something standard like an OS config directory were encrypted, the attacker would know some or all of the plaintext for some example files.
/personal-files/foo.txt   500K
...
/etc/http/httpd.conf       21K    -- a common file, could guess some or all of the plaintext
...

So, are either of these a problem? Or are they safe with AES-GCM (or a similar recommended algorithm)?


texts: How to be able to change the password to access data encrypted with AES-GCM, without reencrypting?

texts:
Let's say you need to encrypt plaintext which is 1 TB big.
You have a password pwd. This very classical AES-GCM process is applied (pseudo code):
salt = 16 random bytes
key = PBKDF2(pwd, salt, count=1000*1000)  # key derivation function
nonce = 16 random bytes
ciphertext, tag = AES_GCM_cipher(key, nonce).encrypt(plaintext)    # by blocks in reality
save to disk:
     salt | nonce | ciphertext | tag

Now if I suspect pwd to be compromised, and I want to change it to pwd_new, I have to restart the whole encryption process which might be long for 1 TB of data.
Question: which simple encryption scheme can I use, still using AES-GCM for the actual data, such that I can change the password without having to reencrypt/rewrite all the data?
(There are implementations of this for example in Microsoft BitLocker disk encryption, etc.)


texts: Is CBC still better than ECB if the key and a large part of the texts are random?

texts:
I am doing protection for my software, which involves storing a part of the crucial algorithm inside a smart-card based dongle. I will supply the input to the dongle, and I will expect the output of the dongle to be correct. If it's not then I know something is wrong.

The idea is that

First a random key is generated
Then I will encrypt my input using this random key, with ECB/CBC algorithm ( to be determined)
Then I will store both the key and the encrypted input in a random, much larger input stream. The position and the size of the key and encrypted input are indicated in the first two bytes of the input stream.
Once the input stream is passed to the dongle, the dongle will read out the key and the encrypted input and do necessary decryption, and then do the computation, and the output passed out.
The output will be encrypted again with the same (passed-in random) key, before passed out of the dongle.
The software side will then check the received output and decrypt accordingly.

Due to the nature of the protection, the hacker can only know the input/output stream to/from the dongle. He can't know what I do in the software, so he won't be able to tell what is the random key, and the encrypted input, and also the position and the size of the key and encrypted input.

I am thinking whether to use ECB/CBC for encryption algorithm. I am aware that ECB is less secure in general because if you encrypt two messages which has two blocks of plaintexts in common, then with ECB mode the corresponding ciphertext blocks will be the same. But in my case, even if my raw input is the same, what the hacker sees looks quite random because

The key is random
Both the key and the encrypted input are stored in random input streams.
The actual, meaningful unencrypted input size is quite small compared to the random input streams that the hacker has accessed to, less than 64 bytes ( 8 blocks). So there isn't too much of same text for the hacker to guess ( not sure about this point)

Also, both of the ECB/CBC contains only one secret key, and the only way how CBC "improves" over ECB is that it applies a random initial vector on the inputs, but I think this "improvement" can be nullified by random key/much bigger random input stream, no?

So I wonder whether CBC really improves over ECB in this case, and whether is there any need to use CBC or not.


texts: How to find the decryption algorithm for this encryption scheme?

texts:
$\mathrm{KGen}(\kappa)$: Let $(\mathcal G, g, q) \gets \mathrm{GenG}(\kappa)$ be a cyclic group of prime order $q$. Choose random generators $g_0, g_1 \gets_R \mathcal G$, random exponent $x \in_R \mathbb Z_q \setminus\{0\}$, compute $h = g^x$, return public key $pk = (\mathcal G, g, q, g_0, g_1, h)$ and private key $sk = x$.

$\mathrm{Enc}(pk, m)$: Parse the 2-bit $m$ into its bits $m_0m_1$. Choose random $r \in_R \mathbb Z_q$ and return $c = (c_1, c_2) = (g^r, g_0^{m_0}\cdot g_1^{m_1}\cdot h^r )$.

Given this key generation scheme and this encryption algorithm, how can I find the decryption algorithm $\mathrm{Dec}(sk,c)$?


texts: Why is using an authenticated AES mode better for in-place data protection?

texts:
I always see people warning not to use unauthenticated modes of operation like CBC for AES . Why is that so ? I mean if you use  AES-CBC with a random IV you will most likely secure your data . So for what do you need MAC / authenticated modes like GCM for your files . If you cant assure that your data is tampered with on your own hard drive you are screwed anyway .

EDIT :

This question was about in place encryption . I understand the relevance of Authenticated stream ciphers like GCM in the context of sending data .


texts: Corner cases of addition on short Weierstrass elliptic curves

texts:
I am trying to implement arithmetic over points on a short Weierstrass elliptic curve and I have trouble with corner cases of the points addition operation. Let me specify the parameters of the curve and what is the problem exactly:

As a test curve I use Bitcoin elliptic curve $y^2 = x^3 + 7$
For testing purpose I do integer arithmetic $x\bmod 11$ to keep it simple for debugging purpose
I do arithmetic exactly as specified herein Wikipedia

The problem I have is with doubling of the point $(5, 0)$. In the doubling formula, there is a modulo inverse of $y$ point coordinate, that clearly doesn't exist for $(5, 0)$ since $y=0$. So my questions are:

How am I supposed to handle this case?
Is $x$ or $y$ equal to $0$ even allowed when doing math for short Weierstrass elliptic curves?
What is the exact list of corner cases that need to be handled when implementing an addition for short Weierstrass elliptic curve

Currently, my implementation has the following branching in the following order:

If one of the arguments in addition operation is the point at infinity, the other argument of operation is returned as the result
If one of the arguments is equal to a negative of the second argument result is the point at infinity
If arguments in addition operation are equal to each other then doubling formula is used as specified here in Wikipedia
Otherwise a basic addition formula is used as specified in Wikipedia

Negation is done by simply negating the $y$ coordinate with the exception that the negation of point at infinity gives back the point at infinity.
How far is this list from being complete? What else needs to be handled for this type of elliptic curve?
For those of you terrified by the fact that some noob is implementing math of an elliptic curve himself have no fear. This is not for practical crypto application, this is just a fun home project, the goal is to understand rather than to get a crypto-ready implementation :)
UPDATE: I used the comment of @corpsfini to update the routine and it turns out that I had an implementation flaw cause with $(5, 0)$ we have a case 2 of my branching scheme since $(5,0)$ is equal to negative of itself. So I fixed the bug and now all the unit tests work fine for $\bmod 11$ and some other random small groups. However the question remains, is it all that's out there? The SafeCurves web site warns that there are some failure cases that might not be disclosed by the random tests and that it's really hard to get them right. What I've coded up so far doesn't seem to be complex at all, yeah a bunch of if/else statements, but not something that I would call hard to get right. I expect that there is something else. Does anybody have an idea?


texts:
I am looking for a scheme to generate and validate cryptographically secure product keys. My requirements are:

Unforgeable. It must be impossible (or at least very hard) for users to forge a product key.
Short. Users may enter product keys by typing so they must be convenient to enter. 128 bits can be encoded using 26 base-32 characters, which is probably close to the maximum that users will type comfortably.
Payload. The keys must be able to carry a limited amount of arbitrary information. For example, this might be flags about enabled product features. 32-bits of payload should be sufficient.
Numerous. There must be a large number of valid (but difficult to guess) product keys for the same payload.
Unique. The product key generation process must generate distinct product keys for the same payload, when invoked multiple times.

In the following I consider only symmetric key schemes. A public key scheme is not necessary in my case because key generation and validation is done on the server, thus there is no need for public/private keys.

I have considered a number of different schemes, but I have found all of them wanting. The main issue is the shortness of the product key.

The obvious first choice is to create product keys of the form

nonce || timestamp || payload || HMAC(K, nonce || timestamp || payload)

The nonce || timestamp ensures that there are numerous unique product keys. HMAC is a secure MAC thus guaranteeing unforgeability. A payload is included. The only issue here is the length of the product key.

Recall that all this needs to fit in 128 bits. Even if we truncate the HMAC to 80 bits (the recommended minimum), this leaves only 48 bits for the nonce || timestamp || payload component, which is clearly not enough (the payload alone requires 32 bits).

Another choice is to create product keys of the form

AES-ECB(K, nonce || timestamp || magic || payload)

Here we use magic to enforce unforgeability. Clearly this is suboptimal, unless we make magic very long. If magic is short it is quite easy for an attacker to keep guessing product keys and feeding them to the validation server to see which ones pass (let's assume for now that the validation server has no countermeasures such as throttling).

The problem is that the nonce || timestamp part also needs to be very long to avoid problems with the use of ECB mode. Ideally it should be at least 80 bits, but perhaps we could get away with 64 bits. This would leave only 32 bits for magic, which I suspect would make this scheme weak.

I have also considered other alternatives, but I have not arrived at a satisfactory solution. I would love to hear any feedback you may have.


texts: Is a good idea to generate a public key from a secret key using a functional encryption scheme?

texts:
FE - functional encryption

PK - public key

I want to design a PK cryptosystem that has a unique PK for each encryptor. Namely, the encryptor submits a unique value (or an attribute) to the private key holder, and the private key holder generates an encryption of the PK cryptosystem private key as well as a secret key for the FE scheme.

The encryptor can then produce its unique PK using the following FE scheme's modified primitives:

$FE.KeyGen(msk, A, x): outputs$ $sk_{x,A}$, where msk - master secret key of the FE scheme, A - atribute of the encryptor, and $x$= a random value

$FE.Encrypt(msk, y=PrivKey):outputs$ $ct_y$, where PrivKey is the private key of the PK cryptosystem

$FE.Decrypt(sk_{x,A}, ct_y):outputs$ $x*y=x*PrivKey$.

For what I need it is important that the $PrivKey$ to remain  hidden as well as the product $x*PrivKey$. That's why I called for attribute A. I hope that only the user with attribute A would be able to obtain the product $x*PrivKey$ and nobody else. The problem is that what I want to do,the secret key $sk_x$ would have the same form so I need to customize the decryption and to allow only the target user to decrypt it, based on attribute A. The secret key $sk_x$ would be the same for all users, but if I use an attribute, I can obtain $sk_{x,A}=sk(x,A)$, and by modifying decryption primtive I insure that only the user with attribute A can decrypt.

Is this secure ? Behind having infinit public keys, for each user, what are other drawbacks and how can they be mitigated ?


texts: differential cryptanalysis on the second round of 4-variant DES

texts:
I am using differential cryptanalysis to attack the second key of a 4-variant DES and I am using Shamir and biham book as a reference .
they say that we should choose two input Xor P3 and P4 that satisfy the following conditions:

the expansion of the right half of the input Xor does not equal zero for all the S-boxes using either P3 or P4 .
the expansion of the right half of the input Xor P3 does not equal its corresponding of P4 , for every S-box.

what is the best way of choosing P3 and P4 so that I can get K2 correctly
for every bit?


texts: How to decrypt plain text x using man in the middle attack

texts:
Suppose Alice want to share a plain text $x = 5$ to Bob; using RSA, DHKE, and El-Gamal.

My question is if Man-in-the-middle attack is applied then weather oscar can compute/decrypt plain text in all of the algorithms if yes then let me how Oscar will decrypt the plain text using the following information

In RSA: $p= 3, q=11, d=7, e=3$
In Elgamal: $\alpha= 2. p=29$, Alice key $A=3$, Bob Key $B=7$
In DHKE: $\alpha= 2, p=29$, Alice key $A=3$, Bob Key $B=7$

Please let me how Oscar will get the plain text $x = 5$


texts: It seems that Shortest Vector Problem in a lattice  is NP hard. Then how Ajtai-Kumar-Sivakumar (AKS) algorithm solves it? I mean, what is the witness?


texts: How does error distribution affect security in lattices?

texts: It's easy to see that the crucial part of any lattice scheme is the added error. And different schemes seem to use different error distributions, some use Gaussian some use centered Binomial. Though, what do we know currently about the different error distributions used in lattices? I mean which one should be used when, and how does it affect the security of a lattice scheme? What are some important results that specifically study the effect of the error in lattice schemes?


texts:
I have to derive master key from N secret key. With the help of master key, i can collect all the secret keys which is used to derive master key.

key1, key2,..keyN ==> single master key

and

single master key ==> key1, key2,..keyN

is this even possible??


texts:
I read a paper about a nonlinear invariant attack that is Y.Todo et. al's "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64"

In this paper's Appendix A., they said that

  Then, by Gaussian elimination like computation, we compute matrix $M'=[M_1'\|M_2']. $ If rows of $M_2'$ are $[0,0,...,0]$ or $[1,0,0,...,0]$, the corresponding row of $M_1'$is the basis of $U(S)$

I wonder why that is the basis of $U(S)$.

In my thinking corresponding row of $M_1'$ such that the row of $M_2'$ are $[1,0,0,...,0]$ or $[0,1,0,0,...,0]$ or $...$ or $[0,0,0,...,0,1]$ is the basis of $U(S)$.

Can you show me why "If rows of $M_2'$ are $[0,0,...,0]$ or $[1,0,0,...,0]$, the corresponding row of $M_1'$ is the basis of $U(S)$" is right.


texts:
For cascading encryption (ie. AES-Twofish-Serpent), the most secure implementation is with mutually independent keys. My question is if it is secure to hash the previous key for each layer of encryption. In my case, Serpent will be the innermost cipher and AES the outermost.
password = "my_hopefully_secure_password"
masterKey = argon2(password,...)
serpentKey = sha3_256(masterKey)
twofishKey = sha3_256(serpentKey)
aesKey = sha3_256(twofishKey)

ciphertext = aes(twofish(serpent(plaintext,serpentKey),twofishKey),aesKey)

In this case, an attacker would have to attack AES first, since it's the outer shell. Suppose that the attacker successfully found the key to AES and decrypted it. Now the attacker is left with Twofish and Serpent, but the AES key doesn't reveal anything because it's a hash of the Twofish key (hashes are one-way). If the attacker broke Twofish, they still wouldn't know Serpent's key because the Twofish key is only a hash of the Serpent key.
Is this secure?
Edit: Is this secure and does it provide 256-bit security? Would this scheme correctly implement cascading encryption and provide three layers of protection?


texts:
I read some similar questions like Simply put, what does “perfect secrecy” mean?
 (This one defines perfect secrecy as ciphertext conveys no information about the content of the plaintext.

Now, problem 2.3 on this assignment asks:

  show that perfect secrecy of $(GEN, ENC, DEC)$ implies $$\Pr [ENC_k(m) = c] = \Pr [ENC_k(m') = c]$$

Isn't the above equation saying that ciphertext $c$ gives no information whether it's $m$ or $m'$?

What is the exact definition of perfect secrecy then?

P.S. the assignment link above contains the solution. In the solution, I don't understand where the definition of perfect secrecy is used, nor what it is.


texts: Is OCSP multi stapling supported by OpenSSL?

texts:
can anyone tell me for sure if OCSP multi stapling is supported by/implemented in the current version of OpenSSL?

Those are the hints I found on the Web:

OCSP stapling now is supported by OpenSSL, see also a security note from 22 September 2016:
https://www.openssl.org/news/secadv/20160922.txt

Mailing list entry from February 2016 discussing it: https://mta.openssl.org/pipermail/openssl-dev/2016-February/005309.html

When looking on the GitHub project, you see a "status_request_v2" entry (the TLS handshake extension for OCSP multi-stapling):
github.com/openssl/openssl/blob/master/crypto/x509v3/v3_tlsf.c#L50

Does anyone have more insight into the current version of OpenSSL regarding OCSP multi-stapling?


texts: Can somebody explain the major contributions of the tenants of the Gödel Prize 2013?

texts:
As you may know, the Gödel Prize 2013 will be awarded this year to cryptographers (see this ACM press release). The people awarded are Antoine Joux, the team of Dan Boneh and Matthew K. Franklin.

Can somebody explain their contribution to cryptography ?


texts: How to store keypair generated by RSA in a textfile?

texts:
I'm trying to write an encryption decryption program using Openssl-RSA. There are only two operations. User stores the data and retrieves it whenever he needs.

To decrypt something, we need the keypair that was generated during the encryption. Where and how do I store this keypair so that I can access it whenever the user requests decryption of something (which was already encrypted by the user).


texts: Which party have to be online during garbled circuit-based MPC protocol?

texts:
Suppose that Alice, Bob and Charlie want to compute some functions without revealing each input to the function one another.
We can construct the protocols using garbled circuits by multiple communications among the three parties.

Assuming all the parties are semi-honest, which party do we need to let be online in the following setting?

The function $f$ is evaluated by taking the input values from Alice and Bob. After the communication between Alice and Bob, we get some result $a$ in Bob's hand (but Bob does not know exact value of $a$).

The function $g$ is evaluated by taking the input values from Bob and Charlie.
Bob takes as input $a$ to $g$.

Cleary, during the evaluation of $f$, Alice and Bob must be online.
Must Alice be online during the evaluation of $g$?


texts: If a hash function $H$ is collision resistant, is it true that $H(x)\neq H(x')$ for all messages $x, x'$ with $x \neq x'$?

texts:
I am puzzled with a question that seems to be based on theory.

If there is a collision resistant hash function (since it is not possible for a hash function to be collision free, this is a theoretical question),
would it be true to say that there are no two unique hash values for all possible messages $x$ and $x'$ where $x\neq x'$?

I feel like this would be true... Can anyone back me up on this?


texts: Convert affine to projective coordinates and vice versa in ECC?

texts:
I am working on a small project. An elliptic curve equation with y^2=x^3-3x+27 mod 43, a point $Q=(1,38)$, using point doubling method https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication#Point_doubling, i got $2Q(Q+Q)=(41,5)$. Now in projective coordinate $Q=(1,38,1)$ taking $z=1$.https://en.wikibooks.org/wiki/Cryptography/Prime_Curve/Standard_Projective_Coordinates

Calculating $2Q$, I get $2Q=(22,31,39)$ and converting to affine coordinate I can't get $2Q=(41,5)$.

So, where did I went wrong can anyone explain or am I following the wrong method??


texts:
I have a question about the calculation of RSA decryption with the help of the CRT (Chinese Remainder Theorem).

If $c$ is the crytogram, $m$ the message, $d$ the private key and $p, q$ the primes.
Then in RSA with CRT they use:

$m_1 = c^d \bmod p = c^{(d \bmod (p-1))} \bmod p$
with the help of  Fermat's little theorem (FLT).

But for FLT you need that $\text{gcd}(c,p)=1$
That is given if $c$ is less than $p$ because $p$ is a prime. But what is, if $c$ is bigger (because $c = m^e \bmod p*q$)? Then we can have $\text{gcd}(c,p)=p$

Does FLT also apply in this case? Or did I do something wrong?


texts: Elgamal problem on $\mathbb{QR}_p$ with $p$ a safe prime

texts:
I need some orientation to solve the following problem:

Let $p = 2q+1$ be a safe prime and $s(x)$ the smallest of the two square roots of $x$ modulo $p$. Then:

Determine the distribution of $s(g^{ab})$ for $a,b$ chosen uniformly in $\mathbb{Z}_q$.
Explicitly formulate Elgamal wrt $\mathbb{QR}_p$ modulo a safe prime $p$. Use $s(x)$ from above for Dec.
Let $G = \langle g \rangle$ be any group of prime order $q$. Determine the distribution of $g^{ab}$ for $a,b$ uniformly distributed on $\mathbb{Z}_q$.

My solution

1) It seems I have to study the distribution of  $ab \; mod \; q = c$. Because the mapping $s^{-1}: \{1,\ldots,\frac{p-1}{2}\} \to \mathbb{QR}_p$ is one-to-one and efficiently invertible. Since $g$ can be assumed to be a generator of $\mathbb{QR}_p$ then it is sufficient to study the exponents (each exponent will correspond exactly to one "smallest" square root.

Now, considering the possible $q^2$ pairs. There are $q+(q-1)$ pairs yielding a zero. For $c \neq 0$, one can fix $a$ and solve immediately for $b$ which yields $q-1$ possibilities for $c$. Adding up, we have $2q-1+(q-1)^2 = q^2$ as expected.

So the distribution is $P[s(g^{ab}) = i] = \frac{q-1}{q^2}$ if $i \neq 1$ and $\frac{2q-1}{q^2}$ if $i = 1$.

2) I don't currently see how to take $s$ into play here.

3) I believe the reasoning is equal to point 1).


texts: Why do crypto libs use table lookups when they're vulnerable to timing attacks?

texts: AESEngine.java, from  BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable to timing attacks. So why would they use them?


texts: Does Paillier Homomorphic Encryption Work only with numbers?

texts:
Paillier homomorphic encryption enables us to combine two messages such as

$D\left(E(m_1,r_1) \cdot E(m_2,r_2) \mod n^2\right) = m_1+m_2 \mod n$

My question is what are the specification of $m_1$ and $m_2$. Should they only be numbers (e.g., integers), or could they be textual information (e.g., "Hi")?

If it allows textual input for $m_1$ and $m_2$ how would the sum $m_1+m_2$ be retrieved for $m_1 =$ "hi" and $m_2 =$ "hello" for example.


texts: Lower bound of key space size with relaxed perfect secrecy

texts:
My apologies, I'm quite new to cryptography.

If we relax the definition of perfect secrecy such that
for cyphertext $c$, messages $m_0$ and $m_1$, and constant $E$:

$P[c|m_0] \le E * P[c|m_1]$

Using this, Can I prove a lower bound on the size of the key space as a function of the size of the message space?

I don't understand how I can know anything about the size of the key space without further knowledge of the encryption procedure used and the size of messages and keys.


texts:
Popular attacks on cryptographic hash algorithms are "birthday attacks" .
At high level ,

if a hash function produces $n$ bits of output, an attacker who computes only $2^{n/2}$ hash operations on random input is likely to find two matching outputs

Is the same true for HMAC ? Or are HMAC with any underlying Hashing (like MD5/SHA-2) prone to birthday attacks ? If not why not ?

Note : this question is not a duplicate of What are the implications of a birthday attack on a HMAC?


texts: Why is Boneh-Franklin IBE scheme secure? What should an adversary do to break it?

texts: Even after reading their paper I am still not able to understand why the scheme is secure and what an adversary should do to break it. This question might look stupid to most of you but I don't have mathematics background to delve this deep into cryptography.


texts: How Will Quantum Computing Change Cryptography's Future?

texts:
Quantum computing is at the intersection of math, physics, and computer science.

It seems so complicated that only large organizations could build such algorithms and have their own quantum computing devices and the other essentials to calculate such complicated equations.

If there is a major advance in the production of quantum computing science and its equipment becomes available to either hackers or intelligence services, can cryptography survive quantum computing?

P.S: If we could not upgrade to quantum or post-quantum signature schemes, then what happens?


texts: Is ecryptfs safe after unmounting but before turning off the computer

texts:
I've read that one of the vulnerabilites of ecryptfs is leaks to swap memory, and that the solution is to encrypt swap. But even if swap is encrypted, it's still open until I reboot. I've also read in this answer, from the designer of the ecryptfs crypto, that "eCryptfs makes no special effort to prevent key proliferation in memory". But I'm not sure if this means only while it is mounted/open.

Given the above I suspect ecryptfs doesn't guarantee that the key is removed from ram after unmounting, is that true? Does that mean that encrypted data is vulnerable between unmounting ecryptfs and rebooting?

The scenario I'm trying to protect against is one where an attacker has physical access to my running computer once, after I have closed my encrypted files. Is there a file based encryption solution for this scenario?


texts:
ISO 9564-1 format 4 describes an extended PIN block format. Simply said, this standard can be used to encrypt 4-digit PIN codes in a secure way.

The standard mentions (simplified) to add random values to the PIN, before encrypting it with a cipher that can be chosen by the implementer (we will go for AES-CTR).

I wonder now, if we follow this standard, and append a cryptographically random value to the PIN before encryption, do we then still need an IV for the AES encryption?


texts: Using last 64 bit of aes as hash of the message vs first?

texts:
If I Generate some key K for the AES algorithm. Encrypt a message M with key K and take the last 64 bits
of the result as the hash of M.

Would there be any disadvantages?
What if I took first 64 bits of the message rather than the last 64 bits?


texts:
I have two hosts, A and B. Host A gives host B a large piece of data and deletes it. Host A then needs to periodically confirm host B is holding the piece of data.

Before deleting the data Host A precomputes multiple HMACs with a CSPRNG generated random number (a salt). When Host A needs B to confirm the data still exists, it sends a salt to B, B then computes the HMAC returns it to A.

Is this cryptographically sound?

When computing HMAC(number, data) can you use an intermediate values instead of the actual data? Keccak is used if this affects the answer.

EDIT: Cross Referencing question on security stackexchange


texts: Meet-in-the-middle with checking complexity

texts:
In regards to meet in the middle type attacks, I have been considering the amount of operations in order to successfully find a key given two sets of plaintext / ciphertext pairs. All of the sources I have checked have stated that the maximum number of trials that are needed is $2^{n+1}$, however this does not seem to take into account the operations needed to validate key guess.

So taking 2DES as an example where one encryption has an effective key size of 56 bits. A meet in the middle attack against 2DES would need $2^{56}$ encryption plus $2^{56}$ decryption operations resulting in $2^{56}$ possible key matches. However each potential key match would then need to be verified on a second (or more) plaintext / ciphertext pair, adding another two operations to verify each match. The result is a maximum of $4 \times 2^{56}$ operations.

Is there a reason the checks are not included in this attack? Or is there a flaw in my thinking here?


texts:
I have some ideas floating around my head for exploring hashing functions, but I want to make sure what I think I know is actually true, before basing a house of cards on it :)

Let’s start with some things I’m reasonably sure of, but are still probably wrong:

A hash function is one such that for any given state $S$, and input bit $X$, we generate a new state
   $$S' = H(S,X)$$
This can be generalised into two functions, we’ll call them $F_a$ and $F_b$
   $$H[S,0] -> F_a[S]$$
   $$H[S,1] -> F_b[S]$$
$F_a(X) \ne F_b(X)$, for all values of $X$.
Selecting between different implementations for $F_a$ and $F_b$ each round is equivalent to just adding state bits
Hash functions that work with padded blocks of input rather than single bits are simply a performance optimisation, and can be replicated as a (more convoluted) single-bit hash by adding (blocksize-1) bits of “counter" state.
Any hash algorithm used for cryptographic purposes would be salted with a random initial state, and that not all state bits would be used as output (NIST SHA-3 is 2 state bits for every output bit).

These things I’m not so sure of. Given a state size of $N$ bits:

Recursive application of $F_a(F_a(F_a(F_a(S) \ldots)$ would ideally yield every possible value for $S$ before repeating

Ditto for $F_b$, of course they must be different sequences.
Mixing in length counter state or using a block mode is effectively an attempt to approach this goal

For all values of $S$, $F_a(S)$ and $F_b(S)$ would have ideally different but close hamming distances from $S$, and the average hamming difference between $S$ and $S’$ for both functions should be $\frac{1}2 N$
On average, the hamming distance between $F_a(S)$ and $F_b(S)$ should be $\frac{1}2 N$

I’m not sure if the above list of desirable qualities is correct, and I’m damn sure it’s not complete. I also think they may be contradictory.

Can anybody shed some light on my understanding, and let me know if I'm miles off-base?

Update:

Apologies for my inability to express what I mean more clearly! The answers and comments are a big help in seeing where I'm leaving too much out.
I shouldn't have mentioned the salt side of things, it's clouding the issue, as I was thinking of things like protecting passwords in stolen databases. Forget about the random start state :)
I understand that the high-level definition of a hash concerns an arbitrarily long input message, and also that current hash methods work on a combination of state and padded n-blocks of input. I'm trying to satisfy my intuition that this (and the required padding) are simply internal details, and could all be generalised into a bigger state and a 1-bit block size.
The reason for all this is because I'm going to do some exhaustive exploration of possible hash functions using small state sizes, to see if I can discover some general criteria for evaluating more practical large-state / large block hash functions - and also to satisfy my curiosity :)


texts: Prove that some Cyphertext C encrypts some plaintext D

texts:
I have a Paillier Cyphertext C and a counterparty that controls the keypair that was used to encrypt the data D to arrive at C.

How can they prove to me that the Cyphertext C is actually the encryption of a particular value, e.g. how can they prove that D=0 without giving me the secret key?

Equivalently, how can that counterparty prove to me that the decryption of C is some value V or not?


texts: Is sending encrypted message and signed message a secure way of transmitting data?

texts:
I know that the industrial standard is normally sending data in the following format:

Send Encr(msg, Sign(msg))

Is the following way a secure as well?

Send Enc(msg) and Sig(msg)

By secure, I mean no one will be able to read my message, and no one will be able to tamper my message.


texts: Why is Math.floor(Math.random()*9000) not secure in JavaScript?

texts:
I heard that one can predict the output from Math.Random() of JavaScript, but another day I had an idea to combine Math.random() with Math.floor() to make it harder to predict, but a week ago I saw one user claimed that he can predict even if I used Math.floor() and that only takes 14 sample values to do that.

How is it possible mathematically?

The concrete construction in question is Math.floor(Math.random()*9000)+1000.

Various API specifications are here and there. Per this answer most browsers use Xorshift128+, possibly derived from this C source code.

In this comment the OP suggests that the question is about "Chrome's V8 implementation" and links to a Chromium commit.


texts: Has threefish successfully been attacked (practically or theoretically)?

texts:
Reading Schneier's "The Doghouse: Crypteto" dated September 30, 2009, I noticed Bruce Schneier stating:

  Threefish, the block cipher inside Skein, encrypts data at 7.6 clock cycles/byte with a 256-bit key, 6.1 clock cycles/byte with a 512-bit key, and 6.5 clock cycles/byte with a 1024-bit key.

and

  I'm not claiming that Threefish is secure and ready for commercial use -- at any keylength -- but there simply isn't a chance that encryption speed will drop by half for every key bit added.

If I understand things correctly, "Skein" (with Threefish at it's core) was an SHA3 candidate. So I expect that Threefish has seen some cryptanalysis since 2009.

Can you tell me if Threefish has successfully been attacked yet (either practically or theoretically) and point me to the related paper(s) so I can learn about those attacks and related security implications?


texts: How can you determine the largest plaintext block size and smallest ciphertext size if you used RSA with $n=59768553302699443$ using an alphabet with $27$ characters?


texts: Authenticate a session initialisation request

texts:
Consider a system where two devices are connected via a wireless encrypted channel.  The channel requires manual pairing and the data passed over the channel is also encrypted using an ephemeral symmetric key.  Each exchange will occur within its own session.

How does the system authenticate the initial request for a session?

Is it adequate that the devices were manually paired to 'trust' a session initialisation request or are there more secure schemes that can be use to increase the odds that the session connection request is from a trusted source?

Thanks


texts: Is there a Javascript and Java implementation of a good CSPRNG

texts:
I need to use a cryptographically secure pseudo random number generator in my client running Javascript and in my server running Java.

Is there a well-known implementation of a good CSPRNG in both Java and Javascript?

If not, is there a pseudo-code description of a good CSPRNG I can implement myself in Java and Javascript?


texts: Is there any known malleability of scrypt outputs?

texts:
The scenario is single-use passphrase-based non-interactive message authentication.

The obvious try to do this is to chose a random salt of the appropriate length and send:

concat(workfactor, salt, message,
       mac(scrypt(workfactor, salt, passphrase), message)).

That protocol is as secure as scrypt is a non-malleable key derivation function (with regards of changing of workfactor and salt).

Is there any publicly known malleability of scrypt?
Are there any better protocols for this scenario?


texts: Attacking AES-128 with Grover's algorithm

texts:
How many plain text / cipher text pairs are required by Grover's algorithm when it is used to try and discover a secret AES key?

I am trying to determine if having a device which limits the speed at which it produces cipher texts from plain texts will help protect against this attack.


texts: Is there a difference in the security provided by a OTS vs a MTS or FTS? Or are they all just different ways of providing the same service?

texts: Is there a difference in the security provided by a One Time signature vs a Many time Signature or a Few time signature? Or are they all just different ways of providing the same service?


texts: Parameters for elliptic curve prime192v3

texts: I'm looking all over the internet for prime192v3's parameters. I think I may have found them here, but it doesn't say what variable each number matches to. Is there some central place where I can find this information?


texts: What are the coordinates of a generator point?

texts:
I'm browsing through Curve25519 code, the generator point of it is $G=9$.

I would like to know how can I get $x$ and $y$ coordinates of this generator point. Is there any standard way of representing x and y as a single scalar value apart from $x$ over $z$ notation?


texts: Non-linear phase that's Side channel attack proof

texts:
I'm designing a cipher and I'm looking for a Non-linear phase in my cipher that is side channel attack proof, I know that Sboxes are vulnerable to to that because of accessing the cache. I'm thinking of something like a 2 or 4 bit Sbox which is like 00->01 11->10 10->11 01->00 but I'm afraid it will be weak to Differential cryptanalysis. Is there a non-linear Side channel attack proof phases?
BTW: I'm using a hash for the key schedule, does it make the cipher more resilient to Differential cryptanalysis?


texts: A problem in secret sharing and mixed operators over $\mathbb{Z}$

texts:
Recently, I studied an article in which it was written that having $(A-B)\oplus C$ and $B\oplus C$, we cannot find $A$. The authors used this result to build a secret sharing scheme, but they did not provide any proof for this claim. In general case, is this claim correct?
Note that in special cases(as an example, in $GF(2^m)$), we can find $A$ easily(since $A-B=A+B=A\oplus B$).
Edit: I don't remember the exact link for my question, but the similar thing is in this paper.


texts: Secretbox- algorithm Poly1305 and cipher Xsalsa20

texts: I use Rclone, which uses Secretbox to authenticate and encrypt data. Secretbox uses the Poly1305 authentication algorithm and the Xsalsa20 symmetric flow cipher. This whole process takes some time (very short time, because it is a very fast cryptographic algorithms). I wonder how fast the Poly1305 algorithm and the Xsalsa20 cipher are. Simply what is the ratio of these algorithms, for example 1: 8 ... I would like to ask you if you have ever thought about this question and you can answer me in some way or help me in some way.


texts: Bitmasks or seed along with public key in WOTS+ post-quantum signatures

texts:
The state of the art hash-based post-quantum signature schemes, like Sphincs and XMSS, are using variations of WOTS (Winternitz OTS), like WOTS+, that require extra random bitmasks along with the public key.

Some history: These bitmasks were initially introduced from Dahmen et al. in order to build hash-based signatures out of 2nd-preimage resistant functions. The main benefit is that collision-resistance is not required and the signature schemes are NOT affected by the birthday paradox. The aforementioned allows WOTS+ to use hash functions with shorter output than original WOTS for the same security level.

However, a drawback of W-OTS+ compared to previous W-OTS variants is the increased public key size due to the inclusion of these bitmasks; even if we reuse the bitmasks, we still need a list of them. For instance this affects the Sphincs key size.
On the other hand, if I understand correctly, the XMSS rfc makes reference on a single SEED required, that will be used in a PRF to generate all required bitmasks.

That said, is it correct to say that we don't need to send a list of bitmasks, but a single n-sized SEED is enough?

Note that WOTS+ key compression using L-trees is out of scope. I know bitmasks are used there as well. This question focuses on the original WOTS+ scheme without public key compression.


texts: Can I save space for short messages by using encryption with private key instead of a signature?

texts:
Let's say I have a message, a Private Key and a Public Key.

Normally if you want to see if the message is unaltered and is from the sender you would have the message part + signature part, which you can verify using the senders Public key.

This will lead to some extra data, which I want to work around

[ message (1 kb) ] [ verification part (?? bytes) ]

My solution to this problem is to encrypt the message using the private key, and to decrypt it using the public key.

This way it should be certain that:

The message is unaltered
The message is really from the sender

In short:

Sender:
Encrypt Message using Private Key

Receiver:
Decrypt Message using Public Key

Is this safe? So is this a way to:

Check the senders identity (is it really from the sender (is it really signed by the Private Key))
The message is unaltered


texts: Is it possible to encrypt a user’s email in a zero-knowledge way and still send them emails?

texts:
This is kind of hypothetical, but let’s say I have a web app and I want to store a user’s email for sending notifications to.

Is there any zero-knowledge way to hide their email from ourselves and any potential database leaks while still having the ability to send to their address (which would obviously require the email plaintext?)

Alternatively, if there probably isn’t a way to hide it from ourselves is there any way to obfuscate the address in the database but still the user emails?


texts: How can I break a Vigenère cipher with partial plain key?

texts:
I've got the cypher text: cöimamiçknsyznhaczstş and a partial plain key: ?ğre??i
I've used "?" instead of unknown characters.
The question is: is it possible to find the whole key?
I've read about given partial text and unknown key some people found the key and text.
My problem is easier than others. I'm sure It can be found but how?
2 vowels cannot come together in turkish. I've tried about vowel and consonant words but I couldn't find any clue
Turkish alphabet = 'abcçdefgğhıijklmnoöprsştuüvyz'


texts: Can a device prove the identity of its own code?

texts:
Say you have a computing system that has some functionality that is not in itself cryptographically secure, but you want to make sure is executed as specified, and, e.g. an adversary hasn't re-flashed the software when you weren't looking. An example might be a voting machine for a non-crypto scheme, or verifying that a motherboard is running the factory's firmware.

Is there any sort of data or verification protocol that can be used to prove which version of the software is being run, that doesn't require physically disassembling the hardware, and is resilient against even an attacker who knows about it and who specifically designs their variant software to try to spoof it?

If nothing about the hardware (and its capacity) is known ahead of time, then AFAIK this is impossible because the attacker can just virtualise the entire "correct" software and return whatever it produces. (Although please correct me if this isn't true) Since that's not a very interesting scenario, instead assume

Both the verifier and the attacker have complete access to the "correct" software in machine code form.
The machine's memory capacity is fixed and known ahead of time by both verifier and attacker. (Or more generally, the machine's hardware configuration is known, and the attacker has not modified it except via software reprogramming)
If a handshake is involved, the verifier can be a trusted computer of arbitary capacity, not necessarily a human. (And so any computations the verifier has to do can be complicated so long as they're efficient.)
If the system's "correct" software has to be prepared in some unusual but efficiently doable way beforehand for the scheme to work, assume that has happened by the verification step.
Solutions that can be implemented in pure software are prefered, but solutions involving "small" hardware changes would also be acceptable. (Assume that simply replacing the program memory with ROM wasn't an option for whatever reason)

(As an example of what I'm looking for, one possible solution for this problem that occured to me was to construct the software image as normal, then pad it with random data up to the capacity of the machine's program memory. To verify, the verifier then provides the system a random number, the machine then computes the hash of that number prepended to the entire contents of its program memory (which it can't spoof because there's nowhere to store the "correct" copy to reproduce for this step) and gives that to the verifier. The verifier can then verify the hash the machine has given it against its own calculation. I haven't thought very hard about the implications of this scheme though, or how to attack it, so I think I'm missing some flaw in it. I'd also like to see if it's possible to achieve the same outcome without relying on there being a reasonably small capacity to fill.)


texts: How long does it take to crack DES and AES?

texts:
Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second.

How long would it take for to recover a DES key, using a brute-force search? How about a 128-bit AES key?


texts: RSA: Given $n$ and $\varphi(n)$, find $e$ such that $e=d$

texts:
Say we have chosen $n=pq$, with $p=89,q=97 \implies n=8633$ and $\varphi(n)=88\times96=8448$. Also, if we want the encoding ($e$) and decoding ($d$) exponents to be equal, we need $$(e,8448)=1 \: \: \text{(relatively prime),}$$ $$ed \equiv 1 \pmod{8448} \implies e^2 \equiv 1 \pmod{8448}.$$

How do I go about solving something like this? My first inclination is that $(e,8448)=1$ means that $e$ must be prime, but I'm really not sure.


texts: Why is breaking the Blum Blum Shub PRNG not an undecidable problem?

texts:
The Blum Blum Schub (BBS) pseudo random number generator (PRNG) is defined inductively by
$$
x_{i+1} = x_i^2 \mod N
$$
to generate the bit sequence $b_0b_1b_2...$ where the bits are taken to be the parity of the integers $x_i$, and $N$ and $x_0$ must satisfy particular properties (see this post for example).
The BBS generator is a cryptographically secure PRNG, modulo the Quadratic Residuosity problem; given the integer $N$; the authors reduced finding the prior bit stream to the problem of finding the two prime factors of $N$.
What I am unclear on is why the authors assumed the adversary has access to the integer $N$ and or $x_i$.  By the definition of a cryptographically secure PRNG on Wikipedia, given part or all of the internal state, an adversary should not be able to reconstruct the prior stream of random numbers.  Under this definition, would it not be sufficient to claim that the "internal state" is not the integers $x_i, N$, but rather the stream of bits $b_0b_1...$?
After all, if I am not mistaken, if an adversary obtained access to part of the pseudo random bit stream, then uniquely determining $x_0$ and $N$ from just that information should be very difficult or undecidable, so I am not sure why the authors reduced the challenge of reconstructing the prior bit stream to solving the quadratic residuosity problem.
In particular, how exactly is the "internal state" of a PRNG defined, if not off the random bit stream?  Is the internal state defined as being the random seed? A few iterations after the random seed?  If so, and the PRNG "seed" is reliant on a set of secret parameters $a_1, a_2,...a_m$, then how many of those parameters should be revealed to constitute an "internal state"?


texts: How difficult is it to guess a salt based on a hash and known plain text?

texts:
I have the following use case:

Alice owns the domain alice.com and Bob owns bob.com.
I want to users to create a hash for themselves and a specific service e.g. facebook.com or twitter.com. The environment is a client side only application , no servers involved. Therefore each user owns a unique random string that is generated once, stored locally at the user's device and intended to be used as a salt. The goal is to have unique hashes for each user tied to a service without an attacker being able to guess the hash of a user on a specific other service. The hash is intended to be the local part of a catch-all email address.

Alice's generated email address for facebook.com: tcpcAwdfMGw5S22/98avSvqrO8vyEefLGRpmu5zHWKw@alice.com

A pseudo-code example with argon2 as hashing function would look like this:
argon2.hash("<service>+<user-domain>", {salt: <user-salt>}) -> hash

A concrete example for Alice, her domain and facebook would be:
argon2.hash("facebook.com+alice.com", {salt: <SaltOfAlice>}) -> tcpcAwdfMGw5S22/98avSvqrO8vyEefLGRpmu5zHWKw

Please note, that there is no actual password to be hashed, just a string consisting of the service's domain and the user's domain. Argon2 is alienated to generate a hash based on this string where the salt is the actual secret part.

This leaves us with a table of users, services, personal domains and hashes.

User     Domain         Service         Hashed Mail
-----------------------------------------------------------------------------------
Alice    alice.com      facebook.com    tcpcAwdfMGw5S22/98avSvqrO8vyEefLGRpmu5zHWKw@alice.com
Alice    alice.com      twitter.com     yQYCTrtMbQCq1ufLGCJAsc+Y1SIIYR7rC7Cbgp6e2IA@alice.com
Bob      bob.com        facebook.com    B+sKf7kXTH13tfj8ueZdmnTIpWRYCUYeNyQzFFx0jWs@bob.com
Bob      bob.com        twitter.com     /EIqXNIG/orOcQfYz/j1IYWTIRvTAoXJ4Di8cESsXwg@bob.com

These hashes are going to be publicly accessible. So when an attacker obtains a list of hashes of Alice and the associated services (facebook.com, twitter.com, etc) and her own domain (alice.com) would the attacker be able to extract the salt?

The attacker should not be able to guess Alice's hashed email address for a new service (e.g. stackexchange.com).

Is this guaranteed even when each user always uses the same salt and the salts are kept private?


texts: Plausibly deniable authentication for agents on multiple teams

texts:
Here's a problem that I've been thinking about:

An individual, Alice, wishes to authenticate herself.
She may wish to authenticate to Bob (who is on the blue team) that they are both on the blue team.
She may wish to authenticate to Charlie (who is on the green team) that she is on the green team.
However, when approaching a person, she has to send a message that could authenticate her to either of the two (as she does not know which one she is approaching)
The goal is for members of the blue team to not know she is on the green team, and for members of the green team to not know she is on the blue team.
Additionally, Eve, who is on the red team, should not be able to determine anything about which teams alice is on due to the message.

How would one construct such a system?


texts: Why does the Fiat-Shamir heuristic not work without a random oracle?

texts:
Consider the following three stage interactive zero knowledge proof in round $i$

The prover sends some commitment $a_i$ to the verifier.
The verifier picks a challenge $c_i\in \{0 ,1\}$
Depending on the challenge, the prover responds with $r_i(c_i)$ that convinces the verifier of his knowledge.

The Fiat-Shamir heuristic converts this into a non-interactive game by using a random oracle to generate a string $c$ whose bits are then used to decide each $c_i$. However, under the assumption that such oracles don't exist, we instead use a one way function on all the commitments to generate $c = f(a_1, a_2,\dotsc,a_n)$. This is known to be insecure. I've tried to read the paper in the Wikipedia page but still do not quite see the issue.

I assume the weakness is that the prover can somehow choose $a_i$ in a manipulative way so that the challenges $c_i$ are controlled by the prover but the argument for how the prover can do this is not very clear to me.

Why exactly is the Fiat-Shamir heuristic insecure in the absence of a random oracle or some other trusted source of randomness?


texts: Benefits of functional programming languages

texts: So far I mostly saw Python (because of simplicity) and C (because of efficiency) for cryptographic programming. But there is a different kind of programming languages called functional programming languages. An example is Haskell. These languages have no side effects and can be proven correct. I was wondering if those programming languages would have any benefits over "normal" programming languages when used for cryptographic applications. Is that the case? If yes, why aren't they used more frequently?


texts: Zero Proof Knowledge for data set information

texts:
I understand the Zero Proof Knowledge Protocol concept but find it tricky to implement sometimes for real world cases.

What I would need is, given a file with some key/value (numbers mainly) pairs, the verifier to verify that some values are within a certain range without knowing the information in the file.

Would that be possible with Zero the Proof Knowledge Protocol?

Thanks


texts: Recover secret SHA-1 constants given Oracle

texts:
There's a black box that's basically SHA-1, except that the constants (h0, h1,...,h4) are secret. We can pass it arbitrary inputs and get the corresponding outputs.

Given this, is it possible to recover the constants used?


texts: Is Argon2id safe from the discovered Argon2i issues?

texts:
So far, as I understand it, two ways to reduce the complexity of Argon2i have been found, one of which was fixed in Argon2 1.3, and one of which is still unfixed but is not a practical problem given enough Argon2i passes.

What I have not seen properly explained anywhere, is whether these weaknesses effect Argon2id, or if the combination is still good - basically, is the weakness in Argon2i enough to undermine the benefits of using it as the first half-pass of Argon2id, or do the passes of Argon2d after basically "cover" it somehow?

My naive intuition is at worst you lose the side-channel resistance, but does this compromise the side-channel resistance?

The weakness I am thinking of that is still applicable to Argon2 1.3 is the one described in "Towards Practical Attacks on Argon2i and Balloon Hashing"

Related to, but not a duplicate of this one, because while the comments and answer there suggest that

argon2id 1.3 takes those known attacks into account, and
argon2id is different enough from argon2i that it is probably safe to assume attacks on the latter do not apply to the former,

it is not clear to me that this actually fully covers my question, and certainly when I was looking for duplicate questions, it was not obvious to me that a question about "which one to choose?" would even touch upon my question - certainly the question as titled points in a completely different direction.


texts: Dimension involved by tensor product on Ring-LWE based homomorphic encryption

texts:
As far as I know, given two $n$-dimensional vectors $\mathbf{a},\mathbf{b} $, tensor product $\mathbf{a} \otimes \mathbf{b} $ produces $n\times n$ matrix.

However in Ring-LWE based homomorphic encryption, tensor product on two 2-dimensional ring elements $c_0=(c_{00}, c_{01}),c_1 =(c_{10}, c_{11}) \in (Z_q[X]/f(x))^2$ where $q$ is an integer and $f(x)$ is a monic irreducible polynomial of degree $n$, produces three ring elements of the form $c_0 \otimes c_1 =  (c_{00} \cdot c_{10},c_{01} \cdot c_{10} +c_{00} \cdot c_{11}, -c_{01} \cdot c_{11}  )$ as shown in Appendix B.5 (line no. 4 of Mult.)  in https://eprint.iacr.org/2012/099.pdf .

Why does this hold instead of producing $2 \times 2=4$ ring elements?


texts:
I've been working through how TLS1.0 works, and think I've basically understood most of it. One thing I can't seem to find a explanation of though is the order in which MACing and encrypting should happen. Let's say we've got the client finished message. You generate the 12 bytes of verify_data from the master secret, the finished label, and the md5/sha1 hashes of the handshake messages. At that point, do you:

a-> use your MAC key to create a hash of the 12 bytes, tag it onto the end and then encrypt the whole thing with your Write Key, or

b-> use your MAC key to create a hash of the 12 bytes, then use your Write Key to encrypt the 12 bytes, and tag the hash onto the end of the encrypted bytes?


texts: Why should I use Authenticated Encryption instead of just encryption?

texts:
There are various different modes of operation for block cipher use, some of which provide "encryption" and some of which provide authenticated encryption.

Why should I use an authenticated encryption mode rather than just an encryption mode?

This question does not aim to discuss different modes of authenticated encryption vrs encryption modes (although a good answer might choose to): its aim is to justify why/when AE is better than 'plain' encryption.


texts: Block cipher mode of operation with beyond-birthday-bound security

texts: I am looking for block cipher modes of operation that are secure even when the number of blocks encrypted exceeds the birthday bound.


texts: Can I use `SHA (message || key)` as MAC?

texts: One should not use SHA for MAC, because knowing SHA(key || message) and message you can construct SHA(key || message || forgery) without knowing the actual key. I read somewhere that one shouldn't use SHA(message || key) as MAC. Why? Here || means string concatenation.


texts:
Do clients use WPS every time when they connect to a WPS-enabled AP? Or maybe they do it just the first time and then they switch to a normal WPA/WPA2 key exchange?

If the latter, it's possible for an AP to force a client to use WPS every time?


texts: KeeLoq showing that decryption is indeed the inverse of encryption?

texts:
In some text I am reading, there is an exercise asking to show that KeeLoq decryption function is the inverse of the encryption function. Details about KeeLoq are given in the Wikipedia article.

As I am no hardware guy, I have no clue how to approach this problem. Does someone happen to see, how to show the requested property?


texts: In the ElGamal cryptosystem, I was wondering whether the $m$ (message) should be less than $p$ (large prime). Because on decryption, we are getting $m \bmod p$. For $m \bmod p$ to be equal to $m$, shouldn't $m$ be less than $p$? So what should be the size of $p$? Should it be a very very large prime number if I need to encrypt a file of 5 GB or something?


texts: Circular Security - Encrypting the key with the key

texts:
I know this isn't the best practice, but what if I took a cheap/fast 128-bit
stream cipher (assuming both the key and the stream blocks are 128 bits) and mixed in the plainkey with the plaintext (let's say the 128-bit key appears
about once within every ten 128-bit blocks, but at otherwise random positions
to prevent a MITM attacker who knows the plaintext from faking a message without
being noticed)?

This is just a crude straightforward way of tamper-proofing a stream.  Don't
worry, I won't actually do this, but I'd like to know if it's been proven to
leak the key for some common stream cipher.  This previous question touches on the risk but does
not get into specifics.

So, are there any commonly used stream ciphers which have known security
vulnerabilities if I did this?  What about slower block ciphers converted to
stream ciphers like ChaCha?  What about slow and already-authenticated stream
ciphers (just because I'm curious about how loose I can be with the
key before encryption) like AES-GCM?

Of course, if you tell me there's a problem with encrypting the key itself
using the same key, I guess I could just encrypt some hash of the key...as
I understand it, that's basically the MAC we often use.


texts:
Can I remove new lines from the RSA public key file to get a one line string? So the question is if the key looks like this

AAA
BBB
CCC

or

AAA\n\rBBB\n\rCCC\n\r

is this the same as

AAABBBCCC


texts: How does post quantum key exchange in OpenSSH 8 work?

texts:
OpenSSH 8 supports a post quantum KEX, namely sntrup4591761x25519-sha512@tinyssh.org

It says in its description that it is basically NTRU + ECC X25519. However, I have tried but cannot understand how it combines the two? My main source of confusion is that the description seems to be saying that the client creates just one set of keys (I am assuming NTRU key pair), but where is the ECC keypair and how is it being used?


texts: Does "identity-based dynamic threshold signature" exist and could such scheme contain a "Signature Combination" algorithm?

texts:
I came across [1] and I'm very puzzled by this paper.
They use a building block which they call "identity-based dynamic threshold (IBDT) signature", citing paper [2].
First of all [2] does use this IBDT term. But even the algorithms list described in [1] do not match the one in [2]. My major concern is this Comb algorithm in [1] which does not appear at all in [2] and that apparently combines signatures with different identities to create a signature that contains all the identities required by the policy $S$.
Combining signatures to get a more powerful signature seems to be the opposite of the security properties of an Attribute-Based scheme, which is what [2] is about, so I was wondering if they just did not cite the proper reference. However at the same time the rest of the algorithms listed in [1] for IBDT is very similar to the one in [2].
Is there a way they are referring to another scheme ?
I found paper [3] that seems to do what [1] describes,
namely combining 'partial' signatures,
but there does not seem to be a dynamic threshold.
References
[1] http://web.ua.es/va/recsi2014/documentos/papers/privacy-preserving-group-discounts.pdf "'Privacy-Preserving Group Discounts' by Josep Domingo-Ferrer and Alberto Blanco-Justicia"
[2] J. Herranz, F. Laguillaumie, B. Libert and C. Ràfols, “Short attribute-based signatures for threshold predicates,” Topics in Cryptology–CT-RSA 2012, pp. 51–67, Springer, 2012.
[3] Sherman S.M. Chow and Lucas C.K. Hui and S.M. Yiu, "Identity Based Threshold Ring Signature", https://eprint.iacr.org/2004/179
appendix: other concerns with this paper
The rest of [1] is also very surprising: While the writing style of the abstract suggests an author who is accustomed to writing papers in cryptography, the protocol description is extremely informal and weird (and the protocol seems so weak !) and the "Security analysis" only states that "the scheme is secure by design".
My guess would be that [1] is a bare joke but it has been published in a (very modest, it seems) conference "RECSI XIII", it is in Springer's LNCS
and the first author seems to be a senior researcher who according to its personal web page received prizes, awards and so on.
Apparently the paper also led to a patent and a smartphone application.
Because of all this "impact" (?) I do not dare calling this paper a joke before really trying to understand what this paper really is.


texts: How to get unknown constants from linear congruential generator

texts:
I need to crack this linear congruential generator.

I have

$$X_{n+1}=a⋅X_n +b \pmod m$$

I know: $m=31,X_3=30,X_4=19,X_5=26$

How can I find $a,b$ and $X_0$?

I have got already the following equations:

$$26=a \cdot 19+b  \pmod{31}$$

$$19=a \cdot 30+b \pmod{31}$$

substruct 2 equations to get

$$7= -11 \cdot a  \pmod{31}$$
$$7= 20 \cdot a  \pmod{31}$$

the inverse of 20  is 14 in $\bmod 31$, $20 \cdot 14 = 1 \pmod{31}$.

$$7 \cdot 14= 14 \cdot 20 \cdot a  \pmod{31}$$

$$7 \cdot 14=  a  \pmod{31}$$


texts: Is a known plaintext, ciphertext, and public-key a viable attack on RSA?

texts:
Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key.

Alice and Bob each have their public- and private-key pairs ($\left[pub_{A}, pri_{A}\right]$ for Alice and $\left[pub_{B}, pri_{B}\right]$ for Bob) and Alice, Bob, and Cindy all know everyone else's public key.

Alice generates a random $n_{A}$ and sends out $En_{pub_{B}}\left(n_{A}\right)$ ($n_{A}$ encrypted with Bob's public key).
Bob generates a random $n_{B}$ and sends out $En_{pub_{A}}\left(n_{B},n_{A}\right)$ and sets the session key to $n_{A}\oplus n_{B}$.
Alice sends out $En_{pri_{A}}\left(n_{B}\right)$ and sets the session key to $n_{A}\oplus n_{B}$.

My thinking is, Cindy decrypts message 3 with Alice's public key to obtain $n_{B}$.  Now Cindy has a plaintext, ciphertext pair and the key that decrypts the ciphertext.

My question is, is it possible with this information for Cindy to find $pri_{A}$ in order to decrypt message 2 and find $n_{A}$?


texts: How to find the inverse of a polynomial in NTRU-PKCS

texts:
I am coding a java based implementation of the NTRU public-key cryptosystem. I can comprehend the majority of the algorithms involved in the encryption and decryption process well enough, but the key generation process is giving me serious trouble.

I'll briefly go over some basics of the cryptosystem for those that are unfamiliar, otherwise, skip ahead to the paragraph titled The Problem.

We'll be working with polynomials with degree $<n$. Adding and subtracting these polynomials functions normally, however multiplying these polynomials works different¹². Given two polynomial $A$ and $B$ of degree $<n$, their product is
$$A \cdot B = c_0\,x^0 + c_1\,x^1 + \ldots + c_{n-1}\,x^{n-1} = C$$
where each coefficient $c_k$ is calculated by³:
$$c_k=\sum_{0\le i<n}a_i\,b_{(k-i\bmod n)}$$
multiplying each coefficient of $a$ with the same from $b$ in reverse order (if $b_k$ is the first coefficient in $b$ then $b_{k-1}$ loops around to the last coefficient in $b$ and so on) ensure the degree of the resulting polynomial remains $<n$.

The key $F$ is a polynomial with coefficients in $\{-1,0,1\}$. An example (where $n=7$) is:
$$1\,x^0 + 0\,x^1 + 0\,x^2 + 1\,x^3 + -1\,x^4 + -1\,x^5 + 0\,x^6$$
or more plainly:
$$1 + x^3 - x^4 - x^5$$

$F$ functions as the private key but must be verified to have inverse polynomials $F_q$ and $F_p$, which are polynomials of degree $<n$ with integer coefficients $q_i$ with $0 \leq  q_i < q$, and $p_i$ with $0 \leq p_i < p$, where $q$ and $p$ are predefined integers ($q$ is coprime with prime $p$).

$F$ must satisfy that $F_q$ and $F_p$ exist given:

$$F \cdot  F_q \equiv 1 \pmod q \quad\text{and}\quad F \cdot  F_p \equiv 1 \pmod p$$
that is, if we define $C=F \cdot  F_q$, its coefficients $c_k$ must verify
$$c_k\bmod q=\begin{cases}1&\text{if }k=0\\0&\text{otherwise}\end{cases}$$
and same for $F \cdot F_p \equiv 1 \pmod p$.

With all that being said…

The Problem

I am still struggling to grasp the algorithm used to calculate the polynomial inverses of the private polynomial key $F$, $F_p$, and $F_q$ for $$F\cdot F_q \equiv 1 \pmod q$$ and for $p$ etc.

Or to even verify if $F$ is invertible. I've seen different pseudocodes explaining the algorithm but all I've seen are poorly elaborated. Other explanations of the algorithm amount to "You can calculate the inverse using the extended euclidean algorithm" with no example, and looking at the eea myself I'm still none the wiser on how it's applied. I'd greatly appreciate a concise explanation in relation to the polynomial $F$ integer $p/q$ and polynomial degree $n$.

Let me know if there seems to be any key concepts I'm missing or critical variables I've omitted.

Notes of the editors:
¹ In this modified polynomial multiplication, $x^n$ is assumed to be $1$ in coefficients of degree $\ge n$.
²  Equivalently, this is polynomial multiplication modulo $x^n-1$.
³ $u \bmod n$ is defined as the integer $v$ with $0\le v<n$ and $u−v$ a multiple of $n$.


texts: Is there an algorithm to find the number of intersections of two sets?

texts:
Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my friend to know any element of my set and he don't want me to know his. But we want to know how many elements are in the intersection of our two sets (without also knowing which elements these are).

Are there any algorithm to achieve this goal? One that will calculate the number of common elements using data from which it is very difficult to compute elements of our sets? Or its just impossible?

All elements of our sets are integers so we can use algorithms of computational number theory.


texts: Can padding length, and thus plaintext length, be considered public information when using aes-cbc?

texts:
Right now I'm using a simple padding system that takes the plaintext, hashes it with SHA512, and appends $x$ bytes of the hash as padding where $x$ is the delta between the plaintext and nearest blocksize multiple.

Is this considered a secure method of padding the message? I am also authenticating the encrypted data using HMAC-SHA512, would this effect the security?


texts: Is there any semantic difference between predicate encryption and functional encryption?

texts:
Predicate encryption(PE) arrived as a descendant of attribute based encryption. Attribute based encryption allows the encryptor to embody a policy to the ciphertext (Ciphertext-Policy based encryption) and the receipent to receive a key from a central trusted authority according to his attributes. If the attributes do satisfy the policy then the receipent can decrypts. Another less secure version is the key-policy based encryption whereby the encryptor associates with the ciphertext the attributes that he wills a potential decryptor to have and the key of the receiver comes with the policy. Because attribute based encryption reveals the policy(KP-ABE) and the attributes(CP-ABE) predicate encryption comes to solve this by allowing the receipent to apply a predicate if he owns a secret key of that predicate.

Functional encryption(FE)
As presented in the paper is a generalization of Identity based encryption, Attribute based encryption and predicate encryption. Instead of a predicate there is a function $f$ that evaluates the attributes of the ciphertext. At the paper the construction is given based on predicate encryption.

My question is what extra functionality FE provides in comparison with PE. Is there a drawback or a security leakage in PE that FE solves?
My intuition from the literature is that the contribution of FE is the generalization of the 3 previous mention crypto schemes(IBE,ABE,PE) into 1 scheme (research purpose for acceptance in a conference, not practical at all) and second is the area of applications. I understood that in PE if your secret key $sk$ lets you evaluate at $1$ a predicate $P$ over a ciphertext $c$ then you recover the plaintext but with the FE if $F_{sk}(c)=1$ then you learn the output of the function on the plaintext. I.e: the function might be a machine learning algorithm classifying spam so you learn if the message is a spam or no, but not the contents of the message. Is this correct?


texts: Is it possible to break AES-128 ECB if you are given a ciphertext and a small portion of the key?

texts: If you are given the ciphertext and the first half bytes (8 bytes) of the encryption key (key is 16 bytes in total), can you use this to break AES-128 ECB encryption and determine the last 8 bytes of the encryption key? (As opposed to trying all 256^8 possibilities for the last 8 bytes of the key, which is A LOT of possibilities and would take days/months to compute)


texts: How to crack rar file with protected pass with only the AES-256 key

texts: I have rar with protected pass.But I have the AES-256 key can I crack it and if I can. how?


texts: /dev/random only needed for key generation / CPU pattern encryption

texts:
Consider the following scenarios:

using OpenSSL to encrypt a file with Rijndael-256
using LUKS to encrypt a hard-drive that is used every day

Exactly when is entropy from /dev/random needed for a crypto process?
Is it only needed for the key generation or is it also needed for the encryption process itself?

When the CPU is executing a crypto process (key generation or encryption) for a program, does the CPU cause some kind of pattern (like a fingerprint of the encrypted data) as it processes? Can this "processing pattern" then be used to break the encryption and see the plaintext?


texts: Decrypting two ciphertexts using the same key

texts:
I'm currently trying to solve an online challenge, where I'm given two ciphertexts, encrypted using a one-time pad and the same key for both messages. The task is to decrypt those messages.

What I'm trying to do is to xor a common English word ("the" in this case) and for that word step by step XOR with the result of c1 XOR c1.

So basically: bits("the") XOR c1 XOR c2

My problem is that all the results I get are not usable.
I know that "the" should be the right word to find something, as the instructor dropped that hint.

My code looks like this:

def text_to_bits(text, encoding='utf-8', errors='surrogatepass'):
    bits = bin(int.from_bytes(text.encode(encoding, errors), 'big'))[2:]
    return bits.zfill(8 * ((len(bits) + 7) // 8))

def text_from_bits(bits, encoding='utf-8', errors='surrogatepass'):
    n = int(bits, 2)
    try :
        return n.to_bytes((n.bit_length() + 7) // 8, 'big').decode(encoding, errors) or '\0'
    except:
        return "Not processable"

def xor(bit1, bit2):
    result = ''
    for idx, val in enumerate(bit1):
        result = result + ('0' if (bit1[idx] == bit2[idx]) else '1')
    return result

def crib_brute(bit_str, crib_word_bit):
    for i in range(50):
        xor_result = xor(crib_word_bit, bit_str[i: len(crib_word_bit) + i])
        print(str(i) + ": " + text_from_bits(xor_result))

c1 = "1010110010011110011111101110011001101100111010001111011101101011101000110010011000000101001110111010010111100100111101001010000011000001010001001001010000000010101001000011100100010011011011011011010111010011000101010111111110010011010111001001010101110001111101010000001011110100000000010010111001111010110000001101010010110101100010011111111011101101001011111001101111101111000100100001000111101111011011001011110011000100011111100001000101111000011101110101110010010100010111101111110011011011001101110111011101100110010100010001100011001010100110001000111100011011001000010101100001110011000000001110001011101111010100101110101000100100010111011000001111001110000011111111111110010111111000011011001010010011100011100001011001101110110001011101011101111110100001111011011000110001011111111101110110101101101001011110110010111101000111011001111"
c2 = "1011110110100110000001101000010111001000110010000110110001101001111101010000101000110100111010000010011001100100111001101010001001010001000011011001010100001100111011010011111100100101000001001001011001110010010100101011111010001110010010101111110001100010100001110000110001111111001000100001001010100011100100001101010101111000100001111101111110111001000101111111101011001010000100100000001011001001010000101001110101110100001111100001011101100100011000110111110001000100010111110110111010010010011101011111111001011011001010010110100100011001010110110001001000100011011001110111010010010010110100110100000111100001111101111010011000100100110011111011001010101000100000011111010010110111001100011100001111100100110010010001111010111011110110001000111101010110101001110111001110111010011111111010100111000100111001011000111101111101100111011001111"

crib_word = "the"
crib_word_bit = text_to_bits(crib_word)

crib_brute(xor(c1, c2), crib_word_bit)

Those are my first 15 results:

0: eP
1: Not processable
2: Not processable
3: Not processable
4: Not processable
5: Sgi
6: :v}
7: Not processable
8: L
9: Not processable
10: Not processable
11: Not processable
12: Not processable
13: {d
14: Not processable
15: Not processable

Nothing looks like part of the English language.
Can someone tell me what I'm doing wrong?


texts: Are there any other alternatives to Sbox's or SP networks to provide diffusion preferably more basic alternatives which still provide a good degree of security?


texts: Two diferents inputs can have the same output in $Shake256$ for every output size (for example, $Shake256(input_1, \ell) = Shake256(input_2,\ell)$ for every $\ell$)?