texts:
Is CRC32C (any) better than CRC32(B)?

I read that CRC32C (alias Castagnoli) is better than CRC32 (sometimes referred as CRC32B) in detecting errors but what that exactly means and how to check it didn't mention. I know they use different polynomial but that alone doesn't explain that. So I started to search a bit more and found nothing really. Only one post on Intel's forum where the guy from Intel says it's been chosen because "this polynomial has nice mathematical properties". I immediately wanted to ask "Since when 'niceness' is a criterion to choose one algorithm (here - polynomial) over the other?". Anyway...

Inspired by this topic I created my own test and checked collisions in English dictionary (from here, note there are two repetitions: "OUTSOURCING", "OUTSOURCINGS"). I used my author's program that hashes all entries and compares these hashes with each other. I also used lowercased, capitalized and first-letter capitalized words. After optimization it gives (n*(n-1)/2) comparisons. The results I got are somewhat characteristic:
('_32a' means first 32 bits of hash ( memcpy(hash32, hash, 4); ), '_lo32b' means low 32 bits of hash ( (uint32_t)hash64; ); (polynomials taken from wikipedia)

| hash         | collisions | polynomial |
+--------------+------------+------------+
| crc32b       |     44     | 0x04C11DB7 |
| crc32c       |     62     | 0x1EDC6F41 |
| crc32k       |     36     | 0x741B8CD7 |
| crc32q       |     54     | 0x814141AB |
| fnv1a        |     51     |      -     |
| md5_32a      |     45     |      -     |
| sha1_32a     |     44     |      -     |
| wyhash_lo32b |     47     |      -     |
| xxh32        |     49     |      -     |
| xxh64        |      0     |      -     |
| xxh64_lo32b  |     51     |      -     |
+--------------+------------+------------+

As you can see - 32 bit hashes are prone to collisions, and good hashes have similar chance of collision in set of this size equal to ~45. All but CRC32C... Seems like CRC32C has 40%+ more collisions than CRC32B which is significant, comparing that other hashes, including cryptographic, have around 45 like CRC32B.
Is it better? Somehow I don't see that.

I also checked how they compare in smhasher as it's designed to test hashed and both CRC32B and CRC32C fail miserably on the same tests in the same fashion (collective set of those tests here).
Is it better? Somehow I don't see that.

I know this crude test is not the best way of testing but smhasher shown the same, and even more of it, so is CRC32C any better than CRC32(B)?


texts: Shamir's Simple Sharing Scheme - preventing partial recovery of data

texts:
In SSSS, if you recreate the original secret with one of the decoder inputs being slightly damaged (e.g. one or two chars incorrect), you receive a slightly damaged version of the original secret. So if the original secret was "Abraham Lincoln", decoding using a slightly damaged input might still get you "Ab%aham Lincoln", for example.

What's the best way to encode and decode the secret, on top of SSSS, such that any variance at all in the inputs causes the decoded secret to be completely useless?

One obvious way would be to encrypt the secret before using SSSS. Are there any alternatives? In particular, any alternative that would not require each user to have a final decryption key (for decoding the secret that comes out of SSSS) as well as their SSSS decoding keys?


texts: Homomorphic Modular Reduction for Secure Storage

texts:
My question is quite similar to Homomorphic modulo, but I want to give a context where the operation is carried in an outsourced environment.

Are there any specific homomorphic cryptographic schemes that could do the modular reduction and subtraction operations at the same time.

Suppose $Enc(x)$ a ciphertext of $x$ after homomorphic encryption, and $mod$ is modular reduction operation.
$$(Enc(x)-Enc(a))\ mod\ Enc(N) == (x-a)\ mod\ N$$
While $x$, $a$ and $N$ are all natural numbers. And $N$ are bigger than $x$ and $a$.

I know that $mod$ can be transformod into additional ($+$) and multiplicative ($*$) operations, which are operations supported by HE. But I don't want the factors exposed to someone who carry such operations, like $Server$.

For example

$(6-5)\ mod\ 10 = 1+(0*10)=1$, $(4-5)\ mod\ 10 = -1+(1*10)=9$

But when a $Server$ is assigned do this, the factors like $0$ and $1$ here are exposed.

So I'm wondering, are there any specific HE schemes that can do modular reduction operation directly, or are there any solutions that can keep $Server$ from knowing the factors?


texts: PKG will be sending the Private key,so it may not be secure,some one may get the private key,how to overcome this problem in IBE. Please help am unable to justify.


texts: Why is OpenSSL generated 256-bit AES key 64 characters in length?

texts:
This might be a noob question, but I couldn't find its answer anywhere online: why does an OpenSSL generated 256-bit AES key have 64 characters? The command I'm using to generate the key is:

$ openssl enc -aes-256-cbc -k secret -P -md sha1
salt=E2EE3D7072F8AAF4
key=C94A324B7221AA8A8760DA0717C80256EF4308EC6068B7144AA3BBA4A5F98007
iv =5C7CB13DBDA69B2C091E0D5E95943627

I thought I could just read the key string and base64 decode it to get a 256-bit AES key, but that didn't work because 64 characters turned into a 384-bit byte array after decoding.

/* read keyString from config... */
byte[] secretKey = Base64.getDecoder().decode(keyString);
Preconditions.checkArgument(secretKey.length == 32,
            "Length of secretKey is %s-bit instead of 256-bit: %s",secretKey.length * 8, config.getSecretKey());
SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey, "AES");

If I'm doing math correctly, a 256-bit key should be 41 characters in length after base64 encoding. Am I missing something obvious here?


texts:
Given ciphertext for a message encrypted using $AES-CTR$ along with actual, desired message and IV, I need to perform malleability attack on the ciphertext to change the original message from $M$ to $M'$. But the message length of $M$ and $M'$ isn't the same. Since CTR doesn't use padding and the ciphertext is same length as the message then should I remove the extra bytes from ciphertext in the forged cipher to get $M'$ as its shorter than $M$?
To explain this better please see the following example of what I have done so far!
$M$ = "Pay alex \$100"
$M'$ = "Pay \$900"
$C$ = Ciphertext with first block as IV

Calculate $x = M ⊕ M'$ (I padded $M'$ before XOR to match length of $M$)
$C' = C[17... n]$ (Exclude initial 16 bytes as it corresponds to IV)
$C'' = C' ⊕ x$
Forged Cipher $C^* = C[1.. 16]||C''$ (First 16 bytes is the IV)

When I decrypt the forged ciphertext $C^*$ I get the expected message but with extra characters in the end as "Pay $900.....".
So in the forged cipher-text if I remove the last 10 hex characters I get the exact message $M'$ that I was expecting. Is it right approach to get rid of the extra bits in the forged cipher-text to match the message length or what I've done is incorrect?


texts: EC scalar multiplication with zero scalar

texts:
Is the elliptic curve scalar multiplication $[n]G$ defined if $n=0$?
I saw multiple software implementations with multiple results such that, $[0]G=0$ or $[0]G=G$.
This made me wonder, how can i compute $[0]G$ on 25519 curve, where G is the base point. $G=(9,14781619447589544791020593568409986887264606134616475288964881837755586237401).$
Also, is [n]$\mathcal{O}$ defined?


texts:
I've been taking a crypto course online. I have a good idea how PRG's and Stream Ciphers work, but I'd love to get some input to help visualize what is actually happening. I understand a seed is used, then expanded into a keyspace. Is this correct?

So: $G: \{0,1\}^s \to \{0,1\}^n , n \verb|>>| s$

From what I understand.. For a generator (function $G$) a random seed from all $s$ bit seedspace is mapped to an $n$ bit string.

I'm having trouble conceptualizing is the "mapping" of the random seed to the key (I might be totally incorrect with the way I'm phrasing this). Is this process laid out in the actual cipher (e.g., CSS, Salsa20) or there something else going on?


texts: Special-purpose witness encryption without multilinear maps

texts:
In Witness Encryption and its Applications Garg et al describe "witness encryption" which allows one to encrypt some specified data to a NP problem, such that another party can decrypt iff they present some witness to the NP problem.

They give general construction using multilinear maps based on a reduction of NP from CNF predicates to subset-sum problems.

Are there any examples of witness encryption on a smaller class of problems (say, inner products, or preimages of point functions, or discrete logarithms) that are provably secure without multilinear maps?


texts: If PGP and GPG both follow the OpenPGP standard, are they 100% compatible in all use cases?

texts: If someone gives me their PGP key, can I use it with GPG, and vice versa, all the time (100% interchangeable)? Or are there times when they are not compatible, when only PGP can be used with a PGP key, and only GPG used with a GPG key?


texts: How is the AddRoundKey operation performed in AES-256?

texts:
Can anyone explain to me (or send a link to somewhere) how round keys are added in AES-256? I understand that the round keys is added to the state matrix for each round and how XOR works. But since the state matrix is always 128 bits, how do you add an 256 bit round key?

I might be confused on a higher level right now...


texts: Can one group the SHA-256 outputs depending on partial inputs?

texts:
Is it possible to predict a hash key based on half key?
Let's have some example:

I have 100000000 hash results, and they are generated by either

sha256( "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" . md5(random()) );

or

sha256( "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" . md5(random()) );

So, when someone generates a new hash (based on method "aa" ou method "bb"), is there any way that I can predict if hash is more a "aa" generated type or more a "bb" one?

I have already tried some type of Bayes classification, because I know that can only be there 2 types of results. But for each result I cannot classify hashes so that I have a good Bayes training.

Is this theoretically possible?


texts: Why is this authentication protocol with a nonce and tree parties not secure?

texts:
Why is the following authentication service not secure?

C⟶S: $I_C$

S⟶C: $N$

C⟶S: $E(K_{C,A}, N)$

S⟶A: $E(K_{S,A}, \{I_C, E(K_{C,A}, N)\})$

A⟶S: $E(K_{S,A}, N)$

where:

C = client
S = server
A = authentication service
$I_X$ = identification string of entity X
$N$ is nonce
$E(K, M)$ is the encryption operation using key $K$ and message $M$
$K_{X,Y}$ = symmetric key shared by X and Y


texts: How can I prove that a set of ciphers are the encryption of a set of plaintexts?

texts:
I have a set of plaintexts e.g., ["how", "are", "you"] and a sender who encrypts each element with a unique symmetrical key (or not) and outputs the set of ciphers.

Receiver needs assurance that all the ciphers he just received have a one-to-one mapping with the ["how", "are", "you"] and not some other values. I'm not using asymmetric encryption because it'd reveal which cipher represents which item.

I have read all other questions and a few papers on set membership, pederson commits, etc but still can't understand how it'd work. It'd be very helpful if you could give a detailed answer.


texts: Are there any papers explaining how to port textbook RSA to realworld RSA?

texts:
Are there any papers, books, or link where it explains how the plain vanilla "textbook RSA" is actually implemented in practice with all the padding and stuff?

Basically, I would like to know the intricacies of implementing an algorithm into production level code…


texts: The PKCS #1 v2.0 specifications suggest using $\lambda(n) = \mathrm{lcm}(p-1,q-1)$. What is the benefit of choosing $\lambda(n)$ over $\varphi(n) = (p-1)(q-1)$ in RSA key generation?


texts: Computing guessing entropy (average rank of the correct key) in attack using deep learning

texts:
I am looking for help with some issues that I have about the guessing entropy (GE) in side-channel attacks context. I have read some papers where GE is used as a metric to measure the attack's performance. In this paper, they define it like:

The q parameter in the expression represents the number of queries

My interpretation:
One experiment is taking a random k from the K set. Then, use the gamma function to associate that k to a specific class. Then, perform the key recovery, and as a result, one gets a vector whose elements are the probability of each class. Finally, the experiment returns the position (index) of the class in the probability vector. So the GE is the mean position of the correct key.

I still have doubts about how to use it in attacks with deep learning. To be more clear: When I have finished training my DL model that has 255 neurons in the output layer (one for each byte, i.e. class, in 255 from 00 to FF). Then, I use the "attack set" to make predictions, and I will get a 255-vector of probabilities, so that is the vector g.

Issue 1: I don't understand how to prepare my attack set, it has to contain random elements with classes from 00 to FF or it has to contain elements from just one class because it is the correct class? But, if the latter is the case how can I choose a random k from K set then?

Issue 2: If I perform 10 experiments with different values of q, this means that I take q=1 elements from my attack set, but it has to be for each class, i.e. q=1 for 00, q=1 for 01... q=1 for FF. Then, repeat for q=2?

Issue 3: When q>1 this means that I have to compute the average of the probability vectors to get one single vector, and then continue the algorithm?

If it's useful, I include this image which is the result of the guessing entropy after experiments with increasing values of q.

Thanks in advance!


texts: Single-pass authentication with a block cipher that accepts a counter

texts: Suppose we have a tweakable block cipher ($E(K, T, X)$ and $D(K, T, X)$) that is used in a scheme where the tweak, either in whole or in part, is used as a counter to make each block encrypt to a distinct ciphertext. If we XOR all of the blocks together and then encrypt the result, do we have a secure tag?


texts: Is my deniable encryption scheme reasonable?

texts:
I was experimenting with RubberhoseFS, but since it is very hard to compile on anything modern, I decided to implement my own version, stripped of many unnecessary features. Namely, my implementation would only work on files (as opposed to drives/volumes/partitions), and in batch mode (no random access). However, before I start implementing it, I would like to verify that my understanding of RubberhoseFS is correct.

I wrote a full documentation of my intended implementation here, it contains all details of what I intend to do.

It boils down to this:

A file of fixed size is created, regardless of how much actual content is intended to be in it. This file is split into blocks, initialised to random noise.
A fixed number of "aspects" (views) is created, regardless of how many are actually used.
Each aspect holds one symmetric master key protected by a password (or a key); one lattice key generator encrypted by the key; and one map of blocks used by that aspect (initially empty, until data is written to it), also encrypted by the key
If a block is referenced by a map of one aspect, it holds data encrypted by a key generated by the aspect's "Lattice Generator", seeded by the block sequence number (i.e. if this is the 3rd block of that aspect, the lattice generator will be seeded with "3". If the block is not referenced by any aspect, it contains random noise.

Is this comparable to what RubberhoseFS does? Does this seem like a reasonable implementation of Deniable Encryption?

Additionally, what is meant by the "Lattice generator"? Which primitives would I use to implement this?

And finally, RubberhoseFS uses a "whitening code" to prevent Known Plaintext Attacks. To my understanding, for each block, a random noise of the same size as half of the block is generated. The other half is then the plaintext, XORed with the random noise. Both of these are then encrypted using the key from the lattice generator, and stored in the block. Is this interpretation correct? And is whitening really necessary, if the key space is large?


texts: Has human-generated entropy ever been a real problem?

texts:
I know the topic of human brains generating random numbers has been discussed here and in Cognitive Sciences before, but I am interested in a particular part of it:

In an introductory book to cryptography I read recently ("Cuando la criptografia falla", by Arturo Quirantes), it is mentioned that in some historical occasions, mecanographers were used to generate random numbers for cryptographic purposes. However, as we know now, it was not truly random (or at least uniformly distributed) and some numbers would appear more than others. I had read about this before, but I have failed to find examples of historical events when this technique was used. I am also curious about whether any important information has ever been leaked because of the low entropy of human-brain generated numbers.

Could you please point me to some documentation about this?


texts: How can I determine if a hash function is secure?

texts:
I'm doing an exam in computer security and I encountered this problem which I'm unsure of how to attack properly. Should I get down and dirty with the Hash function on paper or is there a more general approach to making these kinds of security judgments?

The question is as follows:

Let $M = B_1, ...,B_n$ be a message consisting of $n$ blocks of 512-bits. Let $H$ be the function $H(M)=(((B_1+B_2) \oplus B_3)+B_4 \oplus B_5)...B_n$, where $+$ is the addition modulo $2^{512}$ and $\oplus$ is bitwise XOR. Is $H$ a secure Hash Function?

For each requirement:

preimage resistance (or one-wayness)
second preimage resistance (or weak collision resistance)
collision resistance (or strong collision resistance)

motivate if it holds or disprove it.

Let $D$ be the set of all possible messages with $n \leq 4$ (ie. all messages smaller than 2 Megabits). Does $H$ produce more collisions than SHA-256 for messages in $D$?


texts: Questions about proof of correct encryption in the Paillier cryptosystem

texts:
In the Paillier cryptosystem [1] the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$.
A proof of correct encryption could look like presented in section 4.2 of [2]:

  "Suppose a prover $P$ presents a sceptical verifier $V$ with a ciphertext $c$ and claims that it encodes plaintext $i$. A trivial way to convince $V$ would be to reveal also the random choice $r$, then $V$ can verify himself that $c = E(i, r)$. However, for use in the following, we need a solution where no extra useful information is revealed."

Although I understand the proof itself I don't get the exact point of where it is supposed to offer "extra useful information".

Comparing the proof to the proposed Zero Knowledge Proof the verifier does not learn anything apart from what the proof is all about.
$n$ and $g$ are part of the public key, $m$, $r$ and $c$ are presented for verification of encryption.
Of course the disclosure of $r$ obliterates the probabilism of the system but what is to be gained by this if you already know the plaintext?

Having asked this I have another question that seems closely related to the one above:

Supposed I were to homomorphically sum up the encryptions of a couple of messages from a limited publicly known set of plaintexts $S=\{0, 1\}$. If I then were to proof the correct encryption of the sum by disclosing the encrypted sum, the plaintext sum and the resulting random factor r for the encrypted sum - would this provide any useful information about which summand encrypts which plaintext message?

[1]
Pascal Paillier -
Public-Key Cryptosystems Based on Composite Degree Residuosity Classes
Link

[2]
Ivan Damgård and Mads Jurik -
A Generalisation, a Simplification and Some Applications of Paillier’s Probabilistic Public-Key System
Link


texts: Difference between a secure PRG and semantically secure encryption

texts:
I am taking cryptography course in Coursera from Stanford University. I have following question

I have a question why append 0 in G(k) i.e., G'(k) = G(k) || 0 is
considered as not secure PRG as 0 in message is copied with out
encryption. Whereas in semantically secure E'(k,m) = 0 || E(k,m) i.e.,
prepend 0 is considered as semantically secure. Here why appending 0
does not break semantically secure [sic]?


texts: Prevent MITM attack while encrypting data by using ElGamal ECC?

texts:
I am using ElGamal ECC to encrypt my plain text data. I want to ensure that my data is safe from a Man-In-The-Middle attack. What methodology I can adopt to achieve this goal?

How can we prevent a Man-In-The-Middle attack while encrypting data by using ElGamal ECC?


texts: Reversed One-Time-Password - generating secret server side

texts:
In our company we're thinking about a new auth scheme (not a 2FA!) where vault is secured by secret. User should be able to access the vault just by typing the One-Time-Password (OTP) into the webform.

Here is the theory as I understand the normal OTP works:

generated secret is stored on both the server and user's auth app
some function now accept time and secret and generate OTP (6 digits)
server verify if the OTP entered by the user matches the server generated OTP in the same time slot

`

          client                          server
          ======                          ======

         +------+                        +------+
  time -->      |                        |      <-- time
         |  fn  +--> OTP          OTP <--+  fn  |
secret -->      |                        |      <-- secret
         +------+     ^            ^     +------+
                      |            |
                      +- matches? -+

I was thinking if this scheme can be anyhow turned around like this:

`

          client                          server
          ======                          ======

         +------+                        +------+
  time -->      |                 time -->      |
         |  fn  +--> OTP -----+          |  fn' +--> secret
secret -->      |             +---------->      |
         +------+                        +------+

That way our server application will not store the secret anyhow and we get nice familiar UX for users to unlock the vault.
Is it possible to reverse the OTP algorithm like this?


texts: DHE parameters: which parameters need to be random each time?

texts: In DH key exchange, first, both parties need to agree on a generator $g$ and prime $p$. After that each party computes its key (party A: $g^a \bmod p$) and (party B: $g^b \bmod p$), then they exchange these values to compute the shared secret. Can you please clarify which of these numbers should be random for each session (assume it is used with a protocol like TLS)?


texts: What is the probability of the first half of a hash output being identical to the first half of another hash output?

texts:
Let's say for example that I encrypt a password with some hash function and receive a 256-bit hash value in return. What are the chances that the first 128-bits (half) of this value are identical to the first 128-bits of another hash output?

If you're feeling generous, what are the chances that the first 64-bits (1/4) of the output are identical to the first 64-bits of another output?


texts: Is there a theorem to determine the elliptic curve parameters based on the group order?

texts:
By Hasse's theorem we know that range of the group order of the elliptic curve. And similarly, there exist a theorem on the admissible order of elliptic curves. Suppose by the theorem on the admissible order of elliptic curve we know there exist a curve of desired order then how to determine the curve parameters. For example in case of simplified/short Weierstrass equation the value of the parameters $a,b$.

My question: is there a theorem to determine the curve parameters based on the group order? Does the form of the curve matter? The different forms of the curve are Weierstrass, Montgomery, and Edwards.


texts: Is AES resilient to chosen plaintext with access to related keys (key expansion primitives)?

texts:
I'm interested in knowing whether a cryptosystem is broken given access to a few primitives.
$\DeclareMathOperator{\KEYEXP}{KEY\_EXP}$
$\DeclareMathOperator{\E}{E}$

Suppose that you have access to an oracle that can provide you $\E(k, m)$ for any message $m$ (so you can obtain the AES-128-ECB encryption of any block with a key that you want to learn).

Obviously, AES-128 is resilient to chosen plaintext normally.

However, what happens if there is another primitive that allows one to perform crypto with the final round key of key expansion (and the equivalent inverse)?

That is, in addition to $\E(k, m)$, the adversary has access to $\E(\KEYEXP(k), m)$ and $\E(\KEYEXP^{-1}(k), m)$ for any $m$. (Even more generally, the adversary has access to $\E(\KEYEXP^n(k), m)$ and $\E(\KEYEXP^{-n}(k), m)$ for all $n, m$ and wants to obtain $k$.)

Is AES-128 resilient against this, or is key recovery possible?

(For example, if k was equal to all zeroes, then $\KEYEXP(k)$ would give the final round key as B4EF5B...)


texts: ECIES: key derivation function and symmetric encryption scheme

texts:
I am using an elliptic curve library which provided me with a shared secret using my secret key and a foreign public key. Unfortunately an ECIES is not available in the programming language.

I would like to implement an ECIES as follows.

Use the shared secret as a seed for a random number generator
Create an xor key with the random number generator
Compute $cipher = message \oplus key$
Transmit $cipher$ and a signature of $cipher$ using my private key

Is this approach correct and safe?


texts:
Sorry if this is elementary, but is there such a thing as a dynamic length (output) hash function? Something that would be a fast way to calculate hashes and output different lengths of strings for the output.

This may give away some of the length of the message, and could be undesirable for many other reasons, but would possibly avoid collisions?


texts: Please prove distinguishability given a non-perfectly secure cipher

texts:
I'm trying to prove that a perfectly secure cipher yields indistinguishability. I already know and can prove that a perfect cipher => indistinguishability by the following proof:

\begin{align}
\Pr(Enc(m_1) = c) = & \Pr(C = c | P = m_1) \\
 & = \frac{\Pr(C = c \land P = m_1)}{\Pr(P = m_1)} \\
 & = \frac{\Pr(C = c) | \Pr(P = m_1|C = c)}{\Pr(P = m_1)}\\
 & = \frac{\Pr(C = c) | \Pr(P = m_1)}{\Pr(P = m_1)}\\
 & = \Pr(C = c)\\
\end{align}

Please help me prove indistinguishability will yield a perfect/secure cipher (indistinguishability => perfect cipher) which is the opposite direction.


texts: Derive one public key from ECDH when the other and and the shared secret is known

texts:
Suppose we have an elliptic curve Diffie-Hellman key exchange protocol, where Bob and Alice have public keys $pk_{Alice}= [sk_{Alice}]G$ and $pk_{Bob}= [sk_{Bob}]G$ ($[.]$ elliptic curve "exponentiation"). As usual, they computed the shared secret $s$ as the x-coordinate of $(x,y)= [sk_{Alice} sk_{Bob}]G$
Now Carol has access to $s$ as well as $pk_{Alice}$ and moreover knows a set of public keys $S_{pks}$, such that Bobs public key is in that set, i.e. $pk_{Bob}\in S_{pks}$.
Is it possible for Carol to find Bobs key in $S_{pks}$ (Assuming $S_{pks}$ contains more then just a single element of course)


texts: How can homomorphic encryption be probabilistic while allowing for math to be conducted?

texts:
I've been playing with some homomorphic encryption libraries. It's given me a greater appreciation for probabilistic encryption. These two answers were instrumental in leading to this question, but don't contain an answer for this question by themselves:

If a probabilistic encryption algorithm is used, how does decryption return the correct message?
Partially Homomorphic Cryptographic Schemes - Deterministic vs Probabilistic
Homomorphic & Functional encryption: Mapping unencrypted outputs to encrypted outputs using existing data

For those who don't know, in probabilistic encryption:

A piece of data is anonymized by appending a time-dependent random string to its beginning
This means the same data (or "plaintext") can have a different value each time it's encrypted
When a user with the key decrypts the data, they  then remove this leading string to get back the original plaintext
A single "bit" of data can be a very long string in the HE space. This means HE encrypted strings contain more 'information' than regular bits. What this information contains is a mystery to me.

As you can tell I (think I) understand probabilistic encryption. But I don't understand how you can possibly retain homomorphism within a probabilistic space.

If each piece of data has a different leading random string, how does the algorithm know which parts of the encrypted data contains the true value? How can you add and subtract two encrypted datas that have different leading strings?

Obviously, the person performing math on the encrypted data can't know the key used to decrypt it. So HE somehow uses different leading random strings to encrypt each data,  but these datas can still be added and subtracted together? How can this possibly be true?


texts: Non-malleability of One Time Pad Encryption

texts:
Can anyone explain to me what the following means in relation to one time pad security?  It's from the book 'Serious Cryptography: A Practical Introduction' and my logic knowledge seems to have lost me here so I'm struggling :-

Given a ciphertext $C_1 = E(K, P_1)$, it should be impossible to create another ciphertext, $C_2$, whose corresponding plaintext, $P_2$, is related to $P_1$ in a meaningful way (for example, to create a $P_2$ that is equal to $P_1 \oplus 1$ or to $P_1 \oplus X$ for some known value $X$). Surprisingly, the one-time pad is malleable: given a ciphertext $C_1 = P_1 ⊕ K$, you can define $C_2 = C_1 \oplus 1$, which is a valid ciphertext of $P_2 = P_1 ⊕ 1$ under the same key $K$. Oops, so much for our perfect cipher.


texts: Public key in fully homomorphic encryption over the integers

texts:
I'm reading “Fully Homomorphic Encryption over the Integers” by van Dijk et al.

I wonder why $x_0$, which is a component of the public key, should be an odd number?


texts: creating PKCS8 private keys with a PBMAC1 hash

texts:
PKCS#8 provides two encryption schemes (PBES1 and PBES2) and one message authentication scheme (PBMAC1). It seems like a combined method (eg. authenticated encryption) would be ideal but whatever.

Anyway, my question is...  are there any tools in the wild that can create a PBMAC1 PKCS#8 encoded private key?

The man pages for OpenSSL make me think that OpenSSL doesn't support this:

https://linux.die.net/man/1/pkcs8


texts: How to establish if a string contains a message

texts:
If you have a string S, then the string can be composed of four things:

cleartext
'random' data
encrypted data
compressed or otherwise non-encrypted, but modified, cleartext

If you want to see if the string is an encrypted message, (3), then you might construct a test for 'randomness', say the test is $T_0$. You'd then expect:

$T_0(a) \approx T_0(d)$ -- i.e. not interpreting a compression as an encryption because it is ordered
$T_0(b)$ $\not \approx$ $T_0(c)$ -- i.e. the message is detected

If the message is very well encrypted, then you'd expect:

$T_0(b) =  T_0(c)$ -- that is, the algorithm detects no patterns

Would that be correct?

I'd expect that a watermarked or steganographic image would be revealed as different from standard jpegs by a good $T_0$.

The randomness tests in 'diehard' and 'dieharder' look for specific types of pattern that would not be expected in strings of type (2). Would it not make more sense to structure a $T_0$ on known types of data, so, for example, an apparently normal image file that contained a message would stand out?


texts: Equivalent RSA modulus for NIST P-192 and P-521 elliptic curves

texts:
At www.keylength.com, I found the following table of ECC field size and the corresponding RSA modulus recommended by NIST.

ECC Modulus  RSA Prime Size

160             1024

224             2048

256             3072

384             7680

512             15360

But NIST proposed P-192, P-224, P-256, P-384, P-521 curves. May I know what is equivalent RSA modulus for P-192 and P-521 curves?


texts: Anything known about this variation of Diffie-Hellman key exchange protocol?

texts:
I'm considering a variation of the Diffie-Hellman key exchange protocol based on integer modular multiplication in place of exponentiation. If done naively, that would obviously be insecure, but I'm wondering if it is possible to recover security by erasing the least significant bits before transmitting a product. The idea is inspired by RLWE, where introducing random errors can transform a trivially insecure protocol into a possibly secure (maybe even quantum-proof) one; only here instead of addition of random errors I'm proposing deterministic erasure of the lower part of the data.

Here are the details: Let $n \in \mathbb N$ be fixed (say $n=1024$), and let $M=2^{3n} -1$. We will use the notation $x \bmod M$ to denote the unique integer $y$ in $0, 1, \dots, M-1$ with $x \equiv y \pmod M$.

Alice and Bob begin with a shared public value $g \in \mathbb N$ with $0 \leq g < M$. (Whoever initiates the protocol should choose $g$ uniformly at random and send it to the other party.)
Alice chooses a secret integer $0 \leq s_1 < 2^n$ uniformly at random,  computes $x_1 = gs_1 \bmod M$, rounds $x_1$ to a nearest multiple of $2^n$, and sends the result $\tilde x_1$ to Bob.
Bob chooses a secret integer $0 \leq s_2 < 2^n$ uniformly at random, computes $x_2 = gs_2 \bmod M$, rounds $x_2$ to a nearest multiple of $2^n$, and sends the result $\tilde x_2$ to Alice.
Alice computes $y_1 = \tilde x_2 s_1 \bmod M$, rounds $y_1$ to a nearest multiple of $2^{2n}$, and stores the result $\tilde y_1$.
Bob computes $y_2 = \tilde x_1 s_2 \bmod M$, rounds $y_2$ to a nearest multiple of $2^{2n}$, and stores the result $\tilde y_2$.

It can be shown that $\left\lfloor \frac{\tilde y_1}{2^{2n}}\right\rfloor$ and $\left\lfloor \frac{\tilde y_2}{2^{2n}}\right\rfloor$ differ by at most 1 (modulo $2^n$), and from this Alice and Bob can easily agree on a secret key of length $n-1$.

I'm wondering if anything is known about the security of this protocol? Has anything been published about this sort of technique, or is there some obvious attack that breaks it?

The most straightforward avenue for an adversary to break it would seem to be if they had some way where, given integers $g$ and $\tilde x$ in the interval $[0, M)$ they could find $s$ with $0 \leq s \leq 2^n$ such that the most significant $2n$ bits of $gs \bmod M$ agrees with $\tilde x$ (assuming that such $s$ exists, which it will if $\tilde x$ was produced as one of the $\tilde x_i$ in the protocol). Here the restriction $0 \leq s \leq 2^n$ is the part that is intended to make it hard; it would be easy for anyone to find an $s$ in $[0, M)$ such that $gs \equiv \tilde x \pmod M$, but that would not appear to be sufficient to succeed in an attack.

Edit: We run into trouble if $g$ or $s_i$ happen to share a large divisor with $M$. To fix this, we could replace $M$ with a prime number (say, the largest prime less than $2^{3n}$) or restrict $g$ and $s_i$ to be relatively prime to $M$.


texts: The semantic security in Anonymous Hierarchical identity-bases encryption?

texts:
In Anonymous Hierarchical Identity-Based Encryption (Without Random Oracles) by Boyen, to prove security it defined challenge ciphertext like

I actually can't get how does the proof work? Why we should define challenge ciphertext like this?


texts:
Assume you are already given a properly-salted, password hash $X$ from some slow PBKDF (e.g., like Argon2id).

Now, you want to apply some large (~256-bit) secret "pepper" $S$ to it before storing it in the database.

Is there a significant difference between storing it as an
$$\text{HMAC}\left(S,X\right)$$
(where $S$ is the secret key to the HMAC of $X$) versus a "much simpler/basic"
$$H\left(S\mathbin\parallel X\right)$$

where $H$ is just some SHA-2? (e.g., SHA-256/512)


texts: Explanation of the Decision Diffie Hellman (DDH) problem.

texts: I'm extremely new to crypto, and very much inexperienced. Lately I've been reading about the Diffie-Hellman key-exchange methods, and specifically about the computational diffie-hellman assumption vs. decision diffie-hellman assumption. Specifically I'm referencing Dan Boneh's paper on DDH problem. However, I'm having some trouble understanding the difference between CDH and DDH. What are the differences? Similarities?


texts:
I'm trying to use the Pohlig-Hellman algorithm to solve for $x$ where $15^x=131 \bmod 337$.  This is what I have so far:

Prime factors of $p-1$: $336=2^4\cdot3\cdot7$

$q=2$: $x=2^0\cdot x_0+2^1\cdot x_1+2^2\cdot x_2+2^3\cdot x_3$

$x_0$: $131^{168}=15^{168*x_0}$, $-1(\bmod 337) = (-1)^{x_0}(\bmod 337)$, $x_0=1$

$x_1: 131*15^{-1}=131*45=166 \bmod337$, $166^{184}=15^{168\cdot x_1}$, $148 \bmod 337= -1^{x_1}\bmod 337$

However, from there, $x_1$ has no answer.  So I know I've done something wrong, I just don't see what.  I've double- and triple-checked every computation, so I assume I misunderstand something about the algorithm.


texts:
I have a question that I can't answer:

  A plain text has been encrypted 3 times in a DES method with 3 different keys 56 bit each, after it the text was encrypted for the forth time using a AES method using a 128 bit key, an attacker is planning to decrypt the text using meet in the middle method, how many encryptions and decryption approximately he need to do.

  $2^{56}$
  $2^{112}$
  $2^{128}$
  $2^{168}$
  $2^{184}$
  $2^{240}$
  $2^{296}$


texts:
I was trying to decrypt a text encrypted with AES and ECB mode.
I did try several keys and IV. I solved it by ignoring IV. (The IV was given, but it was maybe a distraction)
My question is in which cases IV is needed and in which is not?


texts: Differential analysis tools for cryptographic hash function

texts:
Is there any software tools available for conducting differential analysis test on cryptographic hash functions?
If so, suggest few of them


texts:
I am trying to find a concrete example of the Weil Pairing.
What I have done until now is that I took $E=(x-1)(x-2)(x-3)$ over $F_5$.
I took $E[2]=\{\infty,(1,0),(2,0),(3,0)\}$.
I know that there exist a rational function f such that
\begin{equation*}
div(f)=2[T]-2[\infty]
\end{equation*}
How can I find this function f?
How can I find the points of order 4?
How should I continue?


texts: Efficient Robust Private Set Intersection Questions

texts:
I am trying to implement Efficient Robust Private Set Intersection using additive ElGamal.

I am trying to run the full protocol mentioned in Section 3.4 on the following inputs:

$p = 17$ (prime)
$g = 6$ (generator)
$x = 5$ (private key)
$k = g^x \pmod p = 6^5 \pmod{17} = 7$ (public key)

Suppose the clients inputs are 1, 2. Then $P(x) = (x-1)(x-2) = x^2-3x+2$, and therefore the coeffiecients to encrypt are $(1, -3, 2)$. I chose $y = 10$ and so the encrypted values are:

$1$ becomes $(15,12)$
$-3$ becomes $(15, 1)$
$2$  becomes $(15, 4)$.

The Server Side Input Set $S=\{1\}$ and the random value $r0$ corresponding to $\{1\}$ is $r_0=2$.

With the above problem in context, I have some questions:

What does P 0,j refer to in Step 7. Can you please give an example?
In Step 8, suddenly variable i is introduced along with j. What does i, j, refer to?
In Step 8, ENC() function has a ; in between. How do we interpret ENC(a;b)?


texts:
I've learnt the formulas needed for the DSA (http://en.wikipedia.org/wiki/Digital_Signature_Algorithm).

But most importantly, I don't quite understand what represents those formulas and why they are the way they are. For example, why if v = r then the signature is verified, why do r and s have such formulas etc.? RSA digital signature is so much simpler.


texts: How can I use Weierstrass curve operations with a=-3 for implementing operations for a=0?

texts:
I am working with golang's elliptic library.

It implements functions on Weierstrass elliptic curves with $a=-3$. I need to make my own library that allows me to handle curves with $a=0$. I understand there are specific equations to use to optimally perform operations on different elliptic curves, which can be found in Short Weierstrass curves.

I would like to know which functions from the library I should change, and which stay the same (as I'm not an expert in cryptography). Here is the full list:

IsOnCurve, affineFromJacobian, Add, addJacobian, Double, doubleJacobian, ScalarMult, ScalarBaseMult, GenerateKey, Marshal, Unmarshal, and some initialization functions.

As I understand I need to change the following:

IsOnCurve (removing the -3x)
doubleJacobian (different equation)
and the init functions

Those should stay the same:

Add
addJacobian (same optimal equation)
Double
ScalarBaseMult
Marshal
Unmarshal

And I'm not sure about those:

affineFromJacobian
ScalarMult
GenerateKey

Can anyone tell me if my list is correct, and if not, give me some feedback on how I should change the given items?


texts:
Assume we are given a small fixed number of LWE samples with secret $s$ and error $e$, where the error distribution is taken so that the LWE problem is hard.

My question: How can one further generate LWE samples (with the same secret $s$), given the LWE samples.

It was briefly noted in [Reg10] (Sec2. "Other implications") that there exists such a procedure, however I was not able to find an explicit explanation (or in the references they suggested).

[Remark] It wouldn't be surprising that we can further generate LWE samples on our own, since the hardness of the LWE problem does not depend on the number of samples (when the error distribution is Gaussian).


texts: Security properties of an encryption scheme built from a PRP and a PRG

texts:
Note: This was my in-class problem last week and potentially will be on the exam tomorrow. Thus, I want to reconfirm my thoughts so that I'll be ready to face this type of question (if appear) tomorrow.
Question:

Assume I have an encryption where the key is computed using a PRP $P$ and the message is computed using a PRG $G$ so that
$$E(k,m) = ( P(k,r) , G(r) \oplus m )$$
(also given) $k \in K = X = Y = \{0,1\}^n$ and $m \in M = \{0,1\}^{2n}$
$P$ is the PRP, $G$ is the PRG, and $k$ and $m$ are the key and the message belonging to the keyspace $K$ and message space $M$ respectively, and $r$ is a random bitstring.

My thoughts:
First, I say that $E(k,m)$ is not perfectly secure because $|M| > |K|$.
Second, I can argue that $E(k,m)$ is indistinguishable because the message is generated by a PRG (assuming that the seed is independent & uniformly distributed).
Third, I claim that $E(k,m)$ is CPA-Secure too because the PRG makes the message non-deterministic.
Fourth, I think $E(k,m)$ is CCA-Secure too, right?
Please feel free to correct me, I don't mind criticism. I think some of my thoughts are still wrong. I just want to feel ready for the exam.


texts: Precise Definition of 1-out-of-2 Oblivious Transfer

texts:
What's the precise definition for 1-out-of-2 OT? and what's the best way to show that it can't be achieved under unconditionally secure setting?

I am reading about it and just couldn't get my head around it as there's a lot of different OT.

Thanks


texts: In search of platform independent 128-bit hash function

texts:
We are currently using murmur3 as our hash function for small strings (up to 128 chars). We plan to replace it with a better non-crypto hash function which is fast and produces unique 128-bit hash for a given input across the platforms (32/64-bit, x86 & arm).

Farmhash could have been an ideal candidate with it's speed and collision resistance but it's quite machine dependent and produces different results on different platform which makes it useless for us.

Cityhash has been known for collision weakness as demonstrated by siphash. So it's out of considerations.

Siphash is too slow and so is Highway hash which appears to be derivative of siphash (feel free to correct)

metrohash, xxhash, and seahash are under considerations.

I wouldn't be bothered by minor difference in speed. However, uniqueness across platform and collision resistance are main criterions.

Please suggest.


texts: decode Vigenere cipher that was encoded with Affine cipher

texts: How do I decode some text that has been encoded like this: affine(vigenere(text, vigenere_key), *affine_key)? I don't know keys to either of them. At first I thought I could just bruteforce it by trying out all possible combinations, but then I realised that cracking Vigenere is based on finding keyword which can be literally anything and since the decoded message wont make any sense after cracking Vigenere as it is still encoded with Affine I'm kinda confused how do I find the right key to Vigenere and crack it?


texts:
AES provides diffusion at the block level by implementing the ShiftRows and MixColumn sublayers. The former permutes data on a byte level, wheres the latter combines blocks of four bytes.

Can it ever be the case that this level of diffusion is insufficient?


texts: RSA: Blinding versus fixed-time computation

texts:
For RSA, what is the standard solution against timing attacks?  I know about RSA blinding as one solution.

Another solution is to always compute both the squared value and square-and-multiply values, and use conditional masking to select which one based on the current bit of the exponent.  (For example, fill a register with a copy of the exponent bit, another register with the NOT of that bit, AND each of the two results with one of these registers, and OR those together.)

Which one is the better accepted solution?  Or is a different one preferred?  Thanks =^-^=


texts:
A Galois field of the type $GF(p)$, where $p$ is prime, is normally expressed as the ring of integers modulo $p$.

If my understanding is correct, it is also possible to represent its elements as a ring $\mathbb Z_2[X]$ of polynomials defined over $GF(p)$, i.e. for $GF(2)$, we'd have polynomials of the form similar to $x^8+x^5+x^3+1$ or $x^9+x^6+x^2$, etc, and for $GF(5)$, we'd have polynomials of the form similar to $4*x^7+2*x^3+3*x+1$ or $2*x^5+3*x^3+x^2$, etc. All arithmetic operations are like with normal polynomials, but with a difference: all arithmetic operations on coefficients which occur in the calculations are done modulo $p$.

The question is: do polynomials defined over $GF(p)$ have any real application in cryptography where they are a better fit than their integers-modulo-$p$ counterparts?

Please correct me if I mixed something up in the theoretical part!


texts: culling equivalent Enigma keys for short messages

texts:
The following for-loop iterates over all possible keys for an M3 Enigma for three selected rotors:

for start_pos_left in A..Z:
    for start_pos_middle in A..Z:
        for ring_middle in 1..26:
            for start_pos_right in A..Z:
                for ring_right in 1..26:

For the middle and right-most rotors we need to know their start position and their ring setting.  For the left-most rotor we need only know its start position as it never 'knocks' another wheel.

A computer-age attack on the Enigma (James J Gillogly. Ciphertext-only Cryptanalysis of Enigma. Cryptologia. 19(4) 405-412.) ignores the plugboard and iterates over the rotor settings, using Index-of-Coincidence to filter the likely settings.  This is the attack I am trying to speed up.  Here is my own implementation (using max freq rather than IC).

However, for short messages (real Enigma messages had a maximum of 320 letters for naval, and 250 for army and airforce messages), many of these keys are identical.

Here are some duplicate keys that turn a certain test message into identical ciphertext:

<A G,1 H,23> is dup of <A F,26 H,23>
<A G,1 I,24> is dup of <A F,26 I,24>
<A G,1 J,25> is dup of <A F,26 J,25>
<A G,1 K,26> is dup of <A F,26 K,26>
<A G,1 L,1> is dup of <A F,26 L,1>
<A G,1 M,2> is dup of <A F,26 M,2>
<A G,1 N,3> is dup of <A F,26 N,3>
<A G,1 O,4> is dup of <A F,26 O,4>
<A G,1 P,5> is dup of <A F,26 P,5>
<A G,1 Q,6> is dup of <A F,26 Q,6>
<A G,26 R,7> is dup of <A F,25 R,7>
<A G,26 S,8> is dup of <A F,25 S,8>
<A G,26 T,9> is dup of <A F,25 T,9>
<A G,26 U,10> is dup of <A F,25 U,10>
<A G,26 V,11> is dup of <A F,25 V,11>
<A H,1 R,7> is dup of <A F,25 R,7>
<A H,1 S,8> is dup of <A F,25 S,8>
<A H,1 T,9> is dup of <A F,25 T,9>
<A H,1 U,10> is dup of <A F,25 U,10>
<A H,1 V,11> is dup of <A F,25 V,11>
<A H,2 H,23> is dup of <A F,26 H,23>
<A H,2 I,24> is dup of <A F,26 I,24>
<A H,2 J,25> is dup of <A F,26 J,25>
<A H,2 K,26> is dup of <A F,26 K,26>
<A H,2 L,1> is dup of <A F,26 L,1>
<A H,2 M,2> is dup of <A F,26 M,2>
<A H,2 N,3> is dup of <A F,26 N,3>
<A H,2 O,4> is dup of <A F,26 O,4>
<A H,2 P,5> is dup of <A F,26 P,5>
<A H,2 Q,6> is dup of <A F,26 Q,6>
<A I,2 R,7> is dup of <A F,25 R,7>
<A I,2 S,8> is dup of <A F,25 S,8>
<A I,2 T,9> is dup of <A F,25 T,9>
<A I,2 U,10> is dup of <A F,25 U,10>
...

(In this example, the middle wheel is wheel II, which has a notch at E.  The leftmost wheel is III and the rightmost wheel is I.)

How can you iterate over just canonical keys given you know the length of the message?


texts: Is pseudorandom function also a one-way function?

texts:
Can I assume this? Specifically, I want to know if the following two cases are valid. Suppose $prf_k(m)=c$

One-wayness: Only given $c$, we cannot reveal $m$.
Without key $k$, even given $m$, cannot get $c$.

They seem intuitive, but I want to be assured of their validity when I say that. Is a pseudorandom function also a one-way function?


texts:
I know about ElGamal scheme and its key generation, encryption, and decryption methods. I'm not sure about what is meant by batch ElGamal.

Can someone please clarify it. How it differs from ElGamal and what are the attacks possible on that scheme. How do we prevent them?


texts: Is this password-cracking challenge possible?

texts:
Taking a graduate computer security class, part of our current assignment is to crack 50 Unix md5crypt password hashes, due on Thursday, October 8th (in eight days.) I've managed to crack 49 out of the 50 passwords using hashcat, but the last password seems borderline impossible within the time given to us.
The hash for this password is $1$gT$qN6H47wSbSr4TaWFkuo/c.
The restraints on this password (given through hints from the professor) are as follows:

The plaintext is 8 characters long
The first character and last two characters are lowercase
There are two numeric characters, and the rest of the password consists of only uppercase and lowercase letters (no symbols).

The best approach I could come up with was using a mask attack with the mask ?l?2?2?2?2?2?l?l, where ?2 = ?l?u?d, but this would take a maximum of 20 days on my single desktop machine, far too long to be able to complete the assignment.
I could potentially try to assume that characters 1-5 (inclusive) are not lowercase, which allows us to use the same mask with ?2 = ?u?d, which cuts the max crack time to 1 day 13 hours. Certainly within the realm of possibility, but that's only in the case that my assumption is correct.
To be clear, this last password apparently isn't required for full credit, but at this point, I'm just curious to see how it could be cracked as fast as possible.
Is this crack possible within the remaining 8 days we're given, or is our professor setting us up to fail without giving us any further hints? Are there any other novel approaches I could take to crack this password faster?


texts: SHA-3 block sizes / bitrate calculation?

texts:
Looking into different papers and online documents, I find the following block sizes for SHA-3:

SHA3-224: 1152 Bit
SHA3-256: 1088 Bit
SHA3-384: 832 Bit
SHA3-512: 576 Bit

Somehow I am unable to find (calculate) these numbers from the specifications:

http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
http://keccak.noekeon.org/Keccak-implementation-3.0.pdf

How are these block sizes calculated, respectively where exactly are they specified?


texts: Why do general encryption key generators also take the algorithm as input?

texts:
To my understanding the key generation logic only needs a source of randomness and the length of the key to be generated as input. However, we still provide the algorithm (names) like AES, DES, Blowfish etc. Is it mainly for validation purpose to ensure that the input key size is correct? So, if e.g. the algorithm is AES, the key length has to be 128, 256 or 192?

Or is there more to it, that I'm not aware of?


texts: How to formally define the security of Random Oblivious Transfer

texts:
Assume that there is a protocol $(A,B)$ such that receives no input and satisfies:
$A$ - outputs two random bits $x_0, x_1 \in \{0,1\}$
$B$ - outputs a random bit $b \in \{0,1\}$ and also outputs $x_b$
$A$ is supposed to learn what is $b$, and $B$ isn't supposed to learn what is $x_{\lnot b}$
I want to formally define the security of $(A,B)$.
Intuitively, I think I understand how to define the security of $(A,B)$, but I'm having problem how to formally write it.
For example, about the security of $A$ (the sender), I thought about this:
A is secure, if for every adversary $B^*$  of time complexity at most $T$, $B^*$ can guess correctly the value of $x_{\lnot b}$ with probability of at most $\frac{1}{2} + \epsilon$
Now, I want to write this as a math statement using probabilities, but I am not sure exactly how.
The same goes about the security of $B$.
Help would be appreciated.


texts: What does the special form of the base point of secp256k1 allow?

texts:
The popular ECC parameters secp256k1 are documented in SEC2 as using curve $y^2\equiv x^3+a\cdot x+b\pmod p$ with $a=0$, $b=7$, $p=2^{256}-2^{32}-\mathtt{3d1_h}$, base point $G$ with the apparently haphazard $(x,y)$ coordinates (hex)

79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8

and order $n=2^{256}-\mathtt{14551231950b75fc4402da1732fc9bebf_h}$, cofactor $h=1$.

However, it turns out that $G$ is $G'+G'$ with $G'$ having $(x',y')$ coordinates (hex)

00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
c0c686408d517dfd67c2367651380d00d126e4229631fd03f8ff35eef1a61e3c

which is easily computable as $\displaystyle\frac{n+1}2\times G$.
The 90 leading zero bits in $x'$ show beyond doubt that this is a deliberate choice. What does it allow (faster computation, attack..)?

As an aside: is it known how $x'$ was chosen? The earliest mentions of that number that I could find are in this answer (January 5, 2015) without mention of its property, and in this challenge (date unknown but it existed on June 5, 2015) where its property is meaningful.

Update: I notice that the generator of secp224k1 is also twice a $G'$ with the very same anomalously small $x'$ as above (this time with 58 leading zero bits, which is still remarkable). I found nothing similar about the generator of secp192k1 or secp160k1. I did not check other SEC curves (but  secp112r1 secp112r2 secp128r1 secp128r2 secp160r1 secp160r2 secp192r1 secp224r1 secp256r1 secp384r1 secp521r1 are reportedly verifiably random, thus nothing similar should occur).

The special form of $G$ seems to allow some perceptible speedup when computing $k\times G$ for arbitrary $k$ by some elementary methods. We can rewrite $k\times G$ as $(2k\bmod n)\times G'$, and the frequent point additions of $G'$ or ($-G'$) occurring in left-to-right binary scan of the scalar multiplier can be sped up a little (at least when using affine, projective or Jacobian coordinates), because multiplication by $x'$ occurs in the point additions, and some of the word multiplications can be skipped.

However, I do not know if the fastest methods used in practice can take advantage of the special form of $G$ (or what these methods are).


texts: How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?

texts:
Wikipedia claims:

  A secure block cipher can be converted into a CSPRNG by running it in counter mode. This is done by choosing a random key and encrypting a 0, then encrypting a 1, then encrypting a 2, etc. The counter can also be started at an arbitrary number other than zero. Obviously, the period will be 2^n for an n-bit block cipher; equally obviously, the initial values (i.e., key and "plaintext") must not become known to an attacker, however good this CSPRNG construction might be. Otherwise, all security will be lost.

Here's a trivial counter-example:

Say I'm interested in generating psuedo-random 128 bit numbers. I'm using this method with a 128bit block cipher, but since the block cipher is giving out essentially a psuedo-random permutation of the counter - all the numbers I get are different! They are obviously not going to pass any basic randomness tests?!

Is this a mistake in Wikipedia (or just a misleading explanation?) or there's something I got wrong here?

If the answer is that it simply wouldn't work for values equal or larger than 128 bits, I would still doubt it would give out good quality output for 64 bits, since it has a very predictable pattern that the concatenation of any two consecutive 64 bit values is unique pattern that would never repeat (if that's a not a "real concern" mathematically, could you explain why? and what about 96 bit numbers?).

And if this is actually the case, are there any alternative examples of CSPRNG constructions that generate quality values for arbitrarily large amount of bits? are secure hashes any better (it seems reasonable I guess..)?

[Note: I've found this answer that very shortly addresses this issue but I didn't find it satisfying enough]

Update: Wikipedia seems to be updated now as a result of this discussion! Many thanks for @CodesInChaos who improved the article. This is useful knowledge for myself and many other people.


texts: Cipher suites: same name, different IDs, why?

texts:
Sorry if I missed with a community to ask.

Recently I stumbled on a fact that the same cipher suite can be designated by two different IDs, and this is not a typo nor single occasion.

For instance:
http://www.thesprawl.org/research/tls-and-ssl-cipher-suites

TLS_ECDH_ECDSA_WITH_NULL_SHA is 0x0047 and 0xC001
TLS_ECDH_ECDSA_WITH_RC4_128_SHA is 0x0048 and 0xC002
SSL_RSA_FIPS_WITH_DES_CBC_SHA is 0xFEFE and 0xFFE1
SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA is 0xFEFF and 0xFFE0

And few others more, like TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA and TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA.

So, the question is: why two codes are used to designate the same cipher suite? Is it a marker of legacy (broken?) implementation to distinguish? Or just a merge of two standards? Or something else?


texts: Commitment based on authencticated encryption

texts:
Let $(E,D)$ be the encryption/decryption of an authenticated encryption scheme. Consider the following commitment scheme.

Generate a random key $k$. Commit to $m$ by sending $c=E_k(m)$.
Reveal $m$ by sending $k$.

The hiding property of the above commitment scheme follows directly from standard assumptions on the confidentiality of $E$. However, I can't figure out if this is binding. It seems that most security notions for authentication do not consider swapping out the keys. In particular, is there a property that guarantees that $D_{k'}(c)$ fails to verify/decrypt?


texts: How to use HMAC for large ciphertexts over TLS

texts: HMAC used to secure chosen cipher-text attacks. if we are encrypting a large file (video) and sending it over TLS for decryption, how server can check MAC for ciphertext when we didn't sent whole of ciphertext yet ?


texts: What is a good way to demonstrate elliptic curve cryptography?

texts:
For school (high school) I am writing an essay on elliptic curve cryptography. The assignment needs to include a practical part, so I decided to write a Python class for elliptic curves. This class is capable of performing elliptic curve arithmetic and can encrypt files using MV-ElGamal (although it is horribly slow).

The problem is that I need to present my research, including the practical part, to fellow high school students. I considered writing a chat app or something similar, with a connection secured by elliptic curve diffie-hellmann+AES256 and elliptic curve digital signatures, however, I'm not sure how easy that is. What would you suggest? I am looking for something simple, with the focus on the cryptography as much as possible, since that is what my essay is about. I also don't want something too ambitious since I am still only a beginner when it comes to programming (I am more into the math side). Keep in mind that my audience is not particularly interested in mathematics nor programming though.


texts: Why is this the inverse of a Enigma Machine rotor?

texts:
I am learning about how the Enigma Machine works and I found this example of one letter being encrypted by an Enigma Machine. It shows the letter "G" going through three rotors and then it goes into the reflector, then back into the inverse rotors. This is where I get confused.

The rotors are

Rotor I:   BDFHJLCPRTXVZNYEIWGAKMUSQO
Rotor II:  AJDKSIRUXBLHWTMCQGZNPYFVOE
Rotor III: EKMFLGDQVZNTOWYHXUSPAIBRCJ
Reflector: ABCDEFGHIJKLMNOPQRSTUVWXYZ  # not sure if this matters
           YRUHQSLDPXNGOKMIEBFZCWVJAT

I would think that the inverse of the rotors would just be each rotor reversed like this.

Inversed Rotor I:   OQSUMKAGWIEYNZVXTRPCLJHFDB
Inversed Rotor II:  EOVFYPNZGQCMTWHLBXURISKDJA
Inversed Rotor III: JCRBIAPSUXHYWOTNZVQDGLFMKE

but on the example I linked to

Inversed Rotor I:   TAGBPCSDQEUFVNZHYIXJWLRKOM
Inversed Rotor II:  AJPCZWRLFBDKOTYUQGENHXMIVS
Inversed Rotor III: UWYGADFPVZBECKMTHXSLRINQOJ

I don't see any relation between the rotor and the inversed versions of them. So, is this example wrong, or am I missing something?


texts: Can any one explain Circuit Privacy using fully homomorphic encryption from Gentry's thesis?

texts:
Craig Gentry's thesis talks about circuit privacy being straight forward from fully homomorphic encryption in the last chapter.

Can somebody explain in simpler terms what that means ? I have read it couple of times but could not get it. While the definition of Circuit privacy is simple the realization of the same using FHE in the last chapter is what is tough to understand.


texts: Diffie-Hellman: Recommendation of the base size?

texts:
Based upon choosing a prime $p$ of recommended length and $N=2p+1$, where $N$ is also prime, and $a^2$ is not congruent to $1 \pmod N$, and $a^p ≡ 1 \pmod N$, I believe you can rely upon $a$ as having order equal to $p$.

My question is, what is a good size for $a$? And the reason I ask is because I've heard that you want the base large enough so that most of the power possibilities exceed $N$. What I'm looking for is more formal requirements or an example that provides $p, N, a$ using current recommendations.


texts:
I'm having difficulties understanding exactly what this protocol means:

$S \to D : \{N_S , S\}K_D$

$D \to S : \{N_S , N_D \}K_S$

$S \to D : \{N_D \}K_D$

"where $S$ represents the supervisor’s console and $D$ represents the door controller and the other symbols have their usual security protocol meanings."

I understand $N$ to be a nonce, a randomly generated number/hash that will only be used once.

I'm assuming $K$ is the public key?

Could someone explain this protocol for me, I’ve looked everywhere and cannot find anything like this.


texts: Has Burdges and De Feo's concept of Delayed Encryption ever been implemented?

texts: In mid 2020 Jeffrey Burdges and Luca De Feo published a paper proposing a trapdoor-less time-lock puzzle called Delay Encryption. Has a prototype of this ever been made?


texts: Is there an anonymous non-interactive authorisation scheme with peer-side auth. signature generation?

texts:
I implemented a pseudonymous PKI scheme (by K. Zeng @Springer Link), where all peers can change their public keys including its signature on their own. I am looking for a way to extend it with some authorisation functionality in that way, that an Authorisation Instance can provide specific credentials to a peer. (e.g. give their message credibility, or allow some special message types). Since such a credential could be linked with the identity of the peer, it also should be renewable without the reinvolvment of the Authorisation Instance. Some of the peers only us local communication and, therefore, are not able to contact the Authorisation Instance or the CA.

The papers I read so far, only offered interactive solutions in the form of a challenge response or required the involvement of the Authorisation Instance again. Maybe I searched for the wrong keywords.


texts:
Assume that user A sends to user B a message, unencrypted,  and signs it with an Elgamal signature.

Can some adversary, call it C, who eavesdrops, learn the private key if user A signed both messages using the same random variable k? if so, how?

to sign the message, as far as i understood, a large prime p along with prime root a are selected, then selects a secret integer, let's call it z(private) so that $b \equiv a^z(mod p)$. then she selects some random integer k so that $GCD(k,p-1)=1$, and computes $r \equiv a^k(modp)$, and uses this to finally compute $s \equiv k^{-1}(m-zr)(modp-1)$

user b verifies it using $v_1,v_2$ so that $v_1 \equiv b^rr^s(modp)$ and $v_2 \equiv a^m(modp)$, and it is valid if and only if there's the following relationship: $v_1 \equiv v_2(modp)$

not sure on that, because if C eavesdrops he can get the signed message, i.e (m,r,s). now if A used the same random variable k, means that r remains the same. if r is the same, i think that it is problematic since for two messages, $m_1,m_2$ and their respective $s_1,s_2$: $s_1k-m_1 \equiv s_2k-m_2mod(p-1) \equiv -zr$, so if she looks at the following difference: $m_1-m_2(modp-1) \equiv k(s_1-s_2)$, but is it enough to know learn and deduct the private key k?

is there any other or smarter way for C to learn private key k?

would really appreciate your assistance with it. thank you very much


texts: Why are there no MACs inspired by block cipher modes other than CBC and CFB?

texts:
I've been studying message authentication codes and I was wondering why a MAC can only be produced with AES in CBC and CFB mode and why not the other modes such as ECB, OFB and counter.

Why are CBC and CFB suitable modes to produce MACs? Is there a certain trait that makes them special when compared to the other modes?


texts: 2DES and 3DES against a DES build with complimentary

texts:
I saw this complicated question and I am not really sure about it, would appreciate your view on it.

Is the following build stronger than 2DES or 3DES with 2 different keys (or even normal DES)?

$DES(DES(x,k),\overline{k})$

what I think is that in regards to a $2^{56}$ key space, we need to perform the following:

regular DES: we need to schedule the key $k$, and then test $E(k,m),k'$;
regarding 2DES/3DES with two different keys: unsure, but I think that in this case we need to schedule $k_1 = k$ and $k_2 = \overline{k}$. I would appreciate seeing how to properly decide if it makes it a stronger build than those (2DES,3DES - both with two different keys).

For simplicity sake (and question sake) assume that the adversary has a small amount of known plaintext:ciphertext pairs.


texts: What is the smallest size of the hash output?

texts: Suppose we want to make the hash pre-image resistant to 40 bit security (success chance is $2^{−40}$). What would be the smallest size of the hash output?


texts: Relation between Key-exchange and Public-Key encryption schemes

texts:
Recently we have seen a lot of papers on Post-quantum key-establishment (key encapsulation mechanism or Key-exchange), largely due to the standardization call of NIST for PQ-protocols. However, most of the work for example : Kyber, NTRU-prime, NTRU-KEM focuses on key-encapsulation rather than Key exchange. Now my questions are as follows :

KEM is a unilateral protocol whereas key-exchange is a bilateral protocol. i.e key is chosen by the client and server gets the key via decryption. Intuitively bilateral protocols (FRODO and NewHope) looks better than the unilateral (KEM) protocols. As both the parties participate in choosing the key. Then why there is more focus on KEM?
Consider this scenario, if we assume that Key exchange establishes a random key on both sides then Client can pick up a random string XOR with the key and send the XOR'ed value to the server. Since, server has the same key, server can easily retrieve the random string of client. Hence, a key exchange can work as PKE (as ElGamal from DH) and subsequently as a KEM. This scheme will be CPA secure as by assumption the established key is random. Hence, Key-exchange can is more flexible than KEM. Is it correct?
I understand that the current key-exchange schemes have a very high failure probabilities than KEMs. And, Hence they can be converted to CCA secure schemes by well known BLack-box transformations for key re-usability. But if we can come up with Key-exchange schemes with similar failure probabilities as KEMs and able to convert them to CCA secure schemes then should we favour Key-exchange schemes more than KEMs?

I appreciate your help.


texts:
Can Skein be used as a secure MAC in format H(k || m)?

I understand it can work with HMAC, but it is fine as a one-pass MAC in the format above and resists length extension attacks. Is this assumption correct?

One of the Skein authors mentions that Skein has another MAC construction with a security proof in their paper, but I can't find it. Does anyone know how that works?


texts:
I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$.

So the question will be self-contained, I provide here the slide describing the protocol (credits to Moni Naor, Weizmann institute).

And the definition as copied from Goldreich's book (Foundation of Cryptography):

  Definition 4.7.3 (system for POK): Let $R$ be a binary relation and $\kappa :N\rightarrow [0,1]$. We say that an interactive function
  $V$ is a knowledge verifier for the relation $R$ with knowledge error
  $\kappa$ if the following two condition holds:

  Non triviality: There exist an interactive machine $P$ s.t. for every $(x,y)\in R$, all possible interactions of $V$ with $P$ on
  common input $x$ and auxilary input $y$ are accepting.
  Validity: $V$ satisfies the Validity requirement with knowledge error $\kappa$ if there exist a polynimial $q(\cdot )$ s.t. for every
  $P^*$, every $x\in L_R$, there exists a probabilistic oracle machine
  $K$ with oracle access to $P^*$, that run in expected polynomial time
  ad outputs a witness with probability at least $\frac{p-\kappa(|x|)}{q(|x|)}$ where $p$ is the probability that $P^*$ succeeds to
  convince $V$ to accept on common input $x$.

My Intuition:

First, it is known that if the commitment scheme is perfectly binding then the above protocol is a IZK proof system with soundness $1/2$.

Non-triviality requirement is trivial to satisfy (specifically, $P$ from the protocol itself satisfies it).
In regard to the Validity requirement, it is easy to construct a Knowledge Extractor

My question:

We know that the soundness of this protocol is $1/2$, so $p\leq 1/2$. Now, it required that there exists a poly $q$ s.t. $K$ succeeds to extract a witness with probability at least $\frac{p-\kappa (|x|)}{q(|x|)}$. If we assigne $p\leq 1/2$ and $\kappa =1/2$, how can such a $q$ exist?


texts: Picking a cipher suite for embedded system emails

texts: I have an embedded system product that emails out event notifications periodically.  I have implemented a non secured email version, but want to use SSL/TLS, if possible.  Can I only use 1 cipher suite for space considerations?  Or, do I have to support many types?  I'm trying to keep it simple, but not sure if there will be issues with just one or a couple.  Any input on how others would handle a simple one-way email feature using SSL/TLS?


texts: Prove knowledge of signature on committed value

texts:
Assume that a prover $P$, has previously obtained a signature $\sigma$ on a value $x$ from a verifier $V$. At a later stage, $P$ produces a Pedersen commitment $C$, to this value:

$C = g^x h^r$

I'm looking for a construction where $P$ can prove to $V$, in zero-knowledge, that they know that $C$ has been opened as well that a signature has been verified on that value, without revealing the signature.

I can find such a construction in Efficient Protocols for Set Membership and Range Proofs, but it uses bilinear-pairings, which I hope to avoid.

Is there such a construction available which is based on standard EC or modular groups?


texts: identity based cryptography (IBE) without key escrow

texts: I am trying to find a method of implementing identity based cryptography to generate key pairs without the use of a trusted PKG that holds the private keys. Has there been any solutions to overcoming this challenge?


texts: Fingerprint RSA public key in PKCS1 format

texts:
I can't find anywhere details on how to fingerprint a public RSA key in PKCS1 format.

There are a lot of examples on the internet on how to fingerprint an RSA public key in openssh format using ssh-keygen -lf id_rsa.pub but in my application I am receiving a public key in PCKS1 format and even if I can remove the -----BEGIN RSA PUBLIC KEY----- and -----END RSA PUBLIC KEY----- parts, base64 decode the contents and hash the resulting data, I can't find an example on how to verify this hash/fingerprint using openssl or ssh-keygen.

What am I doing wrong?


texts: If I have two different MD5 password hashes with two different salts (the salts are known), is there any way to cryptographically deduce if the two passwords match? Other than brute force password cracking, that is.


texts: How to reconstruct the static private key of a Diffie Hellman client, when I can freely choose A, g and p?

texts:
I am struggling with a Diffie Hellman crypto challenge based on a client that uses a static private key. My goal is to trick the client into revealing enough information to reconstruct the private key (2048 bits) of this client.
Let's call the vulnerable client Bob, while I am acting as a malicious Alice. This means that I act as a normal client and I can send arbitrary parameters ($A$, $g$, $p$) to Bob during the handshake. No matter what parameters I use, Bob will always use the same private key $b$ to calculate his public key $B$, which he sends to me.
$B$ is calculated by Bob as follows: $B = g^b \mod p$
My first approach was setting $g = 2$ and $p = 2 ^ {2 ^ {2048}}$, so that mod $p$ doesn't effect the result and I can calculate $\log_2(B)$ to get $b$. Unfortunately this crashes the client and it looks like $p$ cannot be larger than $2^{2048}$.
Next I studied small subgroup confinement attacks, because I am able to set arbitrary values for p and therefore choose it in a way that it allows for small subgroups. But while this allows me to gain some information about the private key, I wasn't able to craft a scheme that allows me to reconstruct the full private key.
I am currently investigating whether I can use the Chinese Remainder Theorem (CRT) to reconstruct the private key with a reasonable amount of data. In theory, I could gather the values $B$ for $2^b \mod p$, iterating $p$ over the prime numbers up to $2^{2048}$, apply CRT, and I will get the correct result, but that's of course not feasible. It would look something like this:
$2^b \equiv 0 \pmod 2$
$2^b \equiv 1 \pmod 3$
$2^b \equiv 4 \pmod 5$
$2^b \equiv 1 \pmod 7$
...
Maybe there is a helpful shortcut because $x = 2^b$, which is usually not the case in the basic CRT. In fact, I can set $g$ to an arbitrary integer, so if any other base than 2 is helpful, I can use it as well. Running CRT with a subset of primes (e.g. from 2 to 9973) shows, that the preliminary result for $b$ isn't an integer, because I don't know how to force CRT to only consider results of the form $2^b$.
So, my specific question is, how I can utilize the fact that $x$ for the CRT is of the form $2^b$? And my more generic question is, whether I am on the right track with CRT or if anyone can point me to another type of attack that I can experiment with in this scenario.


texts: Which 'info' and 'salt' parameters to use in HKDF for TLS 1.3?

texts:
all the following discussion is for HKDF in TLS1.3:

Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM)

as written in RFC 5869:

  HKDF without having to protect the secrecy of the salt.  In a    different application domain, a key agreement protocol deriving
  cryptographic keys from a Diffie-Hellman exchange can derive a salt
  value from public nonces exchanged and authenticated between
  communicating parties as part of the key agreement (this is the
  approach taken in [IKEv2]).

From what it seems, the client's random nonce is used for the salt,
but I cannot find any documentation about it in the TLS 1.3 RFC, am I
correct?

And regarding the 'info' paramter in HKDF-Expand(PRK, info, L):

Is it identical to the 'label' which's used in TLS 1.2 for PRF? Or
are there new values for TLS 1.3 when deriving keys?

I'm just really confused about which parameter should be passed in
each stage.

For example, when deriving the master-secret with the relevant hash,
shared-secret, which 'info' parameter should be passed?

Thanks in advance!


texts: Suppose that we have three authorities which each of them generate one secret/public key for Alice. It means that Alice has three secret keys and three related public keys. Suppose that Alice combines these three secret keys in a way with any kind of function and generate a new secret key (forth secret key), can he generate the related forth public key by any function or not? Is there any relationship between these two functions?


texts: How is the session key more secure than the public key?

texts:
From the website of GNU Privacy Guard (GnuPG):

If an attacker could decrypt a session key it would only be useful for reading the one message encrypted with that session key. The attacker would have to start over and decrypt another session key in order to read any other message.

From my understanding, if an attacker is able to decrypt a session key which was encrypted through a public key, then the attacker practically has the corresponding private key pair.
Hence, it is not difficult to decrypt any further session keys encrypted by the public key.
How does a session key make this any more secure? I can only see this as redundant security.


texts: RSA: Proving that $p+q-1 < 3 \sqrt{N}$, where N = pq and p,q are prime?

texts:
I'm doing some research into attacks on the RSA cryptosystem and have stumbled across Wiener's attack. Within the proof there exists the statement  "$p+q-1 < 3\sqrt{N}$".
No proof is given for this, and I can't seem to figure out why this statement holds. Could anyone help me figure this out or point me towards the relevant theorems?


texts: Inverse of a function $f_k(x) := f (x ⊕ k) ⊕ k$

texts:
$f : \{0, 1\}^4 → \{0, 1\}^4$

Given a function $f_k(x) := f (x ⊕ k) ⊕ k$, what is the inverse function $f_k^{-1}$?

I could not figure out how this would be done. Thanks.


texts: Why is password recovery so slow for Whirlpool hash, when compared with others?

texts:
I'm just curious about why brute force takes so much longer on the Whirlpool hash than it does on the others, as you will see below:

Passcovery Suite Version 3.50 build 3653 x64
Benchmark
CPU [Intel(R) Core(TM) i3-5020U CPU @ 2.20GHz]

Type: Microsoft® Word 2007
Protection: MS Office 2007, SHA1, 256-bit AES
Password recovery rate: 427 (453)

Type: OpenOffice v1.1
Protection: OpenOffice, PBKDF2/SHA1, 128-bit Blowfish
Password recovery rate: 10,654 (10,801)

Type: Blackberry 5.x backup
Protection: BlackBerry 5.x backup, PBKDF2/AES
Password recovery rate: 2,072,277 (2,082,185)

Type: WPA Handshake
Protection: WPA-PSK, PBKDF2/SHA1 HMAC/SHA1
Password recovery rate: 1,894 (1,900)

Type: RAR 3.x
Protection: RAR 3.x, SHA1, 128-bit AES
Password recovery rate: 383 (387)

Type: ZIP/Classic
Protection: ZIP proprietary algorithm, 96-bit
Password recovery rate: 26,890,751 (27,047,441)

Type: WinZip/AES
Protection: WinZip/AES, PBKDF2/SHA1, 256-bit AES
Password recovery rate: 12,891 (14,411)

Type: TrueCrypt volume
Protection: TrueCrypt volume header, PBKDF2/SHA-512/AES
Password recovery rate: 2,459 (2,476)

Type: TrueCrypt volume
Protection: TrueCrypt volume header, PBKDF2/RIPEMD-160/AES
Password recovery rate: 617 (627)

Type: TrueCrypt volume
Protection: TrueCrypt volume header, PBKDF2/Whirlpool/AES
Password recovery rate: 295 (302)

Type: Microsoft® Word 97
Protection: MS Office 97-2000, MD5, 40-bit RC4
Password recovery rate: 1,710,477 (1,703,046)

Type: Microsoft® Word 2003
Protection: MS Office XP-2003, SHA1, 128-bit RC4
Password recovery rate: 1,604,502 (1,602,161)

Type: Adobe® PDF
Protection: PDF /R 3, MD5, 128-bit RC4/AES
Password recovery rate: 125,753 (124,652)

Type: Adobe® PDF
Protection: PDF /R 6, SHA-256/384/512, 256-bit AES
Password recovery rate: 561 (563)

CPU frequency measured: 2195 Mhz

Raw results: 427, 10654, 2072277, 1894, 383, 26890751, 12891, 2459, 617, 295, 1710477, 1604502, 125753, 561

Also, one more question:

How much faster can I recover my password (20+ characters) from knowing nothing about it (it's been years since I last used it) using a GPU instead?


texts: Can we build authenticated encryption using Feistel Networks?

texts:
Most of the encryption modes of Feistel Networks especially the ones used to build fixed length block ciphers just provide confidentiality .

Can we build authenticated encryption using Feistel Networks ?


texts: Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core

texts:
Where should I look at in Bitcoin Core source code to figure out how the signature process transform a message in a curve point?

To sign a transaction (message) in the Bitcoin system, you need to encode the message to a point of the curve $y^2=x^3+7$. I read this Koblitz's paper. There are three encoding schemes. I read this question too.

If I look at in Bitcoin Core source code I can't see any of these encoding schemes, it seems to me that message $M$ is directly encoded in a point ($ \rightarrow \operatorname{hash}(M) $) without check; obviously that is not possible, there is roughly a 50% chance that a random 256 bit string doesn't correspond to a point of the curve. I can't find out how/if the ECDSA library checks if $\operatorname{hash}(M)$ is on the curve or not and especially what it does if the $\operatorname{hash}(M)$ is not on the curve.

What encoding scheme does Bitcoin-ECDSA implement and where is it in the source code?


texts: Impact of a non-uniform distribution in a secret sharing scheme

texts: When it comes to the secret sharing schemes, it seems that the random numbers need to be drawn uniformly. Is there any difference between the random numbers from uniform distribution and the non-uniform distribution? Do different distributions affect the security of the scheme?


texts: How can we define division operation by using Fully homomorphic encryption

texts: Last fews months, I'm working with homomorphic encryption. Now I am dealing with some computational problems with integers or real-numbers (like arithmetic mean, standard deviation) where division is necessary in homomorphic domain. Is there any practical solution of homomorphic division? I'm also looking for practical example.


texts: Correlation attack on Lagged Fibonacci Generator

texts:
Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$.

Say that the adversary intercepts some ciphered text (not the LFG output),
could they use it to perform a correlation attack to get the initial inner state of the LFG? And if so, how much ciphertext would be needed?


texts:
In this note, the manufacturer of a RSA key generation gizmo vulnerable to the new ROCA attack (see second section) explains that

  it is common practice to employ acceleration algorithms in order to generate key pairs, especially if time resources are sparse. (We) also utilizes such an acceleration algorithm in time-restricted cases, called “Fast Prime”. This algorithm is software-based..

  The foundations of “Fast Prime” date back to the year 2000. Its use started around ten years later after thorough reviews. As a sub-part of one cryptographic software library which is supplied to customers as a basis for their own development, this software function was certified by the BSI (Federal Office for Information Security) in Germany. No mathematical weaknesses were known, nor have been discovered during the certification processes.

What is “Fast Prime” and where was it suggested?

The following (likely) tells a property of primes generated by this method; but not how it really works, if that's a deliberate and/or following some article/method, if there was some goof at some point; which I ask.

The ROCA vulnerability/attack targets some RSA keys generated using “Fast Prime”. Details are in the paper: Matus Nemec, Marek Sys, Petr Svenda, Dusan Klinec, Vashek Matyas; The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli published at CCS 2017 (in a slightly earlier version).

Paraphrasing that article: the factors making the attack possible (presumably, those generated by “Fast Prime” ) are of the form
$$p=k\;M+(65537^a\bmod M) \ \ \text{ where } M=P_n\#=\prod_{i=1}^n p_i$$
with $p_i$ is the $i^\text{th}$ prime.

It follows that any public modulus $N$ made from primes generated in this way is such that $N\equiv65537^a\pmod{P_n\#}$ for some integer $a$.

The integer $n$ is chosen according to the desired bit size of $p$ (which is always multiple of 16), by discrete steps, in a way such that $P_n\#$ is a large fraction of the size of $p$
$$\begin{array}{c|ccc}
\text{bits in }p & n & p_n & \text{bits in }P_n\#\\
\hline
 256 \dots  480 &  39 &  167 &  220 \\
 496 \dots  976 &  71 &  353 &  475 \\
 992 \dots 1968 & 126 &  701 &  971 \\
1984 \dots 2048 & 225 & 1427 & 1963 \\
\end{array}$$

A former version of this question discussed the first published ROCA test for vulnerable keys. However that's obsolete: it turns out this test was intentionally simplified to limit disclosure about the vulnerability; the full test has even lower odds of false detection.


texts: Can we use a Cryptographic hash function to generate infinite random numbers?

texts:
I have seen that there are PRNG that can generate a specific number of random-numbers. The Mersenne Twister as an example, can generate 2**19937 (if I'm not wrong) but... can we use a cryptographic hash function to generate infinite random numbers setting any seed to it?
So I can set text for the seed and do it like this:

seed set to "myseed"
counter set to 0
first random number generated = first 64 bits of "myseed0" hashed with sha512
secound number = first 64 bits of "myseed1" hashed with sha512

Or we can save the other 448 bits left and use them later. The main idea, is 100% secure to generate PRN's from a hash function? why don't we do it?


texts: BLS aggregate signatures for relay node non-interactive incentive accounting

texts:
This is a practical application of cryptography question and I hope this is the right place to ask it.   Any advice would be very much appreciated.

I'm looking for a low-bandwidth, non-interactive protocol for proving a message has traversed some set of relay nodes.  These relay nodes communicate via radio and so can only communicate with a small set of nearby nodes.

The key protocol goal is how can you pass a message along a circuit of nodes and at the end prove no one who touched the message has been removed from the list of relays.

One naive solution is to just hash the public key of each relay node before they relay to the next node.  Any sequence of public keys that hashes to that final hash is proven to have been part of the circuit.  There might be some false nodes added, but no previous nodes are removed.

The problem is that anyone can reconstruct a chain of hashes that omits intermediate public key hashes if they know the first public key in the list.

We want a one-way non-interactive solution for bandwidth saving so there is no way to get the first node to sign the hash along the way.  We also don't know the exact list of relay nodes ahead of time.

Aggregate signatures seem like a way to solve this because instead of building up a hash, we have a signature which requires a secret key to generate it. Even if you know the public key list, you can't reconstruct a new sequence of signatures just by knowing the first public key in the list.

If you knew the aggregate signature at an earlier point, you could add your signature from there, but that's fine because it just means you have a shorter path, but you can't take the signature created from a longer path and factor out intermediate signatures after the first one with out having the private keys needed to create those signatures, even if you do know the exact sequence of public keys.

I'm thinking of BLS aggregate signatures as a solution because of their small size and that the protocol is non-interactive (signatures are simply multiplied together).

Am I missing some simpler way to do this?

Are there any other non-interactive schemes that accomplish signature aggregation besides BLS?


texts: What is the difference between a 'cipher' and a 'mode of operation'?

texts:
What is the difference between the term cipher (a name like RIJNDAEL) and mode of operation (like ECB)?

Aren't these both terms for the encryption/decryption technique?


texts:
It seems to me that any noise in the signal would result in Alice and Bob generating different keys, without a simple way to tell the difference.

How do quantum key distribution systems tolerate noise?


texts: I am using EAX AEAD with an 8-byte message header which carries a 32-bit sequence number, a message length, and some other bits that I don't mind exposing.  Assuming the sequence number never repeats for the same key, is there any security difference between treating that as a 4-byte nonce with 4 bytes of "associated data" or just calling it an 8-byte nonce and skipping any MAC calculations on the header?


texts: Multiplicative inverse ($17^{-1} \mod 31$)?

texts:
So. Sorry for bothering you with such a simple question, but I can't really get this done.

It's just an exam question in which I need to use CRT in order to calculate the RSA signature of a msg m=101(dec), given RSA public modulus n=527=p*q=17*31.

So using CRT I need to calculate $p^{-1}\mod q$, which is, for the Euclidean Extended Algorithm, equal to $p^{\phi(q)-1} \mod q$.
Or in other terms $17^{-1}\mod 31 = 17^{29} \mod 31.$

My exercise book shows a (imo) wrong result for this calculation.
Can you please do the calculation (I used a Square&Multiply strategy) and tell me what you get?
Also, is there any tool (online or not) which can help me doing fast MOD calculations like this one without having to do them manually?
Thanks in advance and sorry for the "useless" and "noobish" question.


texts: Do I have to know RSA padding scheme in advance when verifying signature with EVP_Verify*?

texts: Is there a way to figure out what RSA padding type was used on signature during verification (when calling EVP_VerifyInit, EVP_VerifyUpdate and EVP_VerifyFinal) or is it a matter of convention which has to be known in advance?


texts:
Assume we have the following scheme for RFID:
TAG & READER both have initially k keys.
Every session the TAG computes $k_i$=F($k_{i-1})$ where F is a function which computes XOR of previous key with randomly generated number, e.g. $k_i^R$=F($k_{i-1}^L$) $\oplus$ $r_i$ , $k_i^L$=F($k_{i-1}^R$) $\oplus$ $r_i$ where $r_i$ is a random number for session i. The READER receives ($k_i$, $r_i$) and performs same computation to verify $k_i$. If its correct replies with True either False. If READER replied True - they both add $r_i$ to the key set.
If reader replied FALSE or message didn't arrive - key set are not updated.
(if the message didn't arrive, READER does not respond at all).

I've read that one of the possible ways for analyzing this protocol is by creating a table of all possible keys which can be generated after obtaining $k_i$ and then looking for repeating rows.

What are other possible ways to analyze this scheme in order to find  vulnerabilities ?

Thank you

Edit: I've clarified more the question for what I asked, are techniques for analyzing the protocol disregarding technical problems like lost messages.


texts: Let $k$ be uniformly sampled from $\{0,1\}^\lambda$, $F$ be a secure PRP with block length $\lambda$ and let $Enc(k, m)$ be such that it returns $c = (F(k,r), r \oplus F(k,m))$ with $r$ uniformly sampled from $\{0,1\}^\lambda$. How to prove that this scheme is not CCA secure? In particular, how can an attack be thought of?


texts: Digital Dead Drops or guaranteed significant uncertainty of identity over TCP/IP for a large set of users

texts:
Client is part of a Set members. Every distinct object in members has in common, that they do want to communicate to the Server without the Server or other objects of members knowing the origin of each individual communication.

Required is a way for Client to upload data to the Server without the Server knowing about which of the objects of members the data belongs to.

Is there any way of implementing this besides open, cascaded proxy networks, which are in general rather slow, especially for large files?


texts: What are the consequences of not checking the server mac in a TLS connection?

texts:
The context for this question (it's quite involved) can be found in this document: https://docs.google.com/file/d/0B15itpMWb2ztWTJrYTgzX204OVU

However, I want to make it clear that you don't have to read or understand all of that document to answer this question.

Basically, this technique allows the audit of a TLS 1.0/1.1 session without revealing sensitive data (one can effectively choose which html or similar to reveal as part of the audit). However, it's necessary, during the loading of that single resource, that the client does not have possession of the server mac secret (they still have exclusive control of all other secrets - encryption keys and IVs). What potential attacks does that enable?

We should consider an external attacker as well as the 'auditor' (the one holding the server mac key).


texts: What are the dangers of using CPU clock drift for generating random data?

texts:
From what I understand, a physical source of true randomness could be achieved with a multi-core processor, by using clock drift between two or more cores.

However, a processor is easier to manipulate than nuclear decay or thermal noise when it comes to true random number generation.

My questions are:

Are there any attacks?
Are any of them practical?
Are there any steps that can be taken or conditions satisfied to prevent attackers from effectively manipulating the output of the processor?
And finally, how easy is it to bias the cpu virtually compared to properly implemented and secure CSPRNG libraries offered, like java SecureRandom?

My last question is really subjective to different libraries but if you can provide examples and scenarios or comparisons of potential attack vectors it would really help me understand.

I am currently under the impression that using a CPU for a TRNG is about as good as a software based CS-PRNG, but I could be wrong.


texts: Is it possible to decrypt double-key crypted file knowing public key and a having one or more original files?

texts:
I have some encrypted files with double-key. I know public key and don't know private key. Can I obtain the private key (and decrypt all files) using two version of one file - crypted and decrypted? And if yes, how?
Thanks a lot.


texts: What is the security strength of McEliece variants?

texts:
Please help me understand the security strength of McEliece variants prepared for Round 3.
I looked at the specifications - https://classic.mceliece.org/nist/mceliece-20201010.pdf - it doesn't have the security strength information - normally other algorithms submitted to NIST usually carry that information in the specification that they submit.
ISARA implementation of Classic McEliece - "6960119" variant is 128 bits?  and "8192128" variant 256 bits? Probably based on  https://classic.mceliece.org/nist/mceliece-20190331.pdf (though this specification does not talk about the security strength)
What about the other variants submitted for Round 3? How about the NIST Level for these variants?
https://en.wikipedia.org/wiki/McEliece_cryptosystem says 80 bits of security for some of the variants. The description further says "In its round 3 submissions to the NIST post-quantum standardization the highest level of security, level 5 is given for parameter sets 6688128, 6960119, and 8192128. "
How about the other variants what is their security level?


texts: Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve


texts: PIN-based authentication with Diffie-Hellman modular arithmetic

texts:
Given $\text{server}_\text{pub}= ((2^\text{largerandom}\bmod P) \cdot (2^{\operatorname{intvalueof}(“XXXX”)} \bmod P)^\text{pin})\bmod P$
We know the $\text{server}_\text{pub}$ and we know that $\text{pin} \in [0,9999]$.
What we want to find out is the pin. You could write it as $( (2^x \bmod P) \cdot Z ) \bmod P = \text{server}_\text{pub}$
$Z$ is one of 10K values.
I think somehow since $\text{pin} \in [0,9999]$ we should be able to brute force the value but I am unable to come up with the math to do so.
$(2^\text{largerandom} \bmod P) = (\text{server}_\text{pub}\cdot(2^{\operatorname{intvalueof}(“XXXX”)^{-\text{pin}}} \bmod P)) % prime$
So the question is: how can use the fact that $\text{pin} \in [0,9999]$ to determine the value  $(2^\text{largerandom} \bmod P)$. Where $\text{largerandom}\in [1, P-1]$ and $P$ is a large RFC-based prime.