texts: RSA accumulator exclusion proof without set

texts:
In researching about RSA accumulators I came across this question, Inclusion and Exclusion proofs in RSA accumulators - from the first answer I had assumed that proof of non-membership could be computed without knowledge of the set, i.e. using only the accumulator value itself ($A$), and the element ($x$) not contained in $A$. This is accomplished with Bézout's coefficients $ax+bu=\gcd(x,u)=1$, the proof is $\pi=(^{},)$, verification is checking $(g^{a})^⋅^{}=g^{ax+bu}=$. If adding a member then proof of membership can be done without the set also.
When I revisited this after looking at a few implementations I realized the implications,  is the product of the accumulated elements, and therefore although the individual set members are not required, this product is, and it could potentially be a huge number with many accumulated elements, and therefore storage or communication of  might be infeasible quite quickly, as compared to the accumulator itself which uses modular exponentiation.
Have I missed something? Is the exclusion proof possible without the set? I ask as I experimented with say 1,000,000 set members, each with a hash to prime computed for it, e.g. Blake256, and quickly realized that not only is  hard to store and communicate with an increasing number of elements but it would take forever to calculate the product of those primes, so in effect, proof of non-membership without knowing the set is only possible with a small number of accumulated elements (providing this product can be communicated and stored)?
If the above is the case, then is there another tool, accumulator, or otherwise, where an exclusion proof is possible without possessing the set members (or the product), or is this fundamentally not possible?


texts: How are the Keccak rate and capacity bits determined at the beginning stage of the algorithm?

texts: I'm learning about Keccak and am trying to understand more about the rate and capacity; specifically, how they are determined at the very beginning of the algorithm. I see quite a bit of information on the sizes of these two variables, but not how they are set. I understand that in the case of SHA-3, there is a 1600 bit 3 dimensional array that gets filled with bits, but I'm not sure how the bits initially come into the array from the input message + padding, and how this relates to the rate and capacity.


texts:
The biclique attacks that break AES (Biclique Cryptanalysis of the full AES) appear to require decryption oracles to work, presumably because the key schedule of AES is weaker in the decryption direction, enabling better bicliques to be constructed starting from the ciphertext end.  Which is to say, these attacks show that AES does not have 128 bits of security under the Chosen Ciphertext Attack (CCA) model.

But what about modes of operation that only require us to assume the underlying block cipher is a PRP rather than a SPRP, i.e. secure under the Chosen Plaintext Attack (CPA) model?  For example, CTR mode.  Does AES-128-CTR mode still have 128 bits of security not-withstanding the biclique attacks?  Are there also biclique attacks on the full AES starting from the plaintext end?


texts:
I'm trying to reverse a truncated linear congruential generator with all parameters ( modulus  $M,$ multiplier $a$, addend $b$ and the seed $x_0$) hidden.

I have read Scott Contini's article On Stern's attack against truncated linear congruential generator. His method on finding the modulus is easy to apply if $k = 64$ or more ($k$ is the number of bits in $M$).

I know I'm missing something so can someone please help? Given the following truncated sequence how do I reverse it. $y_i  =   9, 7, 25, 14, 16, 3, 8, 18, 0, 6, 10, 10, \ldots$.

The hidden parameters are $M= 1009, a=167 ,b=63,  k =10$. Any help in this regard will be highly appreciated.


texts: I made an encryption device for school how can I make it better?

texts: (All programmed in Visual Basic) How it works is it gets a random number from 1 to 30000 and changes the first character by it in Unicode then it uses that number to change the first character of the key then it gets a new random number and repeat so that the key is entangled in to the end result. Which is how it is decrypted by guessing the number for each of the key values till it is the same as what we know the key should look like the then the corresponding letter from the message is decrypted with the same number. Boy is it hard to explain and I am bad at writing I will link to the git hub when I do it https://github.com/VeryG00dName/Encrypter


texts: Proper implementation of AES-256-GCM with PHP OpenSSL

texts:
I am really lost in this subject, I find it hard to get any reliable documentation on the subject that is a bit friendly for beginners like me. So I apologize in advance if this question would sound nonsensical.

Anyway, I am implementing encryption in a project using php openssl_encrypt. So far this is what I have:

// encrypt

$dataToEncrypt = 'Hello World';

$cypherMethod = 'AES-256-GCM';
$key = random_bytes(32);
$iv = random_bytes(openssl_cipher_iv_length($cypherMethod));

$encryptedString = openssl_encrypt($dataToEncrypt, $cypherMethod, $key, $options=0, $iv, $tag);

And then I store $encryptedString, $key, $iv, and $tag

// decrypt

$decryptedString = openssl_decrypt($encryptedString, $cypherMethod, $key, $options=0, $iv, $tag);

My questions are:

Is there anything wrong with my current implementation?
Should $key be randomly generated or should I use a single secret key for general use? I am asking this because in some examples I see around the web they are using text strings for the $key. If it is not required for the $key to be random, does it have any improvements to security if it is random?
Is the $tag the message authentication code (MAC)? In the PHP documentation it states:

  The authentication tag passed by reference when using AEAD cipher
  mode (GCM or CCM).

If $tag is the MAC, then does that mean that PHP openssl_decrypt is also handling the authentication process?

Thanks for any help!


texts: Encrypting (CBC) identical files with same key and different IV, is it less secure?

texts:
I would like to learn more about cryptography.

Let's say you encrypt multiple files with CBC encryption using the same key, but each file has a unique (and pseudorandom) IV. Does this weaken the security of the data? Is it easier to obtain the key if you have many instances of the same data encoded with a different IV? Let's assume that the attacker knows all the files are the same or at least partially (first half) the same.

Thank you for your time.


texts: How does the KeyGen of Merkle's improvement of Lamport's OTS work?

texts:
In his paper [1] on page 17 and 18, Merkle proposes an improvement on Lamport's OTS by only signing the 1's in the message in combination with a checksum of the amount of 0's in the message. I get the intuition, and why this would, on average, approximately reduce the signature size by half. However, I am not sure what the private/public key should look like?

I feel like if key's are generated in the same way as 'default' Lamport's OTS, the public/private keys would be unnecessarily large.

In this blog [2], I found this is indeed not the case, and the author states that the pk/sk are also cut in half, since only 1's are included. For me it is not clear if for every bit (both 0's  and 1's) in the message only a single random string generated $sk_{i,1}$ and hashed in the public key, or if for every 1-bit in the message a pair of strings $(sk_{i,0},sk_{i,1}) $ generated, and nothing for 0-bits?

Also, I think that 0-bits of the checksum are signed as well and only the 0-bits of the message are omitted, is this correct?

http://www.merkle.com/papers/Certified1979.pdf
https://blog.cryptographyengineering.com/2018/04/07/hash-based-signatures-an-illustrated-primer/


texts: Are there any industry standards for PRFs?

texts: I mean something like a NIST, ISO, FIPS or similar standard which defines a constructions for a PRF.


texts: Is there a fast signature scheme homomorphic over $GF(2^b)$ with $b > 1$?

texts:
Is there a signature scheme that given $x, y \in \mathbb{Z}_p^k$ and signatures $S(x)$ and $S(y)$ allows any linear combination of $x, y$ to be successfully verified, and nothing else?

I'm aware of schemes where $p = 2$, where 'linear combination' just means XOR, but I'm interested in bigger fields, in particular $GF(256)$, where you could prove the authenticity of $c_1x + c_2y$ with $c_1, c_2 \in GF(256)$ given just $S(x)$ and $S(y)$.

I only care about authenticity - what is being signed is not secret.


texts:
I was tasked with making an expo about AES and its steps, but I still can't grasp it, especially when it comes to "key schedule".

Does anyone know some good material to start learning? Or can someone give me good explanations about AES? I tried Wikipedia and some random PDFs but nothing really fit the bill.


texts: Security of AES in CTR mode with fixed nonce (but different key)

texts:
If I am using AES in CTR mode and use a unique key every time but the same nonce, is this secure?

If so, does it make a difference if the nonce is public?


texts: Is there a way to decrypt a AES cipher Text which was encrypted twice with some key, when having a part of this key? (the last 3 bytes of the key are missing)


texts: Piggyback on Bitcoin for independent data verification?

texts:
The recent threats to EPA data integrity have me wondering if it's possible to archive data in a way such that one can later check whether the data have been tampered with since the original archival.

One commonly used mechanism in the open source software world is hash verification. After downloading some software you compute an md5hash of the tarball and then compare that hash to a "golden" hash served by a trusted website. Of course, you trust the website because its certificate checks out with whichever certificate authorities you trust.

But if that trusted website is centrally managed by some stakeholder in the data, then the golden hash is suspect. It seems like there ought to be some kind of P2P or distributed record system that can be used for this. What I thought of was blockchain technologies such as bitcoin. Getting to critical mass with a new blockchain system built for the sole purpose of data tampering detection seems like it would not be feasible because there would be little incentive to actually join that system.

It seems like it might be easier to somehow piggyback on the existing Bitcoin system. I feel reasonably confident in saying that the Bitcoin system is unlikely to disappear any time in the near future.

Is it possible to store even tiny amounts of user data--such as a few md5hashes--in the Bitcoin blockchain?


texts:
Are there different versions of CAST-256 - also known as CAST6 - available? Are there different S-Boxes available for CAST-256? If there are different versions or S-Boxes what identifier should I use to indicate them?

I have an issue with PHP mcrypt version of CAST-256 (the link goes to the ill maintained mcrypt library underneath) where I cannot generate the same value as the one in the test vectors for CAST-256. In case anyone wants to try, I'm using the first test vector from the RFC. The Bouncy Castle libraries (v1.51) for Java seem to generate the correct value.

--

Notes:

the same code on other block ciphers in mcrypt without issue and triple checked the mcrypt input/output values - code available on request;
"Applied Cryptography 2nd Edition" by Bruce Schneier talks about configurable S-Boxes for the original CAST cipher, but I don't see the same indication for CAST-256 other than
that it should reuse the S-Boxes of CAST-128;
there is a set of 4 S-Boxes required for CAST-256, so the S-Boxes in the code are all part of the same configuration.


texts: Is it safe to use ECB mode this way, w/o duplicate blocks?

texts:
I wanna make my own "way" of encrypting separate messages. And I want it to have the least possible size overhead while being completely encrypted (hide msg counter). Here's my current idea:

we exchange some symmetric key K, along with random 32-bit counter start position
for every message:

p1 = first 12 bytes of payload, p2 = the rest of payload
enc_header = aes_ecb_encrypt(K, counter || p1)
IV = some_secure_hash(K || counter)
enc_data_with_mac = aes_gcm_encrypt(K, IV, p2) // or chacha20+poly1305
result = enc_header || enc_data

Every message increments counter by one. Before counter overflows we prepare new K, then use it after overflow, then as soon as receiver receives message encrypted with new key, he forgets old one.

As result, every message contains only 4+16 (counter+MAC) additional bytes and everything including counter is encrypted so only sender and receiver know what data is hidden.

Yes, this explanation is quite simplified. I hope this is enough to understand the idea. The main question is about using ECB mode this way. Just tell me why described algorithm is bad. Also, does random counter start position make this scheme more secure?


texts: I know that the public exponent is always a prime, but what about the private exponent? Is it always a prime too?


texts:
I often see the notation of powers of 1 in cryptography papers.
For example, let $n$ be security parameter, then what does $1^n$ mean??

From high school student perspective, powers of one is always one....
But I hope this is not.
Is this a bit string of length $n$?
If so why don’t they write it as $\{0,1\}^n$?


texts: Independence of answers to queries sent to a random oracle

texts:
Assume we have an algorithm which asks random oracle $\mathcal{O}$ $Q$ queries $u_1, \ldots, u_Q$. All queries are unique, $u_i \neq u_j$ for $i \neq j$. Queries $u_i$ are random variables, too.

What is the easiest (mathematically correct) way to see that the random variable $(\mathcal{O}(u_1),\ldots,\mathcal{O}(u_Q))$ has uniform distribution -- or -- that $\mathcal{O}(u_i)$ are independent random variables?

It looks like that the standard theorems covered in textbooks - like this one in Stinson - cannot be directly applied.

EDIT:

Here is more formal and simplified version of my question: $A$ is set of all random tapes (or private keys or something), $B$ is is set of all functions from, lets say, $\mathbb{Z}_q$ to $\mathbb{Z}_q$. $\mathcal{A}$ is some algorithm that has parameters $\omega \in A$ and random oracle $\mathcal{O}$ from $B$. We pick elements from $A$ and $B$ with uniform distribution.

For example, assume I want to calculate the probability
$
  P((\omega, \mathcal{O}) \in A\times B| \mathcal{A}(\omega, \mathcal{O}) \text{ succeeds})
$

This can be rewritten as

$
  P((\omega, \mathcal{O}) \in A\times B| \mathcal{A}(\omega, \mathcal{O}(u_1), \ldots, \mathcal{O}(u_Q)) \text{ succeeds})
$

And then I have a Stinson's theorem which can be replaced by some other  other "textbook" or citeable theorem.

The main goal is to prove $(\omega, \mathcal{O}(u_1), \ldots, \mathcal{O}(u_Q))$ has uniform distribution by citing something.


texts: Can we use a sort of "hash" function in CTR mode instead of a block cipher?

texts:
CTR mode does not use the decryption function at all, only the encryption function.

This may suggest that a different primitive that has this "one-way" property could do the trick. For instance, I just thought we could map the secret key with the counter under a secure hash function to obtain a complete usable and secure cipher with CTR mode, why is this assertion false?

Maybe a secure hash is not enough, but

  Can we use a different primitive as a cipher in CTR mode, not necessarily a PK Cryptosystem?

Thanks a lot for your answers and comments.


texts: Chosen plaintext attack on textbook RSA decryption

texts:
Let $(n,d)$ be an RSA private key and $(n,e)$ the corresponding public key.

Generate a secret random $r$ from $(\mathbb{Z}/n\mathbb{Z})^*$
Compute $C’ = C (r^e) \bmod n$
Submit $C’$ as a chosen ciphertext and receive back
 $M’ = C’ ^ d \bmod n = M r$,
 since $C’ = (C \bmod n) \times (r^e \bmod n)
      = (M^e \bmod n) x (r^e \bmod n)
      = (M r)^e \bmod n$.
Deduce $M$ with a division modulo $n$ since $r$ is known: $(M r) r^{-1} \bmod n$.

I am trying to understand a chosen plaintext attack on textbook RSA decryption.
If I follow the method above, I must generate a random $n$ from a range of $n-1$ values. How I am I going to know which of my $r$ values is the one I need, because the $n$ value very big? My $e$ value is 65537 and my ciphertext value is very big.


texts: How are isogeny graphs made and how are they helpful to crypto?

texts:
I don't understand how the shapes of isogeny graphs are determined. While Alice and Bob do walk on it and don't backtrack, are they actually relevant to crypto?

Also, I was told that supersingular isogeny graphs are expander graphs. Similarly, how is the shape of an expander graph determined


texts: What order should these HTTPS ciphers go in to maximize security?

texts:
I want to set up a very secure-from-MITM-attacks server. I have these algorithms enabled in my nginx and I'm getting an A+ on ssllabs.com but it's complaining that my cipher strength isn't 100% and that my key exchange isn't either. Even if reordering these won't improve it, I still would like to sort them by security level.

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256  ECDH secp256r1  FS 128
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384  ECDH secp256r1  FS 256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256    DH 4096 bits    FS 128
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384    DH 4096 bits    FS 256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256  ECDH secp256r1  FS 128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA     ECDH secp256r1  FS 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384  ECDH secp256r1  FS 256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA     ECDH secp256r1  FS 256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256    DH 4096 bits    FS 128
TLS_DHE_RSA_WITH_AES_128_CBC_SHA       DH 4096 bits    FS 128
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256    DH 4096 bits    FS 256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA       DH 4096 bits    FS 256

If there is another change I need to make to fix my nginx setup I'm interested in learning that as well.


texts: Let's say I have ciphertext c = Enc(pk,m), produced by a public-key encryption scheme but I don't know the public key of the sender. Can the sender easily produce another key pair and then claim that the ciphertext actually corresponds to c = Enc(pk',m') or is this computationally impossible?


texts: Security of 64-bit truncated HMAC of Matrix protocol

texts:
I have seen other questions like this one, but I am asking this specifically in the context of Riot messaging and the underlying Matrix protocol.

A basic summary of their message encryption (using keys derived from the key ratcheting Olm primitive, details in the section "Olm authenticated encryption" in the Olm spec) is that messages are encrypted with AES-256-CBC, then authenticated with truncated HMAC-SHA256. Only the first 8 bytes of the HMAC code are sent with the message.

Doesn't this provide only 64-bit protection against MAC forgery? Wouldn't it make more sense to include at least 128 bits so as to match the security of the Curve25519 identity keys underlying the ratchet?

While the 2012 NIST document linked in this answer states that at least 64 bits of HMAC is recommended, is a higher security margin called-for nowadays?


texts: What is the hash of this cipher: TLS_RSA_WITH_AES_128_CCM

texts:
In TLS 1.3 supported ciphersuite,  I find the following ciphersuite:

  TLS_RSA_WITH_AES_128_CCM

Can any one tell me what is the hash function used in this ciphersuite? how could you know that (reference please).


texts: Rock-paper-scissors over network, how to protect from cheating server?

texts:
I'm trying to design cryptographic protocol to play Rock-Paper-Scissors with two parties, neither trusting each other, nor trusting server they use for communication, so game is 'provably fair'.

So there are Alice and Bob. They don't know about each other, and they've came to server to match them with each other, with server prompting them to make a bet.

Alice comes to server and deposits some money
Bob comes to server and deposits some money independently of Alice
Alice thinks out of her bet (say, 'rock'), but tells server HMAC('rock', 'some_random_secret') instead of just plain text, to prevent server from implementing always winning bot.
Bob tells server HMAC('paper', 'secret string by bob')
Now server has both commitments, and it publishes them to parties, so Alice gets Bob's commitment, and Bob gets Alice's commitment. Server does not know actual moves.
Now server expects for Alice and Bob to disclose their choices and secrets, and depending on disclosed choices, pay out the pot to winner (minus some server royalty), or if draw just returns money.

Now here is problematic case: imagine there is no Bob, but only server pretending to be Bob.

Alice deposits her bet to clearance account and sends pseudo-Bob commitment of her 'rock' move.
Server responds Alice with clearance of some random move.
Alice discloses to server plaintext of her move.
Now server checks if it's own move was winning — if it was, server claims victory and gets money Alice deposited, providing Alice with proof.
If server appears to be losing, it just pretends pseudo-Bob left the game due to connection problems or whatever, cancelling the deal and returning Alice money.

It's not possible for real Bob to cheat this way, because when Bob gets Alice plaintext, he had already sent his own plaintext, so server knows who had won and who hadn't.

I've been thinking about closing deal by timeout if second party does not respond with plaintext within some reasonable time (or had provided plaintext that does not evaluate to commitment given before), but in cheating server case it's possible to pretend server just hadn't received Alice's plaintext to make her always losing.

Does a solution to this exist, or is this more like "pigeon chess"? How to convince both Alice and Bob server is fair?


texts:
Consider a function to create a tamperproof cookie as follows:

$$\text{cookie}(m, k) = m \| \text{hash}(m \oplus k)$$

where $m$ is a message provided by Alice, and k is a secret key known only to Bob. Bob receives m from Alice and returns the cookie to her. $\text{hash}(m \oplus k)$ functions as a MAC.

Why doesn't this properly authenticate the cookie? What's wrong with the MAC?


texts:
ChaCha20 is considered 256-bit secure (no attack faster than brute force).  However, the best known cryptanalysis that I know of is on ChaCha7.

That gives ChaCha20 a rather large security margin (much larger than, say, AES-256).  Is ChaCha12 still considered to be 256-bit secure (as in "considered usable when top performance and 256-bit security are needed, no HW AES support, and ChaCha20 is too slow")?


texts: Design for file transfers to a new party

texts:
I'm pondering a problem of how to enable transfers of files from clients to people that does not yet have an application/account/keys yet.

Here's my current thought for Alice wanting to send Bob FancyPants.png through my tool:

Generate random UUID
Generate encryption keys from that UUID
Encrypt FancyPants with the key
Upload to server
Ask Alice for Bobs e-mail and send "You have a file waiting, click here to download client and retrieve file securely"
Alice sends Bob the UUID out-of-band, somehow.
Bob clicks the link, enters the UUID on a page and receives a client prepared to start downloading FancyPants.png from the server.

However this method has a couple of problems, step 1, 6 and step 7.

Point 1 since I figure some form of user input would be good, otherwise it's basically just a random key and doesn't require any previous knowledge so anyone can generate it.

Point 6 since it's an out-of-bounds method which likely means they'll likely e-mail or sms in cleartext potentially defeating the whole encryption.

Point 7 since at that point my server will know the unencrypted file, which I'd like to avoid.

Are there any ways around these? I'm looking into if something might be usable like private set intersection or oblivious transfer but people here seem really knowledgeable and might know a better way.

This might be too vague but let me know and I'll edit it. I also don't know how this should be tagged, suggestions highly welcome.


texts: Security of ChaCha compared to AES and Serpent

texts:
I'm trying to understand how secure XChaCha20 is in comparison with other ciphers. From what I know, ChaCha is more secure than AES, but less secure than Serpent. My question is how much more "secure" is ChaCha than AES and how much less secure it is than Serpent. If (on a scale of 1 to 10) AES is 5 and Serpent is 10, what would ChaCha be? I think it is around 6~7, but I'm not sure. Also, about how much longer would ChaCha theoretically last under bruteforce of the NSA than AES (assuming no KDF used)? If I encrypt an archive and store it encrypted by ChaCha in the cloud, can I expect it to be more secure than the same archive encrypted by AES? Would it be less secure theoretically than Serpent? Thanks.

I'm looking for the best combo of security and modernism to store files long term in the cloud.


texts: To utilize asymmetric cryptography in symmetric manner - demand-of-security-definition?

texts:
Cryptography can largely be divided into two classes: asymmetric and symmetric.

Like homomorphic encryption now greatly restricted in the asymmetric cryptography, the difference of asymmetric and symmetric, goes beyond "one-key or two-key", but flexibility, funcationality.

In some system setting, the utilization of asymmetric cryptography is not to provide a "public-key", but to offer funcationality like "additive homomorphic". To guarantee the security of such systems, the adversary with the knowledge of public key should be taken into account.

But, but, what if, we turn back to the history. We want to keep public key "secret".

If both public key and private key are not public, are secret key (i.e. secret key 1, secret key 2).

Some asymmetric cryptography could, if security proof can shows, to have less flexibility like "public-key", but contribute greater security to real-world system. The advantage of "additive-homomorphic" may remain but some security problems vanish.

My question is:

Is it generally acceptable to use asymmetric encryption in a symmetric manner?

Is there any existing works on this conception?

Does the security definition lack here for such case?


texts: Number of preimages of hash function from bounded domain

texts:
Suppose we have an "ideal" cryptographic hash function

$H: \{0,1\}^{n+k}\to \{0,1\}^{n}$

and a given bitstring $b\in \{0,1\}^{n}$, Can we estimate how many preimages $H^{-1}(b)$ there are?

With ideal I mean that it behaves like a random oracle.


texts: AES-128-CTR message integrity: Construction of HMAC

texts:
(Note: This post is not about "rolling my own", but rather trying to deepen my understanding of the underlying structures.)

I'm having difficulties finding clear answers to some questions about the construction of HMACs:

Assuming we have one key for encryption and one key for message integrity checks, and we are using AES in counter mode.
As far as I understand, when creating the HMAC for a message, one should utilize all available information: The encrypted message, the key, the nonce and the counter.

In effect, does this mean that a separate HMAC must be created for every single message, i.e. all 16 bytes?
If this is true, how would the security of a scheme evaluated in which the HMAC would be calculated over arbitrary multiples of 16 bytes, for example only every 160 bytes?
And at last, going even further, what would be the weaknesses of using merely the encrypted message (and the key, for sure) for the HMAC calculation, thus leaving out the initialization vector?

Maybe someone can shed some light on this, I have seen people doing exactly this (for example one HMAC (no counter, no nonce) for a whole file), but I'm unsure about the correctness.

Thanks in advance!


texts: What is the difference between static and dynamic tokens?

texts:
First, what is the difference between hardware and software tokens?
Tokens are "what you have" for example a car key or a chipcard. This would be (I think) hardware tokens? But what are software tokens?

Also what is the difference between static and dynamic tokens?

Could you give me examples for better understanding?


texts:
I had a quick question for all.

Why do we hash the random challenge in Fiat-Shamir heuristic? If we hash the public key of Prover it should be enough for the verifier to prove non-repudiation?

What is the need for hashing the first random message the prover ($x=g^y$) also?


texts: Semantically secure, but not CPA secure?

texts: I'm just starting to read a cryptography book and I'm having trouble understanding this. I know that semantically secure means that the adversary cannot learn any significant information seeing the ciphertext and for CPA security the adversary is allowed to give messages to be encrypted and receive the ciphertexts. However, I can't wrap my head around an example of something that is CPA secure, but not semantically secure.


texts: Amateur question: Constant two way cryptography

texts:
First of all, I would like to tell you guys that I'm a complete noob at cryptography in general, so please pardon any dumb stuff I may say.
Well, I have used a lot of cryptography libraries in a couple projects I have done in the past. They usually work like this:

Input: secure = cryptography('sensitive data', 'password, salt, key, whatever');
Output: U2FsdGVkX1/+sKF6K1TD2/wdHJRwhuwuYez4yESJxuI= ( or something like this)

Question is, when I run the exact same piece of code, the output is always different:

input: secure = cryptography('sensitive data', 'password, salt, key, whatever');
Output: U2FsdGVkX1+TkUfkTukfsEuSBMree9vg2I/ixgOZE1A= (different output from the first time)

Being completely ignorant about cryptography, I don't know why do they change like this every time I run the exact same piece of code again and again.
So, I would like to know, why do they behave like this? And, is there any cryptographic algorithm that always returns the same output when the sensitive string and the key are equal no matter how many times I run the code? Thank you very much.


texts: Encrypting/Decrypting sensitive information for storage purpose

texts:
I want to store account numbers and routing numbers into SQL database, and i was looking for best way to encrypt/decrypt this sensitive information. After researching i found i can use symmetric (like AES) or asymmetric (like RSA, X509 Certificate) algorithms. I just want to encrypt/decrypt the information locally
on the server and store it into SQL DB. Is it recommend to use AES with 128 bit HEX key for such purpose?
Use of asymmetric algorithms seems to be overkill since encryption/decryption will happen locally on the same server.

(Note that this information will ultimately transfer to vendor using SFTP, however during that transfer we will be using vendor provided PGP public key for encryption so vendor can decrypt it. What i am looking here is encryption/decryption for local storage)


texts: Single-scalar multiplication with sign bit

texts:
I want to know if there's an "easy" timing-free way to compute the sign of $y$-coordinate of $r G$, for a secret scalar $r$ and $G$ the generator of an elliptic curve.

We have several choices for scalar multiplication: 1) use a Montgomery ladder, which provides the $x$-coordinate, but tells you nothing about the $y$-coordinate; and 2) other methods such as multiply-and-add on the Edwards curve.

Montgomery ladders are lovely, because it's not too hard to get something which is pretty safe against timing attacks, so for ECDH it's an obvious choice. However, signature schemes require that you know the $y$-coordinate, which leads to very fiddly implementation requirements, like timing-free table lookups for windowed scalar-mul.

My question is whether there's a middle choice: using Montgomery for the $x$-coordinate, and some other method to obtain the sign of the $y$-coordinate, which can then be used by the verifier, avoiding the need to implement a timing-safe double-scalar-mul operation. I'm thinking of some kind of "differential sign-only" operation on the Montgomery curve.

In particular, I'm aware that the choice of "sign" is arbitrary: any half-sized subset of $Z_p$ can be designated as the "positive" set of $y$-coordinates. With this free choice of definition for the sign, is there a choice which makes the sign of $r G$ easy to determine, using a "simple" algorithm?


texts: Using an Even-Mansour block cipher in a tweakable mode of operation

texts:
Assume that:

$P(X): \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$.
$Q(X): \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$.
$E(K, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$.
$D(K, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$.
$\widetilde{E}(K, T, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{T}} \times \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$.
$\widetilde{D}(K, T, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{T}} \times \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$.
$E_{*}(K, IV, T, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{IV}} \times \{0, 1\}^{\ell_{T}} \times \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$.
$D_{*}(K, IV, T, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{IV}} \times \{0, 1\}^{\ell_{T}} \times \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$.
$\ell_{X}$, $\ell_{K}$, $\ell_{T}$, and $\ell_{IV}$ are equal.
$P$ and $Q$ are each other's inverses.
$E(K, X) = P(X \oplus K) \oplus K$.
$D(K, X) = Q(X \oplus K) \oplus K$.
$\widetilde{E}(K, T, X) = E(E(K, T), X)$.
$\widetilde{D}(K, T, X) = D(E(K, T), X)$.
$E_{*}(K, IV, T, X) = \widetilde{E}(E(K, IV), T, X)$.
$D_{*}(K, IV, T, X) = \widetilde{D}(E(K, IV), T, X)$.

$P$ and $Q$ are inverses and are both publicly known pseudorandom permutations that form the core of a single-key Even-Mansour block cipher. $\widetilde{E}$/$\widetilde{D}$ and $E_{*}$/$D_{*}$ are two modes of operation that I've constructed from it. With the mode of operation built around $\widetilde{E}$/$\widetilde{D}$, $CT_{i} = \widetilde{E}(K, i, PT_{i})$ and $PT_{i} = \widetilde{D}(K, i, CT_{i})$. With the mode of operation built around $E_{*}$/$D_{*}$, $CT_{i} = E_{*}(K, IV, i, PT_{i})$ and $PT_{i} = D_{*}(K, IV, i, CT_{i})$.

As I understand the Even-Mansour scheme, an attacker who possesses $2^{0.5 \times \ell_{X}}$ pairs of plaintext and ciphertext blocks can break the security of it. In the case of the first mode of operation, the key used for each block is different and is derived by encrypting the block's index with $K$ as the key. In the case of the second, an instance vector (as opposed to "initialization vector") is encrypted with $K$ as the key and this new value is used as the key the same way as in the first mode of operation. In either mode of operation does the birthday bound apply? Does security disappear after knowing $2^{0.5 \times \ell_{X}}$ pairs of plaintexts and ciphertexts? Or does the security become optimal?


texts: Intuitive explanation for key exchange with public/private keys

texts:
I want to teach some people about crypto basics, and one of the topic will be key exchange with a public and private keys.
The audience is made of people working in InfoSec, but mostly junior fresh out of school.
I am looking for a visual/experimental way to show how we can achieve key exchange with both parties having a public/private elements.
The best thing I found was the example with color being mixed:

I like it, but it only shows the use of 1 secret key, there's no concept of public key.
Also, color may not be as intuitive as I like because people tend to think you can unmix (even if we made the hypothesis we can't.) And a real-world experiment would probably get messy.
Is there another example that would relay on 2 elements from each sides?
I made some attempts with pieces of paper, but alas, nothing came out. I would need a transformation that can be done with 1 piece of paper, and that can only be undone with another. Perhaps someone have a bright idea here.
PS: I introduce the concept of public/private key with the padlock/key analogy, which is very good. However this just depicts a 1way transfert of data, it is not a key exchange.


texts: I conducted a software based experiment for encrypting difference size of images using AES and DES. However unexpectedly DES encryption speed was higher than AES. is it possible that DES is faster than AES?. I also search the literature but could not come up with clear conclusion on this matter. Thanks


texts: find $a$ and $k$ for a given el gamal cryptosystem

texts:
I am given this question:

Suppose Alice is using the ElGamal Signature scheme with parameters

$p = 31847$, $\alpha = 5$, and $\beta = 25703$

Assuming that we have received signed messages

$(x_1,(\gamma_1,\space \delta_1)) = (8990, (23972,\space 31396))$

and

$(x_2,(\gamma_2,\space \delta_2)) = (31415,(23972,\space 20481))$

determine integers $k$ and $a$ that Alice has used without solving any instance of discrete logarithm problem.

I also know from my lecture slides that the following equations are true

$\beta = a^\alpha \bmod p$
$\gamma = a^k \bmod p$
$a\gamma + k\delta = x \bmod p-1$

Since the question specifies not to use the discrete log problem, we can only use equation 3

so we have a system of two equations:

$a\gamma_1 + k\delta_1 = x_1 \bmod p-1 \rightarrow a(23972) + k(31396) = 8890 \bmod (31846)$
$a\gamma_2 + k\delta_2 = x_2 \bmod p-1 \rightarrow a(23972) + k(20481) = 31415 \bmod (31846)$

solving for $k$ is simple enough, just take 1. - 2. as equation 3. below:

$k(10915) = -22425 \bmod(31846) = 9421 \bmod(31846)$

and solve for $k$:

$k = 1165 \bmod(31846)$

Now here's where I'm getting stuck, by plugging in $k$ to equation 2. we get:

$a(23972) + (1165)(20481) = 31415 \bmod 31846 \rightarrow a(23972) = (23704) \bmod 31846$

but we can't isolate $a$ because the $\text{gcd}(23972, 31846) > 1$ so there is no inverse of $23972 \bmod 31846$

note plugging $k$ into equation 3. gets a similar result.

This question is from my textbook so it should be solvable, but the math  is telling me that it's not solvable.

Could someone please explain if there is some work around to finding $a$ when it is multiplied by a non-invertable number?


texts: Hash Function that is Collision Resistant but not Puzzle Friendly

texts:
Is there any example of a Hash function that is collision-resistant but may not be puzzle-friendly, similarly example of a hash function that is puzzle-friendly but not collision-resistant?
Puzzle friendliness: A hash function $H$ is said to be puzzle‐friendly if for every possible $n$‐bit output value $y$, if $k$ is chosen from a distribution with high min‐entropy, then it is infeasible to find $x$ such that $H(k|| x) = y$ in time significantly less than $2^n$ ($k$ and $y$ is given).


texts: Is there an outdated or insecure hash algorithm thats output can be easily reversed back into the input?

texts:
I'm looking for a hash algorithm thats output can be reversed back into the input in a reasonable amount of time (a day or less) using a decent consumer computer. If anyone has any information on this, it would be very much appreciated.

Edit: After reading some of the comments and answers on this post, I feel I should clarify: I'm looking for a hash algorithm where it is relatively easy to reverse a hash into an input that is one byte larger than the hash. For example, if the hash output is 32 bytes, and the input was 33 bytes, I'd like to know if there's a hashing algorithm where it's possible to reverse the output into the input in a situation like this.


texts: What is wrong in the following algorithm for computing a hash function using RSA?

texts:
I'm studying for a cryto exam and have run across this question which has stumped me.

What is wrong in the following algorithm for computing a hash function?

Take a message $M$,
generate a random private RSA key $K$.
Encrypt $M$ with $K$ and
take the first 240 bits of the result as a hash of $M$


texts: Are there any tools to analyze cryptographic algorithms performance?

texts:
How can I analyze a cryptographic algorithm performance to make a table and charts comparing them. I have seen several papers but there's no paper explaining how it is exactly done.
As comparing data block size through time, etc...
Like key size, block size, power, throughtput, data length, processed bytes (MiB/s) and cycles per byte.
Example papers:

A Survey of Lightweight-Cryptography Implementations

Performance Analysis of Data Encryption Algorithms

Performance Evaluation of Symmetric Encryption Algorithms


texts: SRP with random, but constant private-value b

texts:
In RFC5054, the SRP6a algorithm states that the client and the server should generate random ephemeral private values $a$ and $b$ respectively which are used for further derivation in the handshake and in the generation of the shared-key. For a persistent TLS connection, it obviously makes sense to generate a new random $b$ value each time a client connects.

Edited for clarity: However, I would like to use SRP in a stateless authentication handshake over multiple HTTP requests. The first request would be the client sending its $I$ to the server, and it would receive ($N$, $g$, $s$, $B$) in return. The client would the calculate $A$ and make another request to confirm its identity. Since the second request may hit a different server, this implies that the private $b$ would have to be shared across all servers. The simple solution is a constant value shared by all servers.

Aside from replayability, does choosing a random but constant $b$ value across all servers have any other security implications? Should I definitely not do this? Would silly tricks, like a varying time-windowed values derived from a constant $b$ be a better choice?

My instinct tells me this is roughly fine, in the same way that we use random-but-constant secrets to secure, e.g. session cookies, but I want to understand the implications.

To be clear, I'm only using this for authentication purposes so that the server never sees the user's password, and depending on TLS for forward secrecy of subsequent communications. I realize I could also, for example, bcrypt the user's password before sending it to the server to achieve similar goals, but thought it might be better to use a degraded version SRP instead.


texts: Partial-Message Collisions on Iterated Hash Functions

texts:
In Cryptography Engineering by Ferguson et al it says the following is a problem with iterated hash functions:

  Because hashing $m$ and $m'$ leads to the same value, $h(m||X) = h(m'||X)$... for all values for $X$.

I don't see at all how this follows from $h$ being iterated? If some general input $x$ is preprocessed into $x_1...x_t$ then $h(x) = H_t = f(H_{t-1},x_t)$ where $f$ is the compression function. Now, if $m,m'$ both have lengths that are multiples of the block size then the assertion certainly is true, as follows:

Suppose $m = m_1...m_s$, $m' = m'_1...m'_t$ and $h(m)=h(m')$, i.e. $$H_s = f(H_{s-1},m_s) = f(H'_{t-1},m'_t) = H'_t$$ Assuming for simplicity that $X$ is preprocessed into a single block (also denoted by $X$), we get $$h(m||X) = f(H_s,X) = f(H'_t,X) = h(m'||X)$$ All in good order. But suppose now that $h(m)=h(m')$ but $m||X$ and $m'$ are preprocessed into single blocks $M$ and $m'$ resp, so that $m'||X$ is preprocessed into two blocks (denote the preprocssed $X$ by $X$ yet again). We then get $$h(m||X) = f(H_0,M)$$ $$h(m'||X) = f(H_1,X) = f(f(H_0,m'))$$

How does it follow simply from $h$ being iterated that the two are equal?


texts: Vulnerability in DES3 when key can be chosen

texts:
In the question there are two functions encrypt basically does  IV ⨁ DES3(P⨁IV) and encrypt_flag just encrypts the flag after being padded into a multiple of 8. IV is a random 8 byte number which is always constant.
I have been looking at this question for a long time and I can't work it out. The question is to find the value of the flag by submitting encrypt(key, plaintext) and encrypt_flag() requests. I have thought that if plaintext='0000000000000000' then ciphertext=cipher.encrypt(IV)^IV but I have researched and haven't managed to find a vulnerability there. I also thought of saying key='000000000000000000000000000000000000000000000000' but that doesn't work since it isn't DES3 anymore as it degenerates to DES. The flag starts with crypto{ and we don't know it's length and it also finishes with }. The requests are made through an oracle, you send the requests as hex numbers. for encrypt_flag you just send the key as hex and it will return the flag encrypted as described above. With encrypt request you send a key and plaintext as hex number and it encrypts them as described above and then returns the ciphertext. So:
encrypt(plaintext, key)->IV ⨁ DES3(P⨁IV) where ⨁ denotes bitwise xor
and
encrypt_flag(key)->encrypt(padded(flag), key)
My intuition tells me that the vulnerability is in the fact we can select the key, but I can't think how that can make it vulnerable


texts: Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs?

texts:
I'm working on a encryption system where each party can store exactly a single ElGamal private key in a device. This is a hardware limit. The system must be expanded to support signatures and encryption.

Can each party use the same key-pair for both schemes?

I know that encryption/signature key lifetimes and security key-lengths may be different, but this would not pose any serious risk to our system.

So the question can be restated as: Are there passive or active attacks (e.g. algebraic, chosen-plaintext/ciphertext) that are specifically targeted at  users sharing ElGamal Encryption/Signature key-pairs?


texts: Key-Agreement & Key-Transport for Symmetric Authentication System

texts:
Question: I want to know what kind of Master Key sharing process is pursuit on Symmetric encryption environments (strictly symmetric, also in the key sharing scheme).

As I am aware there are several ways to establish the Master Key transportation and storage between two entities. The processes can pursuit a Key-Agreement or a Key-Transport scheme.

In key transportation a key wrapping function is used to protect the shared secret, then I assume that we do not need any public-key system such as DHKE or ECDH.

In key agreement asymmetric encryption processes are used to transport master keys between entities, then this is not a full symmetric master key exchange, correct?

Thanks in advance.


texts: Explain Fischlin's Fiat-Shamir like transformation

texts:
I've been trying for a while to understand why this paper is correct:
ftp://ftp.inf.ethz.ch/pub/crypto/publications/Fischl05b.pdf.

The idea is a NIZK-POK where you require the hash of the commit-challenge-response to be small.
This is supposed to force the prover to make multiple hash queries for each commit, which consequently enables an extractor to extract the witness without having to rewind.
But what I can't figure out - is why not just try multiple witnesses/commits , rather than multiple challenges for a given commit?


texts: How to implement "online" feature of GCM?

texts:
I've heard that Galois Counter Mode (GCM) is an "online" encryption algorithm—it is not necessary to know the size of the input ahead of time.  But does GCM require that all authenticated-but-not-encrypted data ("adata") be provided to the algorithm before processing the data to be encrypted?

If there is no ordering requirement, how can an implementation combine the two independently-calculated sides into a single GHASH result?  My guess is that if it is possible, it involves rearranging the GHASH results into a polynomial.

I wasn't able to find anything on this with some searches on here and Google.


texts: When a program using openssl library is using a certificate, does the server check if the issuer(s) are still valid

texts:
If I have a program acting as TLS server with a certificate signed by a CA, if one of the issuers in the chain becomes invalidated or the date expires, then how does the program using the certificate know this?  Or is it up to the client to do this checking?

My specific scenario is self-signed root CA signs server certificate.


texts: Is truncating a hashed private key with SHA-1 safe to use as the symmetric key for AES for data at rest?

texts:
I realize this is mixing the purposes between asymmetric and symmetric crypto, but I was wondering if it is safe to use a hashed, truncated private key (asymmetric) as the symmetric key for encrypting data at rest? For this question I  am presuming RSA is a 1024 bit key, SHA1 produces 160 bits, and AES is using a 128 bit key.

It appears that the data obtained from an RSA private key maintains a specific structure and is not completely random, so simply taking the first 128 bits from the private key would not provide enough entropy for a symmetric key, correct? (I previously heard that truncating a randomly generated number is okay when selecting symmetric keys - but in this case all the data within the private key is not random)
By hashing the entire RSA private key, the result is condensed into 160 bits, more usable with AES 128 key size, but are we greatly reducing the entropy by doing so? (Of course you could use SHA2 for AES 256, etc)
Would it be recommended to extract something like the algorithm components instead like p and/or q since those values are 'more' random?
Any other suggestions?

Thanks in advance!


texts: what's the reason of the notational difference between statistical and computational indistinguishabilities?

texts:
Statistical: $|\Pr[E_K(m_0)\in T]-\Pr[E_K(m_1)\in T]|\leq\epsilon$
Computational: $|\Pr[A(E_K(m_0))=1]-\Pr[A(E_K(m_1))=1]|\leq\epsilon(n)$
What is the $1$ doing there? Why isn't it $Pr[A(E_K(m_0))\in T]$? Is there something deep behind these different notations? or is it simply a convention of the PPT $A$ having a boolean as a return value?


texts:
In EEA (EPS Encryption Algorithm) and EIA (EPS Integrity Algorithm), what exactly does the direction (uplink/downlink) indicate?
It's confusing because for both encryption and decryption of a given plaintext, the direction has to be same.

This w.r.t the LTE communication.

For your reference, the section B.1 in 33401-g00.zip at https://www.3gpp.org/ftp/Specs/latest/Rel-16/33_series/


texts: What is the state of cryptographic obfuscation in 2015?

texts:
Cryptographic Obfuscation is a technique that allows one to obfuscate source code in a secure way (as opposed to insecurely mangling it into spaghetti code.) For example, here is a way to protect a piece of data with a password:

cipher_text = obfuscate("\key -> if input == SYMETRIC_KEY
then return \"Launch code is 7205872\" else return \"No launch codes for you!\"")

Or here is a public key cryptography scheme:

public_key = obfuscate( "\input -> obfuscate(\" \key -> if key == PRIVATE_KEY
then return " ++ input ++ " else return \\\"You do not have the public key!\\\")" )

My question is, what is the state of this technology? Is it available in any programming languages yet? (I provided my code samples in a haskell-like language, since haskell is very similar to lambda calculus. Indeed, GHC compiles Haskell into lambda calculus as an intermediate step. It is therefore likely that a language like Haskell, or perhaps a lisp, would be the first for which it is available.)

NOTE: I am not talking traditional obfusication of cryptographic programs, but cryptographic obfusication techniques.


texts: How can k3d3/ed25519-java's performance be improved?

texts:
I tried asking this on stackoverflow because I thought it might be a simple coding question and didn't want to clutter up this amazing stack, but I received no responses.

CodesInChaos showed me that the proper implementation of Curve25519 for digital signatures is Ed25519 and also informed me that this implementation, the only implementation I can find, is very slow which I have now confirmed for myself.

I have essentially no experience with cryptography other than using the basic functions in that lib, so I'm afraid to touch it but would like higher performance.

To that end, how can the performance of k3d3/ed25519-java be improved?  Anything specific I can get, preferably code, would be immensely helpful!


texts: Securely transmit signed token (e.g., JWT) over insecure channel

texts:
Apologies if this is already answered somewhere, but I could not find it.
I have a setup where a client has a JWT (RSA- or ECDSA-signed), and needs to prove that fact to the peer which issued the token in the first place, in a way that's safe against person-in-the-mittle attacks. The peers have no prior knowledge of each other (i.e., no trusted certificates etc.). I was wondering whether the following is an authentication scheme that works, or has any obvious flaws. To limit the scope, let us not get into all the issues with JWTs or improper use of cryptographic functions (duplicate IVs etc).
Let A be the peer with the JWT and B the peer that issued the JWT with key pair $\langle K_{pub}, K_{priv}\rangle$.

A sends nonce $n_A$ to B
B generates an ephemeral X25519 key pair $\langle E_{pub}, E_{priv}\rangle$ and responds with $sign(\langle K_{pub}, n_A, E_{pub}\rangle, K_{priv})$.
A verifies the JWT signature as well as the payload signature against $K_{pub}$.
A sends $enc(JWT, E_{pub})$ to B (or generates a symmetric session key, uses that to encrypt JWT, and encrypts the session key with $E_{pub}$).

The nonce $n_A$ ensures that the signature generated in B is specific to the current transaction and not replayed. After the verification in step 3, A knows that B is the holder of the private key used to issue the token in the first place. Encrypting with $E_{pub}$ ensures that an attacker M can not decrypt the encrypted token (and they cannot inject their own $E^M_{pub}$ because the transmitted $E_{pub}$ is signed with $K_{priv}$, which M has no knowledge of).
I realize that there are a lot of subtleties and am not expecting a "certified secure" answer, but it would be great if anyone could (a) point me to similar authentication schemes used in practice, and/or (b) point out any obvious flaws/weaknesses in the proposed scheme.
Many thanks!


texts: Which algorithm do you recommend for practical use to generate unique passwords for each website?

texts: So, in my imagination there is this simple algorithm with only one master password, let's say a prime number 'p', which I have to remember. Using only the address of the website and p, the algorithm must generate a unique password. It must be at least almost impossible to guess the value of p even if you know the algorithm. Also impossible to guess the password of website B if you know the password of website A and the algorithm. The reason why I need this algorithm: I'd have different passwords and would have to remember only one number. There's also the matter of having multiple accounts on the same website but I think it will be easy to modify the algorithm. I think it will be useful for many users.


texts: Why not authenticate full-disk encryption?

texts:
Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an authentication tag for every sector and that would eat significant percentage of available space.

With 512-byte sectors and HMAC-SHA256 for authentication, you would consume roughly 6 % of disk space if each sector was fully authenticated. I could understand that someone would consider this amount to be too much, but if that's the case, you could simply truncate the HMAC tags, for instance to 64 bits (still better than nothing, right?), and use less than 2 % of total space.

With 4096-byte sectors, space is a complete non-issue, less than 1 % is spent on per-sector HMAC tags. Especially for AES-CBC-ESSIV where malleability is a significant risk, this seems like a price well worth paying.

Given that with CBC you need to re-encrypt the whole sector every time anyway, I don't see how authentication would matter even in terms of performance.

So, are there reasons for not using authentication that I'm missing?


texts: Why is factoring $p-1$ easy when $p$ is a safe prime?

texts:
A paper states:

  [...] $(p,g,y)$ is a correct ElGamal public key if $g^x=y\pmod p$. To verify this the order of $g$, and thus the factorization of $p-1$, is needed. This is easy for safe primes (i.e., primes $p$ for
  which $\frac{p-1}2$ is prime), but may be hard otherwise [...]

Why is it easy to factorize a safe prime's predecessor?


texts: AES storing the length within the encrypted data versus storing it outside

texts:
I need to strip off padding after decrypting AES(CBC)-encrypted data (I have control over encryption and data transmission), so have looked at adding the length of the original data to the payload being transmitted.

Option 1:
[ IV | Length | Encrypt(original data) ]

Option 2:
[ IV | Encrypt([ Length | original data ]) ]

Where:
"Length" is the 4-byte length of the original data

Would either of these approaches compromise the security of the message?

My concern with Option 1 is that you're giving away information for free: is there a way in which a potential attacker might be able to utilize the length of the data in attempting to compromise the message?

My concern with Option 2 is that a potential attacker (after determining by decompiling source code that the first 4 bytes indicate length) might try a brute-force approach, only needing to go through a much smaller part of the data for each potential key to determine if the message for that particular key is valid; i.e. that he only has to try one block or only the first 4 bytes of the message until he ends up with a block for which the first 4 bytes are relatively close to the size of the payload (hence effectively reducing the amount of time it would take to determine the message's key)

Are any of the aforementioned concerns valid?

What are the best-practices to store the message length / strip away padding?


texts: Can we say that if $P=NP$ there is no CPA secure public key encryption?

texts:
I've learned that public key encryption is based on the problem of Discrete Log (as regard to group theory) which believed to be hard.

But, can we say that it doesn't matter on which problem our public encryption rely and say that it couldn't be CPA secure anyway?


texts: How to sign a CRL file if I have offline keys?

texts:
I am generating a CA for internal use. When generating a CA, the best practice I have observed is to keep the root CA offline and emit an intermediate CA certificate that will in turn emit the end-user certificates. This way, a compromise of the intermediate CA key can be recovered by revoking that intermediate CA and generating a new one.

I see, however, CRL files need to be renewed regularly (eg. daily), which would require the root CA keys to be used. But the main goal of all this is to keep the CA keys offline. What is the best practice here?

Is there the possibility of using a separate key for CRL signing? If so, how would I do this? Question is not OpenSSL-specific but I'm using OpenSSL in case you want to provide examples.


texts: ElGamal signature scheme: Why is r included in s

texts:
In the ElGamal signature scheme we calculate a signature for a (hashed) message $m$ as

$r \equiv_p g^k$,

$s \equiv_{p-1} (m - xr) k^{-1}$

and verify it by checking

$g^m \equiv_p y^r r^s$.

Here $r$ is a group element which is in some cases used as an exponent. This is not a problem, as long as the group elements are just natural numbers, but using a different group, this causes complications (like in EC-DSA, where we have to use just one coordinate of $r$ when it ought to be an exponent).

Even though this is admittedly not a big problem, my question is: Why is it even necessary to include $r$ as an exponent in $s$? Would changing the calculation of $s$ to just

$s \equiv_{p-1} (m - x) k^{-1}$

and the verification condition to

$g^m \equiv_p y r^s$

be insecure in some way?
So far I couldn't find a way to forge a signature or extract $x$ or $k$ from this modified scheme.


texts: Why can't we use the first block of AES-CBC as MAC

texts: As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?


texts: Are Common Reference String (CRS) and Structured Reference String (SRS) is the same in preprocessing phase of zk-SNARK? Is there any difference between them?


texts: What does CMS standard mean by "initial input to the message digest"

texts:
I'm really grinding my teeth against digest calculation explanation in the CMS standard.

Let's consider the case when the signedAttrs are present.

The first paragraph says

  initial input to the message    digest calculation process is the
  "value" of the encapsulated content    being signed.

To me that implies that whatever digest value that will be signed, somehow "starts" with being the digest of the message.

The second paragraph says:

  When the [signedAttrs] field is present, however, the result is the message
  digest of the complete DER encoding of the SignedAttrs value
  contained in the signedAttrs field.

To me this does sound like the result is solely derived from the signedAttrs value, but then the first paragraph seems to be contradictory because it said that no matter what, the digest must start with encapsulated content. The second paragraph does then mention that the content hash will be indirectly included, because it must be present, but to me that still doesn't negate implication made in the first paragraph.

P.S. Based on OpenSSL implementation, I figure that the "correct" behavior is only hashing signedAttrs.


texts: Infinite one time pads using a pseudorandom hash function

texts:
Paul Christiano writes (source):

  I’ll assume that we have some 256 bit cryptographic hash function F [...] The first important observation is that a 256-bit shared secret allows Alice and Bob to talk for as long as they want, by just using their secret to create a new pseudorandom pad for each message. That is, if Alice and Bob share a secret s, then Alice can send a message m by picking k at random, and sending the pair (k, F(sk) ⊕ m). It’s easy to confirm that Bob can still get the message, and if F is random then this is secure.

This is confusing to me. I was under the impression that there is no way of using a one time pad based on a shared secret of $n$ bits to transmit securely more than $n$ bits but this seems to imply it is possible by sending messages with $k=1,2,\dots$

What am I misunderstanding?


texts:
Imagine the following situation:

you have a tweakable block cipher
you have a plain text block
you have a cipher text block
you have the key which was used to encrypt the plain text block

I have these questions to it:

Is there a way to determine the tweak which was used? (a method which is significantly faster than brute forcing)
Is a tweakable cipher considered more secure if there is no fast method to do that?
Is any tweakable block cipher explicitly protected against that?

My concrete case is the following: I wrote an implementation of threefish in python. To check if I did sth wrong, I looked for test vectors in the internet. Every vector worked, except one. The difference between this vector and a previous example on the same page was only the tweak (to show that changing the tweak leads to another cipher block). So I wanted to know if there might be a fast way to calculate the tweak they actually used. Though this is very specific to threefish, I was curious if this might be a general design goal of tweakable ciphers.


texts: Which encryption technique should be adopted to keep the search functionalities?

texts:
I am in exactly the same situation as described in this post. I must be able to encrypt data from a client workstation then send it to an untrusted server (encrypted at rest), then decrypt it only on the same client workstation. However, the client must be able to continue to do "encrypted" searches based on the cypher text.
AES CBC seems to need a unique IV for each encryption, so I can't use this technique. And all others, CGM, ... and even the asymmetric RSA encryption have the same behavior with a padding which means that the cypher text is never the same for the same plain text ...
It seems that only AES ECB can produce the same cypher text. The important point in my case is that the data that I have to encrypt is all in the format string max 1000 char and also that I have to protect this data from the hoster (at rest), there is no risk the In Transit and the data are not exhibited on the internet. I don't know if I can relay on ECB...
So I ask the question again because 5 years have passed since this post, there may be other options? Can you advise me which technique to use being quite secure and ensuring the non-brute forcing and with which I can continue to search (on cypher text). Can I use AES CBC with the same IV? Can I use AES ECB (256)? Others?
Thank you !


texts: Efficient proof of knowledge using Carter-Wegman hash

texts:
A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an objective to keep $M$ secret or ensure that the other systems hold $M$ in some specified form (it is fine that $M$ is stored compressed or distributed in the other systems).

This seems ideal grounds for a protocol as follows, based on my limited understanding of Carter-Wegman hashes:

verifier chooses a random primitive polynomial $P$ of degree $k$ with binary coefficients, and publishes/broadcasts it as a message of $k-1$ bits (the coefficients of degree $k$ and $0$ are known to be $1$ and need not be sent, and we might compact this a little further by broadcasting the seed for some CSPRNG used to generate $P$);
verifier computes the remainder of the polynomial $M$ (with the bits of $M$ defining the binary coefficients of the polynomial) by polynomial $P$ (in other words, the verifier computes a CRC of message $M$ per polynomial $P$);
verifier receives a message and is content if it is of $k$ bits that match the remainder that is computed. Of course, that message was computed by the other system(s) proving they collectively hold $M$.

Questions:

Does this protocol meet the stated objective? Can we prove it under some appropriate definition of security, with quantitative bound as a function of $k$, and the number $n$ of iterations made for the same $M$ (and perhaps of the size of the broadcast message if that can be made much lower than $k$, and of the size, $m$ of $M$ if that matters)?
What if we replace the condition that polynomial $P$ is primitive by some weaker condition?
What speed (in bit/second) is possible on an actual CPU, like a modern x86-64 or ARM CPU, with comparison to other means (perhaps, HMAC-MD5 or CBC-MAC-AES with the challenge as key)?

Late update: it appears the scheme is Rabin fingerprinting, or closely related to that (a difference is that in Rabin fingerprinting, the polynomial is chosen irreducible, not necessarily primitive; and that Rabin fingerprints use proper padding, which I forgot: my technique fails to prove that the number of initial 0 bits is known by the provers).


texts: Encrypt symmetric session key with asymmetric or symmetric master key?

texts:
Every day, I must backup my server's files, encrypt the backup, and upload it to untrusted cloud storage (dropbox, s3, etc.)

I've spent time on security.stackexchange where I discovered the typical approach is:

encrypt the backup with random one-time symmetric key ("session" key), for speed
encrypt the session key with an asymmetric key ("master" key: the public key in a public/private keypair)
upload the encrypted backup and encrypted session key to cloud storage

But I don't understand: why not use another symmetric key as the master key? Put another way: there is no key exchange here, as I am both "sender" and "receiver" - so how do I benefit from using an asymmetric key as master?

(For example, I'm using gpg, so my server could store a symmetric key with a 100-char passphrase, and use it to encrypt the daily session keys.)


texts:
How can I tell how many bits of security a secure hash function has?

For example, how would I calculate or tell how many bits of security a secure hash function with 160 bits output would have? Assuming there are no known weaknesses…


texts: Security of the Needham-Schroeder public key protocol after a minor adjustment

texts:
I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer:

We have the Needham Schroeder Public Key Protocol:

$ 1. A \rightarrow B: \{N_A, A\}_{pk(B)} \\
2. B \rightarrow A: \{N_A, N_B\}_{pk(A)} \\
3. A \rightarrow B: \{N_B\}_{pk(B)}$

The question asks for an attack on this protocol. Like for the original NSPK I think the weakness is a man-in-the-middle attack (where $I_A$ stands for $I$ impostering as $A$ on the network:

$ 1. A \rightarrow I: \{N_A, A\}_{pk(I)} \\
\hspace{225px} 1'. I_A \rightarrow B: \{N_A, A\}_{pk(B)} \\
\hspace{225px} 2'. B \rightarrow I_A: \{N_A, N_B\}_{pk(A)} \\
2. I \rightarrow A: \{N_A, N_B\}_{pk(A)} \\
3. A \rightarrow I: \{N_B\}_{pk(I)} \\
\hspace{225px} 3'. I_A \rightarrow B: \{N_B\}_{pk(B)} \\
$

Which uses $A$ as a decryption agent to authenticate $I_A$ with $B$ despite it not being $A$'s intention to do so.

Now the question then asks about the modification of line 3 in the given protocol, i.e. changing the line: $3. A \rightarrow B: \{N_B\}_{pk(B)}$ into $3. A \rightarrow B: h(N_B, A, B)$ for a cryptographic hash function $h$.

The original man-in-the-middle attack doesn't seem to work from what I can see under this modification.

It then goes on to ask me whether this new method is secure on not, i.e. does any attacks exist on this new protocol? I have thus far noticed reflection and man-in-the-middle attacks will fail on this new protocol.

I'm wondering if there exist any attacks or else what would be a way to show its security? (Gut feeling says there should exist an attack as it may be very difficult to show it is completely secure.)


texts: Are there encryption schemes that can be performed using an adding machine?

texts:
There's been a lot of talk about encryption that can be done by hand, but what if the user is allowed an adding machine?

Let's say addition, subtraction, multiplication, and division are easy. Memory (i.e. the user writing things down) is possible but undesirable. Are there any good encryption algorithms that can be performed like this?


texts: Is the RSA signature attack from Desmedt and Odlyzko practical?

texts:
I would like to understand how the attack from the Desmedt and Odlyzko on RSA signatures (and subsequents works) can be made practical. This attack describes a way to forge the signature on a new message using Gauss elimination. The problem is that a message is hashed before the private exponent is applied, so maybe I have missed something... Why is this attack practical?

Thank you.


texts: McEliece variants that support signatures

texts: Besides the Niederreiter cryptosystem, are there any other variants that support digital signatures? Can any of them sign arbitrary signatures unlike the Niederreiter cryptosystem? What are the key and signature sizes?


texts:
I'm considering using zkSNARKS for a project i'm building. I have some questions about the practicality of such algorithms:

Does a standard secure implementation exists?
What is the complexity for the generator, prover, and verifier procedures? What does it depend on?
Is it efficient in practice on normal computers (contrary to say homomorphic encryption, which has polynomial complexity but very inefficient in practice)? What are the results of profiling done on actual implementations?


texts: Hitting a counter example in homomorphic encryption over the integers

texts:
The paper Fully Homomorphic Encryption over the Integers talks about a super simple symmetric key implementation on page 1 and 2.

It says that to generate a key, you pick a random odd number between $[2^{N-1} ,2^N)$ where N is the size of your key in bits.

To encrypt a bit (a 0 or a 1), you do this:
$c = pq +2r + m$
In other words:
$CipherBit = Key * RandomIntegerA + 2 * RandomIntegerB + PlainTextBit$

RandomIntegerA is there to hide the key better and RandomIntegerB is a small number to add noise to the encrypted value (to make it a "learning with error" problem).

To recover an encrypted bit you do this:
$PlainTextBit = (CipherBit \% Key) \% 2$

You can do an XOR by adding two cipher bits together, and you can do an AND by multiplying them together.

I've simplified my implementation a bit to make it easier to explain in a presentation, so i have RandomIntegerA hard coded as 1, and RandomIntegerB hard coded at 0.

This simplifies encryption (yes, making it insecure, but more easily explained) to this operation:
$CipherBit = Key + PlainTextBit$

The decryption, AND and XOR operations remain the same.

Now that the explanation is out of the way, here is my issue...

When Key is 9 (1001 in binary), let's say i have 3 cipherbits A,B and C that are valued at 10, 10 and 114100 respectively.

A quick check when decrypting them shows that they are all true bits:
$(10 \% 9) \%2 == 1$
$(114100 \% 9) \% 2 == 1$

I hit a problem though when I calculate A xor B xor C.  To do this, I add them all up and get 114120, which decrypts to a zero bit:
$(114120 \% 9) \% 2 == 0$

However, 1 xor 1 xor 1 is 1!

Something I've noticed is that before doing the % 2 on A,B,C their remainders are 1, 1, 7 respectively.

When adding them together, it effectively adds (and mods) their remainders, so it makes sense that (1+1+7)%9 would be 0.

Can anyone see where I've gone wrong?

Thanks!

EDIT: Here is an even simpler counter example
With a key of 9, say we have two encrypted bits: 1 and 8, which decrypt to 1 and 0 respective.

To do an XOR, we should be able to add them.  When we add them, we get 9.

If we then decrypt 9, 9%9 is 0, so it says that 1 xor 0 is 0, which is wrong!

It seems like this scheme doesn't work if you hit these perfect "roll over" points.

Like if your key is 533 and you want to xor two encrypted bits: 532 (0) and 1 (1), you get 533, which decrypts to zero.

Or if your key is 5 and you want to xor 4 (0) and 1 (1), you add and get 5, which decrypts again to zero!

I've seen plenty of other papers extending the homomorphic encryption over integers... surely they can't all be wrong :P  Not sure what I'm messing up though...


texts: Would the rotors in Enigma machines always advance by one position? Or was there a way to set this?

texts: Before encrypting a letter the first rotor advances by one, right? So there could be a way, once the first rotor turns 26 times, make the second rotor advance two positions instead of one. Or three. Did the Enigma take advantage of it?


texts: I'm looking at the description of NTRUEncrypt given on page 21 of http://archive.dimacs.rutgers.edu/Workshops/Post-Quantum/Slides/Silverman.pdf and using its notation. So in NTRU there are always two private parameters $F$ and $G$. However, decryption only requires knowledge of $F$. I'm confused about what the purpose of $G$ is because it doesn't come into the decryption and I don't see why removing $G$ hurts the security of NTRU - more specifically, is NTRU still hard if $G$ is always set to 1 (i.e., $(1,0,0,...,0)\in \{-1,0,1\}^N$)?


texts: Recommended authenticated stream cipher for minimum overhead?

texts:
I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet.

This causes quite a bit of space overhead for small packets, so at first I was thinking of running AES in CTR-mode and still use the HMAC, but it would be much better to run some sort of stream cipher with integrated authentication.

What are my best options?

Edit:

I should mention that failing an integrity check will always disconnect a connection.

This means re-negotiating the encryption keys, which gives each new connection a new encryption and signing key.

In other words, make a wrong guess and the keys are reset. Even with a small integrity checksum, guessing right to sustain an exchange appears to be a hard problem.


texts:
I'm trying to implement a diffie-hellman key exchange in c++, and I'm struggling with my missing understanding of math / group theory. Let's say I found a large prime number p - how can I find a generator g?

Restricted by the multiprecision library that I have to use, only a few basic operations (+, *, -, /, pow, modExp, modMult, mod, gcd, isProbablyPrime, genRandomBits, and a few more) are available.

I read that in a cyclic finite group $Z_q$ where $q$ is a safe prime, every element is a generator of that group. So I assume I should start by generating a safe prime $q$ first:

Pseudocode:

 // find a safe prime q
 WHILE NOT isProbablyPrime(q)
     WHILE NOT isProbablyPrime(p)
        p = genRandomBits(1024)
     q = 2*p+1

But how do I now find a generator for $Z_q$?


texts:
I need to create a hex string representation of a certificates public key using mbedtls.  I have the certificate parsing OK so have a valid mbedtls_pk_context for public key.
I have been battling with this for a while now and have come up with the following methods to read the key:

mbedtls_pk_get_len - to get key length
mbedtls_pk_write_pubkey - to get the key as ASN.1
mbedtls_asn1_get_sequence_of - get the items in the ASN.1 sequence
Use the first item in the sequence as the raw value for the key (need to check this work for all key types)
Determine if the leading zero is required on the key (by checking if the ASN.1 length is one byte larger than expected for the key.
Print the key as a hex string

This seems like quite a lot of work to get the key out.  But, I cant find any other functions that just give raw access to the key itself.
Anybody have any ideas?
Thanks in advance...


texts: Does a thermodynamic limit on key search apply to quantum computers?

texts:
There is (or at least was) a thermodynamic reasoning that any form of brute force key search would require an energy at least $k\,T$ per key tested, where $k$ is Boltzman's constant and $T$ the device's absolute temperature in Kelvin. It concludes that at the evaporation temperature of helium, our sun's whole radiated energy is short to challenge 192-bit crypto in decades, or 256-bit crypto ever.

Does such thermodynamic limit apply to (still hypothetical) quantum computers doing key search for a symmetric cryptosystem by Grover's algorithm or the like?


texts: Obfuscating functions that are mostly zero

texts:
Let $f_k(x)$ be a boolean function of two arguments with two properties:

The function $f$ can be efficiently computed.
The output is always 0 or 1, and for any fixed $k$, if we choose $x$ randomly, $\Pr[f_k(x)=1]$ is tiny (say, exponentially small).

Question: Is there a generic way to, given $k$, obfuscate an arbitrary such function?  In other words, can all functions with this property be obfuscated?

Here's what I know.  The function $f_k(x)=1$ if $x=k$ or $0$ otherwise can be obfuscated (it's called a point function).  The function $f_k(x)=1$ if $d(k,x)<t$ or $0$ otherwise can be obfuscated, where $d(\cdot,\cdot)$ is the Hamming distance and $t$ is a constant threshold (see the fuzzy vault scheme of Juels and Sudhan).  These are simple examples of functions that meet these properties and can be obfuscated.  Perhaps all functions in this class can be obfuscated?

I also know that there is no generic scheme that can obfuscate all functions -- but perhaps it's possible to find a generic scheme that obfuscates all functions in this class.

Motivation: This would be useful for verification of biometrics.  Think of $k$ as the template for the user, and $x$ as the biometric that's submitted to the system; $f$ verifies whether the user should be accepted.

Password verification is a simple case of this that corresponds to $f_k(x)=1$ iff $x=k$; here $k$ is the saved password stored when the user set up their account, and $x$ is the password entered by the user during the authentication process.  Password hashing is a method of obfuscating this verification function.  The fuzzy vault scheme is suitable for biometric schemes where we think the sensor might introduce random bit errors.  But there are other biometric schemes that might involve more complex procedures for verifying the proposed biometric, and I'm wondering if there is any generic result that demonstrates all such verification schemes can be obfuscated.

I'm fine with any reasonable form of obfuscation (including indistinguishability obfuscation).


texts: Can we use numbers as a pad in the Vernam cipher - why or why not?

texts:
I was playing with the Vernam cipher on some online converter.

But when I tried to encrypt my message string with numbers, it remained unchanged.

Moreover, it was ignoring numbers and was encrypting as some alphabet appears in the key.

So, can we use numbers as a pad in the Vernam cipher - why or why not?


texts: DGHV Bootstrap - How can I recrypt my cipherbit

texts:
I'm implementing this homomorphic crypto-system : http://eprint.iacr.org/2011/440
I'm using SAGE math.

I don't get how the bootstrap is done in this scheme, in the appendix A, they say Apply the decryption circuit to the expanded ciphertext z and the encrypted secret key bits σi, thing that I don't understand since the decryption circuit requires a modulo 2.

How then I should apply the modulo on a cipherbit (and by staying in the cipherworld, using the public key and never decrypt)? (in their implementation, they are using the recrypt function, which I don't understand at all)


texts: Encryption and decryption with Diffie-Hellman

texts:
I don't understand how it works. I only found explanations about the key exchange, but what about the actual encryption and decryption?
Do you use the session key $K$ with a symmetric algorithm?
Do you use something similar to RSA like $m^d \bmod n$?


texts:
I am currently working on a hardware project that will utilize the native USB and keyboard emulation capabilities of the Teensy device. Essentially, the user will store an encrypted password database on a mounted SD card that the Teensy will read and send to the host computer. This prevents the requirement of storing passwords in browsers, or certain managers.

However, I'm having a very hard time finding a secure way of encrypting it.

As of right now, I'm using the SHA256 hash value of the pin code as the AES-256 key.

Pin Code - I am currently using a 4x4 matrix keypad to allow the user to enter a pin code immediately after the device boots up. The available pins for the passcode are (14 characters): 0 1 2 3 4 5 6 7 8 9 A B C D This limited keyspace means that passwords need to be much longer in order to maintain the same amount of security. Otherwise, this is my favorite option. It also allows me to use the keypad for navigation. Adding a salt would better, but exhausting the entire keyspace is very fast.
Fingerprint - This is a neat idea that could potentially be leveraged to allow different users to share a single hardware device. However, this doesn't aid in encryption. I don't know of any implementation of a symmetric encryption algorithm using a fingerprint, or a direct derivative thereof, as a key.
YubiKey - This isn't necessarily a bad option, as it would provide a secure way of handling encryption/decryption of such devices, but that means it requires additional hardware for users. Also, I actually planned on implementing the Yubikey emulation library so the device could, itself, be used as a YubiKey.

Is there a feasible way? Or is this project flawed from the start?


texts: Why does SHA-1 rotate the variables A and B?

texts:
SHA-1 has an operation within round j in stage t, where the functions $f_t$ and $K_t$ change depending on the stage.

Is there a specific reason why the variable $A$ is rotated by 5? How does this improve security? And why not rotate the variable by 30 like $B$ is?

I have the same question about $B$: why is the variable rotated and why isn't it rotated by a different amount?


texts: Trying to understand how the same secret key end up being calculated between Alice and Bob

texts:
This is basically a duplicate of this question which was not answered very clearly. From the documentation, these are the calculations that happen for Alice to compute the shared secret key:

DH1 = DH(IKA, SPKB)
DH2 = DH(EKA, IKB)
DH3 = DH(EKA, SPKB)
DH4 = DH(EKA, OPKB)
SK = KDF(DH1 || DH2 || DH3 || DH4)

If I understand correctly,

IKA -> Alice's private identity key

SPKb -> Bob's public signed prekey

IKB -> Bob's public identity key

EKA -> Alice's public ephermal key

OPKB -> Bob's public one time prekey

From the documentation:
"Bob retrieves Alice's identity key and ephemeral key from the message. Bob also loads his identity private key, and the private key(s) corresponding to whichever signed prekey and one-time prekey (if any) Alice used. Using these keys, Bob repeats the DH and KDF calculations from the previous section to derive SK, and then deletes the DH values."

I interpreted this as bob doing the same computations above with following values:

IKA -> Alice's public identity key

SPKB -> Bob's private signed prekey

IKB -> Bob's private identity key

EKA -> Alice's public ephermal key

OPKB -> Bob's private one time prekey

What I don't understand is how the same secret shared key end up being computed even though for DH1, DH2, DH3, DH4 different values are used for the keys. I am probably missing some property of the DH function along with how public keys are generated from private keys that makes this possible. Or my whole understanding of this is incorrect. Any help would be appreciated thank you!


texts: Struggling to understand CFB mode (with DES)

texts:
I'm really struggling to understand CFB mode (with DES if that matters). I realise after searching around here that these modes are now obsolete but I need to understand them for class. From wikipedia, I see that for encryption:
$$C_i = P_i[:s] \oplus E_k(S_i)[:s]$$
$$S_0 = IV$$
$$S_i = (S_{i-1} << s) | C_i$$
(I'm using a python like notation so [:s] means first $s$ bits).

I'm already having trouble understanding this encryption scheme and how error propagates through. Wikipedia says that if an $C_i$ becomes corrupted then the encryption will eventually recover. I tried reading discussions about this here but I'm failing to see this (I am hoping for a more elaborate explanation).

Let's say $s=4$ bits, $IV$ is 64 bits and that $C_2$ becomes corrupted such that we correctly computed $C_1$ and $C_2$ from $P_1$ and $P_2$ but we can not correctly calculate $C_3'$ since $$C_3 = P_3[:4]\oplus E_k((IV << 8) | C_1 | C_2')[:4]$$
and so $E_k((IV << 8) | C_1 | C_2')$ gives an incorrect encryption and therefore an incorrect $C_3$ which I denoted as $C_3'$. If I continue this pattern, it seems that I always get an incorrect $C_i$ since the shift register will always be wrong. e.g consider

$$C_{17}' =^{?} P_{17}[:4]\oplus E_k((IV << 64)|C_1|C_2'|C_3'|...|C_{16'})$$

$$ = P_{17}[:4]\oplus E_k(C_1|C_2'|C_3'|...|C_{16}')[:4]$$

but this still gives the wrong value so I'm not sure why the system recovers. What am I misunderstanding?


texts: (Simple) Tool for analysing performance (speed in particular) of cryptographic hash function?

texts:
I am doing some research for which I intend to insert some (external) function in different cryptographic hash functions and I would like to analyse how the insertion of this extra code in the hash function affects its performance, especially its speed in hashing and any other performance measures.

I came across SUPERCOP and SMHasher (a test suite for non-cryptographic hash functions) but I have no idea whatsoever how to go about using either.

Anyone have any idea how any of these tools is used?
Otherwise, does anyone know any other tool which I can use and how it is used?

Thanks in advance for your help.

Edit: My code is written in C under Linux.


texts: How is the DUHK attack specific to the ANSI X9.31 RNG?

texts:
Recently, the DUHK attack on bad RNG implementations of hardware devices has been published.

The attack is based on a (known or reverse engineerable) hardcoded key, which is used for a ANSI X9.31 based PRNG to create key material.

According to the blog post by Matthew Green, the attack is explicitely based on the X.931 generator: "ANSI X9.31 (and its cousin X9.17) is over twenty years old. It’s (fortunately) been deprecated as of 2016, but a huge number of products still use it. This algorithm should have disappeared ten years earlier"

But I keep wondering, how this attack is specific to ANSX X9.31. As far as I understand it, the very same problems would arise, if a hardcoded key would be used with any of the other keyed PRNG standards (like HMAC_DRBG or CTR_DRBG). What am I missing?


texts:
Why not have each person simply treated as a counterparty to an off-the-record chat?

People show up in groups and show an ID which is cross-referenced against a central database to prevent Sybil attacks.
They have their apps generate a set of random numbers by each committing to one or more values and then revealing their values, combining them to form some set of random numbers.
Based on this, they each receive a provably random series of off-the-record MAC keys to use for upcoming elections onto their device, without the issuer knowing anything about the device, e.g. scan QR codes.
Then in each election, they vote once using Off-The-Record Messaging and have all the votes stored in a Merkle tree?

This scheme has the following properties:

Verifiability - seeing one’s own Merkle branch is all that’s needed to verify the vote was counted correctly. Seeing the whole Merkle tree one can show that a certain % of issued tokens were used and used only once.
Unlinkability - just like in OTR chat, once you sent the message, the zero-knowledge proof has been conveyed but now no one can prove how you voted.

Is there a flaw I missed? Why can’t we do voting like this?


texts: Can you decrypt all messages if a private key is obtained of one of the two entities in asymmetric encryption?

texts:
Given a context where Alice sends messages to Bob and vice versa. There is an intruder, Carol, that has obtained the private key of Alice. She also obtained both public keys.

Can Carol decrypt all messages or only the ones that are sent from Bob to Alice?

If Carol can decrypt all messages:
How can she do this?
Are there algorithms where Carol couldn't decrypt all messages if she obtained only one private key?


texts: Does adding more letters provide added security compared to a standard substitution cipher?

texts:
Let's say that a substitution cipher had 52 symbols instead of 26. For this, we would include all lower case and upper case letters. This creates a key space of 52! wehere the cipher text can contain both lowercase and uppercase letters. Would this provide more security to a standard substitution cipher?

I would say yes because it's an extra amount of symbols one would have to use and thus creating more options of how many keys can exist. However, I am doubtful because It's still just letters being used. Can anyone explain?


texts: Linear Feedback shift register over integers

texts:
The Solina's paper Generalized Mersenne Numbers contains a Linear Feedback shift register I am not able to understand. Here it is:

It is supposed to be a normal Linear Feedback shift register but it doesn't seem to follow the "normal" lfsr rule. Is anyone able to explain the logic it follows?


texts:
What impact does the quantum compuer has on modern cryptography?

Recently I read that IBM already has a working quantum comptuer, although small number of qubits, but that they hoped to introduce a much more powerful model within the comming years.

Also, such a capable quantum computer should be able to solve hard mathematical problems within polynomial time (if I've understood it correctly).

Is the factoring problem one of these? If so, RSA would be broken, right?

Does a quantum computer make modern crytography obsolete, so that new assumptions have to made on which to base future cryptographic schemes? (Like the factoring problem is hard-to-solve provide justification for the security of RSA).


texts: Can machine learning analyze random number generator?

texts:
I'm studying for random number generators(RNG) and I saw about machine learning a few days ago.
So I searched analysis of RNG using machine learning.
But I couldn't find such fields.
Are there such examples for analysis of RNG using machine learning?
No matter some papers of articles.


texts: Proof one-time pad is perfectly secret with eavesdropping game definition

texts:
I have the following definition of perfect secrecy (please assume that the probabilistic version is not available):

If we consider the eavesdropping game given by:
$$\begin{array}{|r | r|} \hline Alice & Eve \\ \hline & (m_0,m_1) = E.m()\\ k \leftarrow Gen() &  \ \\ b \leftarrow fair\_coin() & \\ c \leftarrow Enc_k (m_b) &  \\ & r = E.r(c)\\ \hline \end{array}$$
one says that a symmetric encription system is perfectly secret if there is no attack $E$ which wins the game with probability strictly greater than $1/2$, where winning the game means that at the end of the process $b = r$.

With this definition I have to prove that the $(G,l)$-one time pad (that is one-time pad over groups) given by $Enc_k(m) = m \circ k$ and $Dec_k(c) = c \circ k^{-1}$ is perfectly secret. Here one defines for $m = (m_1,\ldots,m_l)$ and $k = (k_1,\ldots,k_l)$, $m \circ k = (m_1 \circ k_1,\ldots,m_l \circ k_l)$ and $k^{-1} = (k_1^{-1},\ldots,k_l^{-1})$.
My approach
$k$ is uniformly distributed by assumption and since $m_b$ should be independent
of $k$ then $m_b \circ k$ is uniformly distributed. But no attack can distinguish in a uniformly distributed sequence with probability greater than 2.
Is my approach correct?


texts: Why do we need multiple adversaries in a game-based definition?

texts:
Consider we have a protocol, where multiple algorithms of it are run by an adversary.
When we want to define a game for that protocol (or its security properties), I have seen that an adversary is defined as $A=(A_1,A_2,...A_n)$. Then each of them (e.g. $A_1$) calls a certain algorithm and outputs something (in other words its role is one-off).
Question: Why do we need multiple adversaries instead of a single one? why cannot always use only one adversary (like here)?


texts: AES-128 as compression function in Merkle-Damgard construction

texts:
Using a compression function $f : A × A → A$. A basic version
given by:

$W_0 = IV$
$W_1 = f(W_0, m_1)$
$W_2 = f(W_1, m_2)$
...
$W_n = f(W_{n-1}, m_n)$

$W_n$ is the output of the hash function, $m_1,m_2 . . . m_n$ is the message and $IV$ is a constant.

What would be the simplest way to implement AES-128 as the compression function? And would it be one way?

Excuse my ignorance, I am very new to the topic. My very wild stab in the dark is that AES-128 can be used in a way that feeds its own produced ciphertext blocks back into itself as the key.


texts: I have this list of LibSodium primitives, which should I pick so that the implementations tend to be interoperable?

texts:
When I integrate lib sodium, into a c# project, and try to consume, encryption and decryption in a particular way, it works, but the confusion is about, which method to use while encryption or decryption, as it provides various ways to encrypt/decrypt. For example :

Problem Statement 1: Currently, I have multiple applications, in various technologies like, an android App, iOS App (Swift / Objective C), Node Js App, Web API (C#), Web Site (C#), Web Service (Java), Windows Application (C#, C++), there can be more, but these are the first once to be targeted. These application interact with database and my database is encrypted currently with custom aes encryption format (and can only be accessed with C#), moving forward, I think we are finalizing on LibSodium so that same encryption decryption can be implemented in almost all languages.

While exploring Lib Sodium, its confusing to surely know which encryption or decryption, as seen in attached screenshots is the best/the most secured way to go ahead:

Use a best methodology i.e Stream Encryption, CryptoHash etc. (Any one)
Use combinations of multiple Methods, Like first use Stream Encryption and then to go for CryptoHash etc. ( this might have some performance issue).

Problem Statement 2: Another problem which I am facing is, to find similar methods in other programming languages, i.e. If I use Stream Encryption in C#, its known as xor in Node Js, and some other name in c++, then how should I find its equivalent every time in other languages ?

P.S. I did go through the documentation of lib sodium so please don't comment the link of lib sodium


texts:
Is using Argon2 for both password storage and key derivation secure? I'm planning on using different salt values, of course.

The basic concept is something like this:

Alice has some secret data ($data_e$) on her account. It's encrypted with an Argon2 derived key from her password, using a random salt.

$$ k = \operatorname{Argon2}(\text{password}, \text{salt}_1, \text{iteration})$$
$$ \text{data}_e = \operatorname{E}_k(\text{data})$$

Alice's password is stored as an Argon2 derived key from her password, using a random salt. When Alice (or an adversary) wants to log in, a key is derived from the input using Alice's password salt and checked for a match.

$$\text{storedPWD} = \operatorname{Argon2}(\text{password}, \text{salt}_2, \text{iteration})$$

Should the secret data be encrypted with Alice's raw password?
Should her data to be encrypted with a random key encrypted with her raw password? With a key derived from her password?

You should assume that Alice is a trained system administrator who understands the risk of having a weak password. The password will have at least 12 characters, will include capital and small letters and have numbers.

Also assume that the login system is bruteforce-resistant, but think about the possibility of a database breach.

Thanks in advance.


texts:
How to make a message into a polynomial on NTRU encryption? for example how we can conver 'hello world' to polynomial...
i have read the converting operation on IEEE Std 1363.1- 2008, but i can't understand the process without example, can anyone show for the small example?