texts: Alice trusts Bob only when Bob trusts Alice

texts:
some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her.

Is this something that can be achieved? at the end, the signatures should only be valid or extractable if Alice and Bob did both made their signatures.

Is this something PGP supports? Is this somehow possible in general?

EDIT: There is a mthod of "Private Set Intersection". May by this can somehow applied to this case? Or maybe there is a similiar technique i currently not aware of.


texts: Decrypt authenticated cipher while still encrypting

texts:
Normal AES-GCM generates an authentication tag at the end of encryption. I want to decrypt it while it is still being encrypted. This would be useful to send, encrypt, receive and decrypt a large file (for example) in one go.

This would also be useful for other things like for video streams or encrypted calls. How could I do that? Switching to CBC seems like a bad idea.


texts:
For me, the main advantages of Ed25519 are that it avoids patents (by computing in one dimension) and that it is fast.

However, the 128bit security of Ed25519 is sometimes too strong to comply with export regulations.

So I wonder if there are any weaker curves of the same type (i.e. also patent-free and fast) that I can use instead? (or should I go deeper into ECC and try to determine myself the parameters of such a curve?)


texts:
Diffie–Hellman offers secure key exchange only if sides are authenticated. For authentication, sides are using public/private key. So if side A knows the public key of the side B, then A can simply use that key to encrypt the message (or the new session key).

Why bother to use separate key exchange algorithm?


texts:
The ATmega2560 is slow - it's a single core, 16MHz 8-bit AVR. Despite that, I need to use some encryption on it, and since it is limited to a few blocks, AES-256 can be used.

However, the key derivation is a problem. A computer can easily do a PBKDF2-HMAC-SHA256 with a million iterations in less than a few seconds. The Arduino struggles to perform 100 iterations in 4 seconds (to be exact, the time required with the implementation I use is 4.37s); that also applies when optimizations are enabled.

The current NIST recommendation is to use at least 10,000 iterations, in which case PBKDF2 may not be a good fit for my case.

When it comes to Key Derivation Functions, are there any solutions that are cryptographically safe for low power devices, and more generally IoT devices?

Since I cannot add comments I'll edit to answer them:

I'm not sure what is meant by "if the key derivation is performed only once", so to be more precise: the key derivation is performed only once, yes, but the devices shouldn't block for more than a few seconds before it can actually be used. 4 seconds is not a lot, but I sure don't want to go over that.
The key can - and will - be created beforehand, but it still needs to be computed each time the device is powered on. It would make absolutely no sense to store a key in plaintext.
The device is safe from attackers while it is being used, however it may not be safe while powered off (it is meant to be plugged in, unlocked, have one or two interactions with it and powered off). I guess a similar device would be the "Mooltipass Hardware Password Keeper", except that I don't have access to smart cards nor do I intend to use it as a keyboard while an operating system is up and running. Unless I missed something though, smart cards aren't easily accessible (the SLE4442 is NOT read protected).


texts: Can you use memory errors as a source of randomness for cryptography?

texts:
Obviously, if you need a random number for cryptography, your code should use an api that gets it from hardware. However, not all hardware has a SRNG available. If you are working on a security critical application, and hardware RNG is not available then the appropriate course of action is to abort execution.

BUT, not every application would be deemed security critical. That is to say, while you want security, you are not worried about overly complex attacks because, 1. your application is not worth the effort of being cracked by sophisticated hackers 2. none of your data is considered strictly confidential (you don't want it breached, but it would not be the end of the world).

Assuming a none security critical application, running on a machine without hardware RNG or ECC Memory, would it be viable to allocate a very large amount of memory (perhaps in a long loop) and use the errors that eventually occur as a source of randomness? Would this be more secure than PRNG?


texts: Bounding security of password authentication given entropy

texts:
An adversary Craig tries to log-in as Alice on a system that will only accept the right password, leaks (only) if an attempt succeeds, and allows many attempts.

Alice's password choice is modeled as a random pick in a finite set of $m$ possible passwords $P_i$ each with probability $p_i$, with $0\le i<j<m\implies p_i\ge p_j>0$ , and $1=\displaystyle\sum_{0\le i<k}p_i$ .

Assume Craig has a perfect model of Alice's password choice and tries up to $n$ passwords $P_i$ by increasing $i$ (with $0\le n\le m$), stopping if he logs-in. That success for Craig has probability $q_n=\displaystyle\sum_{0\le i<n}p_i$ .

We know $n$, $m$, and the password distribution's Shannon entropy $H=\displaystyle-\sum_{0\le i<m}p_i\cdot\log_2(p_i)$ . For a uniform distribution of the $p_i$, we'd have $q_n=n/m=n/2^H$ . But we do not know said distribution.

How can we rigorously, and tightly, bound Craig's success probability $q_n$ ?
Clarification: it is asked upper and lower bounds of $q_n$ as a function of $(n,m,H)$.

What if we additionally have the min entropy $H_\text{min}=-\log_2(p_0)$ or some other interesting metric of the probability distribution?

Now there are $u$ users Alice, Bob.. that (we assume) have chosen their password independently of each others, but per the same distribution. Craig knows user logins, and tries $P_i$ for each user before moving to $P_{i+1}$. He stops when he logs into the account of any user, or has made $n$ tries, with $0\le n\le (m-1)\cdot u+1$ .

What does the bounds become?

Suggested numerical illustration: for $n=1000$ out of $m=2^{48}$, $H=20$-bit entropy, what bound can we get for $q_n$? If we additionally assume $H_\text{min}=12$? Or with $u=2^{10}$?

Does some property that actual distributions of password choice tend to have let us tighten the bounds?


texts: What constitutes a "description of B" for probabilistic encryption as defined in Cryptology 6.3.4?

texts:
On page 21 of the Rivest's Cryptology chapter, he defines a trapdoor predicate as a boolean function for which it is easy to choose an x such that B(x) = v, but hard for an adversary to compute B(x) given x, without the trapdoor information.

He goes on to say that Alice's public key contains a description of B.

What exactly goes into this description, to enable the trapdoor predicate property, without giving away the secret key?


texts:
Clearly, there are stages when binary bits are needed and this can be done with the help of Linear Feedback Shift Registers.
Registers are required to be connected in such a manner that one register controls the clock.
can someone explain me more:

The role of Shift Register Cascades in Cryptography?


texts: Adding salt to Blake3 Key derive function

texts:
According to the whitepaper, Blake3 can be used as a key derivation function (function key_derive). Currently, as a key derivation function, I used Rust's Hkdf::<Sha256> which takes as input the master key and salt. Adding salt allows to ensure that even in the case I reuse the master key, the output of the Hkdf is randomized and cannot be linked to previous derivations.
Since Blake3 is much faster than Sha256 I would like to use it as my KDF, however, according to the whitepaper Blake3 takes only a key material and context string, which should be " hardcoded, globally unique and application-specific (...) should not contain variable data like salts, IDs or current time".
How can I then add salt to Blake3 key derivation function, to ensure that even if I reuse the same master key multiple times, the output of the key derivation is randomized?


texts: Discrete log zero knowledge proof lying case

texts:
I read the Wikipedia page on a discrete log zkp, but I don't understand how

$$C' = g^{r'} \cdot (g^x)^{-1} \bmod p$$  would be calculated.

Would it be  $$C' = g^{r} \cdot \frac{1}{y} \bmod p$$  where $y = g^x \bmod p$

When I run the following code to check the current implementation (the one I suggested above), I consistently get false positives.

if g ** Prover.trial_request(return_r) % p != (C*(y % p)):
    return False

I can't see to find my error, but I have narrowed it to this case. Any pointers would be helpful


texts: One-time pad using RSA and Diffie-Hellman functions

texts:
Suppose that Alice and Bob use an encryption algorithm based on a one-way function $F$ (Eve knows it), and $r$, a secret key shared between Alice and Bob (Eve doesn't know it).
Key is computed as: $K = F(r)||F(2r)||F(3r)||...$, and the ciphertext is computed as $C = M \oplus K$, and all the blocks of $F(r)$ are $1024$-bit long.

If $F(x) = x^e \mod n$, and $(n, e)$ pair is public, will the first $1024$ bits of both plaintext and ciphertext be enough for Eve to read the entire message?

Same for $F(x) = g^x \mod p$, and public $(g, p)$ pair.

Also, are the cases described above good examples of public-key cryptography? But Eve can't encrypt only having public keys, as she doesn't have $r$. So interception of $1024$-bit long plain/cipher pair is the only way for her to obtain some information from the system.


texts: Is there a problem with this non-ECDSA message signing?

texts:
Is there a problem with signing a message like this?

p = the Elliptic Curve prime
G = base point
a = Alice’s private key
A = aG = Alice’s public key
e = hash(message)
Jx = x coordinate of J

In my target 32-bit microcontroller I am using p-256 and SHA256.  Thus e will typically be in 1..p-1.

Alice computes:

e = hash(message)
E = eG
J = aE          using Alice’s private key

and sends Jx as signature

Recipient computes:

e = hash(message)
K = eA          using Alice’s public key
and validates Jx = Kx

The only problem I see is that e might be 0 or 1 or some value >= p.  (If it is I have the flexibility to pad the message such that e is in a good range.)

Is there a problem if hash(msg) is greater or equal to the EC prime?  Other than a few unusable values of e is there is a problem that makes this method less secure than ECDSA?


texts:
I have been learning about the fundementals of ECC and I'm a bit confused on this point: What makes up the public key in an ECC key exchange, and when is this public key generated?

In the video at https://www.youtube.com/watch?v=F3zzNa42-tQ and the StackOverflow Q&A Basic explanation of Elliptic Curve Cryptography? , it is stated that the public key is generated when the key exchange takes place. The public keys are the Generator point "times" the private key of each party. Because the Generator point changes for each handshake, the public key must not be generator beforehand.

If this is the case, then what is the purpose of ever generating an ECC public key? For a project I am working on, it is necessary to generate a public key to be placed in a certificate signing request to connect with AWS. Also, there is openssl functionality for creating ECC public keys:

  openssl ec -in ecc_private.pem -pubout -out ecc_public.pem

Is the word "public key" being loosely used? Are there multiple public keys?


texts: Optimal memory-hard KDF parameters when faced with small, slow memory

texts:
I am developing for a low-power embedded system. It has two ARM9 processors at 48 MHz each. One of the processors has access to 6 MiB of "fast" memory as well as access to 26 MiB of "slow" memory. The other processor does not have direct access to memory, so it's going to be pretty much useless in this scenario (I keep it halted). The fast memory timings are complicated, and memory timings change based on whether it's a read or a write, and whether memory access is sequential or not, as well as whether accesses are 16 or 32 bits. The slow memory is much slower, but is consistently slow.
I need to implement a KDF on this system. I considered Argon2, but I do not know how to decide if it's better to run many passes on the "fast" memory, or a few passes on the "slow" memory, or some combination of the two. How do I decide what the optimal parameters are for a memory-hard KDF if the memory is going to be significantly slower than typical systems? Or is memory-hardness a losing game in this scenario and I should just use PBKDF2 (in which case I could make use of both CPUs)?

Update: I write this a little late (long after I finished this project, but reading the datasheet for another ARM-based device reminded me), but I ended up going with bcrypt in a region of very fast memory called the TCM (Tightly Coupled Memory), which can be accessed at the full speed of the processor. This allowed me to use the second processor simultaneously for improved security despite it not having full access to memory, since it has its own TCM region independent of the other processor. The following pseudocode is roughly what was done to turn password into result:
(CPU 0) hash_0 := tcm_bcrypt(password || 0x0)
(CPU 1) hash_1 := tcm_bcrypt(password || 0x1)
(CPU 0) result := hash_0 ^ hash_1


texts: What are the random variables in Universal Hash Function?

texts:
Universal hash function is defined as follow:

$f_{(k_0,k_1)}(x) = (k_0\cdot x + k_1) \mod p$, where $p$ is prime

In Wikipedia, it is mentioned that the above function is pairwise independent. Pairwise independence is defined here

I wonder what are the random variables in $f$ and what pairwise independence means here.


texts:
Hope it will be clear.

I need to digitally sign pieces of information.
What I'm currently doing is the following (for each piece of information):

Run SHA1 on the information
Encrypt the result with RSA
Store both of them together
Now, I can say for sure if someone altered the information.

My problem is that I don't want to run the RSA encryption on each one of the pieces since it has some performance hit on my system.

I thought of doing the following:

Generate a seed for the SHA1
Encrypt the seed with RSA
Store the encrypted seed.
Now I can only run the SHA1 (+seed) on each piece of information.

I don't find any reason for why it should be less safe than what I'm doing today.
Is it true? any thoughts about it?

Thanks


texts: Proof of ignorance to prevent "double-spend"?

texts:
Suppose I have some knowledge that I want to transfer securely from Alice's computer to Bob's computer, and prove that future breaches to Alice's computer will not reveal that information to someone else. I.e., I want to be able to treat that information like a physical object, which can be moved, but not simply copied.

I have discovered that Proofs of Ignorance are a thing, but I don't really understand them very well. So, for any arbitrary piece of information x, is there any protocol between Alice & Bob in which Alive reveals x to Bob (thus proving that she did in fact know it at one point), and then subsequently prove that Alice has forgotten?


texts:
I am trying to cryptanalyse a cipher–text encrypted by Affine cipher.

The encryption formula is: $c = f(x) = (ax+b)\bmod m$, where $a$ and $b$ are unknown constants; $x$ is a plain-text symbol, and $c$ the corresponding cipher-text symbol, both in range $[0\dots m-1]$; $m=26$ is known.

This is what I got so far:

$x=4\implies c=17$

$x=19\implies c=10$

That means that letter 4 has been encrypted into 17 (numbers are according to alphabetical order of letters in English language). Same applies to the line below.
Now goes the following calculations:

$15a\equiv-7\equiv19\pmod{26}$

$a\equiv19/15\pmod{26}$

$a=3$ [because $15\cdot3=45$ and $45\equiv19\pmod{26}$]

$b=5$

I don’t get the logic which leads to obtaining $b$ value. Any help, please?


texts: Why would one choose DTLS-SRTP versus just RTP over DTLS?

texts: If I understand DTLS-SRTP correctly, DTLS is used to exchange keys and then the endpoints switch to SRTP for encryption. What is the benefit of this setup versus just sending RTP over DTLS? Is it just about compatibility with existing SRTP stacks?


texts: Maximum security strength in bits of ISAAC cipher?

texts:
Wikipedia claims key length can be very big in this cipher, so I assume it can offer a million bits of security provided entropy of key is the same?

Of course I can SHA-256 hash the key to allow any key sizes for AES... but it defeats the whole purpose of having such large entropy when the security is less.

So what is the maximum level? For instance, AES-256 provides a 256 bit security level.
I don't want it to wrap the keys or diminish its security/entropy.

Wikipedia and most sources are not clear about it.


texts:
Let us define the hash function $h\colon \{0,1\}^{2n}\to\{0,1\}^n$ as
$$h(x||y)=E(x,y),$$
where $E$ is a block cipher and $x,y\in\{0,1\}^n$. Any ideas on how to easily find collisions on this hash?


texts: Extending the Socialist millionaire problem to three parties

texts: The usual solution of socialist millionaire problem allows to authenticate whether TWO parties have the same secret information. Are there any natural solution of the same problem for THREE parties?


texts: In Feistel cipher, is it possible to get LE0 from RE16 and RE0?

texts:
The notation I'm using here is from my textbook. I'm doing a CTF challenge where I need to know the value of $LE_0$. For now, I only have $RE_0$ and $RE_{16}$. I would like to know if it's possible to calculate $LE_0$ from just $RE_0$ and $RE_{16}$.
The round function F is splitmix64, which is used in generating pesudo random number and it has no subkey. In order to get $LE_0$, I first need to calculate $RD_0$ to plug in Feistel network again. It seems that it is possible to do it with only two rounds.
$$
    RE_0 ⊕ F(LE_0\ ⊕ F(RE_0))
$$
I can easily xor $RE_0$ with the formula above and apply the inverse function of $F$. This will yield $RD_0$. However, I can't see how it can be done with more than two rounds, because it always involve the unknown value $LE_0$. It makes me unable to calculate $RD_0$. Does anyone know how to do it?


texts: What is the strength and attack vectors of this simple scheme?

texts:
Let's say that Alice wants to communicate some secret value $S$ to Bob through a public channel in a way that other people don't know what the value was.

To do this, Alice publishes that secret value to the public channel, along with $N-1$ other values, making a list $L$ which has $N$ items in it.

Before this communication, Alice and Bob agreed that the value Alice wanted to communicate to Bob would be $L_M$ where $M \in [0,N)$.

How secure is this scheme?  What attack vectors could be used on it? Also, does this technique have a name?

Some thoughts of my own:

The security of the scheme seems to relate to the size of $N$.  Larger $N$ values seem more secure.
It seems like if you didn't choose the other values of the list carefully, that it could be seen statistically that "one data point doesn't fit with the others" which could make the actual value cared about stick out more obviously.
One idea to make the value fit in completely could be that if the secret value $S$ could be represented in $B$ bits, that maybe the list $L$ could be a random shuffle of all values $[0,2^B)$, but if someone knew that, they could know that the number was probably on the higher side of the values so this may be too naive.
Agreeing on $M$ in advance has the usual key generation / key sharing / key storing problems and attack vectors.  I'm not interested in that part of the problem.


texts: Chacha20 internal counter/position and nonce

texts: I have to encrypt the communications between two devices. I was planning on using a timestamp(in seconds) and the serial number as the nonce. I know its impossible for me to send more than 100 messages a second. So potentially the nonce can repeat a couple of times in a second, but the internal chacha counter should work to make each nonce unique correct?


texts: cipher text only attacks on deterministic homomorphic encryption schemes

texts:
If we consider a set of numbers say a set $s=\{a,b,c,d\}$ , where $a,b,c,d>1$ and the numbers $a, b, c, d$ do not share any relation between them , i.e. for any two numbers,  $n_1,n_2\in s$ the following relations are guaranteed to hold: $n_1+n_2\neq 0$ and $n_1*n_2\neq 1$.

Is it possible to break the fully homomorphic encryption scheme on these set of numbers?

Note
This is a followup to this question which does not restrict the set $s$ is at all.


texts: Are the prime numbers used for RSA encryption known?

texts:
I read that one reason why RSA is secure is because it uses a huge number that's called the modulus which is the product of two prime numbers.

For maths reasons the prime numbers being prime numbers allow only them to be multiply together and have that exact modulus as a result.

Getting both prime numbers from the modulus is hard. It would take years to do so and this is where the security comes from.

There seems to be an interest to find more and more prime numbers. A lot of prime numbers are known publicly and every once in a while they find another one. They become longer and longer, which helps with the algorithm.

If multiplying two primes is so much easier then the inverse task, why does nobody do this? Why does nobody multiply all known primes and build a table of results?

Would this be as impractical as solving factorisation problem? Or are the primes used for RSA secret?

I heard that people do this with hashing algorithms to build so called "rainbow tables" and am wondering why not the same is happening to RSA.

I'm not really into cryptography and would appreciate an answer in simple terms if possible.


texts:
Given $p = nq$, $n \not\equiv q$, and
$\forall m: m ≡ m^{ed} \bmod n$, how can we show that $ed \equiv 1 \bmod \lambda(n)$?
My idea was to show it using the $k$ exponent, but I got stuck.
So:

From Fermat's Little Theorem we know, that
 $$ m^p = m \bmod p $$
 $ m^{\lambda(n)} = 1 \bmod n$ (Carmichael theorem)

$$\forall m, m^k \equiv 1 \bmod n$$
 so I add $k$:
 $$m^{\lambda(n) \cdot k} \equiv 1 \bmod n$$

In other words:  $$m^{kλ(n)+1} \equiv m \bmod n$$
 $$ed = k\lambda(n)+1$$ so:
 $$m^{ed} = m \bmod n$$
How then do I show that $ed \equiv 1 \bmod \lambda(n)$?


texts: Does RSA - the company - know the $p$ and $q$ used to create $n$ ($p$ and $q$ being prime)

texts:
With the RSA cryptosystem, you  publish $n=pq$. Does RSA $-$ the company $-$ have/store the values of $p$ and $q$?

If not, how do they find $n$ without knowing $p$ and $q$.
Also, how do they find $(p-1)(q-1)$ without knowing $p$ and $q$?

In short, should I trust a private company with my encryption?


texts: How to decrypt a short ciphertext that is said to be immune to attacks?

texts:
I need to decrypt a ciphertext which is short, and I have the first word of the plaintext. I thought of doing a probable-word attack, but I already know the position of the known word.

In addition, subtracting word from cipher gives a random sequence, which makes me kind of hopeless.
So consider this is the ciphertext:

URRLMBURLQHPIFGETNIAZXTCEAHVLXKOHAHGMTP

And the first word is : somebody

I also know that the cipher is supposedly immune to statistical attacks meaning that the ratio of cipher_length/key_length is not sufficient and also I cannot notice any bigrams/trigrams for that matter.


texts: Why does solving the underlying polynomial system "break" the multivariate cryptosystem

texts:
I was wondering why exactly does solving a polynomial system (directly or indirectly) "break" a multivariate cryptosystem as a digital signature.

I realize that the exact reason differs from system to system, but in general, from what I can see, it then allows attackers to sign messages with a private key that is not theirs. Am I on the right track here?


texts: With known ciphertext and plaintext, find other party's Three Pass Protocol Key?

texts:
If I'm the second party participating in a three pass protocol (for simplicity, let's say Shamir's Three Pass Protocol) such that:

Bob sends me a ciphertext
I encrypt it and send it back
He removes his encryption and sends it back to me
I decrypt it fully

Using the information in steps 1 (ciphertext) and 4 (plaintext), how difficult is it for me to determine the key that Bob is using?

I know that this is a somewhat esoteric use-case, but I'm curious.


texts: Like in title: which one of these encryption methods (ZipCrypto, AES-256) is more secure and why? I am asking about it because I'd like to know which should be preferred when compressing files with Zip.


texts: Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter

texts:
To prevent various forms of timing side-channel attacks, it's strongly advisable to implementing public-key cryptography in constant time. Or at least, without secret-dependent timing variations. However, as far as I'm aware, such implementations rely on a constant-cycle hardware multiplier. Sometimes it's also possible to replace some multiplications with shifts and adds, still, a constant-time implementation requires a barrel shifter.
Hypothetically, if I want to implement public-key cryptography (either elliptic curve or discrete log) on the cheapest microcontrollers without either a hardware multiplier or barrel shifter, what are my options for a constant-time multiplication algorithm in pure software? Constant-time multiplication in pure software sounds like a basic enough problem and many researchers must already have investigated it, but I don't know where to look. What algorithms are available, and how do they perform comparing to their non-constant time counterpart? 10x slower? 100x slower?
An obvious solution I can imagine is using a 16-bit lookup table for 8x8 multiplication, then pretending that we have a 8-bit multiplier and proceeding from here. On an embedded system without cache, on ROM, there will be no timing variation. But are there any alternative approaches (or a variation of the LUT approach that performs better in time/space)?
To clarify my motivation, I know this is impractical in real applications (even if one is stubborn enough to do it, a crypto coprocessor would be the solution), I ask it mostly due to theoretical interests.


texts: Confusion about definition of homomorphic encryption

texts:
I am trying to better understand homomorphic encryption, but I feel like I keep getting inconsistent information in the papers that I am reading.

One of the papers I am reading says the following:

  Earlier, homomoprhic encryption was defined as a form of encryption
  where a specific algebraic operation performed on plaintext is
  equivalent to another algebraic operation performed on its ciphertext

Meanwhile, another paper says the following:

  For now, a homomorphic cryptosystem can be thought of as an oracle, or
  black box, that, when given two ciphertexts and an operation, returns
  an encryption of the result of that operation on the two
  corresponding plaintexts.

The wording of the first one makes it seem as though the operation does not have to be the same (it says "another"), but the wording of the second one makes it seem as though the operation IS the same.

Can somebody clear up which one is correct?


texts: What can eve see when I go to https//paypal.com

texts: If I go to https://paypal.com/ and login, can Eve find the approximate size of the HTTPS request from my browser?  Can she see the approximate size of the responses from the paypal server to me? and also can she see that I am visiting paypal.com in particular? To what extent does SSL protect you?


texts: Secret community forming based on zero-knowledge proof (IOT)

texts:
I want to discuss a simplistic scheme that comes to my mind, after I read about zero-knowledge proof and some fermentation time. I should mention that this is not born out of a business need or academic studies / research. So please bear my level in security in general.

Assumptions:

With n participants and m < n communities to be formed. With m > 2

Participants form a community if they have the same secret key set
in the beginning and also know their peers.
Participants form a community secretly if no one knows no
participant’s community besides his peers (We assume they do not
know about each other at the beginning).

A Counter (shared memory with initial value) or a Timer approach are considered.

Counter approach:

Procedure:

All participants hash their secret keys based on some salt. The goal is that when they broadcast the hashes, participants within a single community must broadcast no same hash values (no equal two hashes), otherwise they will be discovered by all participants (as participants within a single community).
The salt is defined as number between the current counter’s value and the next, Randomly chosen with a relatively small granularity, so that collisions of two participants within the same community is very less probable, for example if Counter is the natural numbers, the first value is 0 and if it is the current, then the next value is 1, salts for one round are derived from [0, 0.0001, 0.0002, …, 1].
After a broadcast for round j:

Participants of C(i) (Community i) hash their keys, considering all
possible salts between [0, 0.0001, 0.0002, …, 1], hence they
calculate 1000 hash value for their key and store results in a
secure internal memory.

(a random salt chosen from between the “current counter” and “current counter + 1” with a probability 0.0001 of collisions)

Each participant of C(i) picks up randomly one value from the secret
table of 1000 hashes.
Each participant in the network broadcast his calculated hash to all
participants.

In this case, other participants receive hashes when broadcasted with 0.0001 probability of discovery of a couple (same two hash values) belonging to a same community.

Participants of C(j) compare the received hashes (n-1) each hash
with other 1/0.0001 salted hashes stored in the secret cache table,
they all definitely discover their peers after some time.

Maximum Time of Discovery for all participants to their communities is:  (n) * 1000. This calculation can be done parallelly.

This way, all communities {C0, …, Cm} are formed secretly.

NB: I mentioned this in the context of IOT, but obviously it is very abstract.

The question now is: What are flaws ? and How is this problem addressed otherwise ?

Edit1:

I guess I should read about the socialist millionaire problem as I just knew about.

Edit2:

This can be perfectly achieved in a secure way using: Diffie-Hellman exchanges


texts:
I'm looking for a set of pairing product equations (ala Groth-Sahai) which allow a prover to prove that the output of a VRF is in a specific range.
In the E-cash system in [BCKL] there is a construction of VRF which basically outputs a weak Boneh-Boyen signature. But this signature is a group element in source group 1 ($\mathbb{G}_1$).
Is there a way to "transform/encode" the output as an element in $\mathbb{Z}_p$ and subsequently prove that it falls in a specific range (using the an approach like CCS08)?


texts: What is the last value in a cipher suite?

texts:
I understand that a cipher suite should contain the MAC algorithm at the end.

So ECDHE-RSA-AES128-SHA256 should use SHA256 in HMAC for the MAC.

But what about the PRF? From the RFC this is what I understand: new cipher suites need to include the PRF at the end. The only "new" cipher suites I can think of is AES-GCM: ECDHE-ECDSA-AES128-GCM-SHA256 and here if I understand correctly, since no MAC is used SHA256 refers to the PRF p_SHA256?

I'm confused


texts: homomorphic encryption special case of multi party computation?

texts:
I read that Fully Homomorphic Encryption schemes are special case of  Secure MPC in page no 3. Especially , generalization of two party computation problems stated by Yao

But is there any additional literature showing the connections of the same ?


texts: Why are logic gates assigned integers when checking QAP in zkSNARK algo?

texts:
I am trying to understand how zkSNARKs work. Going through this article by Vitalik, in the section on 'Checking the QAP' he says " If the resulting polynomial, evaluated at every x coordinate that we used above to represent a logic gate, is equal to zero, then that means that all of the checks pass;" -
Can somebody help me understand why logic gates correspond to numbers 1,2,3,4?


texts: How to prove to recipient that we are using public parameters correctly in lattice IBE

texts:
Many lattice IBE scheme follow the scheme outlined in ABB10.
In ABB10, the ciphertext is
$c_0 = u^\top s + x$, where $u$ is a public parameter. (No consider message here.)
I want to ask:
Is it possible to make sure the ciphertext is generated following the scheme?
That is, can the sender provide a zero-knowledge proof that $c_1$ is generated from $us+x$, instead of $u's+x$?


texts:
In MD5, there are four rounds. After every round, why do we need to add the computed $Q$ values to the initial values and then take this value as input to the next round. For example after the first round, we compute
$$Q^{\text{new}}_1=Q_{60}+Q_{-4}, \ Q^{\text{new}}_2=Q_{61}+Q_{-3}, \  Q^{\text{new}}_3=Q_{62}+Q_{-2}, \  Q^{\text{new}}_4=Q_{63}+Q_{-1}$$
Why cant we directly take the computed values as the input to the next round without adding them to the initial values ?


texts: Prove Paillier cryptosystem decryption $M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$

texts:
How can we prove mathematically that in Paillier cryptosystem decryption, our message is equal to the right side of
$$M=L(c^{\lambda(n)}\bmod n^2)\,\mu\bmod n$$


texts: When using Client Certificates, is it usual to generate your own?

texts:
We're building a webservice for a third party customer who wants us to use "two-way SSL". By which I understand them to mean they want us to host the site using https, and to require that include a Client Certificate in each http request.

I've been working through a number of examples on how to make all this work with the tooling we use, and I think I'm beginning to get a handle on it.

If I'm understanding correctly, we'll provide them with a certificate. They have their client include it in their requests, and we validate that the certificate we receive is what we expect.

What's not clear to me is whether it's usual for us to have the certificate created by a CA, or for us to do it ourselves. With SSL certificates, an unsigned cert is meaningless. But with client certs, we're expecting to receive a specific cert, so I'm not sure I see that validating that everything is signed back to a recognized root authority really matters.

Do people generally use CA-signed client certs, regardless?


texts: how to change math.random() implemented in javascript to securerandom

texts: In Javscript code in one of our application,I am trying to change Math.random to secure random.I am not sure ,how to change.can anybody help?


texts: how does a time-memory trade off attack work?


texts: Given generator $g$ with prime order $k$ in $\bmod P$. Does increasing $P = 2 \cdot c \cdot k +1$ decrease security? Increasing $g$ increase security?

texts:
An adversary wants to find $a$ in

$$m \equiv  g^a \bmod P$$

He knows prime $P = 2 \cdot c \cdot k +1$ with it's primes $c,k$, value $m$ and $g$. And he also knows that $g$ only has an order of $k$, so:
$$g^k \equiv 1  \bmod P$$

Question:
If now the prime value $P$ gets increased for constant $k$ (order of $g$ still $k$ only factor $c$ gets increased) does this decrease the security?

Why this? If $P \rightarrow \infty $ it would be the normal logarithm which is easy to compute compared to discrete version.

The smaller the better (for same $k$)? Any boundary for best security?

Discrete Log is hard because it is always reduced to a number from $0$ to $P-1$.
 Is security bound to the number of multiplications of generator $g$ needed until over $P$ again? The less the better?

Question part 2:
Would be a higher value for $g$ increase security? (best would be $(P-1)/2$?)
Or to be more certain would a higher smallest group element $\not=1$ increase security?


texts: Compared with plain RSA , what is the advantage of randomised public key encryption scheme such as EIGamal encryption?

texts: I am new to cryptography, I am very interested in cryptography, thank you for your answer.


texts: Difference between mix networks and onion routing

texts:
From what I know, the two seems to be the same:

Onion routing: Encryption is done in layers. Alice and server1 exchanges keys and she encrypts her message. Then, Alice and server2 exchanges keys and she encrypts again, creating layers of encryption. Alice then sends the whole layered encrypted message to Bob, and each server will only be decrypt a layer to reveal the address of the other server, which will finally lead to Bob.

Mix networks: Seems to be the same under the description and picture in Wiki, with just the nodes shuffling the order? Is mix network just a subset of onion routing?

What are the differences between the them?


texts: Can someone explain the definition of four square roots as it pertains to groups in Z*p?

texts:
So I'm given the following as a problem:

When $p$ and $q$ are distinct odd primes and $N = pq$, the points in $Z^∗_N$ have either
zero or four square roots. A quarter of the points have four square roots; the rest have no square
root. The four square roots of $x ∈ Z^∗_N$ will look like $±a, ±b$. (Of course, −a means N − a since
we’re working modulo N.) Suppose that I give you an efficient deterministic algorithm S that, on
input x that has square roots, finds some square root. (If x does not have a square root, it returns
⊥.)
Use S to make an efficient probabilistic algorithm F that factors N.

I am not asking for a solution to the problem, rather an understanding of what "four square roots" could possibly mean? How can a single element $x∈ Z^∗_N$ have "four square roots"?


texts: What issues are there while using Linux's /dev/urandom for generating cryptographic keys?

texts:
As of Linux 5.1 the /dev/random no longer uses the blocking pool. There is a talk about the change on the page Removing the Linux /dev/random blocking pool

I believe that Linux's blocking pool has outlived its usefulness. Linux's CRNG generates output that is good enough to use even for key generation. The blocking pool is not stronger in any material way, and keeping it around requires a lot of infrastructure of dubious value.

This series should not break any existing programs. /dev/urandom is unchanged. /dev/random will still block just after booting, but it will block less than it used to. getentropy() with existing flags will return output that is, for practical purposes, just as strong as before.

Lutomirski noted that there is still the open question of whether the kernel should provide so-called "true random numbers", which is, to a certain extent, what the blocking pool was meant to do. He can only see one reason to do so: "compliance with government standards". He suggested that if the kernel were to provide that, it should be done through an entirely different interface—or be punted to user space by providing a way for it to extract raw event samples that could be used to create such a blocking pool.

and later

For cryptographers and others who really need a TRNG, Ts'o is also in favor of providing them a way to collect their own entropy in user space to use as they see fit. Entropy collection is not something that the kernel can reliably do on all of the different hardware that it supports, nor can it estimate the amount of entropy provided by the different sources, he said. (The bolds are mine)

So, what issues are there while using Linux's /dev/urandom for generating cryptographic keys?


texts:
In RFC5869 I found that the function of the HKDF-Expand on the input assumes the parameter $L$ which denotes length of output keying material in octets ($\leq 255*\text{Hash}_{Length}$), and then the $N$ is computed as $\operatorname{ceil}(L/\text{Hash}_\text{Length})$ and $L$ is a multiple of $\text{Hash}_\text{Length}$, i.e. the number of output blocks equals $N\in [1,..,255]$.

But when analyzing the use of this function in TLS 1.3 to form a key schedule, I see that the input of this function for $L$ parameter is Hash.length when calling the Derive-Secret function for each generated key:

DeriveSecret(EarlySecret, "ext binder" | "res binder", "") =
    HKDF-Expand-Label(EarlySecret, "ext binder" | "res binder" | Hash(""), Hash.length ) =
        HKDF-Expand(EarlySecret, "ext binder" | "res binder" | Hash(""), Hash.length)

i.e. $L$ = Hash.length and $N = 1$? And so for each key.

I'm sure that I'm wrong somewhere but I do not understand where.


texts: Does the nonce really have to be hashed as part of the challenge in a Schnorr signature?

texts:
From this article: https://tlu.tarilabs.com/cryptography/digital_signatures/introduction_schnorr_signatures.html#why-do-we-need-the-nonce

The article states that the challenge e = H(P || m) is insecure, and that e = H(R || P || m) should be used instead. The signature is s = k * e, where k is the private key.

My question is: what if we used the insecure challenge e = H(P || m) and made the nonce part of the signature like so: s = r + (k * e)? Would that still be secure, or is there a way to extract the private key with this approach?

I've tried to adapt the Rust code example to see if the secret key could still be extracted from the public information with this adapted signature scheme, but it looks like it's still not possible:

extern crate libsecp256k1_rs as secp256k1;

use secp256k1::{SecretKey, PublicKey, thread_rng, Message};
use secp256k1::schnorr::{ Challenge};

// This one tests that adding r/R makes key extraction impossible
#[allow(non_snake_case)]
fn main() {
    // Create a random private key
    let mut rng = thread_rng();
    let r = SecretKey::random(&mut rng);
    println!("My private random value is: {}", r);

    let R = PublicKey::from_secret_key(&r);

    let k = SecretKey::random(&mut rng);
    println!("My private key: {}", k);

    let P = PublicKey::from_secret_key(&k);

    // Challenge, e = H(P || m)
    let m = Message::hash(b"Meet me at 12").unwrap();
    let e = Challenge::new(&[&P, &m]).as_scalar().unwrap();

    // Signature (with nonce)
    let s = r + (e * k);

    // Verify the signature
    assert_eq!(PublicKey::from_secret_key(&s), R + (e*P));
    println!("Signature is valid!");

    let hacked = s * e.inv();
    assert_eq!(k, hacked);  // fails
    println!("Hacked key:     {}", k)
}


texts:
Page 15 of the Keccak reference  (PDF) explains that the $Chi$ step mapping of the Keccak-f permutation in Keccak is defined to be “nonlinear mapping”. Without this, the complete permutation would be linear.

What does ”nonlinear” mean? The paper says that $Chi$ has algebraic degree of 2, so it is not a linear function. But now I have to explain why $Chi$ has exactly algebraic degree 2. I found this question Non-linearity of a boolean function which helped me a little bit. But I am still not sure if understand this correct:

A linear boolean function $y = ax + bz + c$ is a linear function with $y$ as output bit, $x$ and $z$ as input variable and $a$, $b$ and $c$ are constants. The variables are only multiplicated by the constants (I guess the addition and multiplication of a boolean function are defined in $GF(2)$ isn't it?)

So, a non linear boolean function is something like $y = axz + bx + c$. $x$ and $z$ are variables and the term $axz$ contains two variables, which describes the degree of $2$ in this example.

Now, the $Chi$ step mapping function is described formal as:

$a[x] <- a[x] + (a[x+1] + 1)*a[x+2]$

If we say that a[x], a[x+1] and a[x+2] is the input variables for a function like this:

$f(x, y, z) = x + (y+1)z$

we have a a degree of two in the term $(y+1)z$.


texts: Binary neural network encryption quality

texts:
I am creating a Binary Neural Network that encrypts payloads and I would like to compare it to AES in quality, for example: With BNN you would need XX years to decrypt where with AES would take YY years. How can I do that??
Currently, I have two tests:

A graphic representation that shows how random the payload is, like the image below:

The STS randomness test, which gives me the following numbers:

Are there any other test(s) that I can perform to increase the confidence that the encrypted payload is comparable/best/worst than AES??


texts: How to recover a message with shared modulus for textbook RSA

texts:
Same message sent to two users encrypted with textbook RSA, known $n$, $e_1$, $e_2$, $c_1$, $c_2$. Show how the attacker can recover the message.
Problem statement

Consider an RSA system with $n=143$, $e_1=7$ and $e_2=17$. Suppose the same message $m$ was sent to the two users above and the attacker observed the ciphertext $c_1 =42$ and $c_2 =9$. Show how the attacker can recover the message.

Official solution

Use Extended Euclidian algorithm to find $a$ and $b$ such that
$a\,e_1 + b\,e_2 = 1$. Then we obtain $m$ as ${c_1}^a + {c_2}^b \bmod n$ thus $m=3$

My attempt at solving the problem
Having read this and watched this, I did the following, but I get the wrong answer:
Using the Extended Euclidean algorithm I get $a = 5$ and $b = -2$ for  $a\,e_2 + b\,e_1 = 1$. (According to the comment section of the YouTube video, $a$ from the video, let's call it alpha, needs to be greater than or equal to $b$ from the video, let's call it beta; alpha = $e_2$ and beta = $e_1$.)
Then
$$\begin{align}
m &= ({c_2}^a + {c_1}^b) \bmod n\\
i &= {c_1}^{-1} \bmod n\\
m &= ( {c_2}^a i^{-b} ) \bmod n\\
i &= 42^{-1} \bmod 143\\
42i &= 1 \bmod 143\\
i &= (1+143\times \nu)/42\\
\nu &= 37\implies i = 126\\
m &= ({c_2}^5 + i^2) \bmod 143\\
m &= (9^5 + 126^2) \bmod 143\\
m &= 136 \neq 3
\end{align}$$
Could someone please help me figure out what I am doing wrong?
Edit:
Here's my work (in a corrected way), and in a way that won't expire (since the message where I showed my work will eventually expire), in case it helps someone else:
For 1 to 3 of the "Hint to derive the correct equation" part:
To prove that m^1 mod n = m, we know that since m < n and anything less than than the divisor yields the dividend in a modulo expression.
Then, using the properties you mentioned ( the x^(u+v) and x^(uv) stuff from here: https://crypto.stackexchange.com/revisions/81829/21 ), with the constraints described in (4) from here ( Definition of $x^u \bmod k$ ), I get
m = m^1 mod n
m = m^(a e_1 + b e_2) mod n
m = [m^(a e_1) mod n] ] m^(b e_2) mod n] mod n
m = ({[m^(e_1) mod n]}^a) mod n ({[m^(e_2) mod n]}^b) mod n
m = ({C_1}^a) mod n ({C_2}^b) mod n
m = {(C_1^a) mod n (C_2^b) mod n} mod n
m = (C_1^a · C_2^b) mod n.
From the constraints described in (4), we know that it must be the case that gcd(C_2,n) = 1 (which can be seen in the (4) from the case where u < 0, k > 1 and gcd(x,k) = 1, assuming x = C_2 and u = b < 0) for the modular inverse labelled as i, here ( RSA cracking: The same message is sent to two different people problem ), to be defined, and therefore for the whole expression for the (plaintext) message m to be defined (unless C_1^a * C_2^b yields an integer, even if a < 0 or b < 0).


texts: RSA assumption and relationship given by generating elemts of a Cayley graph

texts:
I have read a very interesting description of computation related to the RSA group as follows.

"By the Chinese remainder theorem, we have that:
$$(\mathbb{Z}/pq\mathbb{Z})^* \cong (\mathbb{Z}/p\mathbb{Z})^*\times (\mathbb{Z}/q\mathbb{Z})^* \cong (\mathbb{Z}/(p-1)\mathbb{Z})\times (\mathbb{Z}/(q-1)\mathbb{Z})$$
From this, we should be able to write:
$$(\mathbb{Z}/pq\mathbb{Z})^* \cong \langle g_q, g_p\mid [g_q, g_p] = e, g_q^{q-1} = e, g_p^{p-1} = e\rangle$$
Where $e$ is the identity element of the group, $[g_q, g_p]$ is the commutator, etc. Essentially, this is the free abelian group on two generators, subject to the relations on the order of the generators that come from the CRT representation.

We can then write all the quantities you talk about in terms of the generators $g_q, g_p$.
Say that $z = g_q^{z_q}g_p^{z_p}$, and $y = g_q^{y_q}g_p^{y_p}$.
Then your equation:
$$y^r = z\implies g_q^{ry_q}g_p^{ry_p} = g_q^{z_q}g_p^{z_p}\implies g_q^{ry_q - z_q}g_p^{ry_p - z_p} = e$$
Gives us the "cycle". In particular, if you view the Cayley graph as being on vertices of the form $g_q^{x}g_p^{y}$ (so we can sort of visualize it as being some subset of $\mathbb{Z}^2$), this reduces the problem of finding cycles to finding points $(y_q, y_p)$ such that $(ry_q \equiv z_q \bmod (q-1))$ and $(ry_p\equiv z_p\bmod (p-1))$.
You may want to enforce some non-triviality condition (such as $ry_q\neq z_q$ and $ry_p\neq z_p$), I'm not sure.
If you want to find the minimum/maximimum length cycle, you could then find the minimum/maximum non-trivial $(y_q, y_p)$ such that $ry_q \equiv z_q\bmod (q-1)$ and $ry_p\equiv z_p\bmod(p-1)$. Note that if you know the factorization of $N = pq$, you can compute $y_q \equiv r^{-1}z_q\bmod(q-1)$ and $y_p\equiv r^{-1}z_p\bmod(p-1)$ easily (assuming $r$ is invertible in both rings), and then find particular representatives $(y_p, y_q)$ with properties you want by searching through the cosets $r^{-1}z_q + (q-1)\mathbb{Z}$."

(source:Relationship between generating elements given by cycles in Cayley graph)

I have quoted it only because I was very interested in it and please don't misunderstand.

I would like to ask a few questions regarding it.

For finding the maximum length cycle, it is taken as finding the maximum solution to the two congruence relations. But since these are congruent relations how can we justify that the maximum will give the answer relevant to the longest cycle?

As an example, if we consider $a \equiv 0 (modp)$ where $p$ is a prime and the solutions can take only the values $\{0,1,2,...,p\}$, then $a$ can take only the values $0$ or $p$ only. Then $ry_q$ will always be $z_q$?

a) I tried the above idea (just to check with real values easily) for a Cayley graph (undirected) of the group $\mathbb{Z}_3 \times \mathbb{Z}_5$, where the generating elements are $g_1=(0,1)$ and $g_2=(1,0)$, $|g_1|=5, |g_2|=3$. Then for a Hamiltonian cycle $g_1^{m} g_2^{n}=e$, can I write $m \equiv 0 (mod5)$ and $n \equiv 0 (mod3)$?

b) There are several Hamiltonian cycles in this graph, so when I tested it manually for one cycle it was $m=0, n=3$ and for another, it was $m=5,n=0$. Then it seems like if we solve for solutions as the maximum solution to the above equations I get several solution pairs for the combinations of $m=0,5$ and $n=0,3$. Am I right?

Can we write other groups such as $(\mathbb{Z}_p \times \mathbb{Z}_p) \rtimes (\mathbb{Z}_q \times \mathbb{Z}_q)$, where $p,q$ are odd distinct primes, in terms of a free group as above? I am very glad if some guidance/steps to do so can be explained.


texts: Client authentication on limited hardware

texts:
I'm developing a authentication and authorization protocol for a Bluetooth device. The device should communicate with an Android app and needs to be able to authenticate the app during the connection phase. Some kind of secret or asymmetric pair  is therefore needed to be shared by the app and the Bluetooth device. As apps can be reverse-engineered we need to be able to update this secret.

RSA was the first solution that came to mind. The device can store the public key of some root certificate and then verify the signature of the app certificate like during TLS. The device keeps a list of valid certificate fingerprints.

However, the Bluetooth device is too weak to implement RSA. I need something (much) cheaper. Is there any such protocol?


texts: Value of Prime P in shamir secret sharing

texts:
How the value of prime integer taken in Shamir's Secret sharing scheme. I have taken p which is greater than my secret and the no of shares. When i do calculation without modp then secret reconstruct happens successfully but when i do calculations modp then secret reconstruction is not happening.
Below is my example
Secret S=100
a1=3
a2=6
a3=7
Prime P=107
I had calculated 8 shares without modp. In this case secret 100 appears after reconstruction
S1(1,116)
S2(2,186)
S3(3,352)
S4(4,656)
S5(5,1140)
S6(6,1846)
S7(7,2816)
S8(8,4092)
But when i take f(x) mod 107 then secret doesn't appears as 100 instead some fraction value appears
.Request to suggest how prime no p is selected.


texts: Security of Fernet Construction (wrt non self delimiting tokens and HMAC short key size)

texts:
Fernet is a described as a "high level symmetric encryption recipe" (source) that seems to be the default high level encryption scheme in the cryptography python library. The construction is described in full here, it basically takes a message $m$ and produces a token as follows:

Encrypt $m$ via AES-CBC i.e. $IV \gets \{0,1\}^{128}$, $c = \text{AES-CBC}_{k1}(m, IV)$
Take a timestamp $t$, version number $v$ and compute $tag = \text{HMAC}_{k2}(v || t || IV || c)$
Send $token = v || t || IV || c || tag$ to the recipient

The recipient then takes the $token$ and decrypts as follows:

Verify that $\text{HMAC}_{k2}(v || t || IV || c)$ == $tag$
Decrypt $c$ via AES-CBC i.e. $m = \text{AES-CBC}_{k1}(c, IV)$ (only if tag is correct of course)

Key exchange is not included and it is assumed two 128 bit keys $k1, k2$ can be securely established. My questions are the following:

The spec states that

  Fernet tokens are not self-delimiting. It is assumed that the transport will provide a means of finding the length of each complete fernet token.

Does this allow us to tamper with the tokens in a way we shouldn't be able to by adding data to the front or the end of a token? My intuition says no as HMAC is computed over all the data and the composition is Encrypt-then-MAC.
Is there any danger in computing HMAC (with SHA256 as the underlying hash function) using only a 128 bit key? My understanding is that the standard key size would be 256 bits in this case.


texts: After a diffie hellman key exchange, what is the common secret used for?

texts: What is the common secret that is established used for? What types of interactions are now possible?


texts: Can this key revocation scheme using hierarchical deterministic keys work?

texts:
Assume I am working with crypto that supports hierarchical deterministic key generation, Bitcoin/Ethereum keys using secp256k1 is one example.

There is a decentralised key registry where users register their public keys for use and other users retrieve those public keys for verificaton. A similar setting could be a blockchain where users transfer coins to other people's public keys.

Now I want to support key revocation as if a user's private keys are stolen he can revoke corresponding public keys. The idea is that the user uses hierarchical deterministic key generation. The parent key is heavily guarded in maybe in a cold storage and its children keys are used for regular usage. It is the child public keys that are put on the registry.
You use a knowledge of a parent (private) key to prove control over child keys to the registry and ask the registry to revoke child keys. The registry will verify that the child key is indeed derived from the parent key (can be done using this) and the revoker has the parent private key.

eg. Alice generates a parent keypair $A$ with secret and public keys as $A_s$ and $A_p$ respectively that it never uses apart for child key generation and keeps in a very secure storage. Now whenever Alice wants to create a new child key, it uses the parent key $A$. Say it 2 child keys based on keypair $A1$ ($A1_s$, $A1_p$) and $A2$ ($A2_s$, $A2_p$). Now it loses  the wallet containing $A1$ and $A2$. Alice will not provide a signature to the registry using the private key $A_s$ and asking the registry to revoke $A1$ and $A2$. The registry checks that $A1$ and $A2$ are derived from $A$ and hence revokes.

UPDATE:
As the answer below shows, this scheme is not useful as revoking a child key enables the possesor of any child private key to know the parent private key.


texts: Is there a two-way key-stretching function which is infinite?

texts:
Only for hobby I made some ciphers, it is not my intention to use them in the real world but I am trying to compare them with existing ciphers.
An important function of my ciphers is a key stretching function with the following properties:
Kn = increase(Kn-1) where Kn is totaly different from Kn-1 and the length of Kn is 23 - 26 % longer then Kn-1.
The opposite is of course Kn-1 = decrease(Kn).
And the increase function is infinite.
I have been looking for an existing function with these properties for some time but have not found anything yet, i also cannot imagine that something like this is not already in use somewhere.

Is there a function with these or similar properties?


texts:
The scenario is like this:

$P_1$ has $m_1$, $P_2$ has $m_2$, they want to compare whether $m_1=m_2$ via the server $S$. After the protocol, only $S$ knows the result, and there is no interaction between $P_1$ and $P_2$.

An example solution:

$P_1$ encrypts $m_1$ with his public key $PK_1$; Then he sends $E(PK_1,m_1)$ and $PK_1$ to $S$; ($E$ is additively homomorphic)
$S$ forwards $E(PK_1, m_1)$ and $PK_1$ to $P_2$;
$P_2$ encrypts $m_2$ with $PK_1$, and calculates $E(PK_1,m_0) = E(PK_1, m_2-m_1) = E(PK_1,m_2) - E(PK_1,m_1)$; Then he sends $E(PK_1, m_0)$ to $S$;
$S$ does an oblivious decryption with $P_1$ to get $m_0$, and checks whether $m_0=0$

But in step 2, a malicious $S$ can sends $E(PK_s, 0)$ and $PK_s$ to $P2$ ($S$ knows the decryption key $SK_s$). Then $S$ will get $E(PK_s, m_2)$ from $P_2$, so that he will get $m_2$.


texts: How secure is a book derived key and what can be done to strenghten it?

texts:
If you have a manual encryption system where the keying is done by extracting a key from a book, a major weakness is that an adversary can search trough all existing books to find a perfect Match and thus the key. But isn't that very theoretical since not all books can be accessed by every one on the internet?

What can be done to strenghten such a book derived key?


texts: It seems that AES is non homomorphic. I am seeking a public key non homomorphic encryption that has been proved to be such or at least is accepted as non homomorphic. The internet search leads to those that are homomorphic. Any lead?


texts: I was reading research paper Reusable Garbled circuit in which i read the term "p.p.t Simulator" and p.p.t Algorithm. I know about Probablistic Polynomial Time(p.p.t) Algorithm. Kindly someone tell me what is Probablistic Polynomial Time Simulator


texts: Potential Flaws With Lattice Based Cryptography?

texts:
From researching post-quantum cryptographic schemes it seems hash-based and lattice-based algorithms are the most promising (MQ-based seem to be covered by patents and have more potential unknowns which could be used to exploit them.)  Hash-based schemes seem like the most reliable, but lack certain features found in lattice-based algorithms like the ability to do blind signatures.

For these reasons I'm curious what the potential issues with lattice-based cryptographic systems are and how likely they are to result in practical issues for implementations (be it key and signature size increases to compensate or hard-stop issues where you simply can't work around them with lattice-based cryptosystems.)

What key and signature sizes are expected to be secure currently?  What if new algorithms come along as a worst-case scenario?  (Assuming 256 bits of security in both cases.)


texts:
Consider this scenario:
Alice and Bob need to share some secret messages. Alice is the sender and Bob is the receiver.  This should be facilitated by Bob giving Alice a public key, such as in a certificate provided through a URL on a trusted site. The communication is one-way; Bob does not need to send any encrypted messages to Alice.
Preferrably, Elliptic Curve cryptography should be used.
Additionally, the size of the encrypted messages is likely small, such as < 32 bytes.
The messages are unpredictable random numbers (basically keys themselves, so in essence this is all about securely sharing a secret among two parties).
Initially I thought of implementing a standard ECDH scheme, but this seems unnecessary when Bob never needs to send anything to Alice, so to ask Bob to maintain a keypair and certificate seems excessive.
Second I thought of using ephemeral AES keys to encrypt the secret messages, and then encrypt the AES key with the public EC key, and then simply decide on a format for passing the encrypted ephemeral key, the IV and the encrypted message from Alice to Bob. I've done this in the past, but with RSA instead of EC.
Is there a go-to scheme for this scenario? EC is typically mentioned only in signature and key agreement use-cases it seems. Is it unsuitable to use EC for encryption of ephemeral AES keys? If reasonable, which AES and EC schemes would be suitable?
Furthermore, provided the data is small (<32 bytes), would directly encrypting the secret messages themselves with the public EC key be wise? Of course, if the size of messages would grow in the future, this would break, but assuming it doesn't? I'm guessing this approach could be dangerous if messages were predicatable (such as every communication starting out with a known HELLO message, hence giving an attacker access to plain text and cipher text pairs),
but assuming the messages themselves are random and never really repeated, is there any security risk using EC to directly encrypt the payloads?
Or is there a completely different approach which is preferrable here?


texts: Partial Known Message Pre-Image Attack on SHA-1

texts: If the last 448 bits of a sha1 block input are known (only the first 64 bits are unknown). Is it possible to do a preimage attack using SAT solvers or something else? Or do I have to brute force all $2^{64}$ possibilities? Is this a kind of reduced sha1?


texts: Is the XOR of PRGs sharing the same input a PRG?

texts:
I have question in learning PRG. Given that $f$ and $f_1$ are PRGs, both $\{0,1\}^n \to \{0,1\}^{2n}$.

Is $g(x) = f(x)$ xor $f_1(x)$ a PRG?

Someone told me that in this case, $g(x)$ is not a PRG, but I don't know how to prove it.


texts: Does multiple encryption cycles (using the same password for each iteration) offer any security?

texts:
Does running a plaintext through AES multiple times with the same password offers any security benefit akin to triple DES?

Note that I'm assuming “same password for each iteration”.


texts: Can I hash a secret key and used the hash as key ID?

texts:
I am using AES-CBC to provide confidentiality for protocol messages. I want to allow the receiver to know the secret key by using a key ID. For this I hash the secret key to generate a key ID. Every time the sender wants to send a message, the sender appends the key ID to the message to allow the receiver to bind the key ID with a secret key.

Is hashing the secret key to generate a key ID a secure mechanism?


texts: AES vs other types of encryption such as Twofish

texts: I am kinda of confused about what are some major differences between AES, Twofish, and other types of common encryption algorithms.


texts: How Hermite Lattice reduced basis implies LLL reduced basis?

texts:
Hermite reduced basis is defined as

A basis $\{b_1,\dots,b_n\}$ is reduced if it satisfies

$|\mu_{i,j}| \le \frac{1}{2}$ and
$||\pi_i(b_i)|| \le ||\pi_i(b_j)||$ for $1\le i \le j \le n$

where $\pi_i(x)=\sum_{j=i}^{n}\frac{(x \cdot b_j^*)}{b_j^* \cdot b_j^*)}b_j^*$ i.e., component of $x$ orthogonal to $b_1,\dots,b_{i-1}$

Since the algorithm to find Hermite's reduced basis not known to be in polynomial time for varying dimension.

Lenstra $et\;al$ defined the reduced basis and an algorithm to find the reduced basis in polynomial time.

LLL reduced basis is defined as

$|\mu_{i,j}| \le \frac{1}{2}$ and
$||\pi_i(b_i)|| \le ||\pi_i(b_{i+1})||$

How the second condition of hermite reduced basis implies second condition of Lenstra $et\;al$ reduced basis. Second condition of Lenstra $et\;al$ reduced basis satisfies only some inequalities in second condition of hermite reduced basis. What about the other inequalities? Does other inequalities are satisfied? If not, how does it output nearly orthogonal basis?


texts: Simulation-based proofs - advice tape of reduction algorithm

texts:
I am currently reading Yehuda Lindell's amazing tutorial on simulation proof technique and trying to write my own proof for the first time. In page 4 of this tutorial it is mentioned that

  [...] The value $a$ must therefore be written on the advice tape of the reduction algorithm.

and I also knew that $a$ in context of secure computation represents the parties' inputs (as prof. Lindell said in page 3 of the tutorial).

For proving security of oblivious transfer in semi-honest case (page 13), reduction algorithm $A$ is given $\sigma , b_\sigma$ on its advice tape. Could I also give $b_{1-\sigma}$ (other party's input) to $A$ on its advice tape if needed (which is in my case)?


texts:
I'm researching how to do salt and hashing.  I'll be using SHA256.  Here is what I found:

  To Store a Password

  Generate a long random salt using a CSPRNG.
  Prepend the salt to the password and hash it with a standard password hashing function like Argon2, bcrypt, scrypt, or PBKDF2.
  Save both the salt and the hash in the user's database record.

  To Validate a Password

  Retrieve the user's salt and hash from the database.
  Prepend the salt to the given password and hash it using the same hash
  function.
  Compare the hash of the given password with the hash from the database. If they match, the password is correct. Otherwise, the password is incorrect.

My question is: How do you get the original salt after it's been hashed to the user's password in the database?  You can't "unhash" the salt and add that to the password they've entered and then hash.  Wouldn't you get a different result?


texts: Doubt in computing $g^\frac{1}{\delta+x}$ where $x \in \mathbb{Z}$

texts:
I was going through Zero Knowledge Set Membership and came across the following:

Given $x \in \mathbb{Z}$ and $g$ is the generator of a multiplicative group $\mathbb{G}$ how do we compute $g^\frac{1}{\delta+x}$.

My doubt is, since $\mathbb{G}$ is a multiplicative group, doesn't that require $\frac{1}{\delta + x} \in \mathbb{Z}$. But since $x \in \mathbb{Z}$ is that possible?

Please help me understand this. Thanks in advance.


texts: How can I apply the Meet-in-the-Middle attack to the 3DES algorithm, and why does the literature say that 3DES is more secure than DES?


texts: Authentication of short message based on 6-digit alphanumeric compare-and-confirm

texts:
I have two parties that want to communicate with each other based on a shared password. The protocol is using PBKDF2 (with HMAC-SHA256) to create a shared key on both sides (due to restrictions on the channel, ECDH is not possible). In order to run PBKDF2, they need to exchange a short message, the salt. The salt should be authenticated to prevent against MITM-Attacks.

This should be done by showing a 6-digit alphanumeric value on the display of each party (based on the Numeric Comparison approach of Bluetooth or the Compare-and-Confirm approach). The alphanumeric value consists of all letters of the alphabet, except I,O,Q and U, and all numbers from 0 to 9. Thus, there are in total 32 characters and a 1-digit alphanumeric value can describe 5 bits. The 6-digit value can describe 30 bits. Each party has to compare and confirm the correct value.

The question is how to compute the 6-digit alphanumeric value based on the salt that is 32 bytes long. Is the best way to use SHA-256 and truncate the output to 30 bits? Or might it be a better idea to use a slow cryptographic hash algorithm (maybe PBKDF2 again but values can actually be precomputed so there shouldn't be any advantage) in order to increase the computational time for a MITM-Adversary? This could also be enforced by setting a time limit for the authentication.


texts:
SSL (Secure Socket Layer).
windows Webbroswers ( Chrome, Mozilla, Edge, explorer ) are using which winapi set to Encrypt and Decrypt Data. SSL is asymmetric encryption.
So which Api set is being used to decrypt receavied chipher.


texts:
According to Wikipedia block cipher modes of operation, simplified CFB supports random read access. but what about the real CFB where we have a shift register? below are pictures extracted from the book "Cryptography and Network Security by William Stallings" for CFB.

And

Does it support random read access? if yes, how?


texts:
From Wikipedia:

Check that $Q_a$ is not equal to the identity element $O$, and its
coordinates are otherwise valid.
Check that $Q_a$ lies on the curve.
Check that $n*Q_a = O$
Verify that $r$ and $s$ are integers in $[\![1;n-1]\!]$. If not, the signature
is invalid.

What is the mathematical reason for these checks and what can an attacker do if these checks are not carried out properly?


texts:
This question relates to the underlying RSA assumption. Forgetting about the fact that Textbook RSA is deterministic, I am curious about the assumed strength of the RSA problem.

Does RSA hide all bits of the message, or are there some bits that can be easily revealed. Concretely,

$$m^e \space \bmod \space N$$

Can any part of $m$ be learned(with significant probability) without learning the secret key, and if so how?


texts: How to compare two datasets „anonymously”?

texts:
Ok, I hope this question makes some sense because I am not so sure how to word it any differently… Imagine the following situation:

There are 10 defined colors (blue, orange, yellow etc.)
There are 2 Persons and each of them has 1 favorite, secrete color
The 2 persons don't know each other's favorite color, however, they
want to know if they share the same

My question: How can they do a comparison without exposing their own favorite color to the other person (or to anyone else!) in case they do not match?

Or, to explain the problem with other words: Person A should only know the favorite color of Person B if they share the same. Hence, the result of the comparison must only be True or False.

My first thought was: Every person could simply create a hash of their favorite color using the same hash algorithm (MD5, SHA etc.) and then they can compare the hashes. But obviously, that doesn't work, because it’s easy to find out which hash belongs to which color.

Is there a solution for such a use case? Any help would be highly appreciated.


texts:
I want to implement an internet-based e-voting system.
Voters shall be able to cast their vote for one out of n possible candidates. Each candidate has his own ballot-box kept by and at a trustworthy third party.
This third party is absolutely trustworthy insofar as it can be trusted to attend to his duties of supervising the cast diligently. However it is not without bias and hence under no circumstances must be able to see which voter voted for which candidate.

This problem can be approached using homomorphic encryption.
Votes are homomorphically encrypted and homomorphically added to the ballot-boxes.
In order to prevent the third party from gaining any knowledge of any vote cast every voter puts one vote into every ballot-box.
n-1 times this vote will be "0" for "no vote for this candidate" and only one time it will be "1" for "vote this candidate".

One unpleasant side effect of this approach is that the third party apparently is not able to check the correctness of every single vote.
A voter may try to give a "1" to more than one candidate or a "2" to a single one.
Of course the third party could hand out pre-signed voting coins in advance that the voters would use for casting their votes.
However the third party would recognize these coins, i.e. their values, and hence still know who voted for whom.

Do you have any idea how to solve this problem relying on as few possible other (trusted) third parties as possible?


texts:
I've recently been linked by someone to this particular puzzle which seems to point to a hidden file within the image. The clue given to me was "anagram" although I could not make much sense of it. Steganography comes to my mind but despite several effort at cracking it, nothing works.

http://securitystartshere.org/downloads/cddc/homework/

How can we generically process to try attack this kind of problem, where we are given an image (especially, an uncompressed one), suspect a primitive form of steganography, and do not know the method (contrary to Kerckhoffs principles, but according to practice as faced by  cryptanalyst, especially in the field of practical steganography)?

Fgrieu has given a few tips such as binary comparison after identifying and proceeding with proper conversion of a clean file to the same format as the encoded file. However I am unsure of the follow-up to this methodology, having extracted the byte difference into a separate file, no common file extension seem to yield any executables.


texts: Are there any formal tests to estimate encryption strength?

texts:
So I'm trying to design/make my own encryption algorithm and I believe it to be ok. I'm not saying it's extra secure but I know it's not useless so, what I was wondering is if there are any specific tests I can carry out in order to try and get a better representation of how secure my algorithm is.
Here is some data from tests that I have carried out:

Repeated blocks of data are different from each other
1-bit change in password will completely change the result
1-bit change in input text completely changes the output
even if you encrypt the same file with the same password you will get a different output each time because each encryption gets a different random salt
when tested over a large number of files matching bytes in both encrypted and unencrypted file that matched in the same place was 0.3% random is about 0.34% other encryptions get about 0.28-0.29%

here I have tried to layout the mode of operation for my algorithm. I believe it to be closest related to a PCBC mode of operation but there are some differences in the way I have laid mine out


texts: Does homomorphic encryption hide the algorithm itself?

texts:
The question is rather simple, but finding resources and answers quite tricky. Homomorphic encryption should enable us to compute over encrypted data. What if the algorithm for computing should be kept in secret as well? Given we have a functioning homomorphic encryption in place, is the algorithm which is applied to the input data also secure?
Is it possible for an intruder to understand how the data is computed and learn about the algorithm, given the intruder has access to the program which does the computation?
Update
I tried to ask about circuit privacy or protection with this question. Luckily and unfortunately I learned about this term only by asking this question, which was misleading a bit.
So the question should have been: Does FHE offer circuit privacy?
With this term I found some papers which answer my question.


texts: Entropy when iterating cryptographic hash functions

texts:
Consider a cryptographic hash function that maps $n$-bit strings to $n$-bit strings:

$$
\DeclareMathOperator{\H}{H}
\DeclareMathOperator{\SHA}{SHA-256}
\H(x) : \left\{0,1\right\}^{n} \mapsto \left\{0,1\right\}^{n}.
$$

Let $\H^i$ denote the result of iterating $\H$ $i$ times, i.e., $\H^1 = \H$, $\H^2 = \H \circ \H$, etc.

Suppose we choose $x \in \{0,1\}^n$ uniformly at random.  What is the estimated amount of entropy in $\H^i(x)$?  I'm most interested in the case $n=128$.

More specifically, I'm particularly interested in the following special case.  Define a hash function $\H$ by truncating the output of $\SHA$ to $128$ bits, i.e.,

$$
\H(x) = \SHA\left(x\right)\mid_{128}
$$

With this definition of $\H$, what is the entropy of $\H^i(x)$ now, when $x$ is chosen uniformly at random from $\{0,1\}^{128}$?  Does $\H$ maintain 128 bits of preimage resistance from $\SHA$, or is it significantly weakened? Are any other security properties of the underlying hash function weakened?


texts: How do I generate a number for a lottery and later proves its existence

texts:
I want to create a lottery that works like this: I choose a secret number A in the range [0:999] and publish an object B. People must try to guess the number A to win. When somebody wins, I want to publish an object C. The object C shall now together with B prove the existence of A, such that people know that A was determined from the beginning of the lottery.

Calculating A given B should be either impossible or unfeasible due to computational requirements.

I don't know much about cryptography, but have come up with the following proposal on my own:

p1, p2 = large prime numbers chosen at random, where p1 < p2
f = a hash function: N x N -> {0, 1, ..., 1000}

A = f(p1 | p2)
B = (p1*p2, f)
C = p1

My idea is that given B, it is easy to calculate A if C is also known, but computationally hard without C. Note that both the hash function and the product of p1 and p2 is given as the object B.

What do you think about my proposal, will it work? Is there any better or simpler methods?


texts: RC4 encryption -> AES encryption = more or less secure than RC4 or AES alone?

texts:
Say I have

$k1 = "keyhere";
    $k2 = "keyhere";

$rc4key = sha256($k1 . $seed);
    $aeskey = sha256($k2 . $seed . $rc4key);

$input_data = "hello world";

$rc4 = new RC4 -> encrypt($input,$rc4key)
    $aes = new AES -> encrpt ($rc4, $aeskey);

Meaning...
If I have two keys (1 rc4 and 1 aes), Is it more secure to encrypt my RC4 output with AES, than to use AES or RC4 alone and a single key?


texts: RSA OAEP: prevention of partial decryption of ciphertexts

texts:
I'm trying to understand RSA encryption (as a beginner in cryptography).

go on this wiki page http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding
scroll down to the 2 numbered points: "OAEP satisfies the following two goals:"
The 2nd point says "Prevent partial decryption of ciphertexts".

Say that an attacker attacks a an RSA crypto system that does not prevent the partial decryption of ciphertexts.

What happens if an attacker can decrypt a small part of a string (e.g. 2bits out of 10) using the public key? What information can the attacker retrieve from the decrypted?


texts: Public key encryption from (1,2)-oblivious transfer

texts:
Prove that any two rounds of (1,2)-oblivious transfer, that is semi honestly secure, imply public key encryption.

My ideas so far:

Let's say Alice samples two $n$ random strings $(x_1, x_2)$, and Bob will ask for $x_i$ using the given OT.

Now, wlog, we'll deal with 1 bit encryptions.

The main idea I had, is that Bob will send a random string $s$ when he asks for the string $i$ with the given OT. Then, Alice will always answer with $pk=(x_i, r)$ (the inner product). According to the Goldreich-Levin theorem, guessing $x_i$ based on the inner product is only with negligible advantage over 1/2. In such case, everyone can encrypt using $E_{pk}(m, r)=r, pk \oplus m$, and only Alice can decrypt cause she knows both $x_i$. However, how could she tell which $x_i$ has been used?

I'm not sure if this is indeed PKE, cause there may be many PKs, which looks weird at first.
Moreover I didn't actually use the OT-ness, and the fact OT is two rounds, which may be related.

Secondly, I think that making some secret key agreement between Alice an Bob will suffice to build PKE, but I'm not sure either how to build it from OT.

So the real problem is how the public key should be generated, and that's my problem.
Please help me to prove this theorem.


texts: Adversary for attack on one variant of ElGamal

texts:
I came by the following question:

Consider the following variant of ElGamal encryption.  Let $p= 2q+ 1$,
let $G$ be the group of squares modulo $p$ so $G$ is a subgroup of
$Z_p^*$ of order $q$, and let $g$ be a generator of $G$.  The private
key is $(G, q, g, x)$ and the public key is $(G, q, g, h)$, where $h =
\> g^x$ and $x\in Z_q$ is chosen uniformly.  To encrypt a message $m ∈
\> Z_q$, choose a uniform $r∈Z_q$, compute $c_1=g^r$ mod $p$ and
$c2=h^r+m$ mod $p$, and let the ciphertext be $(c_1, c_2)$.  Is this
scheme CPA-secure? Prove your answer.

Here $G$ is set of all elements in $Z_p^*$ which are quadratic residue modulo $p$ and $Z_p^* \setminus G$ is set of non-quadratic residue elements
.I think attacker should choose two messages in way that encryption of one be in set quadratic residues modulo $p$ i.e $G$ and one be in non-quadratic residues set i.e. $Z_p^* \setminus G$   then use this property to distinguish challange ciphertext . For example, if the attacker choose $m_0 = 0$ encryption of $m_0$ will be in set quadratic residues modulo $p$ i.e. $G$.
How should attacker choose $m_1$ to be able to calculate advantage of adversary exactly? The attacker can choose $m_1$ uniformly and with good probability encryption of it will not be in set quadratic residue but then I can't calculate exact advantage of this attacker. I want a attacker that i could calculate exact advantage.
Also we know $|G| = |Z_p^* \setminus G | = q$  but we do not know the way elements of $G$ are distributed over $Z_p^*$.
Recall: it is easy to tell whether or not an element $g∈Z_p^∗$ is a quadratic residue(simply see if $g^q= 1$ mod p).


texts: Birthday-paradox for big numbers and more than one person: Computing the approximate probability of $k$ hash collisions for $n$ hashes

texts:
Given a cryptographic hashing function, with say a $256$  bit-length, I want to calculate the probability that out of $n$ hashes we have at least $k$ hashes that collide in the first $32$-bit (assuming the $n$ hashes are uniformly distributed over all $2^{32}$ possible prefixes). Assume $k$ and $n$ are very high, something like $k=2^{32},n=2^{64}$. This reminds me of the birthday paradox but for more than $2$ people. I found this post, which suggest using an poisson approximation which from my understanding would result in the formula:

$$ P(\text{at least $k$ hashes in $n$ trials share the same prefix}) =$$
$$ 1 - \exp \left (-{n \choose k}/(2^{32})^{(k-1)} \right )$$

because if we would check every combination of $k$ hashes in the set $n$ hashes, we would on average have $\lambda = {n \choose k}/(2^{32})^{(k-1)}$ combinations that share the same $32$ bit prefix.

The problem with that that formula is that the calculations take too long. For example, calculating the number $(2^{32})^{2^{32}-1}$ is simply too complex. Is there any other way I can approximate this probability while remaining in the computationally feasible area?


texts: Storing passphrase and encrypted private key

texts:
I have to protect a key pair with a passphrase and to store these information someway in a table. I read that I can protect the key pair (specifically, the private one) using a digest of the passphrase as a symmetric key for a symmetric algorithm.

I also found that a good way to store a password (and therefore, I think also a passphrase) is hashing it with a salt with a password hashing algorithm (e.g. PBKDF2, bcrypt, etc.) and save the digest and the salt.

The problem is that I'm pretty sure that storing together, the salt, the digest of the passphrase - which is at the end the symmetric key used to encrypt the private key - and the private key itself, encrypted with the digest of the passphrase, is a naive solution.

But if I don't save the digest of passphrase together with the encrypted private key, how can I be sure, when decrypting the private key with an inserted passphrase, that the passphrase and the obtained private key are the correct ones?

I tried to look for an answer on the forum but I didn't find any good solution to my problem. Can you help me?


texts: RSA-Encryption, How to find private key (d) knowing public key (n) (e) & knowing how big the cypher text is (88 digits)?

texts:
How do i crack given n as n = 4099430871402176635782717535427267202018459295862032363925221458393907152187479623765591

and e as e = 659427

also knowing that the cyphertext is 88 digits long (it is not 88. the cyphertext itself has 88 digits similar to n)?? I have found programs that can do this however i must know how to do it by hand if possible. And those that explain it by hand i cant seem to understand. So if possible, a simplistic version would be very nice. Please and thanks.


texts:
Why are primes so important? Why can't we just use a random number?
My guess is that it's because finding a random prime require more computing power, than finding a random number. Can anybody confirm this?


texts: Chance of finding the right key by exhaustively searching on half of the key space

texts:
An exhaustive search of half the key space requires $2^{n-1}$ work and provides the right answer 75% of the time. If the attacker finds the key, he knows the answer. If he doesn't find the key, he still has a 50% chance of guessing right simply by guessing at random. Overall, his chances of getting the right answer are therefore $0.5 + 0.5*0.5 = 0.75$.).

In this quote from Cryptography Engineering book by Bruce Schneier, section 3.4, it has been said that there is 75% probability that a particular key can be found by dividing the key space into half, exhaustively searching from this and choosing a key randomly if not found. How the $0.5+0.5*0.5$ has been derived in this case? How is the chance of randomly guessing a key from the key space in 50%? Shouldn't it be $1/2^n$ in case where key size is $n$.


texts: Key length and message length in AES and perfect secrecy if plaintext length <= key length

texts:
As I understand it, a plaintext encrypted using a One Time Pad is uncrackable because all possible plaintexts of the same length are possible. As a concrete example, if you decrypt the first 3 bytes of a 4-byte plaintext that you know is in English and get "HEL" (and you knew that was correct somehow), that does not help you decrypt the final byte. It is equally likely that the plaintext is "HELO", "HELP', "HELL", etc. and there is no way for you to know which is correct.

What is the concrete step(s) of AES (or a similar popular symmetric key encryption algorithm) that makes encrypting an n-byte plaintext with an n-byte key not the same as a One Time Pad?

It feels intuitive that if the key is shorter than the plaintext, then all plaintexts cannot be possible regardless of the algorithm. The other way around (key longer than the plaintext) is not intuitive.


texts: Why does applying 56-bit DES twice only give 57 bits of security?

texts:
Given two 56-bit keys, $k_1$ and $k_2$, why does $E_{k_1}(E_{k_2}(M))$ only give 57 bits of security?

So basically I'm unsure why it only gives 57 bits of security; I understand that one key will provide 56 bits. Only thing I can think of is that when adding another 56 bit it will cycle through all the bits and realize they are the same so it just adds 1 extra bit, for the second keyblock instead of another 56 bits?

If I'm wrong, could someone please explain it simply and step-by-step?


texts:
I was trying to use OpenSSL 1.1 (via Ruby) to validate the ChaCha20-Poly1305 test vector from this IETF draft: https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04#section-7

The relevant test vector is quoted here:

The following block contains a test vector for the
AEAD_CHACHA20_POLY1305 algorithm.  The first four lines consist of
the standard inputs to an AEAD algorithm and the last line contains
the encrypted and authenticated result.

KEY:    4290bcb154173531f314af57f3be3b5006da371ece272afa1b5dbdd110
        0a1007
INPUT:  86d09974840bded2a5ca
NONCE:  cd7cf67be39c794a
AD:     87e229d4500845a079c0
OUTPUT: e3e446f7ede9a19b62a4677dabf4e3d24b876bb284753896e1d6

This gives me an 8-byte nonce. But when I try to run this test, I quickly run into a problem:

cipher = OpenSSL::Cipher.new("chacha20-poly1305")
cipher.encrypt
cipher.key = ["4290bcb154173531f314af57f3be3b5006da371ece272afa1b5dbdd1100a1007"].pack("H*")
cipher.iv = ["cd7cf67be39c794a"].pack("H*")

ArgumentError: iv must be 12 bytes
        from (irb):81:in `iv='
        from (irb):81
        from ~/.rvm/rubies/ruby-2.4.0/bin/irb:11:in `<main>'

How come OpenSSL is insisting on a 12-byte nonce, but the draft spec is giving me an 8-byte nonce? I'm still learning about ChaCha20 and Poly1305, so I'm sure I'm missing something basic.


texts: Calculating DES key knowing message before and after encryption

texts: I've 8 bytes before encryption (for example: 01 02 03 04 05 06 07 08) and 8 bytes after DES encryption: 08 07 06 06 05 04 03 02 01. Is it possible to calculate the key?


texts: Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?

texts:
I plan to do a clean install of ArchLinux with Full Disk Encryption (with LUKS) but I'm not sure to understand the default KDF choice (PBKDF2+SHA-256).
I didn't manage to find any pieces of evidence that make PBKDF2 more recommendable than Argon2id. Can someone explain to me ?
In the cryptsetup FAQ, the maintainer says :

5.11 Some people say PBKDF2 is insecure?
There is some discussion that a hash-function should have a "large memory" property, i.e. that it should require a lot of memory to be computed. This serves to prevent attacks using special programmable circuits, like FPGAs, and attacks using graphics cards. PBKDF2 does not need a lot of memory and is vulnerable to these attacks. However, the publication usually referred in these discussions is not very convincing in proving that the presented hash really is "large memory" (that may change, email the FAQ maintainer when it does) and it is of limited usefulness anyways. Attackers that use clusters of normal PCs will not be affected at all by a "large memory" property. For example the US Secret Service is known to use the off-hour time of all the office PCs of the Treasury for password breaking. The Treasury has about 110'000 employees. Assuming every one has an office PC, that is significant computing power, all of it with plenty of memory for computing "large memory" hashes. Bot-net operators also have all the memory they want. The only protection against a resourceful attacker is a high-entropy passphrase, see items 5.9 and 5.10.

Is this point still valid? Can "memory-hard" KDF like Argon2id really "limit" the 2 examples above?
Even if the FAQ is still right, are there any downsides (security wise) of using Argon2id instead of PBKDF2?
PS : Not a native speaker. Sorry for possible language oddities.


texts: Why is ElGamalEngine in bouncy castle restricting input data to be less than the length of the group parameter p?

texts:
I am currently using the ElGamalEngine of bouncy castle to implement exponential ElGamal for the purpose of making ElGamal additively homomorphic. To do this i raise the message to be encrypted to the generator g and modulo it with the group parameter p, like this:

private BigInteger g;
private BigInteger p;

public BigInteger raiseGenerator(long message)
{
    return g.modPow(BigInteger.valueOf(message), p);
}

In non-exponential ElGamal i would encrypt message, but to make it exponential i encrypt g^message%p. I use the following values of g and p:

private static BigInteger g512 = new BigInteger("153d5d6172adb43045b68ae8e1de1070b6137005686d29d3d73a7749199681ee5b212c9b96bfdcfa5b20cd5e3fd2044895d609cf9b410b7a0f12ca1cb9a428cc", 16);
private static BigInteger p512 = new BigInteger("9494fec095f3b85ee286542b3836fc81a5dd0a0349b4c239dd38744d488cf8e31db8bcb7d33b41abb9e5a33cca9144b1cef332c94bf0573bf047a3aca98cdf3b", 16);

With some values of message I get org.bouncycastle.crypto.DataLengthException: input too large for ElGamal cipher.

The reason this exception is raised is because of the following condition in the processBlock function of ElGamalEngine in bouncy castle.

if (input.bitLength() >= p.bitLength())
{
    throw new DataLengthException("input too large for ElGamal cipher.\n");
}

This is the same p as shown in the code above. The input can obviously have the same bit length as p because g^m%p can have almost the same numerical size as p and therefore also the same bit length.

Why is the input data restricted this way?

As an additional question: Is it possible to make ElGamal exponential using bouncy castle?


texts: Prime order elliptic curve groups: Generators and the reason choice

texts:
As far as I understand, the elliptic curve group based on BLS12-381 is prime order and cyclic. Thus, any group element could be used to generate all the elements of the group.

Why is a point explicitly hard-coded as the generator of the group
here and here?
If any group element serves as a generator of the group, what is the specialty of the chosen points in the above libraries? And how would one compute that special point?


texts: Figure out chosen-plaintext-attack in Zerologon attack

texts:
Actually, I'm reading the description about Zerologon attack from the original whitepaper document. In there, Tom Tervoort mention these sentences:
"So I tried to come up with some chosen-plaintext attacks myself and figured out
something interesting: for 1 in 256 keys, applying AES-CFB8 encryption to an all-zero plaintext will result in all-zero ciphertext."
and
"In fact, this property is a bit more general: when an IV consists of only zeroes, there will be one integer 0 ≤ X ≤ 255 for which it holds that a plaintext that starts with n bytes with value X will have a ciphertext that starts with n bytes with value 0. X depends on the encryption key and is randomly distributed."
I did a lot web searching about this topic, but I couldn't find any explanation or prove related to those sentences.
Could someone point me to the right direction about any article, paper, document or website where mentioned properties are proved?
Thank you very much for your support.


texts: Recently I am reading something about order-revealing encryption (by Boneh at al. in EuroCrypt 2015) and encountered "matrix branching programming". It seems like it took me forever to understand this. Anyone can help me with this problem. better have a concrete example in explanations


texts: Are libhydrogen's Gimli permutations production ready?

texts:
I've recently had a situation in which a recommendation for an easy-to-use, hard-to-misuse cryptographic library for Java was required. The first choice was Google's Tink, since it was designed specifically for that purpose. Given it's association with Google, the customer was not too thrilled and asked for alternatives.
libhydrogen came to mind, which had a Java wrapper called Hydride, and was also designed to be easy-to-use and hard-to-misuse. However, libhydrogen only supports NORX v3.0 AEAD as the algorithm for secret-key encryption, which is based on Gimli permutations. Hashes and HMACs offered by libhydrogen are based on Gimli hash functions as well.
I have to admit, I've never heard of Gimli permutations, and I am not nearly skilled enough in cryptography to perform cryptoanalysis myself. As such, I hesitate to fully recommend libhydrogen as alternative to Tink. Can libhydrogen and its Gimli permutations be considered production-ready?


texts:
I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy.

What I'm having a hard time finding is any particular literature which describes how to go from those tests to actual bits of entropy in the byte stream.

How do you go from p value of a byte stream (say a 100 MB long) to bits of entropy?

Updated:

As mentioned below, you can't estimate entropy of the output (not possible), but only by understanding the physics of the underlying process that generates the entropy.


texts: is there cryptography algorithm space /input invariant?

texts: I'm searching for a cryptographic algorithm that produces the same result for the same input, and if in the input, at position k, there is XXXXXX, then in the output at position k there is always the field YYYYYY.


texts: RSA key pair generation and FIPS 140-2, 186-4

texts:
I need to securely generate RSA key pair and I need to have access to private exponent in order to process it further.

What's the difference in FIPS 140-2 and FIPS 186-4 in connection with RSA key pair generation?

If I understand it correctly generating RSA key pair in FIPS 140-2 compliant environment will never show the private part of the RSA key pair as it is protected by cryptographic module.

FIPS 186-4 is about validating that RSA key pair was correctly generated and fulfils requirements about primes and exponents.

So if I want to securely generate RSA key pair and I want to have access to its private part in a clear-text form, I need to use FIPS 186-4 compliant generation and validation.

Am I correct? Do I understand these correctly?


texts:
I was trying to solve this problem:

Sometimes Alice needs to send a file to Bob, guaranteeing her identity and the file integrity (no confidentiality
required); the two parties are sharing a secret w and make use of a hash function $H$ that outputs 40-bit numbers and a symmetric encryption $E$.
Each time they use the following (pre-agreed) protocol.

A → B: $E_w(nA)$, where $nA$ is a nonce (Alice sends a challenge).

B → A: $E_w(nA+1)$ (Bob proves he knows the secret, providing response to challenge).

A → B: $(F, H(F),E_w(H(F)))$ (Bob, given $F$, computes $H(F)$ and $E_w(H(F))$, and then compare his results to data
actually received)

**1.Show how an attacker can act in place of Alice and send a file to Bob tricking him into
believing that the file is coming from Alice.

2.Fix the protocol without significantly perturbing it too.**

*My answer to 1:
The attacker can do Man in the middle attack.
Suppose Trudy impersonates Bob's network address.
1.Alice sends w{nA} to Trudy.
2.Trudy sends w{nA} to Bob.
3.Now Bob will send w{nA+1} to Trudy, which she will use it to send it to Alice.
4.After Trudy sends w{nA+1},
Alice will send (F, H(F),w{H(F)}) to Trudy, thinking she is Bob because she proved her that she is Bob.

Scheme:

A → T: $E_w(nA)$
T → B: $E_w(nA)$
B → T: $E_w(nA+1)$
T → A: $E_w(nA+1)$
A → T: $(F, H(F),E_w(H(F)))$

Is my answer to question 1 correct?
How do I solve the 2nd question?

Best Regards.