texts: Clarification needed in TLS 1.2 key derivation process

texts:
Reference to TLS 1.2 standard documentation section 6.3 regarding the key generation here:

  To generate the key material, compute

  key_block = PRF(SecurityParameters.master_secret,
                  "key expansion",
                  SecurityParameters.server_random +
                  SecurityParameters.client_random);

  until enough output has been generated.  Then, the key_block is
  partitioned as follows:

  client_write_MAC_key[SecurityParameters.mac_key_length]
  server_write_MAC_key[SecurityParameters.mac_key_length]
  client_write_key[SecurityParameters.enc_key_length]
  server_write_key[SecurityParameters.enc_key_length]
  client_write_IV[SecurityParameters.fixed_iv_length]
  server_write_IV[SecurityParameters.fixed_iv_length]

I assigned them the the following variables:

$kc_{mac}$= client_write_MAC_key[SecurityParameters.mac_key_length]
$ks_{mac}$= server_write_MAC_key[SecurityParameters.mac_key_length]
$kc_{data}$= client_write_key[SecurityParameters.enc_key_length]
$ks_{data}$= server_write_key[SecurityParameters.enc_key_length]

In a DHE key-exchange, where the client and server exchanged the keys and both have $\mathit{premaster} = g^{xy}$.

The client and server compute the master secret:

$$ms = \operatorname{hkdf}(\mathit{premaster},\mathit{nonce}_\mathrm{client}+\mathit{nonce}_\mathrm{server})$$

Then both compute the session keys:

$$\mathit{kc}_\mathrm{mac}, \mathit{ks}_\mathrm{mac}, \mathit{kc}_\mathrm{data}, \mathit{ks}_\mathrm{data} = \operatorname{hkdf}(\mathit{ms}, \mathit{nonce}_\mathrm{client} + \mathit{nonce}_\mathrm{server})$$

The $ms$ is used in the Finished MAC computation as follows:
$\operatorname{MAC}(\mathit{ms}, \operatorname{hash}(\mathit{handshake}))$

The Finished messages are encrypted with the $\mathit{kc}_\mathrm{mac}$, e.g. the client Finished MAC:

$$\operatorname{enc}_{\mathit{kc}_\mathrm{mac}}(\operatorname{Finished}(\operatorname{MAC}(\mathit{ms}, \operatorname{hash}(\mathit{handshake})))$$

The data from client to server is encrypted as in:

$$\operatorname{enc}_{\mathit{kc}_\mathrm{data}}(\mathit{data})$$

My questions are:

Is my interpretation for the TLS 1.2 key generation and usage correct?
Are the master key $\mathit{ms}$ and the four session keys: $\mathit{kc}_\mathrm{mac}$, $\mathit{ks}_\mathrm{mac}$, $\mathit{kc}_\mathrm{data}$, $\mathit{ks}_\mathrm{mac}$ computed in in two consecutive steps, that is: after the Client Key Exchange and before the client Change Cipher Spec and Finished messages? or is there any other messages sent/received between them?


texts: Simulator in semi-honest model in real/model paradigm

texts:
Does a simulator in the semi-honest model in IDEAL/REAL model paradigm necessarily make use of the corrupted party's input?

For example, suppose a simulator given an input named $I$ and an output named $O$, tries to simulate the view of the real world. In this case, should the simulator necessarily use the input $I$ for the simulation? Or the simulator can simulate without the use of the input? Does it depend on the scenario?
If you need the exact scenario, please refer to the below link:

Exact Scenario


texts: Based off the various cipher suites available for TLS (which I am looking at here:https://www.thesprawl.org/research/tls-and-ssl-cipher-suites/), can anyone clarify if when the suite contains 'SHA', does it actually mean the orignal sha algorithm, or does it mean sha-1?


texts: What Java actually stores inside Keystore when generating Keys?

texts:
When we use Keytool to generate a Keystore to store Private/Public keys, what Java actually stores inside the Keystore file ?

I have observed that Keytool asks for the keypass and alias to generate the key, the alias can be used to retrieve any key from the keystore given that correct keypass is provided.

So, what actually stores inside a keystore file ?

1) an actual key ?
or
2)  the pair of keypass and alias, and the key is generated using that keypass/alias ?

What I think is, the keypass and alias are stored in the keystore and key is generated if correct data is provided, am I correct ? , If not, and Raw key is stored inside a keystore then what is the need of keypass at first place ?

For your convenience, here is more detail about keytool,

  Java Keytool is a key and certificate management utility. It allows
  users to manage their own public/private key pairs and certificates.
  It also allows users to cache certificates. Java Keytool stores the
  keys and certificates in what is called a keystore. By default the
  Java keystore is implemented as a file. It protects private keys with
  a password. A Keytool keystore contains the private key and any
  certificates necessary to complete a chain of trust and establish the
  trustworthiness of the primary certificate.

Parameters of keytool command

Keystore Parameters

genseckey
Generate SecretKey. This is the flag indicating the creation of a synchronous key which will become our AES key

keystore
Location of the keystore. If the keystore does not exist, the tool will create a new store. Paths can be relative or absolute but must be local

storetype
this is the type of store (JCE, PK12, JCEKS, etc). JCEKS is used to store symmetric keys (AES) not contained within a certificate.

storepass
password related to the keystore. Highly recommended to create a strong passphrase for the keystore

Key Parameters

keyalg
algorithm used to create the key (AES/DES/etc)

keysize
size of the key (128, 192, 256, etc)

alias
alias given to the newly created key in which to reference when using the key

keypass
password protecting the use of the key


texts: Proving key equivalence across different elliptic curves

texts:
We can use the technique described in this answer to prove key equivalence across two elliptic curves of different order. I'm wondering if modifying the technique as described below would compromise anything.

So, let's say I have committed to 2 points $A$ and $A'$ on two different elliptic curves with generators $G$ and $G'$. The curves are of orders $q$ and $q'$ such that $q < q'$. I've also publicly committed to a large random number $h$. I would like to prove that $A = a \cdot G$ and $A' = a \cdot G'$ while using this number $h$. I am thinking I could do the following:

Compute $r = a \cdot h$ (this the main difference from the linked answer).
Compute $T = r \cdot G$ and $T' = r \cdot G'$.
Compute $u = H(G, G', A, A', T, T')$ and use it to compute $v = r + a \cdot u$.
The proof is then $(T, T', v)$.

The verification works same as before: compute $u$ and verify that $v \cdot G = T + u \cdot A$ and $v \cdot G' = T' + u \cdot A'$. The verifier can also verify that I've used the number $h$ because $h \cdot A = T$.

Does the fact that I changed the first step as described above break anything?

Edit: the above approach makes it trivial to recover $a$ - so, it doesn't work. Maybe there is another approach that would work?


texts: If I make use of RSA PKCS#1 in v1.5 what padding length is used. Basically, it is not allowed that the plaintext is bigger than the modulus. But what if the length in bits is the same (padding to modulus size) but then the plaintext value is bigger than the modulus. How to avoid that?


texts:
I have a scenario where a client has a private set and the server has a large public set, we would like an estimate of the intersection size or more specifically the percent of the private set covered by the public set.

However we do not want to send anywhere near the entire public set over the wire, even a bloom filter would seem rather large.

It's OK for the server to discover the size of intersection but should not gain much about specific keys the client has.

Is this possible?
With priorities being minimizing communication, client compute, server compute in that order.


texts: ECDSA - why is the first part of the signature used in the second?

texts:
Using the terminology of https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm

Why is the second part of the ECDSA signature defined as:

$s = k^{-1}(z+rd_A)\text{ mod n}$

Could the scheme not work just as well without multiplying $d_A$ by $r$?

In other words we would have:

$s = k^{-1}(z+d_A)\text{ mod n}$


texts:
Consider following LFS register (where + denotes addition modulo 2)

I have found the output sequence as 1,0,1,1.

I know that The K(s) of a string s is defined as the length of the shortest computer program that generates s and given a non-negative integer c,s incompressible if K(S)>= |s|- c.

My question is:

Is the output sequence Kolmogorov - random?

I could not understand how to find c or s in this question.


texts: elliptic curve infinity point implementation returns exception

texts:
I am trying to implement an elliptic curve discret logarithm problem, but I have got a problem due to the representation of the infinity point. I tried this code :

first define what is an infinity point

    public Point infinity() {
        BigInteger xInfinity = new BigDecimal(Double.POSITIVE_INFINITY).toBigInteger();
        BigInteger yInfinity = new BigDecimal(Double.POSITIVE_INFINITY).toBigInteger();

        return new Point(xInfinity, yInfinity, this.E);
    }

then to test if a given point is an infinity point to return the same point when adding to it

public boolean isInfinity() {
    if (this.x == new BigDecimal(Double.POSITIVE_INFINITY).toBigInteger()
            || this.y == new BigDecimal(Double.POSITIVE_INFINITY).toBigInteger()) {
        return true;
    }
    return false;
}

but I still get an exception even if i try to calculate with simple points

  java.lang.NumberFormatException: Infinite or NaN

Thanks to help me solving this.


texts: Working on subgroup of $\mathbb{Z}^*_p$ in practice

texts:
It is said that, given a group $\mathbb{Z}^*_p$, we can always have a subgroup whose order is prime. To this end, for a safe prime $p=2q+1$, compute $x_i^2 \bmod p$ for all $x_i \in \mathbb{Z}^*_p$.

Questions:

Do we need to only work on the values that exist in this subgroup (whose order is prime)?
What if we need some values that do not exist in the subgroup, but they are in $\mathbb{Z}^*_p$?
To work on the elements of subgroup do we do $\bmod q$?

Because this way limits our choice of elements and we cannot work on any arbitrary values.


texts: Where should I store the private key (RSA) in a web application?

texts:
My web application receives encrypted data from another server encrypted with RSA keys.  Where should I store the private key (RSA) in a .NET web application (Windows)? It seems that putting in it in the application data folder (app_data) probably isn't ideal.  Is there a 'best practice' for this?

I wasn't sure if it's possible to convert the public/private key pair into another format and perhaps store it in the certificate store, but I'm not sure an RSA public/private key pair is even a "certificate".

If this was a PCI compliance issue, it seems I would not even be allowed to store them on the same server, but I cannot then see how one could implement decryption on the server?


texts: How to find a small generator with small inverse? Does it have negative impact to security? (for Schnorr subgroup of $\mathbb{Z}/P\mathbb{Z}$)

texts:
Given a prime $P$ with
$$P= r \cdot q+1$$
with $q$ prime as well.
I'm looking for a generator $g$ of the Schnorr subgroup with order $q$ which is small by value and has a inverse (to $\bmod P$) which is small as well:
$$|\{g^i, \forall i \in [0,P-1]\}| = q$$
$$g^q = 1 \bmod P$$
$$g < m \text{ } \land \text{ } g^{-1}<m$$

To find a Schnorr group generator $g$ in general we can pick a random value $h$ until
$$ h^r \not= 1 \bmod P$$
$$\rightarrow \text{ } g = h^r \bmod P$$
To find $g^{-1}$ we can use the Extended Euclidean algorithm or just compute:
$$ g^{-1} = g^{q-1} \bmod P$$

Questions:

Q1.) What is the best way to find $g,g^{-1}$ which are each less than value $m$?  (edit: found some with step-by-step computation. Main interest now is Q3 (edit-end))
Q2.) How small can $m$ be?
Q3.) Would a small $g,g^{-1}$ have any impact to security?

Trial for Q1: Ways to find small $g, g^{-1}$
a.) pick random $v$ number and project to Schnorr group $v_s = v^r \bmod P$
(all values but $1$ of a Schnorr group are generators)
b.) compute inverse with EEA or with $v_s^{q-1} \bmod P$ (any way faster?)
c.) check if  $g, g^{-1} < m$ . If not repeat a.)b.)c.)

Another way than random picks all the time would be an initial random pick for $g$, and a 2nd random value $w$ in this group to start from. Compute the inverse of both as well and traverse through the group with new generator $g^*_j$:
$$g_j^* = w \cdot (g)^j \bmod P$$
$${g_j^*}^{-1} = w^{-1} \cdot (g^{-1})^j \bmod P$$
$$w \cdot (g)^j \cdot w^{-1} \cdot (g^{-1})^j = 1 \bmod P$$
and test if $g^*_j$ and its inverse are smaller than $m$.
This computes the values faster but will it be faster in finding suitable generator? Can it be for certain values the results lay in a valley of bad values?

Trial for Q2: How small can $m$ be?
The product of $g, g^{-1}$ need to be at least $p+1$
That means $m \ge \sqrt{p-1}$
Is there another higher border for smallest $m$?

In general the equation need to hold:
$$g \cdot g^{-1} = a\cdot P +1 \equiv 1 \bmod P $$
$$a \in [1,P-2]$$

Can the factorization of $(aP+1)$ be used to solve Q1 ($g,g^{-1}$ products of factor(combinations))?
Any way to guarantee its inside the Schnorr group?
Or just check again with $g^q = 1 \bmod P$?


texts:
I'm trying to create BIP32 like key derivation for EKCDSA by riding over a  BIP32-EdDSA derivation

Can anyone tell me if there is a glaring problem with my conversion technique?

PrivateECKCDSA = First32Bytes(Hash512(PrivateEdDSA))
PublicECKCDSA = Convert_ED25519_to_Curve25519_public_key(PublicKeyEdDSA)

Can any buffer be considered an ECKCDSA private key? I know that because we are using curves and fields there might be some limitation (I'm really clueless about this).

Also can every EdDSA public key be converted into curve25519, or are some excluded?

If no named this conversion I'd like to call it the Yaffe Bender key conversion.


texts: Is it safe to seed a random number generator from system time?

texts:
It seemed to me that the Bouncy Castle SecureRandom class for C#/.NET only uses DateTime.Now.Ticks as its seed by default.

I was wrong, but wouldn't that be unsafe to do?


texts: Advantages of using intermediate hash over full hash in digital signature application

texts:
Description of intermediate hashes

Intermediate (or partial) hashes are canonical forms of digest state that can be transferred from one hash implementation to another, so that the other, limited device (e.g. a smart card chip) can finish the hash calculation with the remaining data. This scheme is used to create a signature generation system consisting of the devices performing the calculations.

So:

Terminal generates intermediate hash by processing the first i blocks of the message;
Terminal sends intermediate hash to the smart card;
Smart card finishes the hash with the last (N - i) blocks of data;
Smart card creates the signature and sends it back to the terminal;
Sends back the signature.

instead of:

Terminal creates full hash;
Terminal sends full hash to the smart card;
Smart card creates the signature and sends it back to the terminal;
Sends back the signature.

Obviously letting the smart card generate a full hash has drawbacks with regards to performance if the data to be hashed is large. This can still be an option, e.g. when the signature is generated over signed attributes instead of the content itself.

Intermediate hashes are not specified in the SHA-1, SHA-2 or SHA-3 standards.

Possible reason for using intermediate hashes

In my previous question I've already asked about if other protocols use partial hashes. Due to the limited amount of feedback there I'll probably have to conclude that they are not often used.

I've mused there that intermediate hashes could possibly be used to avoid covert channels, i.e. the insertion of data other than a hash into the signature generation. I'm not sure that this would pose a significant threat though (as the provider of the hash could also provide a hash over anything else).

Question

What cryptographic rationale is there to use intermediate/partial hashes instead of full hashes provided by the terminal?


texts:
I would like to know:

What is the currently best (efficiency and security wise) known EC based password authenticated key exchange protocol?
(i.e. is there any EC based protocol may be similar to DH based SRP protocol)
What is the certicom's patent number/title of elliptic curve Point Compression? (I have searched net but I couldn't find)
In EC based user authentication protocol, how is user ID is sent?
(i.e. sent in pain text or encrypted with RSA public key of server and then EC based key exchange is performed)


texts:
I'm reading about Zero-Knowledge-Proofs, in particular the argument of building a Simulator in order to prove the zero-knowledge property.
As expected, there's something that doesn't click yet.

Since a simulator is using a transcript to 'fool' the verifier, I understand the idea that since the Simulator knows nothing but the transcript, then the verifier can't extract any knowledge besides the statement being challenged.

Now, this doesn't prove that the verifier is not extracting knowledge from the transcript. If the transcript per-se has the knowledge, woudn't be a problem?.

Thinking it differently, if a monkey randomly type a Calculus book... yes, the monkey knows nothing about calculus, but a reading verifier would get real knowledge by reading his work.

Am I missing something?


texts: How to analyse the sensitivity in argmax in exponential mechanism of differential privacy?

texts:
Consider we have a database $D=[1,2,1,3]$, and the query for $\mathop{\arg\max}_{i} D_i$. So how to analyse the sentivity of the utility function?

for the sensitivity of $u$ equals to $\Delta u=\max_{i} \max_{D,D':\Vert D-D'\Vert_1\leq 1}\|\mathop{\arg\max}_{i} D_i-\mathop{\arg\max}_{i} D'_i\|$

Is it necessary to set an upper bound of $D_i$ to have the sensitivity of the utility function?

Thank you in advance.


texts: Graphically representing points on Elliptic Curve over finite field

texts:
I have taken elliptic curve $E\colon y^2=x^3-4x+20$, defined over $\mathbb{F}_{29}$.
The number of points on the curve, $\left|E(\mathbb{F}_{29})\right|=37$.

I took base point $P=(1,5)$, and got following results:

I want the results graphically to know the behaviour of the curve.

Is there any tool for this to show results graphically by giving input as curve points?


texts: Why is this authentication procedure using Rabin crypto not useful?

texts:
A friend asked me the following, pointing out that the method is not very useful (my problem is I do not see why it is not good):

Consider a person A which chooses $n$ as the public key for the Rabin crypto-system.
We want to be sure that we are communicating with person A so we send her a random item $r\equiv m^2 \mod n$.
Person A receives $r$ and decodes it using the factorization of $n$ and finds a square rot $m_1$ of $r$.
A then sends us $m_1$ and we check $r\equiv m_1^2 \mod n$.

Why is this not useful?


texts: Homomorphic encryption for vector addition

texts:
Building on the question and answer from Addition-only PHE in F# which ponders homomorphic cryptosystems to navigate, relatively, a single dimension without revealing absolute position (an encrypted counter?), I am now interested in extending this to multiple dimensions, the ability to do vector addition in HE.  i.e. $\varepsilon((x, y, z)) \oplus \varepsilon((a, b, c))$.

As in the referenced question, it is desirable to me that $\oplus$'s time complexity is just hyperlinear to the distance $|| (x, y, z) - (a, b, c) ||$.  One way to enforce this (but not the only way, perhaps) is to provide only 6 pre-computed $\varepsilon((a, b, c))$ ciphertexts representing unit relative moves.  If this is complete, then it seems to me that the key, whether symmetric or asymmetric, can be discarded.  I don't particularly like this because it has a bias in moving parallel to axes.  This paragraph has been causing a lot of confusion in the comments, but I'm too dense to understand the confusion.

If all 26 precomputed "cell" moves are provided, then moving diagonally has the bias.  Ideally, the time required should be proportional to the distance moved.  The complication here is that the time complexity for $\varepsilon(\overrightarrow{X}) \oplus \varepsilon(\overrightarrow{A})$ likely equals $\varepsilon(\overrightarrow{A}) \oplus \varepsilon(\overrightarrow{X})$, and of course since we'd know the magnitude of $\overrightarrow{A}$ then the time of the $\oplus$ operation would indicate the magnitude of $\overrightarrow{X}$ which is bad and would already be absent from any cryptosystem.  The only improvement I can think of is an FHE encoded custom $\oplus$ routine that cleverly incorporates the appropriate penalty.

The system should be deterministic - that is, there is only one ciphertext of any absolute position.

Is there an upper bound on the size of the ciphertext for, say, any 192-bit vector?  I believe that ciphertexts will not necessarily be the same width as the plaintext.  But then maybe that's only true for non-deterministic systems.

(... Otherwise,) if only the ciphertexts are seen, how easy is it to discover the bit width of the vector? (short of finding the periodicity which is not practical)

I assume that any $\oplus$ is blind to arithmetic overflow and just wraps around, which is desirable here.

I think the function I'm asking for is just a scrambled/hidden mapping between $\mathbb{Z}^3$ spaces.  Is this an unnecessarily complicated way of going about that?

$\varepsilon((0,0,0))$ cannot be obtained from  $\varepsilon(\overrightarrow{X}) \oplus (\varepsilon(\overrightarrow{A}) \otimes -1)$ or $\varepsilon(\overrightarrow{X}) \ominus \varepsilon(\overrightarrow{A})$ if $\ominus$ and  $\otimes$ are not available.

Thanks!

Edited to incorporate some of the comments discussion

New approach?

What about this new Indistinguishability Obfuscation (1, 2)?  Could a quine-like program, but one which takes a direction symbol as input, do the trick?  Each executable contains an embedded (and now secret) "point".  When the program is run, it outputs itself but with a modification of the resulting "point" instead of the exact original.  The program would have to also know how to indistinguishably obfuscate itself.  Are all the necessary operations bootstrappable like that?  The obfuscated programs are the coordinates.

How compact could they be?


texts:
Consider the following excerpt from Rueppels paper, titled When Shift Registers Clock Themselves:

His example includes $C(D) = 1 + D + D^2 + D^3 + D^4 + D^5$ as a primitive connection polynomial. However, this polynomial is not irreducible, let alone primitive, since it can be factored as $(1+D)(1+D+D^2)^2$ over $\text{GF}(2)$.

What am I missing?


texts:
There are some questions here concerning lattice-based cryptography and this kind of cryptography seems to be especially useful if quantum computers are assumed to exist.

When reading such questions I always asked myself: "What is a lattice?"

And now I'm asking here:

How is a lattice defined?
What's the most common operation performed on / with a lattice? (like doubling and adding in ECC)

If you need assumptions on what knowledge is available:
Solid knowledge on most non-quantum resistant cryptography, like teached in the HAC.


texts: Multiplication in elliptical curve cryptography

texts:
I'm practising for a cryptography test and came across this question:

  Let us assume that for a specific elliptic curve the formulas for the computation of $(x_3, y_3)=R+S$ are given by:

  $X_3=\sigma^2-x_1-x_2\ (\textrm{mod}\ p)$

  $Y_3=\sigma(x_1-x_3)-y_1 \ (\textrm{mod}\ p)$

  $\sigma = \frac{y_2-y_1}{x_2-x_1}\qquad \textrm{if R}\neq\textrm{S}$

  $\sigma = \frac{3x_1^2+5}{2y_1}\qquad \textrm{if R = S}$

  The following holds: $p=17$, $P=(3, 5)$, $a=3$, $k=2$, $M=(2, 7)$. Compute Q.

I understand the provided solution up until step 5.

  1.$\ Q=a\cdot P = 3\cdot P$

  2.$\ P= (3, 5) \Rightarrow 3\cdot P=2\cdot P+P$

  3.$\ 2\cdot P\Rightarrow(3,5)+(3,5)$

  4.$\ \sigma=\frac{3x_1^2+5}{2y_1}\qquad\ \ \ (R=S)$

  5.$\ \sigma =\frac{3\cdot 3^2+5}{2\cdot 5}=\frac{32}{10}=\frac{16}{5}=\frac{16\cdot7}{5\cdot 7}\textrm{ mod } 17=112\textrm{ mod }17=10\qquad\ \ \  (5^{-1}=7\textrm{ mod } 17)$

I understand that $16\cdot 7\textrm{ mod }17=10$, but where does the $7$ come from? Also, why is $5^{-1}=7\textrm{ mod } 17$ shouldn't that equal zero..?


texts:
I am reading the paper on GCM  The  Galois/Counter  Mode  of  Operation  (GCM)  . I have some doubts about the implementation of table M0 and R.

When I have to multiply by the variable P it is nothing more than a shift to the indexes. At the top of page 10 I have the example of multiplication by X · P and I suppose the one below is to multiply two elements.

  Z ← 0, V ← X
  for i =0 to 127 do
  if Yi =1 then
  Z ← Z ⊕ V
  end if
  V ← V · P
  end for
  return Z

From what I understand:

  V ← V · P

Is equal to:

  if V127 =0 then
  V ← rightshift(V )
  else
  V ← rightshift(V ) ⊕ R

According to the examples on page 9 in formulas (3) (5), would they be the same, right?

Well already on page 11 in the example of the deconposition of X (7), xi refers to 1 byte of X, but my doubt is in P ^ 8i, in the first for 8 · i would give zero and at the end when i is 15 would be 120. That part I don't really understand.

Going to algorithm 3 and its explanation above:

  while i> 0 do
  M ← M[2i] · P
  i ←li/2J

Assuming that the value of i is 64, that cycle would multiply by P eight times if I am not mistaken.

Well and in the part of the multiplication by P:

  M ← M[2i] · P

Is equal to:

  if  M[2i]127 =0 then
  M ← rightshift(M[2i])
  else
  M ← rightshift(M[2i]) ⊕ R
  end if

And the 247 additions would be:

  M[i + j]= M ⊕M[j]

Everything explained above is fine, it would be enough to build table M0 and R? But I don't understand the following elevation P^8(i+1) and P^128.

Thanks.


texts: Is symmetric encryption vulnerable to plain-text-attacks?

texts: Imagine that Bob sends a message to Alice for symmetric encryption to send to Charlie. (Only Alice and Charlie know the key.) Alice sends the encrypted message back to Bob to send to Charlie. Can Bob compare the plain text he sent to Alice with the encrypted version to guess, for example, what is Alice's AES key?


texts: Efficiently show/prove knowledge of third party secret without leaking information

texts:
Say Alice publishes (i.e. all parties in the universe) a key or certificate $x$ and sends a secret $s$ to Bob.
Bob then publishes some data $d$ (his identity or a message or smt.) and an authentication of the data using the secret, $auth = mac(d,s)$.
Dave can now verify the authenticity of $d$, $verify(auth,x)$, and must not be able to extract substantial information about $s$, even when Bob reuses $s$ for different messages.
Furthermore, Alice may produce many $(x_i,s_i)$ pairs and all parties have limited computing resources.
Finally, the identities of all parties are known and private sidechannels are possible (so $s$ can safely be transmitted to Bob).

This can be implemented using public-key cryptography with $x$ being the public key and $s$ the private key. However, the (public key) algorithms I know of rely on large prime generation (or other costly operations), which I presume is too costly when in practice Alice produces lots of unused key pairs.

Is there a cheap solution to the scenario above?

(the title may be a bit off — if only I knew what I was looking for)


texts: Real life systems that use concepts of crypto computing

texts: Are there any working cloud/internet solutions/products that operates on encrypted data such as systems using homomorphic encryption, secure multiparty computation, electronic voting, private information retrieval?


texts: Bob has an EC key pair. How can he receive a small integer in the least compute intensive way?

texts:
Alice wishes to send Bob a number $n$ between 0 and 255.

Bob has a private, public EC key pair $(b, B)$ where $B = bG$ and $G$ is an already agreed upon base point on the ed25519 curve.

Alice could roll a random number $r$ and perform a Diffie Hellman exchange to compute the shared secret $rB$. Alice could then use the shared secret $rB$ as a symmetric key to encrypt $n$, resulting in an encrypted payload $p$. Alice can then send Bob $R$ and $p$ where $R=rG$.

Bob would compute the shared secret as $bR$ and then use this as a symmetric key to decrypt the payload $p$ to discover $n$.

This requires Bob to perform some considerable computation, particularly the EC multiplication required to calculate $bR$.

What alternative method can Alice use to send $n$ to Bob, making use of Bob's EC key pair $(b, B)$, which would require the least taxing computation by Bob?

We are not too concerned with how taxing the computation is for Alice. It's only Bob's computation time that we wish to minimize.

Assume that observers of the communication are aware that some number $n$ between 0 and 255 is being transmitted. It is important that only Bob can discover Alice's choice of $n$, and important that an observer cannot detect when Alice sends the same value of $n$ to Bob twice. Observers are aware of Bob's public key $B$.

Given that many different people will want to send Bob a number $n$, it is perhaps likely that a good solution may involve Bob using a pre-computed lookup table of some sort.

The transmission to Bob cannot be interactive.


texts: Salsa20 expands a 256-bit key and a 64-bit nonce into a 2^70 byte stream - where did the 2^70 come from?

texts:
From Section 3.1 in DJB's document on The Salsa20 family of stream ciphers- https://cr.yp.to/snuffle/salsafamily-20071225.pdf

Salsa20 expands a 256-bit key and a 64-bit nonce (unique message number) into a $2^{70}$-byte stream.

Where does this $2^{70}$ number come from?


texts: How long to wait to feed hashing using SHA 256?

texts:
I have a source which generates secrets at $8-10 bits $ per second. I need to use this secret to feed another generator every second. I am wondering how long should I wait while I am concatenating 8 bits every second and then use longer bits as input to hash.

I have two options:

Use 8 bit that I get every second, hash it and send to next level every second.
Wait for say 10 seconds then hash the final say 100 bit. In between for 9 seconds keep sending hashed value of previous 100 bit using public informations.

Which one is more secure?
I am using HKDF for hashing.


texts: (EC)DSA signature without hashing, or with offloaded hash?

texts:
In (EC)DSA as per FIPS 186-4, the message to sign is first hashed. Imagine that we skip this hashing stage, instead put the message where the hash was, and constrain the size of message $h$ to the original hash's output width $N$ bits. The resulting scheme is vulnerable to (at least) these existential forgeries ($q$ is the multiplicative group order):

any signature for message $0\le h<2^N-q$ is also valid for message $h+q$;
a valid signature for messages $h=0$ and $h=q$ is easy to obtain: in DSA, $(r,s)$ with $r=s=y\bmod q$ does the trick, where $y$ is the public key; there's an analog with ECDSA, which $r=s=x_A\bmod q$, where $x_A$ is the $x$ coordinate of the public key, and $q=n$.

Are other attacks possible? In particular, does temporary access to a signing oracle allow a total break (key extraction or other mean to sign any message)?

The question is of direct interest when one wants to lower the communication overhead between a signing device and a host using it to (EC)DSA-sign large messages: can we fully offload the hash computation to the host? I believe that holds (and as noted in comments, that seems to be practice), but can we demonstrate that? If not, how can we safely offload most of that computation, without breaking standard conformance?


texts:
A variation of the CBC mode is the Inﬁnite Garble Extension.

I can neither find a block diagram of it, nor the formulas for encryption and decryption. I would really like to learn more about it but there is not much online information available which helps.

What is the main difference between "normal" CBC and the CBC Inﬁnite Garble Extension if I decrypt blocks ?


texts: Difference left-or-right CPA security, IND-CPA security

texts:
I am trying to understand the notion of left-or-right-CPA (LOR-CPA) security for private-key encryption schemes introduced in my lecture. If I understood it correctly so far, the only difference to the standard IND-CPA game is that the encryption oracle always encrypts either the left or the right given message and that the attacker can query the oracle as often as it likes.

I am given the following game definition:

Generate key by running KeyGen $k \leftarrow KeyGen(1^n)$
Choose random hidden bit $h \leftarrow \{0,1\}$
Prepare an oracle $O_{LOR}$ called left-or-right oracle. When called with $m_0, m_1 \in M$ returns $c \leftarrow Enc_k(m_h)$
Call attacker A with $1^n$, attacker outputs two messages $m_0, m_1$ of same length
Call $O_{LOR}$ that returns $c \leftarrow Enc_k(m_h)$, give c to A, and await guess h'
If h' = h ACCEPT, else REJECT

My questions are:

In what sense is this security notion stronger than the notion of IND-CPA security?
Doesn't the standard IND-CPA game also always encrypts the left or the right message, dependent on the hidden bit?


texts: I have been academic papers about Rijndael, Serpent, and Twofish, and there is this term that is vague to me. I cannot find a tangible definition in google. Can someone briefly define, describe, and/or give examples about security margin and where it is used.


texts:
Suppose I receive a list of 1 million coinflips, and I want to know how likely it is that the list was randomly generated.

My first thought would be to count the number of heads and tails, which should be evenly distributed (around 500.000). But suppose the distribution looks normal, its still possible the list contains patterns or repititions. For example, the first half of the list may be the heads, and the last half the tails. In real random data, that would be highly unlikely.

So how do you calculate the 'randomness' of this list?


texts:
I'm trying to build an encrypted database where we can't trust on the database manager. And since encrypt data in a deterministic way is bad, attackers can recover information doing frequency attacks, I had the following idea:

|Names         |bucket|
|0xF32(Michael)|2     |
|0x321(Simon)  |1     |
|0xG3F(Simon)  |1     |
|0xT2A(Ana)    |1     |

As u can see Names is encrypted in a random way, and the bucket is calculated with some function where f(Simon) = 1;
And now if a client wanna get all Simons in the database he will execute f(Simon) =1 and query the database where the bucket value = 1. In this way, database will give to client Simon and Ana's value. And the client will discard Ana. In this way, database will not know what values correspond to Simon.

My main problem is a way to get a function where it gives me collisions but not a lot.


texts: Have any PAKE extensions been added to TLS 1.3?

texts:
In TLS 1.2, there was TLS-SRP (RFC 5054,) which provided a password-authenticated key exchange (PAKE) protocol for use with TLS. However, it apparently relied on handshake messages that have been removed from TLS 1.3 and, thus, is not applicable to TLS 1.3. TLS 1.3 does still support the PSK-DHE handshake, but it doesn't provide PAKE properties since it allows offline brute-force attacks. It appears that there was a proposal to add a PAKE extension for TLS 1.3 back in 2018, but the draft appears to have expired and I haven't seen why it was allowed to expire or if anything further came of it.
Has anything been done since then to add PAKE support to TLS 1.3? Are there any active proposals?


texts: Montgomery Exponentiation - selecting input value R for a given BigInteger

texts:
I have Montgomery exponentiation working, but it's working quite slow. I suspect there are two reasons for this - I implemented it bit size instead of word size (I didn't realize at the time that software implementation should use word size).

The second is how I select R. Given a modulus N with bit length n, I'm calculating R by raising 2 to the power of the bit length of N, n. i.e. This is way all the examples I've seen use, but they all use small numbers. Every number I'm dealing with here has at least 1024 bits.

BigInteger R = new BigInteger("2").pow(n.bitLength());

I suspect this might be why my Montgomery is running slower than my Right-To-Left binary implementation - can anyone give me a more efficient way of selecting r? (In as simple English as possible please!)

Edit - the full code is at - https://codereview.stackexchange.com/questions/18199/optimization-of-exponentiation if anyone want to have a look at it.


texts: How does a Hashing algorithm always result in a digest in a fixed size?

texts:
This question revolves around the Hashing Algorithm attribute that the resulting digest is always the same size (also known as Fixed Width). For example, whether you hash the word "hello", or 10gb file, MD5 will always return a 128 bit digest.

My question is, how do hashing algorithms always result in a constant length digest ?

The only operation I can think of is the MOD / remainder operation that regardless of the starting value, after doing a MOD operation using modulus X, the result is always a value between 0 and (X-1). But I am specifically curious if there are other operations that also serve in reducing (or increasing, I guess) the digest size to get to the desire digest length.

note: I am not interested specifically in how MD5 does it, but in what operations exist that any hashing algorithm might use to always ensure the same size digest


texts: Most secure but feasible encryption running on WWII technology

texts: Imagine you are transported back to ~1940. What is the best (i.e. most secure, but technologically feasible) encryption you can think of for widespread (i.e. military) use? How would you implement it?


texts: Why does plain RSA not work with big messages ($m>n$)?

texts:
From what I can remember, RSA is something like this:

Generate 2 distinct prime numbers $p$ and $q$ that have similar bit length.
Compute $n=pq$ and $\phi(n)=(p-1)(q-1)$
Compute $e$ such that $1<e<\phi(n)$ and $\gcd(\phi(n),e)=1$. It is optimal for $e$ to be prime
Compute $d$ such that $ed\equiv1\pmod{\phi(n)}$
To encrypt a message $m$ into cipher $c$, compute $c=m^e\pmod{n}$
To decrypt a cipher $c$ into message $m$, compute $m=c^d\pmod{n}$

But for large $m$ values, this does not necesssarily work.

Let me use an example to demonstrate what I mean:

Let $p=1999$, $q=2039$, and $e=65537$ (note, all of $p$, $q$ and $e$ are prime)
Compute $\displaystyle n=pq=1999\times2039=4075961$
Compute $\displaystyle \phi(n)=(p-1)(q-1)=1998\times2038=4071924$
Compute $d$ such that $65537d\equiv1\pmod{4071924}$  by solving the Linear Diophantine Equation $\displaystyle 65537x-4071924y=1$

Steps to solve (using a bad implementation of the Extended Euclidean Algorithm)

$\displaystyle 65537\times63-1\times4071924=56907$

$\displaystyle 1\times65537-1\times56907=8630$

$\displaystyle 1\times56907-6\times8630=5127$

$\displaystyle 1\times8630-1\times5127=3503$

$\displaystyle 1\times5127-1\times3503=1624$

$\displaystyle 1\times3503-2\times1624=255$

$\displaystyle 1\times1624-6\times255=94$

$\displaystyle 1\times255-2\times94=67$

$\displaystyle 1\times94-1\times67=27$

$\displaystyle 1\times67-2\times27=13$

$\displaystyle 1\times27-2\times13=1$

Therefore, these things can be substituted:

$\displaystyle 1\times27-2\times(1\times67-2\times27)=5\times27-2\times67=1$

$\displaystyle 5\times(1\times94-1\times67)-2\times67=5\times94-7\times67=1$

$\displaystyle 5\times94-7\times(1\times255-2\times94)=19\times94-7\times255=1$

$\displaystyle 19\times(1\times1624-6\times255)-7\times255=19\times1624-121\times255=1$

$\displaystyle 19\times1624-121\times(1\times3503-2\times1624)=261\times1624-121\times3503=1$

$\displaystyle 261\times(1\times5127-1\times3503)-121\times3503=261\times5127-382\times3503=1$

$\displaystyle 261\times5127-382\times(1\times8630-1\times5127)=643\times5127-382\times8630=1$

$\displaystyle 643\times(1\times56907-6\times8630)-382\times8630=643\times56907-4240\times8630=1$

$\displaystyle 643\times56907-4240\times(1\times65537-1\times56907)=4883\times56907-4240\times65537=1$

$\displaystyle 4883\times(63\times65537-1\times4071924)-4240\times65537=303389\times65537-4883\times4071924=1$

Through calculation, we conclude that $\displaystyle d=303389$ because $\displaystyle 65537\times303389\equiv1\pmod{4071924}$

Example 1

Encryption

Let $m=113$, then, $c\equiv(113^{65537})\pmod{4075961}=3345792$

Decryption

Let $c=3345792$, then, $m\equiv(3345792^{303389})\pmod{4075961}=113$

It works this time! Good!

Example 2:

Encryption

Let $m=33555553$, then, $m\equiv(33555553^{65537})\pmod{4075961}=2621940$

Decryption

Let $c=2621940$, then, $m\equiv(2621940^{303389})\pmod{4075961}=947865$

It does not work this time! What the ----?

Is this message too big to be encrypted? If so, how do we make it smaller?


texts:
Consider the following hash function:
$$(V\cdot A + V\cdot B)^2 \bmod C$$
$A, B,$ and $C$ are large primes. $V$ is the value to be hashed and is guaranteed to contain at least as many bits as the largest prime.
Ostensibly, this should provide an excellent level of collision resistance.
Now assuming that the primes in question are large enough, computing the reverse should be unfeasible. Correct?


texts: Side Channel Analysis (CorrPA), comparison between HW-results and measured power traces

texts:
I think I have missed something very fundamental.

I am trying to understand the step in DPA where you compare your hypothetical power consumptions with your measured ones.
The Matrix H with Matrix T.

Matrix T is of size D x T, where D is the number of data blocks and T is the number of measured points in one power trace. This implies that an element value in this matrix T can be of 0.58W (just an example).

If I use Hamming Weight, as power model, I will end up with a real number.
E.g., 0110 0111 = 5 (dimensionless). How can this number correlate with the power traces that are in Watts? (e.g., If I use Pearsons).


texts: Is this SHA-256 modification still valid?

texts:
We typically model a hash function (in particular $\mathrm{SHA}$-$256$) as a function $H:\{0,1\}^{2^{64}-1} \to \{0,1\}^{256}$ with some special properties that makes them useful in practice. In this case, the probability for a collision is around $2^{-256}$ which is assumed to be infeasible in practice.
Now (because $256$ bits seems too long to handle for me), I want to cut some of them off and still keeping an (almost) infeasible probability of having a collision. In other words, which is the correct amount of bits I have to truncate so that I still have a good collision resistance? It is just $2^{-m}$, where $m$ denotes the bits that you keep from the beginning?
To illustrate what I mean, Imagine that the beginning of two outputs of $H$ are $1011100...$ and $1011000...$. If I just decide to cut off $4$ bites then I have a collision ($1011$), otherwise I don't.
Where could I find when (and why) a probability is "low enough" in practice? I assume it is something related with computer's limits...

The idea behind this question is using tracking hashes easy to handle by users. An upper bound for the number of users is $2$ millions. Since $256$ bits is too large (it is still large if you use base-$16$ or base-$64$), we though to prune some amount of bits if it is secure to do that. Two users with the same pruned hash would mean a disaster.


texts: Do i need MAC if i sign the message with for example ed25519?

texts: If I understand correctly MAC makes sure that the encrypted message isn't altered, so I presume signing the message with for example ed25519 would do the job too. Am I right?


texts: how to choose a random secret key for ECDH

texts:
I am a beginner, I can understand the basics of ECC and elliptic curve, i can't find where I missed to understand. But I have a great doubt in ECDH regarding below. Could any of you please clarify for me? I will ask with the help of an example.

Example:

Let $G=(1,3)$ be the generator point with order $n=18$ for an elliptic curve $E(13,24)\bmod29$. I want to calculate Public key for both Alice and Bob.
Now Let the secret key of Alice be $A=5$ and of Bob be $B=7$ (such that the scalar which is multiplying with $G$ should be less than the order $n$ of the generator point).
Now the public key of Alice is $P_A=A\cdot G=5\cdot G=5(1,3)=(19,7)$
and the public key of Bob is $P_B=B\cdot G=7\cdot G=7(1,3)=(15,6)$
Now after transmitting the public key mutually, the parties have to calculate the shared secret key.
The shared key of Alice is $S_A=A\cdot P_B=5(15,6)=(23,1)$
and the shared key of Bob is $S_B=B\cdot P_A=7(19,7)=\mathcal O$(Point at infinity).
The shared secret supposed to be the same. But I am getting the point at infinity instead of $(23,1)$. How to overcome this?
My doubt is,if this is the case how can the sender and receiver get the  shared key in ECDH?
If not, kindly quote where I did mistake here and in what i misunderstood?


texts: modular exponentiation as a one-way-hash

texts:
As far as I can tell most one-way hashes apply some iterated encryption algorithm to the input data.

What would be the issues with a one-way hash based on some fixed large prime $p$ and a generator $g$ with $h(x) = g^x \bmod p$? Is it just that the methods used for modern hashes are even harder than the discrete logarithm?


texts:
It would seem to a naive eye that if you have a MAC, you have a hash function: use a key that all the parties know (such as all-bits-zero).

A potential application would be a resource-constrained platform where code size is at a premium, and which needs to implement AES for confidentiality: instead of also implementing SHA-2 for integrity verifications, it could use e.g. AES-CMAC.

Is there a reason not to do this? Is the existence of hash functions alongside MAC due to security? Performance? History?


texts: How the condition $s \geq 8$ is determined in Lindner-Peikert cryptosystem?

texts:
In Lindner & Peikert paper, the authors propose that to set the cryptosystem's parameters, one should choose $q$ to be large enough to allow for a Gaussian parameter $s \geq 8$.

My question is, how this condition ($s \geq 8$) is obtained? I guess this lower-bound on $s$ relates to the smoothing parameter, but I can't figure out how it is determined?


texts: How to convert AES to a PRNG in order to run NIST Statistical Test Suite?

texts: I want to run statistical tests on my implementation of AES. How should I convert it into a PRNG? Is there a standard way to go about doing this? I could not find much information about this although this was done by NIST while during the selection of AES back in the days.


texts: Camellia Sbox - Linear Approximation Probability

texts:
One Page 7, of Document Camellia Design and Analysis

The author says,

  In the case of Camellia, the maximum diferential/linear probabilities of s-boxes are $2^{-6}$.

Since Camellia S-boxes are made up from Affine-Inverse-Affine Transformation in $GF(2^8)$ which has Linear Approximation Probability of $2^{-4}$, then why authors wrote it $2^{-6}$.

Does Camellia S-boxes have Linear Approximation probability of $2^{-6}$ or $2^{-4}$?

any body calculated it?


texts: Can two traitors safely reveal themselves to each other?

texts:
Suppose Alice is a traitor and suspects Bob might also be a traitor. If Bob is a traitor, she would like to conspire with him together, if not she doesn't want to reveal that she is a traitor.
Is there a protocol Alice and Bob can engage in that would reveal that they are either:

Both traitors
Not both traitors

With a trusted third party, this would be be easy. Both Alice and Bob reveal their traitor/non-traitor status to the TTP and if both are traitors the TTP tells them so, if only one or none of them are traitors the TTP just says they are not both traitors.
But is there a way without a trusted third party?
I did some research and found this might be an example of a fair exchange and thus be technically impossible without a TTP. Most of the info I can find on fair exchange is over my head though and I thought this situation might be unique in that it involves agreement on potentially the same information, the protocol equivalent of an AND operation. And of course there is that feeling of "it's such a simple problem, how could it be impossible?" so I had to ask.


texts: How difficult is it to find the "pre-image" of a block cipher?

texts:
Say that I have

$$ C_1 = AES_{k_1}(M_1) $$

How difficult would it be to find a key, K2 and plaintext M2

$$ C_2 = AES_{k_2}(M_2) $$

such that

$$ C_1 == C_2 $$

How would using a block cipher algorithm other than AES effect this problem?


texts: Why only non-prime order fields have small subgroup attacks?

texts:
Why don't prime-order curves have small subgroup attacks?

It seems that I can choose a Generator such that it has a small order, maybe 2 points, and so an attack could generate all of the points in that subgroup and figure out the scalar that exponentiated it.

Why only non-primes this is possible? Do prime fields have subgroups of a certain size, that ensures this?

Also is it correct to say "prime-ordered curves" ? It is the Field that the curve is defined over that has prime order, so I feel like i'm saying it wrong.


texts:
I want to find an algorithm to get a private/public key pair where one coordinate of the public key has some specific prefix (for example: 20 leading zeroes).
In the secp256k1 case (the Bitcoin curve), G. Maxwell has found a public key with coordinate

x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63

( see https://bitcointalk.org/index.php?topic=90982.msg13789635#msg13789635).
In that case 22 zeroes means 88 bits, and he claimed to have found the private key too. Obviously $2^{88}$ random tries are computationally infeasible, then I think that the Birthday Paradox should be used (to reduce the steps from $2^{88}$ to $2^{44}$). But I can't understand how to apply the Pollard Rho algorithm (the classic Birthday Paradox - based algorithm) to this specific task.  Any ideas?
EDIT1:
It is very simple to find only a public key with as many leading zeros as you want without the private key, for example:

x = 0000000000000000000000000000000000000000000000000000000000000001
y = 4218f20ae6c646b363db68605822fb14264ca8d2587fdd6fbc750d587e76a7ee

are the coordinates of a valid point of the secp256k1 curve because they fulfill the equation $y^2 = x^3 + 7$ mod $p$
That's why I'm pretty sure that G.Maxwell has the private key too (otherwise his public key would have nothing special)
For now I know that if I generated about $2^{44}$ random points, I would find a "partial" collision, i.e. I would find a couple of points $P_1$, $P_2$ with $x_{P_1}$ and $x_{P_2}$ that share the first 88 bits. How do I use this information to find a point $P_3$ with 88 leading zero bits?
EDIT2:
Very strange: it seems that it takes $2^{88}$ steps to find a private key to any public key with a specific 88 bit prefix,
but it takes only $2^{128}$ steps to find a private key to a single specific public key (with a specific 256 bit "prefix") using the Pollard Rho algorithm  (see http://andrea.corbellini.name/2015/06/08/elliptic-curve-cryptography-breaking-security-and-a-comparison-with-rsa/ or https://blog.coinfabrik.com/wp-content/uploads/2016/06/ECDSA-Security-in-Bitcoin-and-Ethereum-a-Research-Survey.pdf)
Then to find a private key to any public key with a specific m bit prefix, with $m> n/2$, Pollard Rho is the best shot, with $m\leq n/2$ the fgrieu method is the best.


texts: What happens if I remove client certificate from TLS

texts:
If I have a TLS authentication process between two entities A and B, like the one outlined below, what would happen to it, if I remove the client's (A) certificate from it? In this case, the certificate of the client is defined as {A,pk(A)}inv(pk(s)).

A->B: A,NA,Sid,PA

B->A: NB,Sid,PB,
  {B,pk(B)}inv(pk(s))
A->B: {A,pk(A)}inv(pk(s))
{PMS}pk(B),
{hash(NB,B,PMS)}inv(pk(A)),
{|hash(prf(PMS,NA,NB),A,B,NA,NB,Sid,PA,PB,PMS)|}
  clientK(NA,NB,prf(PMS,NA,NB))

B->A:   {|hash(prf(PMS,NA,NB),A,B,NA,NB,Sid,PA,PB,PMS)|}
  serverK(NA,NB,prf(PMS,NA,NB))

Of course the client loses it's way of authenticating itself with the server (B), but in what way exactly does this make the message exchanges vulnerable to attacks?

Another way to frame the question would be by looking at the Wiki description of the TLS handshake. In the client-authenticated TLS handshake, what would happen if we omit the client certificate?


texts: How to better generate large primes: sieving and then random picking or random picking and then checking?

texts:
I'm writing an RSA algorithm, and am wondering what is the best and/or usual way to choose the initial prime numbers (p and q).

I know of two methods to achieve this, one based on a prime number sieve and another based on primality tests:

Use a prime sieve to find prime numbers within a random range, and then randomly pick a prime number from the output of the sieve.
Pick a number at random, and then test whether or not it is prime.

What is the best method, both from a security and efficiency perspective?


texts:
Can anyone help me understand key entropy the mathematics behind it and the uses for it?
I understand most of it but I just want to understand what does $\log 2$ do like if I do. $\log 128 / \log 2 = 7$?

The Professor has really confused me here on this one on what the $\log 2$ mean? formula;
$Entropy = \log(Phrases)/\log 2$

The professor gave this formula, too: How many bits can represent $X$ phases? Just take the $\log X$, and divide by $\log 2$.


texts: In RSA encryption, can I calculate d given only m,n,c and e?

texts:
Newbie here. Not familiar with cryptography; just interested and reading up about it from time to time.

We know that the RSA problem (let's say $c=m^e \bmod N, c^d= m \bmod N$) is about recovering $m$ given $N, c$ and $e$. However, if given $N, m, C$ and $e$ - can I recover $d$?


texts: can session key be be used as digital signature?

texts:
if two communicating parties share a (symmetric)  session key, k.

When one of the party wants to send a message 'm' to other, is it okay use {m}k as a digital signature?


texts: I'm searching Why the SHA-1 is collision resistance? Anybody could help me with the proof or say me where I can find this proof?


texts: Assume that A and B have exchanged their public keys beforehand. Now, A and B wants to communicate over an insecure channel and want to provide integrity and confidentiality on the message. A use the shared secret calculated using DH to encrypt the message using a symmetric cipher. If B can decrypt the message, can B be assured that this message is written AND encrypted by A?


texts: What is the difference between substitution cipher and block cipher?

texts:
I'm studying(and clearing my head) about block cipher. I started from Caesar Cipher which can be considered as a kind of substitution cipher (if my understanding is right).

And an ideal substitution cipher (in 26 alphabets) is the two functions $E(x,k)$ and $D(x,k)$ where $0 \leq k < 26!$. And given $k$, one of the bijection(substitution) functions is (uniformly)selected and used to substitute a letter.

What I thought here is that this is also a block cipher. (1 letter is 1 block)
I read https://en.wikipedia.org/wiki/Substitution_cipher and it says

  Although the number of possible keys is very large ($26! \approx 2^{88.4}$, or
  about 88 bits), this cipher is not very strong, and is easily broken.
  Provided the message is of reasonable length (see below), the
  cryptanalyst can deduce the probable meaning of the most common
  symbols by analyzing the frequency distribution of the
  ciphertext—frequency analysis.

I feel this description is talking about the problem of ECB mode in block cipher.

So my understanding so far is that substitution cipher can be considered as a block cipher. But I'm wondering if a block cipher is always substitution cipher.

What is the difference between them in general.


texts: What place do prime numbers have in cryptography?

texts:
My understanding of hashing and encryption is rather limited. I certainly do not understand the mathematical formulas at play in these algorithms. With that said, what part do prime numbers play in cryptography?

When I was in college, one of my professors told me that the fact that there is no formula to predict a prime number (other than just trying them) is what makes many encryption schemes (like PGP) so secure, since it's not possible to guess the number used for the public/private key in any reasonable amount of time. Is that correct?


texts: AES+CTR+HMAC Encryption and Authentication on an Arduino

texts:
In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel.

We have chosen AES in CTR mode as the cryptographic cipher of our choice, transmitting the initialization vector and the message number in clear such that both know which to use (next).

Since encryption is not enough (and integrity actually much better), we are also pondering which authentication algorithm to use. HMAC-SHA256 or simply SHA-256 seem to be suitable candidates. We would encrypt then authenticate.

The questions are:

do we need to authenticate the initialization vector?
is SHA-256 enough for authentication purposes, or should we use HMAC-SHA-256?
if we use HMAC-SHA-256, should we use a different key than the one used for AES encryption?
is SHA256 a good choice to use for the initialization vector? We would use only 128bit of the resulting hash in case of short messages, or multiples of 128 Bit

Or should we pertain to other solutions?


texts: In a TLS 1.3 connection, how do the client and server choose a mutual cipher suite?

texts:
According to KeyCDN, TLSv1.3 connections are established in a single round trip:

  While TLS 1.2 requires two round-trips to complete the TLS handshake, 1.3 gets the job done in just one trip

If that is the case, then the client's first message (after the TCP handshake) must include everything that the server will need for symmetric encryption, including the key and cipher suite. That means that the client would have to choose a suite without any input from the server.

How can the client be sure to pick a cipher suite that the server supports?


texts:
This may seem like basic crypto knowledge, but why do hash functions like SHA-2 and Whirlpool have round constants that are absorbed into their respective states?

I can understand that in a cipher you need some way to incorporate a variable secret key, but there are no such user keys for hash functions.  All the round constants start off from fixed (and publicly known) values. I thought that substitution and permutation operations were sufficient for encryption. So, why XOR in round constants?


texts: What would happen in DSA/ECDSA if there were a collision in $r$ but not $k$?

texts:
In DSA, the value of $r$ is generated as:

$r = (g^k \bmod p) \bmod q$

ECDSA is similar, using the $x$ coordinate of the generator $g$ scalar-multiplied by $k$, again taken modulo $q$.

It's well-known, particularly by Sony, that $k$ must be different for each message signed, or the private key leaks.

Due to the construction, it is possible, but unlikely, to generate two different $k$ values that result in the same $r$ value.  If you happen to generate two signatures of different messages that have the same $r$ value but different $k$ values, does it break security?


texts: Using a LibSodium CryptoBox KeyPair with `crypto_sign`

texts:
More of a theoretical question...

Taking a system where Lib Sodium has been used for asymmetric encryption, where a "crypto_box_keypair" has been generated, and the public key has been distributed to a number of different systems.

Would it be possible to sign a message using that keypair?

As in, the message remains in plain text, and a signature is generated with the secret key (possibly indirectly), and anyone in possession of (and trusts) the public key, can verify that the message hasn't been tampered with.

Considering that the "crypto_sign" function requires the use of "crypto_sign_keypair", not "crypto_box_keypair".

From a PHP implementation point of view, I was wondering if you could...

Take the keypair that has been previously generated by:

<?php
$key_pair = sodium_crypto_box_keypair();
$key_secret = sodium_crypto_box_secretkey($key_pair);
$key_public = sodium_crypto_box_publickey($key_pair);
?>

Then, for every message you want to sign, create a "crypto_sign_keypair", and use sodium_crypto_sign() as intended:

<?php

// $sign_seed = random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES);
// $sign_pair = sodium_crypto_sign_seed_keypair($sign_seed);

$sign_pair = sodium_crypto_sign_keypair();
$sign_secret = sodium_crypto_sign_secretkey($sign_pair);
$sign_public = sodium_crypto_sign_publickey($sign_pair);

$message = 'Hello';

$message_signed = sodium_crypto_sign($message, $sign_secret);

?>

The $sign_secret and $sign_pair can be destroyed, because the recipient just needs to use $sign_public:

<?php
$message = sodium_crypto_sign_open($message_signed, $sign_public);
?>

The problem is that $sign_public needs to be sent to the recipient.

Where they need to verify it hasn't been tampered with, and that it came from the owner of the original $key_secret, by using their trusted copy of $key_public.

Noting that:

sodium_crypto_sign_detached is basically the same thing, but does not contain the message in its output.
sodium_crypto_box requires the recipient to have a keypair as well.
sodium_crypto_box_seal uses the public key to encrypt.
sodium_crypto_secretbox and sodium_crypto_aead_* use a shared key (symmetric).
sodium_crypto_auth uses a shared key.


texts: How to use CPA on AES128-CBC with constant Key and IV to leak info?

texts:
I'm doing a challenge in which I need to login to a server as an admin to capture a flag.
I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters.
The flow is as follows:

The client side creates a message of a specific format:
$$M = {id}\text{-}{password}\text{-}{cookie}$$
Where "$\text{-}$" acts as delimiter and $cookie$ is a constant postfix to ensure that the message was sent from the expected server (kind of like a signature).
Then the client adds padding of null bytes and encrypts $M$ using AES128-CBC and the same key $k$ and same iv $IV$ is used every time, for which I don't have access to.
The ciphertext is encoded in hex and sent (I do have access to the sent message)

After some analysis I found that if I obtain $cookie$ I can login as an admin.

What attack should I try to implement?
Can I get my hands on $IV$ or even $k$ using CPA when they are reused in CBC mode?
What additional information I should try to gather which can help me?


texts: modfied man in the middle attack diffie hellman

texts:
I have been given a problem in preparation for my cryptography final that I'm not sure how to solve. It asks me to suppose a scenario where instead of where an attacker would intercept some message from Alice ($g^a$) mod p and ($g^b$) mod p from bob, and then replacing each of these with $g^e$, the attacker would replace it with $g^q$ where $p=mq+1$, $p$ is the large prime upon which Alice and bob have agreed, $m$ is a small even number, and $q$ is another prime.

Why are there exactly $m$ values for $k$?
Why is this attack any better than the attacker simply raising $g$ to their own value ($e$)?


texts: Proving security for Secure Multiparty Computation with malicious adversaries

texts:
In the case of malicious adversaries, while creating a simulator for an attacker in the real world what are the algorithms that this simulator has access to and why?

For eg. I've seen simulators that use the adversary in the real world and also rewind them.

I do not understand what powers are given to the simulator and why.


texts:
I recently skimmed over tho papers on time-lock encryption:

“Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan
“How to Build Time-Lock Encryption” by Jager

To get the data released on a specific point in time they'd extract some information from the blockchain, which can only be obtained if the blockchain has reached a certain size) and use this as a witness for witness encryption:

Is there any "easy" instance of witness encryption or can it be otherwise "simply" explained or visualized?

Requested level and amount of detail: Enough to understand how easy versions work and what they actually do. Knowledge of cryptographic standard primitives (hash, cipher, AE, …) can be assumed if neccessary.


texts: Why does "gpg --export-secret-keys" ask for a password?

texts:
What is it about the architecture of GPG that requires me to enter the password of the secret key when I export it with "gpg --export-secret-keys"?

I would expect that gpg can just copy the relevant part out of the keyring and dump it into a file, without a password prompt. After all, the exported form is still encrypted with my password.


texts:
In RFC 8017 modBits is the length in bits of the RSA modulus n
I am using 2048 RSA key
modBits = 2048?
modBits = 2048 % n?
lets say n = 10 decimal = 1010 binary
then modBits = 4?
in my 2048 RSA key DER file n uses 257 bytes
then modBits = 257 *8 ?
which modBits = ... is true?


texts: Necessity of changing $p$ and $q$ when your private key is exposed?

texts: Suppose your private key $d_1$ has been exposed. Instead of changing $p$ and $q$, instead you just choose a new public and private key (say $e_2$ and $d_2$) and use these instead. What kinds of attacks could someone perform knowing $N,e_1,e_2,d_1$ (where $e_1$ is the first public key)?


texts: I have just undergone a one semester course in cryptography. I was introduced to multiple theoretical aspects, the way several algorithms work, the methods and their stability and so on. Due to time constraint, not much of problem solving was done. I want to understand more of cryptography through practical problems. How do I go about it ? Relevant web sites can also be included. Thanks !!


texts: Why is modulo being used for congruence in SHA-2 padding when the outcome is always the same?

texts:
I am reading up on SHA-2 algorithms and I came across this paper: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf

In section 5.2.1 it talks about the formula for padding a message. There is states there is congruence between:

$$\text{message length} + 1 + k$$
and $$896 \pmod{1024}$$

To calculate $k$ (the amount of zeroes) the following example is given for a message length of 24:

  896-(24+1) = 871

I am wondering though why is $896 \pmod{1024}$ used when the outcome of this is always constant? Why not simply use the number 896?


texts:
I'm currently developing a product that requires user data to be encrypted on the client side.
The product is a web app + a browser extension, so the focus is encrypting user data with Javascript. The concept is similar to what 1Password or Lastpass do, basically never storing user data in plaintext, and only the user has a key to decipher his/her own data.
I'm storing log entries for the user, though the concept can be expanded.
I've researched the subject quite a lot and found an article on medium with an approach that seems interesting: https://rhamedy.medium.com/encryption-decryption-of-data-based-on-users-password-using-pbkdf2-aes-algorithms-592f8c1bb79a
Based on this, I came up with a process I think works, but since I'm not a security/cryptography expert, this is definitely not something I want to take lightly.
Documentation source for the functions mentioned here: https://nodejs.org/api/crypto.html
Current Idea
1. The user kicks off the process by enabling this logging feature
At this point, on the server side, I generate a random 32 byte salt plus a 32 byte random IV using crypto.randomBytes(32), give them to the user and I store them in a document in a database so the user can retrieve them later.
2. Key generation
The user defines a master password (#1 concern here).
With the master password, the salt, using 10000 iterations and HMAC SHA256, the user can generate a Key Encryption Key (KEK) with crypto.pbkdf2().
At the same time, the client also generates a 256 bit AES key using crypto.generateKey().
3. Key Encryption
The client encrypts the generated AES key with his KEK + the IV, and sends it to the server, where we add it to the user document (now containing a Salt, an IV and the newly added ciphered key). The client can do this with crypto.createCipheriv() using AES-GCM.
4. After all of that
Now for encrypting/decrypting data, the user would just need to grab his document containing the Salt, IV and key.
With his Master Password + Salt, the user can recreate the KEK. With the KEK + IV, the user can now decipher the key. For actually encrypting and decrypting data now, the user can use this key + a randomly generated IV for each ciphertext, and I can store into the DB both of them.
Questions

Is this approach secure or am I missing something here?
Any library recommendations for server side and client side? WebCrypto looks good but the Node docs suggest it's still experimental (https://nodejs.org/api/documentation.html#documentation_stability_index)
What is the best practice for storing secrets in the user's device? Specifically, when the user decrypts the key, this needs to be stored somewhere. Is the browser's localStorage good enough? At this stage, this key is already in plain text, so I assume storing it, even if temporarily, could be a concern.

Thank you very much!


texts: Quantum resistance of Lamport signatures

texts: The Lamport-Diffie signature scheme is said to be quantum-resistant. Why is that? What would a quantum attempt to attack this signature scheme look like, and how does it fail?


texts: Can Shor's algorithm compromise RSA when both the public and private key are secret?

texts:
If RSA is to create a public-private key pair and encryption is performed on plain test P to create ciphertext C, given P and C could Shor's algorithm be used to find either of the public and private keys? You have both the plain text and cipher text but neither of the keys.
The fact that it seems pointless to use RSA if both the public and private keys are secret has come up a few times now so let me explain. I would like to use RSA because it has the property that if plain text P is encrypted with key K1 and the result is encrypted with key K2, assuming K1 and K2 have the same modulus base, this will produce the same ciphertext as encrypting P with K2 then K1.
If there is another more secure encryption scheme that has this property then I would be very interested in knowing about it. Otherwise, I will need to use RSA which is why I am asking about RSA's strength against quantum computers.
Also, the module base would be publicly known as well. The only secret information would be the exponents in the key pair.
Purpose
It has been asked what the value of key commutativity is. It allows one party to encrypt a secret text P (known only to party A) with the secret key K of another part (known only to party B). This is how:
let P = plain text (known only to party Alice)
let C = ciphertext (known only to party Alice)
let K = key (known only to party Bob)
let U = intermediate key (known only to party Alice)
Alice encrypts P with U and sends it to Bob. Bob encrypts this with K and sends this back to Alice. A removes the initial encryption (using U's decrypting pair) getting C.
C is the same as if P were encrypted with K without the involvement of the intermediate key because the keys commute.
Schematic:

Alice and Bob can only see things that are on their "side" (both the keys and the texts). the wall of equal signs represents this separation. the arrows represent text being transferred from one place to another and the keys intersecting the arrows represent encryption of the text traveling through them. I hope this is a clear explanation of this process. I'm not familiar with any traditional way of drawing these sorts of schematics. I someone could direct me to some information on how to draw one I would be happy to learn it and rewrite my schematic in that format.


texts: How to determine secp256r1 or secp256k1 is used on the web sites

texts: I'm pretty new at Cryptography (and at Cryptanalysis), but I went to the website Elliptic to try to discover the elliptic curve they use, and I found they use ECDP 256. So, by SEC2 I discovered they do use either secp256r1 or secp256k1. How can I know which one they do use? I do also need to find the base point they are using. Where can I find that? Thanks.


texts:
Suppose you need to authenticate yourself to a program with the password - but the program's source code is public, the program doesn't have access to any private information and all your communications with the program are public.  The only privacy you have is the information that you have but don't send.

No fixed password could work because the first time you used it, everyone would know it, and all subsequent runs of the program would be compromised.  One partial solution would be to have a different password every second.  But naive password generation wouldn't work, since both the source code of the program and any information it has access to are known.

Is there a (secure) way for the program to quickly generate password hashes, so that a trusted user with the right information could quickly generate passwords matching those hashes?  This would be difficult to attack iff it is hard to predict the next password given the next hash and all the previous passwords.  It is easy to make it so that nobody can come up with passwords (just randomly generate hashes), but making it actually possible for one person to generate passwords (quickly) given a little secret information seems much harder to me.


texts:
My understanding of an ideal block cipher is as follows:

For a block cipher with block size $n$, there are $2^n$ possible plaintexts. The number of possible keys (mappings) would then be $2^n!$.

The size of a single key would then be $2^n$ because you're choosing one full permutation from the set of all possible permutations.

EDIT: Now that I think about it some more, the key size would be the required number of bits to express the number of possible permutations. So for 24 permutations, that would be a 5-bit key size. For 40,320 permutations, that would be a 16-bit key size.

Is this correct?


texts:
In section 3.2 (page 10) of Vikram Singh's paper A practical Key Exchange for the internet using Lattice Cryptography, he gives the number of elements in each set for odd $q$. However, the results do not match my calculation of the number of elements in each set for odd $q$.

For example, given an odd prime $q=17$, you can see that calculated result does not match. Can anyone explain this discrepancy?

$\textbf{Randomized Rounding Procedure:}$

Let $q=17$. Thus $q\bmod 4 = 17\bmod 4 = 1 \implies q \equiv 1 \pmod4$

Now,

$$I_0 = \mathbb{Z}_q \cap \left[0,\tfrac{q}4\right) = \mathbb{Z}_q \cap \left[0,\tfrac{17}4\right) = \left[0,4\right)$$
$$I^{\prime}_1 = \mathbb{Z}_q \cap \left[\tfrac{q}4,\tfrac{q}2\right) = \left[\tfrac{17}4,\tfrac{17}2\right) = \left[4,8\right)$$
$$I^{\prime}_0 = \mathbb{Z}_q \cap \left[\tfrac{q}2,\tfrac{3q}4\right) = \left[\tfrac{17}2,\tfrac{51}4\right) = \left[8,12\right)$$
$$I_1 = \mathbb{Z}_q \cap \left[\tfrac{3q}4,q\right) = \left[\tfrac{51}4,17\right) = \left[12,17\right)$$

For odd $q$ the number of elements in each set is:

$$\left(\begin{array}{cc}\#I_1 & \#I_0 \\ \#I^{\prime}_0 & \#I^{\prime}_1\end{array}\right) = \left(\begin{array}{cc}\tfrac{q-1}4 & \tfrac{q+3}4 \\ \tfrac{q-1}4 & \tfrac{q-1}4\end{array}\right) \textrm{ for } q \equiv 1\pmod4$$
$$= \left(\begin{array}{cc}\tfrac{16}4 & \tfrac{20}4 \\ \tfrac{16}4 & \tfrac{16}4\end{array}\right)$$
$$= \left(\begin{array}{cc}4 & 5 \\ 4 & 4\end{array}\right)$$

But $I_0 = \left[0,4\right) = \left\{0,1,2,3\right\}$ (No. of elements is not 5), and $I_1 = \left[12,17\right) = \left\{12,13,14,15,16\right\}$ (No. of elements is not 4)

So, the number of elements in $I_0$ is not 5. Why?


texts: Looking for a fully transcribed codebook

texts:
I currently need a way to turn English text into different English text that can then be turned back.
The resulting text doesn't need to make sense or to be grammatically correct, but it must at least use english words.
From what I can tell this is usually done using a code, which requires a codebook.
I was able to find mentions of specific codebooks, but could not find their actual contents.
The closest I could get was the U.S. State Department codebook that has pictures on the Codebook Wikipedia page. Some editions of this codebook are kept at the National Cryptologic Museum in the USA, but their online portal contains only pictures of the book and its cover, without much on its contents.
This page contains information on various versions and editions of the State Department codebook, but without transcriptions of the contents.

Are there available tools that can encrypt text using a code?
Or are there fully transcribed codebooks available online? If so where?


texts: Affine transformation in AES: Matrix representation

texts: I know that the affine transformation of the AES can be represented both as a polynomial evaluation over $\operatorname{GF}(2^8)$ and as a matrix-vector multiplication (see, e.g., p.212 C.4 of The Design of Rijndael for the polynomial representation and p.36 3.9 for the matrix-vector multiplication). I would like to know how this change of representation is done. In other words: given the polynomial representation (or maybe a slightly different polynomial), how can we come up with the matrix-vector representation? Is there some algorithm for this, or is the only way to do it just by "brute-forcing" all possibilites?


texts:
SHA-256 is a well know hash function that creates digests of 256 bits. This means that the size of the digest space is 2^256 (or at least it should be), ie, the range of the digest space is:

from 0x 00 00 00 ... 00 00 00
to 0x FF FF FF ... FF FF FF

Question
However, is there any kind of limitation in the SHA-256 algorithm that would not allow a specific range of digests?

For example: 0x 00 00 00 ... 00 00 00 and 0x FF FF FF ... FF FF FF are two possible digests for SHA-256 or it is impossible to exist a message that would hash into those values?


texts:
SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations?

I tried to set up TLS-SRP protocol, but it haven't worked for me.

Haaalp! Someone?


texts: Privacy of randomness using extractors and PRGs

texts:
The Wikipedia article on randomness extraction states that they are different to pseudo random number generators but the distinction is very hazy. Both seem to take in some input quasi-randomness and produce a uniformly random output.

I'm interested in the security aspect of the generated output. I want my final randomness to be private. For PRGs, knowing the seed completely compromises the generated output. Is this also the case for extractors i.e. they are only as secure as the privacy of the input randomness?

More generally, if I have no control over the privacy of my source of randomness, is there any way I can generate (assuming a public protocol that I follow) a private and random string?


texts: Why choose an authenticated encryption mode instead of a separate MAC?

texts:
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?

Assume there is no implementation reason to pick one or the other (crypto library supports both, no backward compatibility constraints, etc).


texts: secret and unique random number generator within a range

texts:
I am trying to think of a way to generate secret and unique random numbers within a range.

Say we have a public range [1-n], how could we have a maximum of n users choose a random number within this range and ensure that no one else chooses the same number.

The difference between this question and others is that we want to keep the chosen number a secret this time.

It would be okay to have a third party facilitate the process, however, I would still like the third party to not learn anything about the final number generated for the user.

Is this feasible?


texts: Ciphertext notation where the ciphertext consists of two parts

texts:
I've see in several places (here or there) the notation $c = (U, V)$ or $c =\langle U, V \rangle$, where $c$ is a ciphertext (to be transmitted).

But as both $U$ and $V$ are "key-like". I can't find if the key to be used on the other is $U$ or $V$.

From the context, I guessed it means "Encrypt $V$ with $U$ (ie the key) to produce $c$".

Can anyone confirm me this ? They are quite commons notations, but I can't find their meaning.


texts: Padding to increase entropy and size of (otherwise) small JSON objects

texts:
Maybe this better fits, the security stackexchange...

I'm building a web API. We want to enable some relatively simple encryption, instead of going full-blown OAuth2 (which frankly, IMO, sucks). So I decided to use JWT. Anyway, it could happen for some requests that the request or response payloads are very small. Something like this for example:

{
    "order_id": 7
}

I imagine that when you encrypt something as small as this that it'd be relatively easy to brute-force. Therefore I'd like to increase the size of the payload by doing something like this:

{
    "order_id": 7,
    "padding": "kjt4J78vwzXXKEpuaodwOeTes2O5IIM5mUieNrxlRRWg1K0gXK164hstyL42QlQhKwoKCfVuA2eEJ8Pb1Sdm5tdRxXNNTl55dzrENzMBvrybGjeaHz8c7awmFmiHIsFsQ6gFKTzK2afZV483V4sjYVlYCy9C4pqU2BTK3YaonfxocG57UQwxlharNIhl8qqWbxCjEF7za9b6Sf1YfjHo2WoQ38miqSHr1aDlDWi35UZmHkYXpNVG7SoB3lfTYJ0Y"
}

This should work, unless I'm missing something. But ideally, I'd like to prevent the padding from being visible after decoding the JSON payload. I considered using a comment to that end, but JSON does not allow comments and apparently most implementations stick to the specification in that regard.

So is there a better way to do what I want, with the padding disappearing after decrypting/decoding? If anyone has an alternative for JWE, which does not involve OAUTH, I'm also all ears.


texts: Proving impossibility for a stronger primitive

texts: I have a primitive $A$ which is impossible to prove under some hardness assumption in a black-box way. Now, if another primitive $B$ is stronger than $A$ - in other words $B$ implies $A$ - will it imply that $B$ is also impossible to prove under the same hardness assumption in a black-box way?


texts: What does SSL use? RSA? El-Gamal? Elliptic curves?

texts: I'm not sure what SSL uses to share the symmetric key to both end users, i.e. at the beginning of the communication. Is it RSA? Or El-Gamal? Or something else?


texts:
I was looking at this image about OAEP:

..and was wondering what was happening here.

We have a data block DB which consists of:

lHash: What is this and where does this come from?
PS: A string of zeros, but how much zeros?
M: clearly our message.

We have a seed which , is some random number. We put this seed into a MGF, a Mask Generating Function, and XOR the outcome with the MB. This is our maskedDB. Correct?
We put the  maskedDB to the MGF again and XOR it with the seed. This is our maskedSeed.
For the final EM (encrypted message) we prepend some zeros. What do we do with EM then?


texts: Separate TLS Client Write and Server Write Keys in AES-CCM Mode

texts:
I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system.  I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing encryption and MAC to use the same key.  I would further like to combine the server write and client write keys into a single key for both directions because I would like to avoid having 2 expanded keys stored for each open session.

Nonce non-reuse in this case is achieved through a combination of a per-device ID and an incrementing frame counter, but I can also add an extra bit to differentiate client versus server writes at the nonce level, ensuring non-reuse of a nonce/key combination between both halves of the conversation.

Can anyone foresee a specific possible problem with doing this?

(PS: I am aware of the normal reason for separate encryption keys for each direction, and for separate MAC/encryption keys for modes other than CCM and GCM.  I am also most interested in specific possible problems, and would really like to avoid making a decision that would consume extra memory and degrade performance purely based on the vague/non-specific/unjustified/fear-motivated 'best-practices' that I've found so far.)


texts: Why is the payload size is restricted when using RSA

texts:
Doing some research about cryptography, I've read many times that, when using RSA 1024 and PKCS#1, the size of the payload cannot be bigger than 117 bytes.

This payload cannot be bigger than the modulus size, which is the key size in bits / 8  (1024/8 = 128 - bytesFromPKCS1 = 117).

But why does this limitation exist? Is it in the formula? if so, why?

Thanks for the answer :)


texts: How to find 64 collisions for a hash value?

texts:
The first block $M_0$ is one of 64 possible values, whereas the next six blocks $M_1...M_6$ are chosen randomly. The idea is to publish the SHA-1 hash of $M_0...M_6$, wait for the value of $M_0$ to be announced, and then release the original message $M_0...M_6$ - so as to prove that we can predict $M_0$ beforehand.

But now we want to fake our prediction: that is, publish a certain hash $H$, and then once $M_0$ is revealed, we publish $M_0...M_6$ such that $M_0$ is correct and it hashes to $H$.

I'm not sure if my attack should leverage properties that are specific to SHA-1: it seems unlikely that it should. But I'm lost as to how I can choose 64 different sets of 6 random blocks that hash to the same value (when concatenated with one of $M_0$'s 64 values).

Edit: I forgot to mention that the algorithm used can be probabilistic, and it should work with at least $50\%$ probability.


texts: Depth of $\operatorname{SHA-256}$ implementation by fan-in $2$ and fan-out $1$ Boolean circuits?

texts:
A fan-in $2$ and fan-out $1$ Boolean circuit is a circuit consisting of $\operatorname{AND}$, $\operatorname{OR}$ and $\operatorname{NOT}$ gates where number of inputs to $\operatorname{AND}$ and $\operatorname{NOT}$ are constrained to be $2$ and number of output gates any of the gates can be connected to is $1$.

I am wondering if $\operatorname{SHA-256}$ is implemented as a multi-output (all hash bits computed by one circuit) fan-in $2$ Boolean circuit what would its depth be?

Can its depth be in the low $10$s while the number of gates could be in say range $10^6$ to $10^9$?

Direct sequential implementation of rounds would warrant a depth of at least $64$ since $\operatorname{SHA-256}$ employs $64$ rounds.
It has to be a clever optimized design.


texts: Differential privacy what does "where the probability is taken over the randomness used by the algorithm" mean?

texts:
The definition of differential privacy is as follows:
A randomized mechanism $\mathcal{M}$ is $(\epsilon, \delta)$-differentially private, where $\epsilon \leq 0$ and $\delta \leq 0$, if for any database $D \in \mathcal{X}$ and $D' \in \mathcal{X}$, differing on at most one record, and for any possible output $S \subseteq Range(\mathcal{M})$, the following in-equation holds
\begin{align}
      \Pr[\mathcal{M}(D) \in S] \leq e^{\epsilon} \cdot \Pr[\mathcal{M}(D') \in S] + \delta
  \end{align}
where the probability is taken over the randomness used by $\mathcal{M}$.
What does the part "where the probability is taken over the randomness used by $\mathcal{M}$" mean?


texts: Are there conventions for signing JSON as a tree, to allow proofs of signed subtrees?

texts:
Given some JSON with a chosen encoding, you can obviously cryptographically-sign the whole thing as a binary blob.

However, it might be useful if the logical structure of the JSON-compatible object were leveraged to control what is signed, in such a way that you could later provide compact proofs that some subtree of the JSON object was signed (without necessarily providing the full JSON object).

For the purposes of illustration, assume the JSON object is a large dictionary, mapping short names to longer blobs, as might be constructed by the following Javascript.

json = { 'A': 'rfhserusliurslierfsieursiuebr',
         'B': '384ur3984hfe98r9e8hjf8ej4fj04',
         ...
         'Z': 'xcvubxudgoxduhf9xd88hxd9fybdf',
}

I'm hoping for some robust deterministic convention, already hammered out in a mature spec, for providing a "signature" of this object that does more than a plain signature-of-its-JSON-serialization.

Then, consider a 3rd party that has that signature, plus the full JSON, but only wants/needs to show that the original signer signed something containing:

subset = { 'B': '384ur3984hfe98r9e8hjf8ej4fj04', }

I'm hoping the convention also specifies how this 3rd party can construct a combination of that subset, the signature, and something else about the elided ranges – that still proves the original signer committed to just that subset.

It seems this might already exist – if not already for JSON, then for some other similar hierarchical object model.

One natural approach that 1st comes to mind would involve composing the keys/values/slots of the entire object into a hash tree, and then signing the root. With suitable tricks, this might allow the 3rd party to prove any subset, like the one above, in a compact (or even fixed-size) way. (But maybe there are other techniques, involving composable signatures, zk-proofs, redactable-hashing, etc - the goal is more important than the mechanism.)

Does anyone know of applicable conventions/standards/published-techniques? Just names or references of related prior work, for further searching/reading, would be great answers.


texts:
When proving theorems in crypto we often make use of the concept of negligible functions or, more simply, negligible parameters.

As a rule of thumb, given today (2018) computational power, what is the smallest inverse power of 2 that we can consider negligible?
I expect this to be something around $2^{-64}$.


texts: Decrypt affine cipher given encryption key

texts:
i have a ciphertext C=TLNJG formed using the equation
c=(7p+11) mod 27,c equivalent to numerical equivalent character of ciphertext and p the plaintext
how do i get the plaintext back?
for encryption:c=(7p+11) mod 27
for decryption:p=5(c-11) mod 27
let's say i encrypt the letter B(1) I would get

c=(7+11) mod 27
c=18 mod 27=18 (letter S)

but if I do decryption using the decryption equation of the letter S I will get the letter I instead of B.Why?

p=5(18-11) mod 27
p=35 mod 27=8(letter i)


texts: Quantifying bit security for smart-vercauteren encryption scheme

texts:
I am working on project that requires to compare in terms of security between two encryption schemes, one of them is the SV scheme.  However, I dont know what are the steps exactly towards quantifying bit security. Below is what I really got from reading multiple papers, I really hope I can get some directions :

SV is built on top of Gentrys FHE in ideal lattices, its is based on small principle ideal problem ( that is currently solved in polynomisl time) it also provides semantic security based on polynomial coset problem. There is a security parameter that is related to a security key yet I dont know its correspondance to typical encryption key sizes


texts: Designing an AES-based protocol for controlling and acessing ioT boards via RF

texts:
I'm designing an open ioT protocol to be used on ioT boards based on Texas Instruments RF-based MCUs. These MCUs have an AES module to easily encrypt and decrypt AES content, so that's why I choose a symmetric key algorithm rather than a public key one (also, RSA would need licensing). So, obviously, there are some problems I want to avoid:

It should not be possible to other people read or control the ioT boards, except for the 'master' board, the one that's gonna be connected to the internet and broadcast messages to the 'slave' boards.
Replay attacks must be avoided. I could avoid this by having one-directional communication (master-slave) using time-signed messages, but this would need a clock to be maintaned in both sides. I prefer to have bi-directional communication, so I can avoid time-syncing problems.
I don't want to share the master's key with every slave device, because if one gets stolen, the key will be compromised. So I've opted to use different keys for every slave, and store them all in the master board.
To avoid radio interference (normal RF doesn't have all the channels and things that prevents wifi and bluetooth to interfere with each other) I'm thinking about the commands being broadcast messages that only the right slave would answer. However, I still have to think about when a slave must send a random message to the master, I don't want more than one slave sending a message at the same time.

Given these constraints, I've been thinking in a protocol like this:

Master sends AES(slaveKey,command+challenge+nonce) (the master keeps track of all used nonces so it doesn't send the same again, so every message is gonna be different, therefore invalidating replay attacks or identification of the type of message by frequency of it being sent. For example, someone who listens enough of the same message could know for what that message is for)
All slaves receive the message, but only the one who's able to decrypt it is gonna read the command and the challenge. So, the slave respond with AES(slaveKey, commandResponse+challengeResponse+newChallenge+nonce2). Again, the slave maintains track of the nonce so it never sends the same one. After the message is sent, the slave starts counting for like, 5 seconds, and wait for the master's response (this time constraint ensures the message will not work later if someone tries to replay it).
Master receives the slave's answer to the challenge, and then finally responds it with AES(slaveKey, command+newChallengeResponse+nonce3).
If the message is received by the slave within 5 seconds, then the message is accepted by the slave as true and the slave does its action. When the action is done, the slave again sends the status of the action for the master in the form: AES(slaveKey, commandStatus+nonce4)

I'm also thinking in adding an ID in all messages, so both the master and the slave will be able to know for which action they're responding too.
I'm thinking about the possible vulnerabilities of this model. Is there any need to message authentication? Because the very act of being able to decrypt the message and answer the challenge is a form of knowing that only the right slave or master could have read that message. If it needs authentication, I'll use SHA2 because its easy to implement in the chip.

Also, is there any work in this field? TLS seems too complicated for a RF chip that's not wireless (wireless MCUs from Texas have a TLS module, but they're too expensive for the project). What's the model used in these new car keys that avoid replay attacks? I've read this entire PDF from Atmel about rolling code and it addresses the replay attack vulnerability because it's an one-way transmission.


texts: Are there any security risks in using Elliptic Curves defined over fields $\mathbf{F}_{p^n}$ where $n>1$

texts:
I've recently been studying elliptic curves, and I've found that most of the current implementations use fields $\mathbf{Z_p}$ or in some cases $\mathbf{F}_{2^n}$. All the reasons I've seen for not using other extension fields are for reasons of efficiency.

I'm wondering if, efficiency aside, are there any security concerns inherent to using curves over  $\mathbf{F}_{p^n}$ where $n>1$ and $p > 2$?


texts: Do I need different encryption and decryption algorithms for each key?

texts: Is a different encryption and decryption algorithm used for every secret key, or can I use the same encryption and decryption algorithm for different keys?


texts: What are the major code breaks in the history of cryptography? Which code breaks changed the face of a battle or another major event? Which one had nationwide consequences?


texts:
If I want to protect myself from implementation of algorithm issues and inherent design flaws of algorithms in password hashing, what would be most secure way to combine two hashes?

bcrypt(pbkdf2(pw))
pbkdf2(bcrypt(pw))
f, l = split(pw); pw = bcrypt(f) + pbkdf2(l)  # loses entropy, bad
pw = bcrypt(pw) + pbkdf2(pw) ## one broken, both broken, particularly bad

Something else? Should I do variation of 1-2 where I'll add entropy?

Why isn't this common/best-practice when storing user data in databases? Using any single hash algorithm seems risky when you combine implementation + design risks. Using SHA seems odd choice, as it's designed to be fast.
Seems odd that end-user needs to think about this and figure out safe way to store PWs.

I don't want to make perfect-world bcrypt or perfect-world pbkdf2 better by this means, I simply want to assume that there are scenarios where in particular environment one of them may be bad to begin with at least. Or in future one of them is found to be not as nearly secure as it was thought to be, giving me safety margin to migrate to another combo of hashes, without going into panic mode.


texts: Is H(k||length||x) a secure MAC construction?

texts:
If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mathbin\| x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k \mathbin\| x_1$ to a longer message with the same hash.

Is $(k,x) \mapsto H(k \mathbin\| \mathrm{len}(x) \mathbin\| x)$ (where $\mathrm{len}$ unambiguously encodes the length of $x$) a secure MAC construction? Obviously it's inconvenient because you can't treat $x$ as a stream, but is there a known security weakness, or is this known to be as strong as HMAC?