texts:
I am trying to implement given DSA signature generation instructions in python, there are few instructions that I couldn't understand in step 3 and 4.

Let m be an arbitrary length message. The signature is computed
as follows:

generate k (i.e., k is a random integer in [0, q − 1])
r = g^^k(mod p)
h = SHA3 256(m||r)

What does m||r mean? m is a message length r is also a number so what should be the input of hashlib.sha3_256(input) function? As I see in Python it says input must be a string (converted to byte).
s = α · h + k (mod q)

h is a string returned by sha3_256 so how do I multiply it with α?
The signature for m is the tuple (s, h)


texts: Combination of TLS_PSK and TLS False Start

texts:
I am evaluating the use of TLS 1.2 for a low powered embedded environment.

After looking at RFC 7925 (TLS for IoT) I was wondering if the combination of

the TLS_PSK_WITH_AES_128_CCM_8 cipher suite (RFC 6655)
and the TLS False Start extension (RFC 7918)

is

possible / compatible and
has additional security implications beyond those already imposed by the use of a TLS_PSK_* cipher suite.

Section 21 of RFC 7925 mentions several conditions for using TLS False Start. However, TLS_PSK_* cipher suites are not mentioned specifically.


texts: Can the encryption exponent e be greater than ϕ(N)?

texts:
So I was just wondering in RSA, can the encryption exponent e be greater than ϕ(N)??

For an examples sake, lets just say N = 707, so p = 101 & q = 7. So, we have ϕ(707) = 600.

Can I have e = 707? because I can calculate d = 443 by de=1 mod 600.

I have seen it almost everywhere that 1 < e < ϕ(N). But my question is WHY?

Why can't I have e = 707 & d = 443 in the setting I described above?


texts:
Passwords hashed under Unix/Linux systems can use several hashing algorithms.

      ID  | Method
      -------------------------------------------------
      1   | MD5
      2a  | Blowfish (on some Linux distributions)
      5   | SHA-256 (since glibc 2.7)
      6   | SHA-512 (since glibc 2.7)

I'm interested in how UNIX uses blowfish to encrypt the password. Is it bcrypt like (and in fact hashing and not encrypting) where the key is derived from the password, expanded and then used to encrypt the password itself several times, finally yielding a hash?


texts: What happen if a asymmetric crypto-system deals with only one key

texts:
Assume there is a crypto algorithm that deals with matrices to encrypt and decrypt. Regardless of the specification of such algorithm, what if the algorithm assumes that two parties can securely agree on a matrix and use it along with its inverse to encrypt and decrypt? What I am trying to understand, is that, such thing plays excatly the same role of asymmetric/public key cryptosystem. However, in this algorithm (unknown), there is only one key to encrypt and decrypt messages and is known to two parties who have never met before (agreed on it through a public channel). I would like to know in point of security, and consideration of public key cryptoo

Thanks in advance


texts:
In this paper the authors describe a differential attack against FEAL-8. They find several short differential trails, then extend the attack to the full 8-Rounds of the cipher by algebraic means.

In the diagram below, the differential trail includes a zero difference. How is this possible? If the inputs lead to a zero difference at some round in the middle of the cipher, would the intermediate ciphertexts not continue to stay the same for all future rounds?

How are these differential characteristics discovered? It seems easy to iterate over a (small) round function and find the difference probabilities for the inputs, but how can the authors see what the inputs are that cause the desired difference somewhere at a middle round of the cipher?


texts:
So lately I've been studying the TLS Protocol. In particular, going through RFC 2246, section 7.4.7.1, i.e, RSA Encrypted Premaster Secret Message, I encountered:

  If RSA is being used for key agreement and authentication, the
  client generates a 48-byte premaster secret, encrypts it using
  the public key from the server’s certificate or the temporary RSA
  key provided in a server key exchange message, and sends the
  result in an encrypted premaster secret message. This structure
  is a variant of the client key exchange message, not a message in
  itself.

On the server side I have decrypted a “.key.enc” file using the server RSA private key. The output is as follows:

otpauth://totp/381151134?secret=X2WXGSZ5LSZ66TX6AGL4DIJ6XJAAEJQ2ZUJDM4KJFNWAJOD4GI7Q

I've also read that 46 bytes out of the 48 bytes are randomly generated. However, I believe I'm getting something wrong here since evidently there is no sign of 46 bytes of randomness in the output file.

As far as I know 381151134 is called a “label”, “TOTP” stands for “Time-based One-Time Passcode” and “OTPAUTH” determines the authentication scheme.

Can someone point out what I might be missing or getting wrong here?

Besides that, I have another related question:

The IBM Knowledge Center states…

  For server authentication, the client uses the server's public key to encrypt the data that is used to compute the secret key.

… but they don’t provide any detailed information on how that’s done.

Can you additionally point me to a reference paper or some documentation that describes how the secret X2WXGSZ5LSZ66TX6AGL4DIJ6XJAAEJQ2ZUJDM4KJFNWAJOD4GI7Q
is generated? I do know that this is Base32 encoding. However, I'm specifically asking about the steps before the encoding, possibly the use of a 256 bit output hash algorithm (such as SHA256) since there are 52 Base32 characters.

EDIT:
Based on a comment my question seems vague in its current form. Further details:

I have been able to generate TOTP codes using the SECRET. I was able to authenticate to a server using the SECRET. Therefore, I guess the SECRET is a HMAC key. The main problem here however is that, how is the SECRET generated. Regarding the connection to TLS, the previous link from IBM Knowledge Center sounds informative. In addition, as I mentioned above the OTPAUTH link was encrypted with a RSA public key and sent to the server. I (may erroneously) believe this is part of the handshaking process in TLS


texts: How to perform authentication without central server in P2P?

texts:
How can one be sure that the man who you're talking with is the one who you think he is? i.e. How can one perform authentication in P2P network without a central trust server or Certificate Authority?

I'm just wondering how someone can make distributed (peer-to-peer) overlay network or chat using DHT for finding peers (like BitTorrent Chat has done).

BitTorrent chat uses DHT to find some information about peers and then to connect to them directly. I think it uses assymetric cryptography, as well. But this doesn't solve the problem of somebody trying to perform a MiTM attack by putting a lot of incorrect data about peers into the DHT (i.e. incorrect peer IP addresses or public keys).


texts: I know there are many AES MPC implementations, but in general, is it possible to restore the raw AES key if we have access to all of the nodes? If we take, for example, VIFF and its "shares". Is it difficult?


texts: CRL number generation sequence: can I use a time stamp?

texts: RFC 5280 states that the CRL number should monotonically increase. I have seen this common practice of incrementing the CRL number by 1, every time a new CRL is generated. But can I use a Unix (epoch based) time stamp as the CRL number, which is monotonically increasing ?


texts: 64 bit clock cipher with CFB mode. One-byte defected from ciphertext. What is the number of bits defected from plaintext

texts:
I have a question from an exam;

We encrypted a message of size 100 Bytes with CFB. In the transmission, byte number 12 got defected. How many bits defected will be in the decryption. The answer is 72 bits and I don't understand why?


texts:
In general, after we design a secure cryptographic protocol and make sure that it is efficient (e.g. through complexity analysis) we implement it.

Questions:

Do we implement it for proof of concept?
Do we implement it to support our claim that the protocol is efficient?


texts: EC: How to prevent discovery of base point after commutative operation

texts:
If I have a scalar $x$ and point $B$, then I can compute $X = f(x,B)$

If the function $f$ is point multiplication, i.e. $f(x,B) = x \cdot B$, then $B$ can be determined if $X$ and $x$ are known.

Under the circumstances where $x$ and $X$ will be known, is it possible to modify the function $f$ such that $B$ cannot be determined?

It is necessary that:

the function $f$ is commutative, i.e. $f(x, f(y, B)) = f(y, f(x, B))$
$X$ cannot be determined from $x$.
If many pairs of ($x$, $X$) are given out, it cannot be inferred that any two of the pairs were created using the same base point $B$, even if $B$ is not itself determinable.

Edit: It would be fine to limit our choice of $x$ if that would prevent $B$ from being determined.

Edit: The curve used is ed25519


texts: Can you help me understand the RSA Broadcast Attack?

texts:
I am currently working on a broadcast attack on RSA. This is what I have:

17 ciphertexts $C_i$ and corresponding moduli $N_i$ for a single common message $m$.
Public key $e = 17$

The first part (of the exercise) asks me to attack the first 17 ciphers. I programmed it with sage using the CRT. The CRT returns a result $x$ where I applied the 17th root on it, revealing the encrypted message. Everything good so far.

The second part asks me to again recover the message, but the ciphertexts and one modulus got changed. I tried to do the same as in the first part but I don't get a solution.

I already read different articles and books to figure out what the problem is, but I can't find anything :(

Could someone help me with that one?

This is the first one: Part 1
This is the second one: Part 2


texts: Password as it relates to various encryption schemes

texts:
Suppose you have 2 drives you want to encrypt using different encryption algorithms, as an example: AES256 and Twofish.

I am aware that using the same password for both could potentially weaken either one or both because it would build a relationship.

But AFAIK it's only true if both passwords are hashed into the same bit string.

If this assumption of mine is correct what if:

Different hash algorithms are used? (could introduce another weakness?)
One of the passwords has a 1 appended to the end changing the hash.

Could be I got it completely or mostly wrong, in which case what should I do if I want to encrypt 2+ drives using different software using AES256/AES128. I threw in the Twofish to contrast this problem. I'm not sure if the AES implementation for all the different software is identical, XTC vs. CTS for example.

The goal is to have multiple encrypted partitions/drives across multiple devices utilizing multiple software (dm-crypt, truecrypt for example - assume implementation can vary, but not vulnerable implementation) but having the same password or at least nearly identical one.

If it's not possible then by how much am I weakening myself?

And what if I encrypt the same drive using both Twofish and AES and using the same password (Truecrypt, I think it uses different salts)?
The idea is even assuming AES can be broken somehow in reasonable time through some breakthrough in math or w/e there will be nothing to match to verify a good break other than Twofish ciphertext, or even if Truecrypt isn't so obliging since different salts are used they would still need to brute force the hash to get the actual password string?

So the bottom line, why do people keep saying using the same password is insecure? Do they actually mean the bit string cipher key? Since salts transform the same password into completely different bit keys...


texts: Palisade: EvalMult between plaintext and ciphertext resulting in tower size mismatch

texts:
I hope someone can help me understand an error I get when using Palisades.  I want to only use the first 329 slots of a BGV ciphertext, and zero out the rest (which at some point contains some 'rubbish' I don't want to re-enter the first 329 slots when doing rotations).  So I have created a Plaintext called mask that I fill with 1's in the first 329 slots like this:
Plaintext mask;
vector<int64_t> vecMask;
for(int i=0; i<329; ++i)
  vecMask.push_back(1);
mask = cryptoContext->MakePackedPlaintext(vecMask);

Later I call EvalMult to zero out everything in a ciphertext C1 except for the 329 first positions:
C1=cryptoContext->EvalMult(mask,C1);

But when I then later try to add another ciphertext to C1, the following error message occurs:
tower size mismatch; cannot add
If the masking is commented out, everything works fine except C1 will contain the rubbish I want removed.  How should I do the masking correctly?


texts:
DISCLAIMER: I understand the question might be a bit amateurish due to my limited knowledge of cryptography but, please, bear with me for a minute.

QUESTION: Suppose a user Alice generates a pass phrase "hello", and a user Bob generates another pass phrase "world".

I need to create an encryption/hashing pipeline that would map Alice's pass phrase to Bob's pass phrase. I'll illustrate the basic idea of what I'm trying to achieve:

"hello" --> [encryption pipeline] -> "world"

The pipeline is unidirectional, as illustrated. The database of the server hosting the pipeline CANNOT store plain text pass phrases. It can store hashed or encrypted modifications of the pass phrases though, the basic goal is to make it impossible/immensely difficult to derive "world" without knowing that the original input is "hello" (say in a scenario where the database is compromised)

How could one securely implement such a pipeline and abide with common security principles? I've just started digging deeper into hashing/encryption algorithms, Levenshtein distance, etc. but I would really like to get an insight from someone who's a lot more knowledgeable in this area than myself.


texts: Why is garbled circuit a randomized encoding?

texts:
In Garbled Circuit, a circuit C is encoded to C' and input x is encoded to x' such that only C(x) can be computed given C' and x'.

Randomized encoding of a function f is another randomized function f' such that output distribution of f' encodes f.

I heard that garbled circuit is a randomized encoding but couldn't figure out how. Can anyone please explain it?


texts:
In algorithms like Dixon's factorization a factor base is used, which contains all primes below a bound.

Then calculates  $x^2 \mod n$, and then checks it is in factor base or not.

Suppose $P$ is the factor base for bound $B$.

We calculate the value $x^2 \mod n$, then how to check whether the result contains only prime factors from the factor base?

Let $x^2 \mod n=q_1^{e_1}q_2^{e_2}q_3^{e_3}\cdots q_k^{e_k}$
and $P=\{p_1,p_2,p_3,\cdots,p_l\}$

Then how to check whether each $q_i$ is present in factor base? and how to get corresponding arity $e_i$?

Is it achieved by repetitive division or by means of any other efficient methods?


texts: Does decryption with a wrong key creates a new encryption?

texts:
I'm wondering if decrypting with a wrong key is the same a encrypting in a different way.
For example if I encrypt the message "hello" with Caesar cipher with key = 3 it will give the message "khoor" but if I decrypt it with key = 2 the result will be "ifmmp". So we can say, decrypting a message encrypted with Cesar cypher will be the same as encrypting the encrypted message with -wrongKey.
But in a general way, if I decrypt a message with a wrong key, do I encrypt the encrypted message in a different way?


texts: RSA Certificate Owner and Issuer line meanings?

texts:
Apologies if this question is not in the right place.

I've recently been looking through some RSA certificates ( specifically, Android apk .rsa files) and I'm having trouble deciphering the one and two letter combinations in the Owner/Issuer lines.

ex: CN, OU, O, L, ST, C

L, ST, and C are Location, State and Country, I think, but what are the others?


texts:
I am new to cryptography but I want to learn about it. I would like to get from you a list (possibly ordered) of "must have and read" book titles.
Best regards


texts:
We have a key representing an SHA-256 hash in HEX, and we have the key in AES-ECB. We also have a file with plaintext to cipher messages that were encrypted with our key. How could we find this key?
8cb78d34edfec9db1fa4a044f14c06cd5d9aa8a4fece263c439c5fa62dd1fedadf757d79fa6a28069ddcba4ca624c9694559483254896625392f70bf7df4dd66

The above is the flag encrypted in AES-ECB, we know that the flag is a hex representation of an SHA-256 hash:
79621ca63d052e64 --> ca5b6fdb77e3b1ec39b6c4e1a4b69ba5

55191c3c4eeb107e --> ded63de07b250d83f842d7bc860db40c

We have a whole list with plaintext that was encrypted with our key (flag).


texts: Are there any crypography schemes which rely on Graph Isomorphism not being in P?

texts:
Are there any cryptography schemes having correctness relying on Graph Isomorphism not being in P?  If I should ask this question in the CS Theory area, I will migrate it.

Thanks.


texts: Collusion resistance in proxy re-encryption scheme depending on bilinear map rules

texts:
A proxy re-encryption scheme is collusion resistant, if the proxy and a delegatee are not able to recover the secret key of the delegator. For example, when we have a message that was originally encrypted for Alice and a proxy re-encrypts it for Bob, Alice is the delegator and Bob the delegatee. Bob and the proxy should not be able to "collude" and recover the secret key of Alice.

I'm trying to understand if the first scheme in this paper https://eprint.iacr.org/2006/473.pdf is collusion resistant or not.

With $e:\mathbb{G} \times \mathbb{G} \rightarrow \mathbb{G}_T$ a bilinear map, $\mathcal{H}_1:\{0,1\}^* \rightarrow \mathbb{G}, \mathcal{H}_2:\mathbb{G} \rightarrow \mathbb{G}_T$ two independent full-domain hash functions, the master secret key $\mathsf{msk}=s$, and $X \xleftarrow{R} \mathbb{G}_T$ we have:

a) Bob has his secret key $sk_{Bob} = \mathcal{H}_1(Bob)^s$,

b) the proxy has the re-encryption key $rk_{Alice \rightarrow Bob} = \langle \mathsf{Enc}(Bob, X), sk_{Alice}^{-1}\cdot \mathcal{H}_2(X) \rangle$.

So obviously, if the proxy and Bob work together they can recover $sk_{Alice}^{-1}$, because it's based on identity encryption and $X$ has been encrypted under Bob's identity. How difficult is it now for them to get $sk_{Alice}$, if they already have the inverse?

But maybe this is not necessary, because how decryption works in the scheme. To decrypt a ciphertext $c = \langle C_1, C_2 \rangle$ that has been encrypted for Alice we have to do this: $m = C_2/e(C_1, sk_{Alice})$.

If the inverse can be treated as any other exponent, then we have:

$\frac{C_2}{e(C_1, sk_{Alice})} = C_2 \cdot e(C_1, sk_{Alice})^{-1} = C_2 \cdot e(C_1, sk_{Alice}^{-1})$

So here are my questions:

1) Is 1. correct? That would mean the scheme is not collusion resistant.

2) If 1. is not correct, how difficult is it to get $sk_{Alice}$ from $sk_{Alice}^{-1}$?


texts:
As i read MD5 have many complex formulas, example:

$k_i := \lfloor \space| \sin(i + 1) \times 2^{32}| \space\rfloor$

My question is why use sin(), how about cos() or tan() or something like that. Does it make any sense when use sin() ? Or just for more complex of formula lead to more secure of algorithm ?


texts: How can data be encrypted in a client-server application so only clients can read it?

texts:
Requirements

We are building a system that connects multiple clients through a restful API. It allows the creation of groups of trusted clients. We need a way to store group shared data encrypted on the server side, which only the clients in that certain group can decrypt. Clients are expected to be able to join the group at any moment and still have access to the stored data.

In a more basic description let’s assume:

Client1 and Client2 belong to the same group.
Client1 wants to share data with Client2. To accomplish this, Client1 saves the encrypted data on the server, which Client2 will fetch.
Client1 is expected to be able to understand the data.
Client2 is expected to be able to understand the data.
The server MUST NOT understand the data
When a new client (Client3) joins the group he is expected to be able to understand the data.

Solution

All the clients in a group have a pair of public/private keys.
All the clients in a group have access to all the public keys of all the other clients in the group.
Each group will have a master key ‘K’ used to encrypt/decrypt data to be shared with the group which is initially not set.

The first client who joins the group (lets say it’s Client1) will create and store K locally and mark the group as having initialized its master key. It will then post group shared data encrypted using K and AES-128 to the API.

When Client2 joins the group the following will happen:

Client2 will check if the group has a master key (K) which it does, as it was created by Client1
Client2 will request K from any one of the group members
Client1 will encrypt K with Client2’s public key and send it over
Client2 will decrypt the key with his private key and store it locally so as to not have to request it anymore
Client2 will fetch the encrypted data from the server and use K to decrypt it (note that Client2 does not need to get/store all the data from the server, only the parts that it is interested in)

K is always exchanged by encrypting it using the public key of the client requesting it. This should happen at most 1 time when the client is first joining the group.

Problems

if all the clients leave the group (at which moment they delete K from their local store), all the information on the server will be useless as nobody has K anymore
if Client2 comes online for the first time and another group member is not online it will not be able to obtain K and will not be able to decrypt any of the data stored on the server

Am I correct when seeing these problems? And is there a solution to handle them?

I am not a expert in this domain, so your advice will be very helpful.


texts: What is a purpose of reducing lattice basis?

texts:
This may be too broad question but it is not. I have been studying lattices for few months now, more specifically I studied:

Lattice problems ($SVP$, $CVP$ and etc.)
Lattice cryptography in post quantum computers
Worst-case hardness in Lattice cryptography
Public key encryption using Lattice
Lattice reduction algorithms (LLL and its running time)

However, I could not figure out the relationship with reducing a lattice basis and lattice problems. Essentially, why we should reduce a lattice basis? I know the goal of reducing lattice basis is to get short and nearly orthogonal basis vectors, but why? what is the bigger picture?
To be fair, during past few months of reading papers, I found only few only sentences (here, and there):

Reduced bases allow to solve the following important lattice problems (SVP, CVP), either exactly or approximately

It would be greatly appreciated if I could get a direction or hint or something to help me figure out the concept.


texts: Given $P=xG$, prove in zero knowledge that I know $sqrt(x)$

texts:
Assuming that x has a sqrt.

Given $P=xG$ is it possible to prove that I know the $sqrt(x)$ in zero knowledge?


texts:
I am building kinda simple IoT project, but I would like to implement good security (just for educational purposes and fun). My plan is to build simple solution where one arduino board reads some data (lets say temperature), it sends data to mqtt broker on rapsberry pi and second arduino board subscribed to this broker can do something with temperature data recieved.

As I found out, best solution here is to communicate over TLS, but as you may know those devices are realy resource constrained, so I am not able to use that. I was able to implement AES payload encryption with HMAC to check message integrity, but now I am kinda stuck. My solution works only with same key for every device stored in its flash memory.There must be better way to do that, right?

I know about ECDH protocol, but I am able to use it only when two devices communicate directly, not via mqtt broker and not for more than two devices.

Thank you for every idea!


texts: Is $f(x) = g(x) ⊕ g(\bar{x})$ a one-way function where $g(x)$ is a OWF?

texts: Let $g$ be a one-way function, and let $f(x) = g(x) ⊕ g(\bar{x})$ (where the bar over x denotes bitwise complement). Is $f$ necessarily a one-way function?


texts: Are there deterministic private-key encryption schemes that are CPA-secure?

texts:
I'm assuming there can't be such schemes because CPA-security is equivalent to CPA-security for multiple encryptions, and
an adversary can distinguish between $(\mathsf{Enc}_k(m_0),\mathsf{Enc}_k(m_0))$ and $(\mathsf{Enc}_k(m_0),\mathsf{Enc}_k(m_1))$ if Enc is deterministic, hence there is no deterministic symmetric encryption scheme that is CPA-secure.
However, I can't see how an adversary might distinguish only one encryption from another.

The CPA indistinguishability experiment $\mathsf{PrivK}_{\mathcal A,\Pi}^{\mathsf{cpa}}(n)$:
Let $\Pi = (\mathsf{Gen}, \mathsf{Enc}, \mathsf{Dec})$ be any encryption scheme, $\mathcal A$ any adversary, and $n$ the security parameter.

A key $k$ is generated by running $\mathsf{Gen}(1^n)$.
The adversary $\mathcal A$ is given input $1^n$ and oracle access to $\mathsf{Enc}_k(\cdot)$, and outputs a pair of messages $m_0$, $m_1$ of the same length.
A uniform bit $b \in \{0, 1\}$ is chosen, and then a ciphertext $c \leftarrow \mathsf{Enc}_k(m_b)$ is computed and given to $\mathsf A$.
The adversary $\mathcal A$ continues to have oracle access to $\mathsf{Enc}_k(\cdot)$, and outputs a bit $b'$.
The experiment is defined to be $1$ if $b' = b$, and $0$ otherwise.

Definition of CPA-security:
A private-key encryption scheme $\Pi = (\mathsf{Gen}, \mathsf{Enc}, \mathsf{Dec})$ has indistinguishable encryptions under a chosen-plaintext attack, or is CPA-secure, if for all probabilistic polynomial-time adversaries $\mathcal A$ there is a negligible function $\mathsf{negl}$ such that
$$\text{Pr}[\mathsf{PrivK}_{\mathcal A,\Pi}^{\mathsf{cpa}}(n) = 1] \leq \frac{1}{2} + \mathsf{negl}(n),$$
where the probability is taken over the randomness used by $\mathcal A$, as well as the randomness used in the experiment.


texts: Why don't parameters generated by dhparams conform to `(2^p) mod (p-1)/2 == 1`?

texts:
I've used openssl dhparams to generate 512-bit DH parameters for a test. The resulting file is:

-----BEGIN DH PARAMETERS-----
MEYCQQDgkQsR2SuYabxysYaxk2oB2Us+YKNbEBQCdhBzMZ/5fb1s80PBDsch5gRD
A5TLoOG/XOc9hr6MXhNu2A6/WzZ7AgEC
-----END DH PARAMETERS-----
Vs-MacBook:LRS v$ openssl asn1parse -in dh512.pem
    0:d=0  hl=2 l=  70 cons: SEQUENCE
    2:d=1  hl=2 l=  65 prim: INTEGER           :E0910B11D92B9869BC72B186B1936A01D94B3E60A35B101402761073319FF97DBD6CF343C10EC721E604430394CBA0E1BF5CE73D86BE8C5E136ED80EBF5B367B
   69:d=1  hl=2 l=   1 prim: INTEGER           :02

Yet, if we take those numbers, and compute (2 ^ prime) % ((prime-1)/2),

the result is not 1, which I thought should be the case.  Why?


texts: SHA-256 Hash identical on two similar but not exact items

texts:
There are two discs that we have that have all the same files. However, using a new method for burning the discs, the second disc had modified file dates of 5/30/2018 while the original disc has dates of 2013.

The hash value of each CD is identical.

I tried to recreate this by making a Microsoft Word document that had the word 'blue' in size 12 Times New Roman. First I had my name as the author and hashed the file. I added an other through Windows Explorer in the details tab of the properties menu. The hash value of each file, though stored in the same folder with the same content differed between the two files.

Is there an easy explanation for what two cds with files having different modification dates be identical?

Thanks in advance.


texts: Why $e>n^{3/2}$ prevents Wiener's attack

texts:
Here's the Wiener's attack as I understand it.

Suppose $n=pq$ with $q < p < 2q$, and $d < n^{1/4}/3$ where $ed=k\phi(n)+1$ and $e < \phi(n)$.

$$\begin{align*}
n-\phi(n) &=n-(p-1)(q-1)\\
&= n-(n-p-q+1) \\
&= p+q-1 \\
&< 2q+q-1\\
&=3q-1 \\
&< 3\sqrt{n}
\end{align*}$$

and $e<\phi(n)\implies ke < k\phi(n) =ed -1 < ed \implies k<d<n^{1/4}/3$.

Therefore,
$$\begin{align*}
\left|\frac{e}{n}-\frac{k}{d}\right| &= \left|\frac{ed-kn}{nd}\right|\\
&=\left|\frac{de-k\phi(n)-(kn+k\phi(n))}{nd}\right|\\
&= \left|\frac{1-k(n-\phi(n))}{nd}\right|\\
&\le \frac{3k\sqrt{n}}{nd} \\
&\le \frac{3(n^{1/4}/3)\sqrt{n}}{nd} = \frac{1}{dn^{1/4}}\\
&< \frac{1}{2d^2}.
\end{align*}$$

The last inequality (by some theorem about continued fraction) and $gcd(d,k)=1$ imply that $\frac{k}{d}$ is a convergent in simple continued fraction of $\frac{e}{n}$.

Why does $e>n^{3/2}$ imply that $k/d$ is not a convergent in simple continued fraction of $e/n$? Or why does such an $e$ prevent Wiener's attack?

It suffices to show that $|e/n-k/d| > 1/d^2$.

Thank you!


texts: Web Cryptography API and low level AES APIs

texts:
Does anyone know why https://www.w3.org/TR/WebCryptoAPI/ does not offer also low level AES APIs like:

AES block encryption with several allowed block sizes (like for example the one offered in golang, https://golang.org/pkg/crypto/aes/);
AES ECB mode;

Using any of the javascript implementations of AES is orders of magnitude slower than the "C"/asm implementation that is exported through webcrypto.


texts:
I've looked at paper Ciphertext-Policy Attribute-Based Encryption by Bethencourt, Sahai, Waters and see this an answer here for the explanation of DecrypNode for a leaf node.

I could understand the derivation of this $f_n$ for a leaf node but not for a non-leaf node in the $s$.

I could not understand the move from step 4 to 5 ( the last move).

I will be very grateful Can somebody help in understanding the last move here?

How qx(0) = qx(1) /\1(0) . qx(2) /\2(0) . qx(3) /_\3(0) . ...  ? I dont think legarange interpolation says this. I think i am missing something heere. Please help me in understanding this.

Thanks and Regards


texts: How does RFC 5652 authenticated data confirm origin and data integrity?

texts:
My reading of RFC 5652 Authenticated-Data does not give receiver confidence in originator of message, and therefore can not provide data integrity certainty.

Originator process is:

1. generate random message key
2. encrypt message key for (each) receiver
3. generate message MAC using message key
4. send to receiver

Why can't an attacker do this?

1. intercept message
2. modify message (since it is not encrypted)
3. generate a new random message key
4. encrypt message key for receiver using receiver public key
5. generate a new MAC
6. send to receiver

How would receiver know that it was not from originator?
How would receiver know that message has been changed?


texts: Can zero knowledge proof and zero knowledge proof of knowledge transfer to each other?

texts:
Recently I'm studying learning with errors crypto systems and I'm running into a problem. I try to prove that the plaintext is in some specific range(for example 0~10) using zero knowledge proof.

However, almost all the papers I find in Google are talking about constructing "zero knowledge proof of knowledge" schemes, but what I want is zero knowledge proof, can these two primitives transfer to each other?


texts: Mixing algorithms for password hashing good or bad?

texts:
So I've come across the following algorithm for hashing passwords

function hashpassword($str, $salt)
{
$hashed_password = md5($str);
$hash = md5('more_salt');
$hash = sha1($hash.$salt);
$hashed_password = crc32($hashed_password.$hash);
$hashed_password = sha1($hashed_password.$hash);
$hashed_password = md5($hashed_password.$salt);
return $hashed_password;
}

Does mixing hash-algorithms like this increase or reduce the chances of collisions? Doesn't it end up being a case of find the weakest link? The use of crc32 looks like a terrible idea to me since it isn't even meant for this, but I don't understand the maths behind so I can't tell if it is or not.

Does this look like it's done by someone who knows what they're doing or is it just a case of someone throwing all the algorithms they find together and hoping it's a good solution?

What I'm basically asking is, is this strong or weak? Is there an obvious problem with it?


texts: How many bits in the resultant hash will change, if the x bits are changed in its the original input?

texts:
I came across a question stating:

  We have a message consisting of 10,000 characters. After computing its message digest using SHA-1, we decide to change the last 19 characters in the original message. How many bits in the digest will change if it is recomputed, and why?

Until and unless this is an explicit attack on the hashing scheme, the new hash would be different than the original one (sort of exhibiting an avalanche effect).

But I am unable to understand how does small changes in the input text affect their corresponding hashes. Like does there exist a relationship on how many bits of the hash will be affected, if a certain change is done to the input text?

P.S.: I am not a 100% sure, but I believe I have read it somewhere that a hashing algorithm should change the bits of hash by $X$% if a new character/bit is added/substituted to the previous input text.


texts: Can DH_anon really be exploited by an attacker?

texts: General consensus is that DH_anon (and ECDH_anon) ciphersuites should be disabled since they offer no way to verify if the server is the one you intend to communicate with. However, I have never run into a client that supports DH or ECDH_anon. Could an attacker really leverage this to pull off a successful attack (with no errors/warnings?)


texts: Encrypted key- determining type and properties

texts:
If I was given an encrypted .key file (no further information about the key), called "abcd.key.enc," how would I start characterizing and identifying information about the key, its encryption/ cipher used, etc...?

My ultimate goal is to decrypt the key, but I can't find any trivial ways to determine anything about the key itself, especially since I can't read the cipher text.  The best I can think of is to run linux "strings" against the key file which gives me the output

3Nj3
!/'i9

thanks for any help!


texts: Number of affine points on an elliptic curve

texts:
I'm given an elliptic curve $y^2=x^3+ax+b \in \mathbb{Z}_p[x]$ (with numbers $a,b,p$ not greater than $10^6$).

I would like to find, using the naive approach, the number of affine points on the curve without the point at infinity .

My approach is to go through all $x\in\mathbb{Z}_p$ and check which of them have residue (stored in counter. Since each $x$ has either two or zero residues, I multiply the number of $x$ with residues times 2.

To return the number of affine points, the following method is used:

if isSingular(a,b,p):
    return counter*2+2
return counter*2+1

It seems to work for some cases, but not for others. Is there something special we have to consider for singular curves, and why?


texts:
I cannot understand why a one-way function $f$ is defined in this way

$\text{Pr}(f(A(f(x))) = f(x)) < \frac{1}{p(n)}$

and not

$\text{Pr}(A(f(x)) = x) < \frac{1}{p(n)}$

where $A$ is a randomized algorithm.

Where is the difference? Is the second one weaker?


texts: Implementing a pseudo random function in practice

texts:
Can anyone point me to a C++ crypto library with an implementation of a pseudo random function (PRF)? I don't have much background in crypto theory, but I am in the middle of a graduate course introducing applications of crypto, so I have a basic understanding of the tools available to me. The research paper I am implementing calls for use of the following cryptographic primitive:

A pseudo random function $G: \{0,1\}^k \times \{w_1,...,w_m\} \rightarrow \{0,1\}^k$

To clarify, the function $G$, takes as input a private key of length $k$, and a variable length message $w$ (which just happens to be from a finite list of $m$ keywords; I don't think that's important here), and returns output of length $k$.

Now I understand that a block cipher or hash function is to be used in the implementation, but I know it's not as straightforward as "hash(K+w)" and I can not find a technical specification for "pseudo random function" anywhere (e.g., NIST). I come across similar terms all over the place, e.g., pseudo random number generator (PRNG), but I can't definitively connect the two.

I'm not looking for a theoretical connection here (although feel free to include one). I'm hoping someone can point me to a function that gets used in practice for this this situation.


texts: Who can create a MAC? Who can verify a MAC?

texts: I have read many answers but I cannot get the basic explanation. There's no need for full details. I just need some basic information about who can create a mac and verify it.


texts: Transfer and hide ciphertext with hash functions?

texts:
Can hash functions be used to transfer and hide ciphertext?

This somewhat similar locked question, "If cryptographic hashes are completely unique, could they theoretically be used to transfer data?", received several cogent no answers, but consider this:

Alice and Bob share a secret:

/p68J5gd3%}"jd9fkg;BtiAraGgsioe2:L<76e7emOngehf]jfur80}{_kod*6

Alice adds her ciphertext JWHSM to her copy of the secret:

/p68J5gd3%}"jd9fkg;BtiAraGgsioe2:L<76e7emOngehf]jfur80}{_kod*6 || JWHSM

Now she hashes (secret + message) with SHA-512 and sends the hash to Bob.

Bob knows that he has to do a bit of computation and find the ciphertext that will concatenate and resolve to the hash value he has been sent by Alice, and he knows how many characters there will be (5 in this case).  So, in effect, Alice sent Bob a message he could not immediately read, but he can resolve it.  They want to defeat certain aspects of traffic analysis, and they suspect that Mr. Attacker might be able to make easy preimage attacks on every hash they send--to which they respond "So what?"

Can hash functions be used to transfer and hide ciphertext in this unorthodox, expensive manner?


texts: Are IVs and salts the same and usable for each other uses?

texts:
I'm new in the crypto world and I've just discovered PBKDF (I used to use typed passeword as symmetric key).

When using some crypto mode, you're required to generate an IV which must be completely random and not predictable, the best length is the length of a block size. PBKDF (and hashing functions in general) needs a salt which must also be random, I don't know the best length for a salt.

I'm thinking that an IV and a salt seems to be exactly the same but with a different name, they're random and are made to avoid getting the same output for the same input(s).

So I wonder if it would be secured to generate an IV, derive the password with this IV as salt, and use these to encrypt data?


texts:
While implementing ciphers and hash functions, I often face a problem: where to find test vectors for it; so that I can guarantee my program is working correctly. It is generally a tedious job to find test cases.

Currently I am trying to gather test vectors for several ciphers and hash functions; including (but not limited to):
RC4, all ciphers from eStream, DES (round-wise, if possible), 3DES, AES, …

To avoid looking in the wrong places: Where can I find test vectors for ciphers?

For a head-start, I put test cases of RC4 (correct me if I am wrong):

Key        (255, 255, 0, 255)
Keystream  23, 0, 135, 229, 197, 74, 253, 202, 72, 83, ...
Key        (0, 0, 0, 255, 127, 31)
Keystream  40, 172, 142, 137, 101, 124, 164, 50, 0, 172, ...

Related:

Test vectors for PRESENT algorithm?
Where are the ChaCha20 test vectors/examples?


texts: How to decode a caesar that goes to transposed plaintext?

texts:
When decoding vigeneres, I am left with Caesars. Often when the key is longer, these are shorter so normal frequency analysis won't work.

Is there another method I can implement without adding a load of loops?


texts: Correctness of RSA variation using CRT to decrypt?

texts:
Consider RSA variation with public key $(e,N)$ where we take $e=3$ and $N=pq$ where:

$p \equiv 1 \text{(mod 3)}$ so that we don't have $\text{gcd}(e,(p-1)(q-1)) \neq 1$

$p \equiv 7 \text{(mod 9)}$  so that we can compute a cubic root of x by doing $x^{\frac{p+2}{9}} \equiv 1 \text{(mod p)}$

For decryption take $d_p = \frac{p+2}{9}$ and $d_q = \frac{q+2}{9}$. Compute $x_p = y^{d_p} \text{(mod p)}$ and $x_q = y^{d_q} \text{(mod q)}$. Finally recover $x = CRT(x_p,x_q)$ where $CRT$ is the function that computes the isomorphism given by the Chinese Remainder theorem.

We know that we can have three different cubic roots for each number in a field. So how is it that given $x_p$ and $x_q$ I can compute $x$ with Chinese Remainder Theorem?


texts:
Why do we need a field for RSA and what are the two operations in this field?
Why can't we have a ring or group for example? Because in a group you also have inverse elements.


texts: preferred method for generating k for DSA / ECDSA

texts:
FIPS 186-4, sections B.2.1 and B.2.2, discuss two different methods for generating k for DSA / ECDSA. Unless I'm mistaken RFC 6979 discusses another method utilizing HMAC_DRBG.

So what method is the preferred method?

FIPS 186-4 was published July 2013. RFC 6979 was published August 2013. So the RFC is newer but not much newer.


texts:
$A(x) \bmod B(x) = C(x)$ and $A(x) \bmod D(x) = E(x)$:

A dealer knows $A(x)$ polynomial, which is a secret. He distributes $C(x)$ and $E(x)$ privately to $X$ and $Y$, respectively. $B(x)$ and $D(x)$ are public. $X$ and $Y$ want to know that $C(x)$ and $E(x)$ is the result of $A(x) \bmod B(x)$ and $A(x) \bmod D(x)$, respectively, without getting to know $A(x)$.

Is it possible to the dealer to commmit to $A(x)$ to prove that this is the polynomial being used in both expressions?


texts:
I have seen that given blockciphers $F,G : \mathcal{K} \times \mathcal{M} \to \mathcal{M}$, their cascade $F \circ G$ is defined to be $F \circ G : \mathcal{K}^2 \times \mathcal{M} \times \mathcal{M}$ via $(F \circ G)_{(K,K')}(M) = G_{K'}(F_K(M))$. My question is why it's done this way around, not the other order?

In "standard life" (see Wiki article), if I have two functions $f,g : X \to X$, then $(f \circ g)(x) = f(g(x))$. However above, writing $f = F_K$ and $g = G_{K'}$, we have, in essence, $(f \circ g)(m) = g(f(m))$.

I understand that it's just a formal convention, but it seems strange to pick the formal convention which is (or rather, appears to me to be) counter to the previously established convention.

Incidentally, I saw this notation in Hoang-Morris-Rogaway, twice on page 6.


texts: Exact communication of the IPS compiler?

texts:
I'm reading papers related to the IPS compiler.

I'm confused about one point: The paper IPS08 (PDF) proposed a protocol with $O(s)$ communication for a circuit of size $s$ in the OT-Hybrid model.

Are they actually assuming a bit-OT Hybrid model, where parties can perform OT on single bits? For example, the communication of GMW is counted as $O(m^2 s)$ for m parties with circuit size s.


texts:
I am considering the SIS problem of finding $x\in \mathbb{Z}^m$ such that for random $A\in\mathbb{Z}_q^{n\times m}$, $Ax=0$ and $\lVert x\rVert < \beta$ for some $p$-norm and bound $\beta < q$. High density is when $n\log_2(q) \ll m$, or more generally when input is significantly larger than output.

General methodology

The tightest reduction I know of from SIS to worst-case lattice problems comes from [MP13] which provides nearly optimal asymptotic parameters. But papers (like this) that implement SIS select parameters by following [MR08], which analyzes the cost of the random ($q$-ary) $m$-dimensional lattice problem, ignoring the reduction to, and cost of the respective worst-case $n$-dimensional lattice problem.
Does this mean that average-to-worst-case reductions are only of theoretical, asymptotic interest and not relevant when selecting practical, concrete parameters? Is the (sole) value of average-to-worst-case reductions a reassurance that attack algorithms will not significantly improve in the future?

If this is indeed the case then I will also follow [MR08] below in an effort to select safe parameters for high density SIS (in order to construct a highly compressive collision-resistant hash). I will consider the infinite norm with bound $d<q$.

Avoiding lattice reduction attacks

In reasonable time one may select any subset of $c$ columns of $A$ and find a solution $x$ with $\lVert x\rVert_2 \geq q^{n/c}\delta^c$ by setting coordinates for ignored columns to $0$. (I think $\delta$ is called the "root Hermite factor"). An $x$ with $\lVert x\rVert_\infty < d$ will have $\lVert x\rVert_2 \leq \sqrt{c(d-1)^2}$. Thus it seems sufficient to set the constraint $\forall c\in[m]: q^{n/c}\delta^c > (d-1)\sqrt{c}$. This can be modified to $\forall c\in[m]: n\log_2(q) > c\log_2((d-1)\sqrt{c}/\delta^c)$.

Avoiding combinatorial attacks

For the smallest integer $k$ satisfying
$$
\frac{2^k}{k+1} \geq \frac{m\log_2(2(d-1)+1)}{n\log_2(q)}
$$
one can find solution $x$ with $\lVert x\rVert_\infty < d$ in time $(2(d-1)+1)^{m/2^k}$. Thus for security parameter $s$ we add the constraint $(2(d-1)+1)^{m/2^k} \geq 2^s$.

Avoiding all attacks

Are the above constraints sufficient?
Do I also need to analyze the cost of the best high density subset-sum algorithms?
An example of parameters (achieving hash compression factor $6000$) is
$$
d=64 \\
m=2 \times 10^6 \\
n\log_2(q) = 2\times 10^3
$$
For $\delta=1.01$ (could be reduced for quantum algorithms) the maximum of $c\log_2((d-1)\sqrt{c}/\delta^c)$ is about $1800$ at about $c=400$. Thus the first constraint is satisfied with
$$
n\log_2(q) = 2000 > 1800 = max_c\{c\log_2((d-1)\sqrt{c}/\delta^c)\}
$$
For $k=17$
$$
\frac{2^k}{k+1} = 7281 \geq 6989 = \frac{m\log_2(2(d-1)+1)}{n\log_2(q)}
$$
So the cost is $(2(d-1)+1)^{m/2^k} = 2^{m\log_2(2(d-1)+1)/2^k} = 2^{106}$ offering $106$ bits of security. Note the precise values of $n$ and $q$ are left free subject to $n\log_2(q) = 2\times 10^3$ and $q > 64$.

Questions

As I asked above, what is the general methodology? How should I select safe parameters for high-density SIS? If the criteria of [MR08] is not enough, what constraints are lacking? If the criteria are enough, am I free to choose any parameters satisfying these constraints, no matter how tight the inequalities (e.g. $d = q-1$)?

References

[MR08]: Lattice-based Cryptography (https://cims.nyu.edu/~regev/papers/pqc.pdf)

[MP13]: Hardness of SIS and LWE with Small Parameters (https://web.eecs.umich.edu/~cpeikert/pubs/LWsE.pdf)


texts: Elliptic Curve-based Diffie Hellman: How is the shared key (mnp) calculated?

texts:
It's a very quick question, but I couldn't find the answer from the sources I have.

I've been coding EC based D-H key exchange, and I'm almost done with it.

So here's what I've understood so far.

Michael and Nikita agree on an Elliptic Curve $E:y^2=x^3+ax+b $, a prime number $p$, and a point $P$ on $E$ over $Z/pZ$.
They choose their secret numbers $m$ (for Michael) and $n$ (for Nikita).
They exchange $mP$ and $nP$, each calculated by adding $P$ to itself $m$ and $n$ times over $E$ in $Z/pZ$. (I understand how the "addition" works)
Now by using the $mP$ or $nP$ they got from each other and the secret number they chose ($n$ and $m$) to calculate the shared key $mnP$.

So my question is, how do you calculate $mnP$? No source I have specified what exactly it is, so I'm not sure if it is $(m \times n)P$ or $P$ added $n$ times to $mP$.

Thanks in advance!


texts: CPA vs CCA attack of an encryption scheme

texts:
Semantic Security is a concept that made New Cryptography, (that is Cryptography invented after 1975) into a rigorous science. It connected old cryptography (that is Shannon's information theory-based cryptography) to New Cryptography.

Suppose that we use a randomly chosen 128-bit IV  to encipher a 128-bit message $m$, and AES with a randomly chosen key $k$, to generate a 256-bit cipher-text computed as: $IV \| \mathrm{AES}(k,(IV \oplus m))$. Here $\|$ means concatenation and $\oplus$ means exclusive or.

Why is this scheme semantically secure against an eavesdropper, but not  against an active attacker? -- i.e why is it secure against Chosen Plaintext Attack, but not against Chosen Ciphertext Attack?


texts: Are TLS connections in china mostly encrypted with AES or with SM4?

texts: What is the dominant symmetric cipher used for TLS connections in China? Is it AES, as it is in the US, or is it SM4?


texts: Proving collision resistance of a hash function?

texts:
Let $f$, $g$, and $h$ be hash functions that each map binary strings
  of length $2n$ to binary strings of length $n$. Suppose that $h(x) =
 f(g(x)||g(x))$.  Prove that if $f$ and $g$ are collision resistant
  then $h$ is also collision resistant.

This question was asked on an earlier assignment and my professor had taken it up in class using proof by contrapositive.  I am expecting a question like this to show up on our final but I have forgotten how he answered it.  Could anyone off some insight into how I can answer this?


texts: Is "Bingo voting" insecure against a corrupt election authority?

texts:
I am reading about "Bingo voting"  (Wikipedia, Paper), and
I'm not understanding how it is secure against a corrupt election authority.

If the election authority knows all the dummy votes $N_j^i$, can't it just look at any voter's ballot and tell who they voted for (by finding the candidate on the ballot whose vote is not a dummy vote)?

My question: does the election authority have to be trusted in order for people's votes to be secret from the authorities?


texts:
I would like to ask what happens if we build an RSA system with modulus a product of more than 2 primes, for example let $n=p_{1}p_{2}...p_{L}$. I know only the classical RSA system with $n=pq$ with $p$ and $q$ large prime numbers.
I guess the modulus $n=p_{1}p_{2}...p_{L}$ will be not a good idea, because one can use the Chinese Remainder Theorem to decrypt easily the message?

Can anybody explain how we deal with such moduli products of many primes?


texts: Parallel random-access machine resistance in memory-hard functions

texts:
I'm trying to add memory-hardness to a hash function. A link to the specific line where that part of the implementation starts can be seen here. The basic approach is this:
(1) Concatenate a string of variable-length hashes up to some memory limit
(2) Compute a "window" size equal to the cost divided by the average size of each hash
(3) Then, starting from the end,
(3a) Calculate a "read position" by extracting an "offset" (directly from the hash data) to be subtracted from the "current position" (within a "window's length")
(3b) Append the digit at "read position" to the output
(3c) Set "current position" to the value of the "read position"
(3d) Repeat until the front of the concatenated hashes is been reached
This appears sufficient enough to me, as it doesn't seem likely that an attacker could either 'curry' smaller blocks of the concatenated hashes (and thus save on memory expenditure) or even distribute chunks to a parallel random access machine to be indexed in any efficient way, as the actual positions of the digits appended are (ostensibly) stochastic in nature.
Are there any obvious flaws in such an approach?


texts: why Niederreiter cryptosystem is not a candidate in NIST PQC competition?

texts: Seemingly, Niederreiter cryptosystem is faster than McEliece, and it can also be used to implement digital signature. Why isn't this scheme appear in NIST post quantum competition?


texts: Why does Montgomery Ladder not work for Brainpool curves

texts:
According to SafeCurves, the Brainpool curves mentioned there (P256t1 and P384t1) do not support the Montgomery Ladder for scalar multiplication in constant time.
I am wondering

why this is the case
if this is true for all Brainpool curves (in particular P256r1 and P512r1)

This has already partly been discussed in this answer, but no reason was stated there.


texts: I was wondering if using a salt with a hash is more effective than hashing and encrypting your hash.


texts: Knowing interval of discrete log for elliptic curve

texts: Are there any special attacks I can apply if I know the upper bound for $n$ (meaning $0 \le n \le \text{Upper Bound}$) in the equation $Q = nP$, where $P$ is the base point and I'm trying to solve for $n$.


texts:
Let $R_q=\mathbb{Z}_q[x]/(x^n+1)$ as usual in the RLWE assumption.

Suppoes that I choose a sample of the RLWE distribution, that is, I compute $(a,y=as+e)$ where $a$ is uniform in $R_q$ and $s,e\leftarrow\chi_\alpha$ are sampled from the error distribution (discrete Gaussian distribution with parameter $\alpha$).

Question: I want to know the probability $$Pr(y=r)$$ for some $r\in R_q$. Note that, in this case, I know the secret $s$ and error $e$. Hence, I believe I cannot use the indistinguishability of RLWE samples from uniform samples to conclude that $Pr(y=r)$ is close to uniform, say $1/q^n+negl$ (or can I?).

Thanks


texts: Question about IV/initialization vectors

texts:
I found some code to get crypto-js to encrypt data in the browser, and with a pointer from someone on SO, it now decodes data as well.

My next question is about the use of an IV; is an IV like a salt where it needs to be generated from a cryptographically secure RNG, or will any data do like, a timestamp?

And from my reading, an IV does not need to be secret - if your IV is 16 bytes long, you take those 16 bytes, append the text to it that you want to encrypt, and then can publish both the IV and cipher text. Upon decrypting, you would check that the first 16 bytes of plain text match the IV, and then discard them from the resulting plain text.

Am I understanding this correctly? Will any unique data (to each cipher text) be useful for an IV, or should I be looking for a method to generate IV's (on the client side, which means it could potentially be substituted) in a secure manner?

Thanks!

PS - this is for a personal project/learning experience, not a product that's advertised as being secure :)


texts: Can a duplicate ssh private key be dangerous?

texts:
For convenience I had an id_rsa keypair and duplicated them with a new name. I may or may not use them consistently on different machines. (The reason was to keep an existing id_rsa on a machine I didn't own.) Today I decided to give them new passwords ssh-keygen -f id_rsa -p. Just to make sure, I checked md5 on both sets to see that they were identical before and after. After I changed the passwords on the private keys, they were different but the public keys remained the same. Which is what I wanted.

How worried should I be that there are now two individual solutions to the public keys? In theory I could keep doing this couldn't I? So clearly there are multiple solutions. How many?


texts: Flexibility in $RSA$ and $DLOG$ standards?

texts:
Today's security is based on $RSA$ and $DLOG$ primarily. If both go down then it is hard to imagine a scenario where internet can be salvaged quickly.

Assume $RSA$ with $n$ bit prime factors and $DLOG$ with $n$ bit prime modulus have a (possibly practially realizable (Shor's algorithm still has challenges in implementation) quauntum) algorithm with $\leq(20n)^{2.5}$ time (picked an exponent on par with today's linear programming complexity exponent and $20$ was a reasonable small number). Then if we take $10^{25}$ arithmetic operations as ultimate limit of realizable complexity then if $n\leq 5\times 10^8$ holds we can break it ($(20n)^{2.5}\leq10^{25}\iff(20n)^{}\leq10^{10}\iff2n\leq10^9$).

How large can $RSA$ and $DLOG$ keys be before the standard gives up?

Is it reasonable to assume $10^9$ bit keys are possible with next generation internet?


texts:
I want to do generate individual AES keys for a number of smart cards, based on a random master key (key diversification) and the serial number of the card.

According to the answers to this question HKDF is the/one way to go.

HKDF has three inputs, ikm, salt and info. Feeding in the serial number as part of ikm seems to be incorrect usage (and maybe dangerous because it makes the IKM less random?). That leaves salt and info, which one should I use?


texts:
If I have some data I hash with SHA256 as hash=SHA256(data) and then copy only the first 8 bytes of the hash instead of the whole 32 bytes. How easy is it to find a hash collision with different data? Is it $2^{64}$ or $2^{32}$?

And uf I need to reduce a hash of some data to a smaller size ($n$ bits) is there any way to ensure the search space $2^n$?


texts: Why does the Secure Remote Protocol have resistance of dictionary attack?

texts:
Assume that Eeve who masquerades as a legitimate host and convinces Carol to
make an authentication attempt. (Carol wants to handshake with Steve – a host)

Thus, Eve can get values $A = g^a, M1 = H(A,B',K')$

For a guessing password $P'$, Eve can calculate the following :

$x' = H(s,P') \rightarrow v' = g^{x'}$ (Eve can get random string $s$ in previous run)
$S' = (A(v')^u )^b = (g^a \times g^{ux'} )^b = g^{(ab +bux')}$
$K' = H(S')$.

If Carol's proof of key and Eve's are matched, the password guessed is correct. Hence, If the correct password of Carol is in Eve's dictionary, Eve can get the password.

I read “Thomas Wu, The Secure Remote Password Protocol”… but that paper tells me SRP is safe against dictionary attack.

What am I missing?


texts: Schnorr signature security level as compared to AES/RSA

texts:
As per the Schnorr's original paper (1991),

  The Security Complexity $2^t$: We wish to choose the parameters $p$, $q$ so that forging a signature or an authentication requires about $2^t$ steps by known methods. For this we choose $q > 2^{2t}$ and $p$ such that $2^t$ is about $e^{\sqrt{\ln(p)\ln(\ln(p))}}$. ... For $p > 2^{512}$ and $q > 2^{140}$ the discrete logarithm problem requires at least $2^{72}$ steps by known algorithms.

Now I have three questions regarding this.

How does value of $p$ comes to $2^{512}$ for security complexity of $2^{72}$?
What is the equivalent AES and RSA key-lengths if we use $p$ of $1024$ bits and $q$ of $512$ bits?
Since Schnorr is finite field signature scheme, what is the 'field size', 'group size' and 'subgroup size' in case of schnorr signature scheme?

Thanks in advance.


texts: How to generate hard subset sum instances

texts:
A subset sum problem can be defined as:

Given a set of integers $S$
A target integer $x$
Find some subset of elements $s \in S$ such that $\sum_0^{n}s_i = x$

The "density" of a subset sum problem is defined as: $\text{density} = \frac{k}{\operatorname{log}(\operatorname{max}(S))}$

Where $k$ is the number of elements in the set $S$ and $\operatorname{log}(\operatorname{max}(S))$ is the size of the largest element in the set.

Subset sum problems of density $\lt 0.9408$ can be solved in polynomial time.

I would like to know:

How can we generate hard instances of the subset sum problem that are not solvable in polynomial time, or more specifically, require exponential time to solve?

Is it sufficient to use any size set and with elements such that $\text{density} = 1$? Assume that all set elements are uniformly random and of size $\operatorname{log}(\operatorname{max}(S))$
Is a higher density necessarily more difficult?

Supposing we can generate problems that require exponential time to solve, what parameter is the problem exponential in?

A set of size $8$ with $8$-bit elements has a density of $1$, and so does a set of size $256$ with $256$-bit elements, so if $\text{density} = 1$ is the requirement for hardness then it wouldn't make sense for the running time to be exponential in the density parameter.


texts:
Maybe the answer to my question is obvious, but I have doubt...

I have noticed that hash functions are studied in two forms, keyed hash functions or unkeyed. In general, lecture notes present hash function without key.

Is there a key generation algorithm for a keyed hash function?


texts: Simple reduction of commitments to one way functions

texts:
I am looking for an explicit and simple reduction of commitments to one way functions.
I don't care about the number of rounds, only simplicity.
I am aware of the simple reductions you can find in Wikipedia of commitments to one way permutations and to pseudo-random generators, but the first isn't to one way functions so it is not relevant, and for the second to get a reduction to OWFs we will need to go through the reduction of PRGs to OWFs which is not simple. (I didn't actually check that it isn't simple but this is the impression I got from other sources)
Note that the reduction of commitments to PRGs results commitments with only two rounds of interaction, but I wouldn't mind if the resulting commitment scheme has even a polynomial number of rounds - I just want it to be simple.


texts: How vulnerable are SIMD operations to side channel attacks?

texts:
For a while, I was experimenting with optimization of several crypto implementations with SIMD (Single Instruction Multiple Data ) made available by C compiler extensions.
Since, crypto implementations are all about constant time and fast execution, they are optimized to do the same. SIMD has gained massive importance in this area, because we can execute an instruction, on multiple data points simultaneously. This enables vectorization of performance draining parts of code.
I need not emphasize on the performance of SIMD, but I'm worried about its security, despite the performance benefits that it offers.
For example:  The ordinary mull instruction may not be constant  time on most platforms. Let's imagine that we have a vectorized mull instruction on that platform that operates on two 128 bit registers and outputs another 128 bit register. Let's assume that the lane size is 8 bytes. So, if the multiplication of two corresponding lanes is not constant time, won't that create a net difference in the entire SIMD operation, even though we are operating on multiple data points simultaneously.
Can this lead to software side channel attacks ?

Can there be software vulnerabilities to a crypto implementation that
uses SIMD ?
Can some physical sensor trace the
operations as well as the contents of a SIMD register by monitoring the CPU ?


texts:
I tried implementing the Hessian form of an Elliptic curve over the prime field Fp where,
p I have taken as 1051.
The curve equation I took is $X^3 + Y^3 + cZ^3 = dXYZ$ with c = 1 and d = 6. Selected (4,2,6)  as the base point.
Followed the equation (5) and (6) of https://www.iacr.org/archive/pkc2010/60560246/60560246.pdf for point addition and point doubling respectively.
However, when multiplying (4,2,6) with 42, I am getting (0,0,0) after the 30 steps.
For ease of understanding, I am providing the formulae for addition and doubling.
Addition
$X3 = X2*Z2*Y1^2 - X1*Z1*Y2^2$
$Y3 = Y2*Z2*X1^2 - Y1*Z1*X2^2$
$Z3 = X2*Y2*Z1^2 -X1*Y1*Z2^2$
Doubling
$X3 = Y1*(c*Z1^3 - X1^3)$
$Y3 = X1*(Y1^3 -c*Z1^3)$
$Z3 = Z1*(X1^3 - Y1^3)$
All the points have been computed with respect to modulo p.


texts:
I'm studying for an exam and answering practice questions and I would love clarification on something. Apologies if it seems really simple.

My lecture notes indicate that for ElGamal:

  the ciphertext is twice the length of the plaintext.

Here is my exercise:

the public key $y$ which is $5496$
my chosen plaintext $m$ which is $104$
$p$ which is $9323$ and $g$ which is $5261$
my secret value $k$ which is $92$

These values were all supplied for the exercise so I have to work with them.

I have calculated $g^k \bmod p$ which is $8606$

I have also calculated $(y^k×m) \bmod p$ which is $3095$

Therefore, $3095$ is the ciphertext, correct?

My plaintext $m$ was $104$ which is 3 digits, and my ciphertext is only... 4?

Realistically, if the result is $\bmod p$ then $p$ is 4 digits and no result would ever be greater than that.

So is this statement not so literal? Wherein, it's not that $3095$ is twice the length of $104$, it's that $3095$ decoded from numbers to text is twice the length of $104$ decoded from numbers to text?

Therefore, if A = 0 then 104 = KE and 3095 = DAJF which is... twice the length.

Is this the correct theory behind the statement that the ciphertext is twice the length of the plaintext?


texts: MySQL/MariaDB AES_ENCRYPT() - ECB mode, IV, Padding Oracle Attack Question

texts:
Multipart question all related to AES encryption with MariaDB.  Strangely enough, it looks like even today MariaDB only has AES with ECB mode.  MySQL allows CBC and more I believe.  Anyway I'm stuck with MariaDB and luckily in this situation, the highest level of security is only a nicety and not a requirement.  I'm asking more for academic reasons.

My usage requirements: Store encrypted data in mariadb in an environment I consider to be secure in the first place (no unauthorized user could ever even see the encrypted data).  Be able to decrypt directly through a query (for sql ORDER BY and search operations).  I've create my own SQL function as a wrapper around AES_ENCRYPT() so I can add whatever additional encrypt/decrypt logic I need.  The most likely scenario is someone remotely gains access to the database, so they can see the encrypted data and function used to encrypt/decrypt.

ECB mode - I understand why this isn't considered secure.  So does salting the passphrase (16 random Bytes) adequately fix the ECB issue for my situation, since in theory the same input and passphrase should never create the same output?
Is salting a passphrase randomly have the same security benefit as an unsalted password and an IV assuming the salt and IV have the same amount of entropy?  I realize ECB doesn't use IVs, I'm just asking in general.
Padding Oracles - For both ECB and CBC (when mariadb implements it).  This is the one I least understand.  So assuming someone has stolen the database contents, how likely is it that the hacker could create their own padding oracle for an sql database?  Seems like they should be able to.
Supposing a hacker could create a padding oracle for a stolen sql database, they should be able to crack the encryption fairly easily.  Can anything be done to mitigate this?  For example, could the padding be added to the beginning of the message?  From what I gather, the hack works by testing decryption on blocks in reverse order.  So maybe if the padding wasn't at the end of the message, they would have to fully decrypt the message to check the padding at the beginning.


texts: Defining format-preserving encryption for natural language

texts: Assume we have plaintext in natural language. Can we use format-preserving encryption in such a way that the produced ciphertext cannot be distinguished from natural language?


texts: How much would an unexpected hash collision undermine the security of a hash function?

texts:
Say some random person manages to, by sheer luck, find 2 messages with the same hash. There is no systematic way of creating more such pairs of messages that produce collisions.

How much would this one pair of collision producing messages affect the security of the hash function?


texts: Is there a standard for public key encrypting and signing short messages?

texts:
Some systems, that operate over flaky bearers, need to send signed, encrypted messages that are entirely self contained - i.e. send a single 300 byte UDP rather than have a 10Kb, two-way, certificate conversation over TCP.

Assume the destination has a private key and already knows the source's public key, and the source has a private key and already knows the destination's public key.

Given this assumption, is there a standard for encrypting/signing a small, but arbitrary length, message?

(I'm well aware of the dangers of rolling my own encryption scheme.)

Would there be a minimum ciphertext size that is related to the public key size?

(I'm thinking plain PKI encryption for plaintexts shorter than the key, and a PKI encrypted AES key for longer plaintexts.)


texts: Why does a single bit error when using the CBC block cipher mode of operation affect the decryption of a block (Oj) with a probabilty of 50%? And in the following block, why is the one bit error in the exact position as in cipher block? Differently worded: why is the 1 bit error propagation 1:1?


texts:
Consider the naive hash function: HASH = INPUT % 4. This function is periodic in the sense that if we call it with sequential numbers 0, 1, 2, 3, 4, 5, ... the produced hashed sequence will have periodicity of four: 0, 1, 2, 3, 0, 1, 2, 3, 0, ....

My question is whether modern cryptographic hash functions, such as SHA256, are periodic in this sense? In other words, are there some integers 0 <= n and 0 < k such that HASH(n + b) = HASH(n + b + ak) for all integers b in [0, k - 1] and all positive integers a? For example, will the sequence SHA256(0), SHA256(1), SHA256(2), SHA256(3), ... be periodic after some point?

One of the purposes of Hash function is, of course, to make collisions unlikely (both of the deliberate and undeliberate kind). With periodicity this would be broken. However, to avoid collisions in practice, we only need that n and/or k are (very) large and unknown. Has it been proven that no n and k exists?

(This question was previously asked on Stack Overflow.)


texts: Unforgeability proof of partially blind signature (schnorr signature based)

texts:
I read a representative paper about partially blind signature.

Abe and Okamoto - "provably secure partially blind signature".

They suggested a partially blind signature scheme based on Schnorr signature.

But I cannot understand the proof of Lemma 2 that the scheme is unforgeable.

Below image is part of the proof process. (p.281)

${M}$ is a machine constructed by a forger ${U^*}$, y is public key where ${y=g^x}$, ${F, H}$ is random oracles, and ${Info}$ means message.

Why ${M}$ outputs a valid signature with probability at least ${1-e^{-1}}$? (highlighted part)

Thanks.


texts: Session-specific Symmetric Key Derivation Using SHA256

texts:
I was wondering if there were any security implications of deriving session keys from a symmetric key using SHA256 in the following manner: $Ks = SHA256(Nonce||K)$, where $Nonce$ is the session specific nonce and $K$ is the pre-shared symmetric key. And $Ks$ will be derived at both ends as mentioned.

As far as I am aware, length extension attacks are not applicable here as being able to append additional data to the input makes no difference. Would $Ks = HMAC(Nonce, K)$ be any different security-wise? What would be an advisable way of going about my requirement?


texts: Which is the fastest way to find a member of a subgroup with known size modulo prime $P$, with know factorization of $P-1$?->$x$ with $x^s \mod P = 1$

texts:
Assuming you know the factorization of used prime $P-1$
$P-1 = s \cdot f_2\cdot f_3...f_i$
Now you want to find a member of a subgroup $\mathbb{Z}_s$.
This means any $x$ with
$x^s \equiv 1 \mod P $

Naive way whould be selecting a random value $x$, compute $x^s$ and check if it is equal to $1$.

Another way I found online:
transform to disc. log
This first first computes a prime root $g$ of $P$. With this you can rewrite the equation:
$x^s \equiv (g^k)^s \equiv  (g^s)^k \mod P$
And computes a $k$ with Shanks' baby-step giant-step algorithm.

Is that the best/fastest way to go? Does it help if $s$ is a prime?
Is there a faster way if you are allowed to change $s$ and $P$ as well?
e.g. instead finding $x$ look for a fitting P' instead. For this fix $x$ to any number of choice $x_{const}$ and search for a  $P'=s \cdot f +1$
$x_{const}^s \equiv 1 \mod P' $

(Trivial $x$ like $x = 1+n \cdot P$ do not count here)


texts: Decryption of Vignere cipher by hand using Kasiski examination

texts:
My task is to decrypt the following message, which was encrypted with a Vignere cipher of length 4:

BCRRBCQORHKEPSLSLCWRWXXDESPEZMPYQWCEBCBOSFHCIZHSQWV HCBRWRVLNEGDRCKRRQS.

I used the Kasiski method but I must be doing something wrong.

the first charter in the sets of 4 the letters was B=3 and Q=3 but if B=E or Q=E then then shift is incorrect.

the second character in the set of 4 is C if C=E then it does not work,
the third character in the set of 4 is R if  R=E then it does not work,
the fourth character in the set of 4 is E if E=E then it works.

How am I gong to figure out the first second and third shift using the Kasiski method?

Keep in mind I will have to do this on paper with a timed test.

I know the code is YODA and the plan test is:

DO OR DO NOT THERE IS NO TRY JUDGE ME BY MY SIZE DO YOU RECKLESS IS HE NOW THINGS ARE WORSE


texts: Is It Safe to Reuse the Same Salt in Bcrypt Password Hash (Specifically for Chaining Hashes)

texts:
As explained in my previous question, I want to develop a scheme which would be able to increase the password hash strength without the user password.

According to Thomas Pornin it should be safe to chain BCrypt hashes to generate a new, more expensive hash. I disregarded the handling for the salt in the previous question so he warned to be careful about that.

To reiterate, I basically want to do the following:

bcrypt_hash_0 = bcrypt(pw, salt_0, work_factor_0);
bcrypt_hash_1 = bcrypt(bcrypt_hash_0, salt_1, work_factor_1);
...
bcrypt_hash_n = bcrypt(bcrypt_hash_n-1, salt_n, work_factor_n);

Possible Handling for the Salt

Let's assume I have a BCrypt function, where I can manually choose the salt. salt_0 is the salt for the initial hash, salt_1 the used salt for the chained hash which produces bcrypt_hash_1 and so on.

Option 0: Reuse the Same Salt

The most simple approach is just to reuse the same salt. This makes it quite easy to handle but it is unclear if this approach introduces severe security issues (is there a research on that?)

Option 1: Create a New Salt

The naive fix to Option 0 would be to create a new random 16 byte salt for each iteration. Unfortunately, this increases the hash output message since in addition to salt_0, the new salt_1 must be appended (etc.). This is probably fine for a single chain, but using it to chain multiple hashes, the message will get quite impractical. From the security side, it should be safe, as it uses an unrelated new salt (?).

Option 2: Derive a New Salt from the Old One (CTR)

Assume the scheme allows for chaining up to 255 hashes. We already introduced HKDF to the scheme and could use the following simple derivation:

salt_n = hkdf_expand(salt_n-1, n, 16)

where n is a counter; the n-th Bcrypt chained hash; by using n as the info parameter we create a new salt for each iteration.

By having n be up to 255, do we "use up" some entropy? Would it be sound to say we lose 1 byte of the 16-byte source salt (aka salt_0)?

Option 2.1: Derive a New Salt from the Old One (CTR+Hash)

As an enhancement of the previous scheme, which would allow deriving all future salts from the source salt, we could incorporate the previous chained hash:

salt_n = hkdf_expand(salt_n-1, n | bcrypt_hash_n-1, 16)

I'm not sure this has some actual security benefits because a salt can be public.  It would make it as expensive as calculating the hash to get the salt of the specific round basically.

Question

Which of these schemes would be safe to use? The goal is to keep the output Bcrypt hash as small as possible, without compromising the security of BCrypt (in reasonable ways)


texts: How can I generate cryptographic-quality 1/f noise, aka “pink noise”?

texts:
Can anyone suggest how I'd generate cryptographic quality 1/f noise: aka 'pink noise', where the PSD follows 1/f.

I'd be happy to derive the pink noise from white noise (e.g. /dev/urandom), but I don't want to filter it in a way that would compromise the quality of the noise. All the references to 1/f noise I can find are from the audio/dsp world where they tend to use very crude approximations to convert white noise to 1/f noise which would introduce unwanted patterns.


texts: Is AES really used for Top Secret stuff?

texts: I've read almost everywhere that AES-256 can be used for Top Secret material (in the US). Is it really used or is it some kind of decoy to hide the more advanced algorithm they might use ?


texts: Why is only one generator stated in literature for elliptic curve group P-256?

texts:
I refer to elliptic curve groups over prime fields and their application in cryptography.

If the order of a group is prime, it follows (am I wrong?) that:

the group is cyclic and
every element beside the zero element is a generator.

To my knowledge the first statement is well known and last statement is a consequence of the theorem:

If G is a cyclic group of order n and $\phi$ is Euler'sPhi-Function, then G has exactly $\phi(n)$ generators.

Now, if n=p is prime, then $\phi(p) = p-1$.
Therefore it follows (2).

But: The order of P-256 (n=115792089210356248762697446949407573529996955224135760342422259061068512044369) is prime. So every point in this group beside the point at infinity should be a generater of the whole group. Why is a particular base point given in all the literature:

$G=(x,y)$, with

x=048439561293906451759052585252797914202762949526041747995844080717082404635286
y=002258390684796862237411570494974242622288194167061563441992324890848025900319

when every point is an equally good possible base point? is it just a convention to use that particular point and for what reason?


texts: How to figure out DES mode used given plaintext and ciphertext?

texts:
In DES, I'm given the following exercise.

  - How can I find out which part of the plaintext each ciphertext message corresponds to, and which mode they were each encrypted with?


texts:
First of all, I want to say that I'm totally new to cryptography. I searched on crypto stackexchange but couldn't find the answer to the following question.(probably because it's easy, but I still don't get it)

My question is based on this question. So a signature basically does the following: message $\rightarrow$ hash $\rightarrow$ Bob's private key $\rightarrow$ combine signature with message $\rightarrow$ send to Alice $\rightarrow$ Alice decrypts the signature using Bob's public key $\rightarrow$ compares the hash of the signature with the text in the message:

Now the real question: Why not just encrypt the whole message with the private key of Bob send it to Alice and decrypt it with bobs public key? Because we can get Bob's public key from a CA and make sure we got the right public key, so if someone else sends the message we simply couldn't decrypt it.

I'm probably messing up some concepts so if something isn't clear, please leave a comment!


texts: Is encryption with the Web Cryptography API resistant against side channel attacks?

texts: If I want to encrypt some payload with AES-GCM, with the Web Cryptography API, how resistant would this be against side channel attacks?


texts: How to upgrade encryption version of many large files?

texts:
Assume that I operate a user-facing online file syncing service that offers end-to-end encryption of large files, such that files are encrypted client-side first, then uploaded to the server for storage. Assume that at present, files are encrypted with AES-CBC.

My question is, how is a such a service to safely facilitate long-term saving of data if longevity implies that files may need to be re-encrypted with newer algorithms in the future? That is, if a user has built up a collection of 10,000 files at 1GB a file over the last 10 years, and this service now needs to upgrade files to AES-GCM, how is it to do so? Manually downloading, decrypting CBC, re-encrypting with GCM, then uploading to server could take the client months to complete.

Proxy re-encryption seems a related topic, but having looked into that, it seems mostly related to the re-encryption of ciphertexts having been encrypted with RSA/asymmetric encryption, rather than symmetric encryption. Otherwise, if we can offload AES (or any arbitrary algorithm) re-encryption to a proxy server, that would be great, but doesn't seem to be the case with this type of encryption.

Is there a cryptographic solution to this, or is this more of a practical problem that must be solved through the only way possible—coordinating efficient, multi-day communication of client and server to ensure a safe upgrade process?

To be clear, I don't mean this in an enterprise capacity, but as a practical user-facing tool like Dropbox. If I'm storing many terabytes of encrypted data for millions of users, how do I facilitate encryption upgrades?


texts: Modification of RSA using two inverses, one for P mod (Q-1) and one for Q mode (P-1), instead of inverse d mod [(p-1)(q-1)], more or less secure?

texts:
Lets say I have the following modified RSA scheme

We choose two large primes P, Q, with additional restriction that these are relatively prime to (p-1) and (q-1)
We choose N = PQ as public key
We calculate $P'$ such that $P'P \bmod (Q-1) = 1$ and $Q'$ such that $Q'Q \bmod (P-1) = 1$
Encryption is $C = M^N \bmod N$
To decrypt, we find M such that
$M = C^{P'} \bmod Q$ and $M = C^{Q'} \bmod P$

which can be shown to be correct using similar proof as RSA.

Is this scheme more secure or less secure than the normal RSA? Better or worse? My gut feeling is that it is less secure because it depends on primes that satisfy condition 1 which reduces the search space. However, more computation is required to check for this in the first place so I can't be sure.

Also this encryption scheme will only result in one public key N compared to (N, e) in the RSA and no private key which seems to suggest less security on the surface


texts: Asymmetrical encryption with multiple sufficient key-pairs

texts: I have the following requirement: There are N public/private RSA key pairs. The encrypted data must be decryptable by any of the private keys alone, but not by any other key. For encryption, the server knows and may utilize all the public keys for encryption if the scheme requires so. Does such a scheme exists?


texts: Hashing Resource ID Into Publicly Known Value Securely

texts:
I am in an environment where I have unique IDs for a list of resources. I am trying to design a system that takes that ID as an input parameter and produces a consistent output for a given resource. I am trying to obfuscate which ID led to a given output, but both the input IDs and the output will be public information. There can be as few as 2 resources (and thus only 2
 possible input IDs).

I am also trying to avoid having to store any additional information for each resource.

Would combining the input ID with a large (256 bit) secret salt value then running it through a hash function be sufficient? Would it be safe to use the same salt for all inputs?

Optimally, It would also be convenient if I could figure out which resource created which output given only the salt, but that wouldn't work with my proposed solution. Is there some other way to approach this problem that would have that property?


texts: are outputs of sha256 independent when padded with different seed each time, in other words, when inputs can be somewhat related

texts:
So I was wondering about what will be the dependence of the outputs when I padded one input with two different strings two times for technically generating two different strings, say the input string is 123 and the first time I have padded 12 before 123 $$H(12\mathbin\|234)$$ and next time I have padded '24' before '123' $$H(24\mathbin\|234).$$  Can I safely deduce that the outputs are completely independent even if the inputs are somehow related?
Asking this because I don't completely know the internal mechanisms of sha256 and how they are hashing stuff like this. I have good ideas about universal hash functions but kind of ignorant of cryptographic hash functions. So I have something developed using 3 wise independent hash functions but I am trying to shift everything using sha256 and in order to prove a lot of theoretical part concepts, I was looking for answers like this. I was looking for some sort of rigorous math proof/conceptual proof in this regard. Would appreciate any sort of help.


texts: For any hash value, is there an infinite number of inputs that hash to it?

texts:
Bruce Schneier writes (back in 2005) in a post on cryptanalysis of SHA-1:

  SHA-1 produces a 160-bit hash. That is, every message hashes down
      to a 160-bit number. Given that there are an infinite number of
      messages that hash to each possible value, there are an infinite
      number of possible collisions.

How do we know that there is an infinite number of messages that hash to each possible value?
Is this known to be true for other hash algorithms than SHA-1?


texts: Recommendation for lightweight algorithm for partial message encryption

texts:
I have designed a specific client and server program, which sends a file  from client to server in 32k chunks. I want to encrypt only part of the data. More specifically: in each 32k chunk passing from client to server I want to encrypt only 500 bytes. This, in a non-continuous way (meaning: partial encryptionhere and there in the chunk of 32k, totally forming 500 bytesof encrypted data within the 32k block). Here client is a constrained sensor and server is an Arduino board used for Internet of Things concept, to save of energy of the constrained device(client) i want to encrypt only parts of data.

Are there any lightweight(here refers to C.P.U consumption) cryptographic algorithms or methods which offer  the option to set an “offset” and a parameter defining how much partial data we want to encrypt?

For example encrypt (bufptr, random_num, ENCRYPT_LENGTH); where bufptr is a 32k chunk with information, random_num is the random number smaller than the bufptr pointing to the bufptr, ENCRYPT_LENGTH is the length we want to encrypt (like 20 bytes from the number pointed by the random_num).


texts: Would it be possible to create a game where one would need to decrypt a simple encryption?

texts:
This might sound pretty weird, but I was thinking of a game a person could play alone with a pen and paper.

I got this idea where the person would write a random four letter string on a paper, and would have to decode it. There would be a mean to verify if the person is getting closer to the goal or not. So, I decided to ask here.

Do you think it would be possible to create a simple game where one would have to decrypt a simple string (a bit like the BitCoin miners do, I guess?), where there would be a logical next step from every point during the decryption and where it would be possible to verify if the contemplated logical next step brings the player closer to the solution or not.

Similar Question: Toy encryption system that provides "hints"

Interesting, but not-quite-it option: Vigenère cipher (Wikipedia article)


texts: Pad ciphertext with arbitrary number of bits

texts:
I have a symmetric-key encryption scheme. I think the output from this scheme (MAC + IV + CBC ciphertext) should already be practically indistinguishable from random, but I would like to pad the output to an arbitrary number of bits and have it still look like noise (I will be using the output for steganography). It would also be fine to pad the input.

What is the best cipher to use for this?

It seems to be difficult to do with AES without putting a plaintext length somewhere in the output. Perhaps I could use a stream cipher where I can decrypt part of the message to find the length?


texts: Are textbook RSA signatures secure if an Adversary does not have access to ask signing oracle queries?


texts:
when given p=5, q=19, e=5
solution:-
    n=5*19
     =95
    φ (n)=4*18
         =72

de=1 modφ (n)
d(5)=mod(72)
using euclidean algorithm

72=14(5)+2
5=2(2)+1

back substituition

1=5-2(2)
1=5-2[72-14(5)]
1=15(5)-2(72)

now what how to calculate the value of 'd'


texts: Difference between encrypting something and hashing something

texts: What is the difference between encrypting something and hashing something?  in what situations would I want one or the other?


texts: The theory of transformation of arithmetic expressions into boolean circuits in zkboo

texts:
I've read the sources of ZKBoo where they transformed arithmetic operations of the SHA hash functions into a bunch of boolean ones. Where does this transformation arise from? How do you construct such transformation? How do you prove that these boolean operations are equivalent to arithmetic ones?

I've followed Circuit-based Evaluation of the Arithmetic Transform of Boolean Functions by René Krenz et al. but that seems to go the other way around: constructing arithmetic expression from a circuit.

Thanks in advance!


texts: Importance of timing attack resistance with AES

texts:
I've implemented AES in my library with several variations: a straight C version, a version using x86 SSSE3, and a version using x86 AES-NI.  The SSSE3 and AES-NI implementations are constant-time, whereas the C implementation uses lookup tables.

My SSSE3 implementation is a bit (~20%) slower than my C implementation.  It doesn't use bit-slicing, so as to support CBC encryption.  AES-NI, of course, is at least 15x faster than either of the other two.

How important is it that my implementation prevents timing attacks?  I'm wondering whether I should ditch my SSSE3 implementation and stick with straight C.


texts: The difficulty of computing discrete logs

texts:
I understand that in Diffie-Hellman it should be hard to compute $a$ given $g$ and $g^a$.

In computational Diffie-Hellman, it appears to be hard to compute $(g^{ab})$ from $g^a$ and $g^b$.

As for the field, please consider $\mathbb F_p^*$ for this question.

Is it also difficult to compute the discrete log $w$ of more trivial things, such as $g^w\equiv (g^a+1)^b\pmod p$? It may be assumed that $a,b,g$ and $p$ are given.


texts: First contact when using Public-key cryptography?

texts:
Are there any "smart", useful ways when doing first contact in Public-key cryptography? Besides physical contact.

Example: SSH has the "VisualHostKey=yes" (but this also requires to know the image...)

Visual Validation of SSL Certificates in the Mozilla Browser using Hash Images
https://www.cs.cmu.edu/afs/cs/user/mjs/ftp/thesis-program/2004/tay,evelyn.pdf


texts:
Can we use elliptic curve cryptography in wireless sensors?

If so, how do you map points to message characters?


texts: How can process algebra help to design security protocols?

texts:
Would you please tell me how process algebra could help me to design security protocols?

More specifically, can I use it for proving the security of protocols?

Is process algebra used for any security protocol or specific types of protocol such as network protocols?


texts: Why do new versions of TLS use an explicit IV for CBC suites?

texts:
SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. This attack was demonstrated in the BEAST attack.

To avoid these issues, TLS 1.1 and later use explicit IVs, which are sent as part of the record. This avoids the attack, but also adds a 16 byte overhead to each record.

  [CBCATT] describes a chosen plaintext attack on TLS that depends on
     knowing the IV for a record.  Previous versions of TLS [TLS1.0] used
     the CBC residue of the previous record as the IV and therefore
     enabled this attack.  This version uses an explicit IV in order to
     protect against this attack.

My first idea to fix this problem wouldn't have been explicit IVs, but rather implicit IVs that get derived securely from a shared secret. TLS already defines schemes to generate arbitrary-length pseudo-random data from the master secret (see 5. HMAC and the Pseudorandom Function).

Why did the designers of TLS 1.1 decide to go with explicit IVs, instead of simply replacing the weak implicit IV scheme with a strong one? Do explicit IVs offer any advantage over well-generated implicit IVs?


texts: What does "bits" mean in the context of hash functions?

texts:
What does the "bits" in hash functions mean?

I started studying hash functions but I still do not understand what the bits mean.

What does it mean to say that MD5 is 128-bits or that SHA-1 is 160 bits? How is this calculated?


texts: Are My Answers to This Hash Question Correct?

texts:
Question

When determining the security of a hash system, the cryptanalyst tries the following attacks.

(a) If the attacker is NOT allowed to modify the original message, determine the number of hash calculations that would be required to have a 50% chance of generating a new message with the same hash as the original message. In your calculations, assume the hash length is 8 bits.

(b) Derive the expression of number of hash calculations, $n$, required to have a 30% chance of generating two different messages with the same hash. Determine the approximate value of $n$.

My Answer

These are what I think is correct, please let me know if I am wrong, Thank you!

a)

$\text{Hashed} = \big(\frac{2^8}{2}\big)$
        = $\big(2\big)^7$

$p = 1 - \big(\frac{(2^7-1)}{2^7}\big)^n$

$n = 88.38 \rightarrow n = 89$.

b)

$\text{Hashed} = \big(2^\frac{8}{2}\big)$
        = $\big(2\big)^4$
        = $16$

$p(n) = 1 - (\frac{\text{Hashed}!}{\text{hashed}^n(\text{hashed}-n)!})$
      = $1 - (\frac{16!}{16^n(16-n)!})$

$p(n) = 1 - e^{(-n^2+n/2 \times 16)}$

$n = 4.57 \rightarrow n = 5$

Birthday Attack

$q(n) = 1 - \big(\frac{365-1}{365}\big)^n$


texts: X509 CertificatePolicies, IssuerAlternativeNames, BasicConstraints extensions. What is done when Issuer signs?

texts:
I have got one theoretical question related to extensions of X509 Certificate. More precisely I have question about what is happening when issuer signs subject's certificate with has several extensions, especially I am interested in three extensions, certificate policies, issuer alternative names and basic constraints.

Is Issuer Alternative Names extension being filled with issuer's Subject Alternative Names extension when signing certificate?

Is Certificate Policies extension being unchanged when sign is done by issuer?

EDIT: I have given only an interface of application, where I should implement logic behind it. So I am given extensions fields which I can fill only when I generate initial self-signed certificate. Basic constraints comes with "is critical" checkbox, "is CA" checkbox and "path length" integer field. So I am confused when I fill those data when I generate self-signed, and when Issuer after that signs my previous certificate, what is happening with this extension.


texts: Implementing a web app where the server cannot decrypt its own data?

texts:
I'm a cryptography novice, but I think that the world needs to move towards an "encrypt everything" mentality as much as possible.  As a result, I've been thinking a lot about ways to build a web app that stores all data on the server in a way that the server can't decrypt the data even if it wanted to.

Here's my thinking.  I'd love feedback.

(Let me start by saying everything would be done over SSL.  This isn't meant to protect the data over the wire, but to protect the data from the server.)

Server = any web server/technology, Client = a JavaScript web app

When a user signs up OR changes his/her password:

Either an RSA key pair is provided by the customer (high security, less convenient) OR a key pair is generated by the server and sent to the client (customer has to trust that we won't store the private key, but more convenient)
Also, a UUID is generated by the server and sent to the client
The user enters their password into the client—this password is NEVER sent to the server
The client uses PBKDF2 to generate a secret key
This secret key is used to encrypt:

The user's private key
The UUID sent from the server

The client then sends the following to the server:

The public key
The encrypted private key
The original UUID
The encrypted UUID

When a user logs in:

The client sends the username to the server
The server responds with the unencrypted UUID & a new UUID
The client sends the following back to the server:

The unencrypted UUID
An encrypted copy of the UUID using the same method as above
The unencrypted new UUID
An encrypted copy of the new UUID

If the encrypted copy matches the encrypted copy on the server, the user is considered authenticated, and the new unencrypted/encrypted UUID pair is stored for the next time this used needs to log in
The server responds with an authentication token that is used for all further requests during this session, as well as the public key and encrypted private key

As the app is used

All data is encrypted using the public key before it's sent to the server, and decrypted using the private key in the client.  If the server has to add content to the database, it's encrypted using the public key so that the server only has access to the data while it's generating it.  Obviously this would not work in all use-cases, particularly highly relational data, but I think if the structure of the data is generally maintained, it wouldn't matter what the content was.

For example:

{
    "username": "jsmith",
    "name": "John Smith",
    "message": "Hello there!"
}

Can be handled by the server very similarly to:

{
    "username": "U2FsdGVkX1+B9f7mMjoU9sWnYU79eN2IiDxNsetNeUI=",
    "name": "U2FsdGVkX188VmG67BS5lGDEs8NAUsQrG8eaVmyOlIg=",
    "message": "U2FsdGVkX1+7cqObxGFq2ZR3rc05NznGdoPENDujAa4="
}

So maybe not all metadata could be encrypted, but it's definitely a step in the right direction.

I'd love feedback!  Like I said, I'm a complete novice, so I could have made a terrible assumption somewhere in there, but it seems like it theoretically would work…

One final note: I recognize that JavaScript isn't ideal for encryption.  That said, I think it's acceptable in this case because we're using JavaScript as an added layer on top of SSL & all other existing security best-practices.


texts:
In public key cryptography, how many keys are required for secure communication between n parties?

In my view the answer should be $n^2$.

Reason: There are ‘$n$’ Parties. Every Party has One (1) Public Key (for Encryption). Also, every party has $(n-1)$ private keys (paired) (for Decryption). So every party has $$ 1 + (n-1) = n\,keys,$$ and there are $n$ parties communicating. Number of Keys required is therefore equal to $$ n * n = n^2$$

Now, am I correct? (Please be specific & also show the full logic & give proper explanations).


texts: Factorization of the public value $N$ from the RSA cryptosystem

texts:
It is mentioned here that the public value $N=p*q$ of the RSA cryptosystem can be factorized if one of the factors is reused. Thus, if $N_1=p*q_1$ and $N_2=p*q_2$ and only $N_1$ and $N_2$ are known, then one can factor $N_1$ and $N_2$.

I wasn't able to come up how this can be achieved. Is that statement really true?