texts:
I wrote a litte random generator using a geiger tube. I use a 16bit timer that overflows every ~1ms;
when i get a reading form the geiger (~36count/minute), i save the current timer value as "random number".

But if run the test ent i get a completly different result for the chi-squared-test, in binary mode is fine, but in byte mode it fails miserably.

This is just a side project only for a little presentation, but i would like to have an idea to understand what is wrong.

binary mode

ent lestobaremetal.txt -b
Entropy = 0.999990 bits per bit.

Optimum compression would reduce the size of this 654560 bit file by 0 percent.

Chi square distribution for 654560 samples is 9.08, and randomly would exceed this value 0.26 percent of the times.

Arithmetic mean value of data bits is 0.5019 (0.5 = random).
Monte Carlo value for Pi is 3.123203285 (error 0.59 percent).
Serial correlation coefficient is -0.001670 (totally uncorrelated = 0.0).

byte mode

ent lestobaremetal.txt
Entropy = 7.986452 bits per byte.

Optimum compression would reduce the size of this 81820 byte file by 0 percent.

Chi square distribution for 81820 samples is 899.48, and randomly would exceed this value less than 0.01 percent of the times.

Arithmetic mean value of data bytes is 128.1813 (127.5 = random).
Monte Carlo value for Pi is 3.123203285 (error 0.59 percent).
Serial correlation coefficient is -0.001851 (totally uncorrelated = 0.0).

UPDATE:

The random stream is generated in this way: the pulse from the GM tube is stretched by a 555 astable timer to 5mS duration. The stretched pulse is fed into the INT0 pin on an atmega328. When the external interrupt is generated, the current TCNT1 16-bit counter value is taken and sent over uart to the pc. The timer is run with prescaler 1 at 16MHz, for an overflow every ~4ms

Here you can find the binary file with the data collected in a couple of days:
lestobaremetal.txt
More about the proect:
Source code
Hardware schematics and layout


texts: Proof that LFSR (with XOR feedback and nonzero seed) will never hit state of all 0s

texts:
Does anyone know a good proof that a LFSR (with XOR feedback and seeded with non-zero starting state) will never enter zero state?

It is obvious that a zero state will always get stuck in a zero state, but what is the proof that nonzero states cannot cycle into the zero state eventually?


texts: Tls 1.3 ClientHello legacy_session_id as zero length vector alignment

texts:
Looking at tls 1.3 draft 23: https://tools.ietf.org/html/draft-ietf-tls-tls13-23

Section 4.1.2 shows, for a freshly established connection (no previous session from tls 1.2 or earlier) the legacy_session_id for ClientHello must be a zero length variable vector, which allows a max length of 32.

My interpretation of section 3.3 makes this zero length vector a single byte of value 0, followed by a zero byte-length entry, ie followed by nothing.

This seems to misalign structs comprised of the ClientHello. Is this correct?


texts: Does security against a CCA1 attacker imply security against a CPA attacker?

texts:
I've seen it mentioned multiple times, but have not seen a formal proof of how security of an encryption scheme against a non adaptive chosen-ciphertext attacker (under non-malleability or ciphertext indistinguishability) implies security against an adaptive chosen-plaintext attacker.

Does IND-CCA1 imply IND-CPA (and NM-CCA1 imply NM-CPA)?


texts:
JPBC library describes 6 types of elliptic curves. This is how they describe type A:

Type A pairings are constructed on the curve  $y^2=x^3+x$ over the field  $\mathbb{F}_q$ for some prime  $q=3 \mod 4$ . Both  $\mathbb{G}_1$ and  $\mathbb{G}_2$ are the group of points  $E(\mathbb{F}_q)$ , so this pairing is symmetric. The order  $r$ is some prime factor of  $q+1$ .

They also offer a curve generator implementation that takes in rBits and qBits values and calculates the q,r,h, exp1, exp2 values.

I would like to know, what rBits and qBits values consider to be secure enough for cryptocurrency wallet security? Also, what is the best type that provides the mentioned security and has the best performance?

I recently implemented BLS signature aggregation using JPBC, and I would like to know what would be the best settings to use in cryptocurrency application that will use it?


texts: Use of the IV for the CBC Block Cipher in TLS1.2

texts:
I'm struggling to understand at what point a message is encrypted when looking at RFC 5246. The spec gives the generic block cipher in section 6.2.3.2 as:

struct {
    opaque IV[SecurityParameters.record_iv_length];
    block-ciphered struct {
        opaque content[TLSCompressed.length];
        opaque MAC[SecurityParameters.mac_length];
        uint8 padding[GenericBlockCipher.padding_length];
        uint8 padding_length;
    };
} GenericBlockCipher;

So my question is, does the IV get encrypted or not, and does the IV affect the padding?


texts: Are there methods for finding not optimal but good linear approximations for functions?

texts:
I'm interested in finding the best, or maybe just a good linear approximation of the function $F^{(19)}: V_{56}\to V_8$, where
$$
\begin{array}{l}
F^{(1)}(x_1,x_2,\ldots, x_7) = P(x_2+x_6);  \\  F^{(2)}(x_1,\ldots,x_7) =
F^{(1)}(x_2,\ldots,x_7,F^{(1)}(x_1,\ldots,x_7)),
\\ F^{(3)}(x_1,\ldots,x_7) = F^{(1)}\left(x_3,\ldots,x_7, F^{(1)}(x_1,\ldots,x_7), F^{(2)}(x_1,\ldots, x_7) \right) \ldots
\end{array}
$$
Here $x_j\in V_8$, $P$ is a byte permutation and by $+$ we denote addition in $V_8$.

Are there methods for finding not optimal but good linear approximations for such a function?


texts:
I'm analyzing the transmitted data from the apple Smart Keyboard to the iPad, and I have troubles arriving to a conclusion:

When I press a key, the keyboard transmit two blocks of data: the identification address (I think, it is always the same) and the key data divided in 4 bytes. It sends the same information when I release the key.

The key data I recorded was:

press   'b': 11011101 10001000 01011100 11100010
release 'b': 11011101 01001000 01011100 01001000
press   'b': 11011101 11001000 01011100 01101011
release 'b': 11011101 00101000 01011100 00011101

press   'c': 11011101 10101000 01011100 00111110
release 'c': 11011101 01101000 01011100 10010100
press   'c': 11011101 11101000 01011100 10110111
release 'c': 11011101 00011000 01011100 10101111

press   'd': 11011101 10011000 01011100 10001100
release 'd': 11011101 01011000 01011100 00100110
press   'd': 11011101 11011000 01011100 00000101
release 'd': 11011101 00111000 01011100 01110011

As you can see, the first and the third bits are always the same, independent of the key, and the second byte is a counter, in big-endian format.
I guess that the last byte is actually carrying the information about the exact key pressed, but since it's different every time, my first thought was that the byte is somehow encrypted with the counter.

Any suggestion on how can I obtain the information about the key?


texts: Is it easy to crack a hashed phone number?

texts: I want to SHA256 hash phone numbers in order to hide them. Is this a good idea? Are there any other ways I could make this safe?


texts: Are quantum computers a sign that we should phase out RSA?

texts: Shor's algorithm has already been implemented to factor 15 into 3*5 on a simple quantum computer. Is technology to the point that we should consider RSA deprecated?


texts:
I need to test if my AES-CCM implementation works correctly, but I don't find any example to test that.

Could you please help me and provide test vectors / other value-inserted examples?

In case there are none, I'd like to ask for the ciphertext of the following test vector for verification purposes:

AES-128
Plaintext = 00112233445566778899AABBCCDDEEFF
Key = 000102030405060708090A0B0C0D0E0F


texts: Advantage of $\operatorname{GF}(2^8)$ over $\mathbb Z/2^8\mathbb Z$ in AES/Rijndael

texts:
The Galois Field is used in the mixColumns step of the Rijndael-Algorithm. Over $\operatorname{GF}(2^8)$ (irreducible polynomial: $x^8 + x^4 + x^3 + x + 1$), the first value of a matrix multiplication (all numbers are hex numbers) would be:

$$\begin{bmatrix} \mathtt{1e}\\\mathtt{27}\\\mathtt{98}\\\mathtt{e5}\end{bmatrix}\cdot\begin{bmatrix} 2 & 3 & 1 & 1\\...&...&...&...\end{bmatrix} = \begin{bmatrix} \mathtt{28}\\...\\...\\...\end{bmatrix}$$

If I calculate the same matrix multiplication in the realm of natural numbers the result is:

$$(\mathtt{1e}\cdot2)+(\mathtt{27}\cdot3)+\mathtt{98}+\mathtt{e5} = \mathtt{22e}$$

Okay, $\mathtt{22e}$ is bigger than $2^8-1$, but we can just take $\mathtt{22e} \bmod 2^8 = \mathtt{2e}$ and the result would be well within the boundary of an byte.

As a non-mathematican I wonder what's the advantage of the calculating in the $\operatorname{GF}(2^8)$ over calculating with the natural numbers modulo $2^8$, because both methods seem to be feasible. I have two ideas in my head but did not find any confirmation nor disprove. Is it about efficiency because the $\operatorname{GF}(2^8)$ is perfectly aligned to the byte architecture of a computer? Or does the $\operatorname{GF}(2^8)$ provide better diffusion than the calculation via natural numbers? Or is it something else?


texts: What would happen if the last message in a three-pass authentication protocol was undelivered?

texts:
I did read some articles about the protocol but couldn't figure out what would happen. Would the two parties be unable to verify each other? Or would it be something else?

based on the international standard ISO/IEC 9798-2.


texts: How to go about encrypting a digital exam?

texts:
I'm building a Digital Examination system and I'm having problems understanding some concepts in cryptography.

I want use to Asymetric Cryptography and my questions are

Do I encrypt the entire file?

When I do my encryption is it that I should make the entire file encrypted with the private key of the sender of the exam? (as it passes through different hands e.g. lecturer to exam department)

Or do I just generate some kind of code that the recepient would compare it to?
Is that what digital signing is?
Do I need a public and private key for every party the exam passes through?

(lecturer, student, exam dept etc)


texts: Why is RSA easily cracked if N is prime?

texts:
This question was part of an assignment.
Here's my reasonning:

If N is prime and N=p*q, then p=1 and q=N (or the opposite).
e * d ≡ 1 mod ((p-1) * (q-1)), but ((p-1) * (q-1))=0 here.
e * d ≡ 1 mod 0, so e=d.
We now have the private key.

Is this correct?


texts: Does maximum length of CN in a x509 cert include the length of the OIDs?

texts:
This is a CN from a x509 certificate (I have done some substitutions just to mask the data but the length is not changed)

CN=Alex Perry/pseudonym=88b2e76beE0e4e4b94b502020202262E/x500UniqueIdentifier=22e4EE844E8B744490EEE96EE8BEB7E29548e4496E425247944B025E04528654/postalCode=60601

As per the RFC, the CN field should not be more than 64 bytes, but this CN is more than 64 bytes

So does the max length 64 only counted up for the CN=Alex Perry & the rest of the string (/pseudonym, /x500UniqueIdentifier etc) is ignored?

If so, is there a limit imposed on the total maximum length? What is that?


texts: Applicability of IBM's projected 50-qubit quantum computer Q to cryptanalysis?

texts:
IBM announced Q, a project for a 50-qubit universal quantum computer, according to the press realease. Here is more PR spin, and the research sub-page.

What would be the applicability of that to cryptanalysis?


texts:
My misunderstanding is all about the parity attack mentioned in "Cryptography Engineering by Ferguson, Schneier and Kohno".

Most modern block ciphers have a 128-bit block size, but they operate on 32-bit words. They build the encryption function from many 32-bit operations.This has proved to be a very successful method, but it has one side effect. It is rather hard to build an odd permutation from small operations; as a result,virtually all block ciphers only generate even permutations.

I still do not get in how far a parity attack will be helpful.
Why only ideal ciphers have odd permutations?
Can someone form an example why odd permutations need more operations and why it is hard to realize with the current hardware being able to do 32-bit operations only?
I did not get smart by another thread on this forum exactly on this question.


texts: Why does only length prepending improve the security of CBC-MAC

texts: I know that length prepending improves security of CBC-MAC. However, wouldn't inserting the length elsewhere (middle, end or any other part of message) be equally good? After all, even the length is processed by the underlying cipher block.


texts:
There has been a lot of buzz about quantum computing especially with D-Wave breaking the limits each month. I have basic knowledge about cryptography with an introductory course in quantum computing.

So, how does quantum encryption work? and how is it different in principle from the current practices adopted?


texts:
I was thinking about a brute force attack on Curve25519. For this, we need to solve the discrete Logarithm problem $P = [n]Q \bmod 2^{255} - 19$. $P$ and $Q$ are known Points on the elliptic curve, so we 'only' need to find $n$. The $n$ is in $ \{2^{254} + 8 \cdot \{0,1,2,\ldots,2^{251}-1 \} \}$. So there are $2^{251}$ different possibilities for n. On average the brute force attack needs to test $2^{250}$ different n.
We want to calculate how much time the best supercomputer in the world would need. Bernstein says that it needs 640383 cycles for one multiplication. 92% are floating points operations (flop) so i approximated this to 100% flop. The best supercomputer can do $148600 \cdot 10^{12}$ flops. Combining this information, I achieved the following result:
$$\dfrac{2^{250} \cdot 640838}{148600 \cdot 10^{12}} \cdot \dfrac{1}{60\cdot 60\cdot 24\cdot 365.25} \approx 2.47243\cdot 10^{56} \text{ years}$$
Do I have an error in reasoning?


texts: OpenPGP tag 18/19 description confusion Continuation

texts:
After coming back to try to finish more of my OpenPGP implementation, I refound one of my  questions https://stackoverflow.com/questions/6021360/openpgp-tag-18-19-description-confusion that I am still having trouble with.

This time however, I have been able to encrypt some data and get another program to decrypt it. The problem is, that I used tag 9 instead of tag 18+19. After rereading the answer to my question, it seemed quite straightforward. Unfortunately, my implementation disagrees with me.

From the answer, it says:

MDC_hash = SHA-1(OpenPGP_CFB_extra_data + [plaintext] + "\xd3\x14")
encrypt(OpenPGP_CFB_extra_data + [plaintext] + "\xd3\x14" + MDC_hash)

what I am doing:

data (ASCII): 0123456789abcdef

after being placed inside a literal data packet:
plaintext = \xcb\x16\x74\x00\x00\x00\x00\x000123456789abcdef

"generated" prefix for CFB: \x51\x33\xc6\x4b\x4c\x77\x7b\x06\x4c\xfb\x71\xe3\xdd\xfb\xa1\x9f

here, tried hashing the data in 2 different ways (i think the correct data to hash is the second version):

sha1("\x51\x33\xc6\x4b\x4c\x77\x7b\x06\x4c\xfb\x71\xe3\xdd\xfb\xa1\x9f\xcb\x16\x74\x00\x00\x00\x00\x000123456789abcdef\xd3\x14") = (in hex) 8c2cf8ede9bd851d3dba76363ee32c4ca14e4643

and with the repeated last 2 prefix octets:

sha1("\x51\x33\xc6\x4b\x4c\x77\x7b\x06\x4c\xfb\x71\xe3\xdd\xfb\xa1\x9f\xa1\x9f\xcb\x16\x74\x00\x00\x00\x00\x000123456789abcdef\xd3\x14") = (in hex) 80f570ff8570ed11bea3e2afa826b10c66117fe4

then, I do the encryption on:

\x51\x33\xc6\x4b\x4c\x77\x7b\x06\x4c\xfb\x71\xe3\xdd\xfb\xa1\x9f\xa1\x9f\xcb\x16\x74\x00\x00\x00\x00\x000123456789abcdef\xd3\x14 + either hash

the result I get is PortablePGP/BouncyCastle complaining "unknown object in stream 15".

What am I doing wrong here? Is the error here in my thinking, or somewhere in my unposted code? I am fairly certain that my encrypt function is correct, since, as mentioned above, worked correctly, just not on packet type 18.


texts:
The question

Given the same plaintext content that is encrypted two times.
One time with AES-CTR and the other time with AES-CBC.
Both times with the same AES key but with different IVs.

What are known possible attacks (apart from the following example) that could help to decrypt the plaintext without knowing the key?

Does some probability analysis exist for the example attack outlined below?

An example for a possible attack:

By looking at how CBC and CTR are done, one possible attack where the attacker knows a certain number of plaintext blocks would be the following. (Please excuse my probably non-standard notation)

Lets say:

CBC(k) is the kth block of the CBC ciphertext
CTR(k) is the kth block of the CTR ciphertext
CTRIV(k) is the kth block of the CTR counter (before being applied to AES)
PLN(k) is the kth block of the plaintext

we know from how AES-CBC works that:

CBC(n)=AES(key, PLN(n) XOR CBC(n-1))

and from how AES-CTR works that:

PLN(m)=CTR(m) XOR AES(key, CTRIV(m))

so it follows that:

For all (m,n) where

PLN(n) XOR CBC(n-1) = CTRIV(m)

the following is true:

PLN(m)=CTR(m) XOR CBC(n)

And because PLN(n) XOR CBC(n-1) is easily calculated and CTRIV(m) is a stream of consecutive numbers the check can be done very fast.

Now, as I understand this: The longer the encrypted content and the more plaintext blocks the attacker already knows, the higher the probability for finding new plaintext blocks, which again help in finding newer ones.

The probability would also rise if additional reencryptions of the plaintext with the same key and random IVs are done, because more CBC(n) and/or CTRIV(m) blocks can be gathered.


texts: Given an insecure channel, what are the pros and cons of using Diffie Hellman to generate a symmetric shared key and then send encrypted data with this key, or simply use Shamir's three-pass protocol with symmetric ciphers for Alice and Bob to each supply parts of the key to one another?


texts: Different ways of building a ChaCha20-based RNG

texts:
Let's say you're building RNG with ChaCha20 and the fast key erasure technique.  There seem to be a few ways to do it.

The reference implementation in the SUPERCOP benchmarking toolkit looks like this:

#define KEYBYTES 32
#define OUTPUTBYTES 736

int crypto_rng_chacha20(
        unsigned char *r, /* random output */
        unsigned char *n, /* new key */
  const unsigned char *g  /* old key */
)
{
  unsigned char x[KEYBYTES + OUTPUTBYTES];
  crypto_stream_chacha20(x,sizeof x,nonce,g);
  memcpy(n,x,KEYBYTES);
  memcpy(r,x + KEYBYTES,OUTPUTBYTES);
  return 0;
}

How often should I replace the key?  The SUPERCOP implementation replaces the 32-byte key every 768 bytes.
What about the nonce and counter?  The SUPERCOP implementation sets the nonce to zero and resets the counter to zero every time the key is replaced.  What about treating the nonce/counter similar to the key and periodically replacing them with ChaCha20 output?  (Except for a few counter bits that we need to crank to get 768 bytes of output.)
The SUPERCOP implementation replaces the key with the first 32 byte of the 768-byte sequence.  Can I use the last 32 bytes instead?  That would allow my implementation to keep less state.
What about replacing the key incrementally?  For example, instead of fully replacing the key with the first 32 bytes of every 768, what if I used the first 4 bytes of every 96 and incrementally replaced the key?

Note: I'm asking this question primarily to get a deeper understanding of how things work.  In practice, I'd just copy the SUPERCOP implementation.


texts: Do sites store login password with hash? If so, can people can use hash collision to log in?

texts:
I was researching about hash, and I thought, If sites store passwords with hash algorithms, then can't this happen:

User A has the password 'hello'
User B finds out the hash code of the password of user A
User B knows the username of user A and uses hash collision to find a string with an identical hash
User B logs in the account of user A

So now, my main question is:
Do databases store the hash of the password or not? And if they do so, can the thing I wrote above happen?


texts:
Consider a secure modern block cipher like AES/Serpent/Twofish.

I hear everyone say that the complexity is $2^{128}$ for a 128 block cipher. But isn't the weak link the actual hashed and salted password? Any brute force should be targeted at it?

By my rough calculations $2^{128}$ = $84^{20}$, so any proper password composed of all available keyboard characters shorter in length than 20 is a weakness?

The problem seems to only grow with 256 ciphers: $2^{256}$ = $84^{40}$.

So does this mean there is no point using AES256 if you don't plan to have a password 40 characters long or use keyfiles? Could someone please clarify?


texts: How practical are side-channel attacks and how much of a concern are they?

texts:
I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like decrypt any block given to it with no IV or nonce (so usually ECB mode).

That said, there have been practical attacks against smart cards and timing attacks against RSA.

So, when building a system which uses cryptography (be it public or symmetric key), how practical of a concern are such attacks? And, what guidelines can be followed to determine if your systems needs protections (be they power analysis protections, emissions, timing, etc)?


texts: Theoretically, what if I were to change some magic numbers in, say, AES?

texts:
Purely theoretically. I know it's a bad idea to try to invent your own encryption and that's not the intention here. Just a thought experiment.

Say, I change some or all of the magic numbers used in, say, AES (but this would also apply to other algorithms) and create "AES-RobIII". Of course, this would be incompatible with the current AES algorithm.

First: I know these numbers are chosen (usually) very carefully (sometimes maybe even crafted so that they can contain a secret backdoor, but I'm not interested in conspiracy theories, etc). How are these numbers chosen generally and I assume there are many ('infinite') variations possible? Do they come from an 'RNG' (tuned to some specific rules)? Are they chosen 'manually'? I know they have to satisfy some polynomial(s) but do they (the cryptographers designing the algorithm) just start with a random seed or pick a specific number or...?
Since these magic numbers are, along with the algorithm, out in the open (as any good encryption algorithm should be), I could theoretically pad the encrypted message with them and 'load' these tables with the numbers before the algorithm is kicked off to encrypt/decrypt, right?
Then why have these numbers as constants in the algorithm (unless size is a priority of course) in the first place? Or why don't we have, say, AES-I, AES-II, and AES-III with the only difference being another set of magic numbers? You could even consider the table(s) of magic numbers used a sort of "extra key" so, say, a company could use their generated (similar to how private/public keypairs are generated for example) set of numbers internally for extra added security when stuff would leak. I realise it won't add much (if anything at all) but added complexity but I was just wondering.

Again, I realise this won't add any advantage of any meaning (probably), if at all, but I was just wondering. Also, this question is based on the assumption that if I change any of the magic numbers and encrypt something with it and then try to decrypt it (with the same, altered, magic numbers) it would still decrypt correctly.

Update: the answers so far seem to focus primarily on AES, but that was just an example. I could've picked any algorithm (though I realise that details may differ per algorithm). I also realise that AES is plenty strong enough and that AES is implemented in a lot of hardware; though I don't see a problem if you can load these magic values in some 'registers' or 'dedicated ram for this purpose' (but I understand it would be a lot less performant and use up a whole lot more wafer space). I was/am looking more from a theoretical point of view where speed or practicality don't (really) matter.


texts: What is the role of a circuit in ZK-SNARKS

texts: What role does a circuit play in ZK-SNARKS? Is it executed on both the prover's and the verifier's machine? If so, how would you program it to check if one value is greater than another value?


texts: How to properly format a PGP Message Block?

texts:
As sort of a follow up to my (currently) unanswered question, if it is correct, how do i properly calculate and format the packet that actually stores the data being encrypted? I thought I knew what I was doing, but something here causes bouncycastle to freak out.

Using data from the first post and:

AES256 (pgp value 9)

Data (ASCII): 0123456789abcdef

Data + SHA1 Hash (hex): 30313233343536373839616263646566fe5567e8d769550852182cdf69d74bb16dff8e29

random data used in cfb as prefix (hex): 5133c64b4c777b064cfb71e3ddfba19f

Encrypted data (hex): 5e963a759c48fbf2af931c5c575a27821323cd283c244900a60d7bf1147be20e84980021588fcfd85749468e64dfaae2541aabac23d7

packet 2 (tag 18) in hex: = 01 + (Encrypted Data)

According to what i understand, this data will result in the output (both session key packet (tag 1) and encrypted data packet (tag 18)) of:

-----BEGIN PGP MESSAGE-----
Version:

wY4D+UDEMBpnd50QAf92cuXMV6qhSz/aBd7gLs7einXuy4EwYCJMOQ5I84071BAx
ydRlm/qjYkavFFkwpI2LXcVhi0UG+1X2NH1b3f/AAf9F8VuE6Oe5Xf7wtSrOoQrv
TCCz/JuPfG8kh7LkO4v69d3rrt3AVkPDSOt4VVn6fddPdUK0Ss43Rtgp+/H2OSpT
0jcBXpY6dZxI+/KvkxxcV1onghMjzSg8JEkApg178RR74g6EmAAhWI/P2FdJRo5k
36riVBqrrCPX
=I+T/
-----END PGP MESSAGE-----

Can anyone tell me what I did wrong and how to fix it?

Anybody?


texts: Advanced Electronic Signature: PKCS#7 to PFX Conversion

texts:
I am a user requiring a legal signature to be installed on a SAP/R3 application.  For the past few years a service provider provided a X.509 advanced signature certificate that could be exported as a .pfx file and installed on SAP.
A new service provider supplied a dongle with PKCS#7 and a separate private key is required to create a .pfx file.  As far as I understand the private key is encrypted on the dongle.  They also informed me that they are not allowed to provide the private key.
Is there a way to create a .pfx file using this dongle?
If not, how do I correctly specify the requirement of a X.509 advanced signature that can be used to create the .pfx file?


texts: Understanding generation of IV in CBC encryption

texts:
I am trying to understand CBC encryption and have a question in two parts:

When generating the next block for encryption I XOR the next plaintext block with the current ciphertext as the initialisation vector. The next plaintext block is 16 bytes, the current ciphertext is, say, 120 bytes. Which part of the ciphertext do I use? Is it implementation specific? Could I use 16 bytes from position 40?
What is the advantage of XORing the next plaintext block with current ciphertext over XORing the next plaintext block with the current XORed plaintext block? My guess is that the second option produces predictable patterns.


texts:
Is there any tool / way to decrypt raw bytes of a TLS 1.2 session, when the master key is known, even if forward secrecy is used?
The closest I found is this.
I know its possible using Wireshark, but I am intrested in decrypting raw TLS bytes (without the underlying protocols) as described here.
An example input (without the master key) is this.


texts: Requirements for the modulus in the Massey-Omura three pass protocol

texts:
In the Massey-Omura three pass protocol:

How many bits long should the prime modulus $M$ be in order to be secure?
Should the $M$ be secret?
Should the $M$ be generated every time or it could be reused to generate new keys?


texts: What is the correct way to choose the start parameters for NIST tests?

texts:
I had an idea of creating a pseudo-random binary sequence with that code:

import random as rd
p=[]
k=10**6
for i in range(k):
  p.append(rd.getrandbits(1))

s=''
for i in p:
  s+=str(i)
a=p.count(0)
b=p.count(1)
f = open('s.txt', 'w')
f.write(s)
f.close()

And on the stage of testing it with NIST tests there came a question of choosing right parameters for launching them. If I set the length of the sequence for this file for 100000 and number of bitstreams for 1, will it mean that from this file i will have only first 100000 bits tested as one sequence? Should the data in file be separated in some way?

I have also checked this question on crypto.stackexchange, but to be honest it didn't help me. Reading the official docs for NIST package didn't bring no understanding of bitstreams parameter too.

I will be very grateful if you explain me, how to set number of bitstreams parameter correctly and explain the meaning of it in this situation and the way the input data should be given to the tests.


texts: Details related to the ZIP algorithm used in PGP message encryption?

texts:
I am very new to PGP. PGP encryption works with hash function, asymmetric encryption, symmetric encryption and a zip algorithm (LZ77). What I know is that the zip algorithm is used to reduce the length of message which has repeating characters, but the algorithm consist of two encoding schemes which are:

-- <0> < 8-bit pointer length> <4-bit length>
-- <1> <12-bit pointer length> <6-bit length>

Can you tell me the difference between them? Because version 1 may be can only take 14 bit input at once for conducting the comparison, but the version 2 can take 20 bit input at once for comparison…


texts:
I am searching test vectors of the HMAC-SHA256 primitive to verify the correctness of an implementation.

Without hesitation I go on the NIST website to see what they offer.

While reading the corresponding file (HMAC.rsp from hmactestvectors.zip) I can see that  the given test vectors associated to the SHA256 hash function are computed with different key sizes: $40$, $45$, $64$ and $70$ (in bytes).

I was a little surprised about this because according to the RFC 4868, the key used should be composed of $32$ bytes:

  While no fixed key length    is specified in [HMAC], this
  specification requires that when used as    an
  integrity/authentication algorithm, a fixed key length equal to    the
  output length of the hash functions MUST be supported, and key lengths other than the output length of the associated hash function MUST NOT be supported.

On the other hand, I read:

  However cryptographic keys (for symmetric algorithms like HMAC) longer
  than 128 bits don't really add security, so there is no actual need to
  go to a full block-length key

(see What are requirements for HMAC secret key?)

That's why these test vectors are getting me confused:

According to the RFC mentioned above, the key used should be a $256$-bit key.
It seems that most of the time, HMAC is computed with a $128$-bit key.

But NIST test vectors are using longer keys than the output length (ie $256$ bits because SHA256 is used). Still according to RFC 4868:

  key lengths less than the output length decrease security strength,
  and keys longer than the output length do not significantly increase
  security strength

So why did the NIST use these key sizes to compute their test vectors? Is it because HMAC algorithm is mainly based on a hash function and it's this feature that requires special assessment? There is also this document which specifies the procedures involved in validating implementations of HMAC but I don't see anything that justify the choice of the key sizes.

To verify the implementation in question is it possible to find other test vectors? Can I consider that if the ones given in RFC 4868 are verified then it's well implemented?


texts: Disjunction of several instances of sigma protocol

texts:
Assume there exists zero-knowledge interactive protocol for a language $L \in NP$ i.e., if an instance $x \in L$ then prover can convince the verifier, that $x \in L$ with high probability without any other information.
A zero-knowledge interactive protocol is said to sigma protocol if it satisfies following conditions

Three move protocol: In the protocol, prover first sends a message
$m_1$ to verifier, verifier upon receiving $m_1$ send a $t \in
   \{0,1\}^k$ to prover. Prover based on $t$, compute and send message
$m_2$ to verifier. Verifier outputs valid ot invalid based on input
$x$ and the transcript $(m_1,t,m_2)$
Completeness: If $x \in L$, verifier returns valid
Special Soundness: For any $x$, if there are two accepting transcript
$(m_1,t,m_2)$ and $(m_1,t^\prime,m_2^\prime)$ where $t \neq
   t^\prime$, one can extract witness for $x$.
Zero-knowledgeness: There exists a polynomial-time simulator $M$, which on input $x$ and
a random $t$, outputs an accepting conversation of the form     $(m_1,t,m_2)$, with the same probability distribution as conversations between the honest $(P,V)$ on input $x$

Assume, there exists a sigma protocol for language $L$ and consider $n$ instances $(x_1,x_2,x_3,.....x_n) \in L$.  Consider, prover has $n$ instances of $(x_1,x_2,x_3,.....x_n) \in L$ and witness $w_i$ for only one  $x_i \in L$. Can we construct a sigma protocol to prove that that atleast one $x_i \in L$ out of $n$ instances?


texts: A block cipher with independent keys for each round

texts:
I want to modify a standard block cipher in the following way. I replace each round key by a key picked at random. Is this block cipher as secure as the original one ?

Thank you.

EDIT

Some missing information related to the question, according to comment by OP to one of the answers:

  My question is related to the key-schedule of AES, I wonder if we can replace it by something more stringent and be sure that the security will not be not worst than the original one.


texts: Faster alternatives to RSA trapdoor permutation

texts:
We're working on web3.0 decentralized internet, a big part of which is a decentralized file storage system where clients upload files to storage providers and pay them for the services. Storage providers return signed messages, with the content hashes included, as guarantees, such that if they lose the file and fail to respond to a verification challenge on the blockchain, by not being able to provide the proof they're still storing the file, they will lose their collateral.
Clients upload files to several storage providers at once for redundancy. We needed to make sure that providers can't collude with each other/one provider can't misrepresent itself as being several and take payments for N copies of the file, getting away with storing only one copy. At the same time, the original file contents should always be available to storage providers, since they're supposed to publicly serve it on the network by responding to requests for the content based on its hash. This means encrypting several copies with AES
The solution I initially came up with is to use pure RSA (not hybrid) algorithm in signature mode, i.e. when you encrypt with the private key, and decrypt with the public key (or, more precisely, sign a message with a private key, and recover the message from the signature using the complement of that, but the math is the same as encryption/decryption, just with swapped keys). That way:

A client can generate one key pair per provider
When storing file F with the provider N, it can generate an "encrypted" replica of F (a signature containing the message) specific to that provider, by performing F_N = RSASign(F, k_priv_N), and sending the public key k_pub_N to the provider
Provider signs the guarantee on the Hash(F_N), promising to store the encrypted copy
Provider can at any point extract the content by performing F = RSARecover(F_N, k_pub_N) which is analogous to feeding the public key to a decryption algorithm, calculate the real hash Hash(F), and serve this file on the DHT network
However, all providers, even if they wanted to collude, must continue to store individual encrypted copies/signatures F_N because each signed off on their specific Hash(F_N). There is no way to lose the F_N, deliberately or accidentally, and then recreate it on demand just by having F and k_pub_N, because that would require knowledge of the private key (which also explains why RSA must be in pure mode, and not in hybrid node, because performing AES encryption on provider side is trivial given the symmetric key, and they could get away with having to store just the RSA signature on top of the symmetric key, which is much smaller in size).

This works well, but we've ran into a few problems with this approach:

RSA in pure mode is extremely slow
Using proper padding for each block reduces the space we can use for embedding the file chunks, and therefore the resulting files are many percent bigger than the originals

Q: Are there any other similar cryptographic functions we can use for this case, which are superior to the RSA scheme in speed and size?
(For example, we've been looking at elliptic curves but there doesn't seem to be a way to extract the message, or even hash of the message, which would have also been helpful, from an EC signature.)


texts: Why is plain-hash-then-encrypt not a secure MAC?

texts:
It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why?

Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as the MAC-then-encrypted version of the message? Assuming no bad relations between $Encrypt$ and $H$, what are the possible weaknesses? It seems that in this case we are encrypting the hash with part of a secretly keyed stream cipher keystream, and the hash is secure; does this not fulfil an approximation of the ideal MAC?

This must be somehow bad, since no secure protocol seems to use it. Why?


texts: HMAC vs PKDBF2 as the first step towards HKDF

texts:
I'm implementing an application that from a password has to derive two keys, one for authentication with the server, one for encryption. I'm using Java, with JCA and Bouncy Castle.

So far, to generate a key from the password I was using PBKDF2, like this:

SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA512", BC);
PBEKeySpec keySpec = new PBEKeySpec(password.toCharArray(), salt, iterations, keyLength);
SecretKey passwordKey = secretKeyFactory.generateSecret(keySpec);

but in the two examples I found of HKDF:

https://github.com/WhisperSystems/libsignal-protocol-java/blob/master/java/src/main/java/org/whispersystems/libsignal/kdf/HKDF.java
https://www.javatips.net/api/keywhiz-master/hkdf/src/main/java/keywhiz/hkdf/Hkdf.java

they start with HmacSHA256, not PBKDF2. Why is that? What are the pros and cons of these two algorithms in this case?


texts:
I need to use NIST SP 800-22 approved software / hardware to generate RSA key pair.

Where I can find a list of certified software / hardware RNGs compliant to NIST SP 800-22?

And how is the SP 800-22 related to FIPS 186-x? If I generate RSA key pair with approved software compliant to FIPS 186-x, does it mean that it is also compliant to SP 800-22?


texts: How do I multiply a Twisted Edwards point in Montgomery space?

texts:
EdDSA (and ed25519) signatures require a scalar multiplication.  Currently, I do this directly in Twisted Edwards space.  (The code can be found in my crypto library.)  My research and my tests suggest it would be quite a bit faster to do that multiplication in Montgomery space instead.  This would mean 4 steps:

Convert the Twisted Edwards point to Montgomery space.
Perform the Montgomery ladder.
Recover the Y coordinate.
Convert back to Twisted Edwards space.

Steps 1, 2, and 4 seem pretty simple (even straightforward).  Step 3 is more complex, but is documented in this paper, which I have followed.  Here is my attempt, which unfortunately gives the wrong result:

typedef i32 fe[10]
typedef struct { fe X; fe Y; fe Z; fe T; } ge;

sv ge_scalarmult(ge *p, const ge *q, const u8 scalar[32])
{
    // convert q to montgomery format
    fe x1, y1, z1, x2, z2, x3, z3, t1, t2, t3, t4;
    fe_sub(z1, q->Z, q->Y);  fe_mul(z1, z1, q->X);  fe_invert(z1, z1);
    fe_add(t1, q->Z, q->Y);
    fe_mul(x1, q->X, t1  );  fe_mul(x1, x1, z1);
    fe_mul(y1, q->Z, t1  );  fe_mul(y1, y1, z1);
    fe_1(z1); // coherence

    // montgomery scalarmult
    // The same ladder is used for x25519,
    // it comes from the ref10 implementation.
    // Field elements are modified in-place
    x25519_ladder(x1, x2, z2, x3, z3, scalar);

    // recover the y1 coordinate
    fe_mul(t1, x1, z2);  // t1 = x1 * z2
    fe_add(t2, x2, t1);  // t2 = x2 + t1
    fe_sub(t3, x2, t1);  // t3 = x2 − t1
    fe_sq (t3, t3);      // t3 = t3^2
    fe_mul(t3, t3, x3);  // t3 = t3 * x3
    fe_mul973324(t1, z2);// t1 = 2a * z2
    fe_add(t2, t2, t1);  // t2 = t2 + t1
    fe_mul(t4, x1, x2);  // t4 = x1 * x2
    fe_add(t4, t4, z2);  // t4 = t4 + z2
    fe_mul(t2, t2, t4);  // t2 = t2 * t4
    fe_mul(t1, t1, z2);  // t1 = t1 * z2
    fe_sub(t2, t2, t1);  // t2 = t2 − t1
    fe_mul(t2, t2, z3);  // t2 = t2 * z3
    fe_add(t1, y1, y1);  // t1 = y1 + y1
    fe_mul(t1, t1, z2);  // t1 = t1 * z2
    fe_mul(t1, t1, z3);  // t1 = t1 * z3
    fe_mul(x1, t1, x2);  // x1 = t1 * x2
    fe_sub(y1, t2, t3);  // y1 = t2 − t3
    fe_mul(z1, t1, z2);  // z1 = t1 * z2

    // convert back to twisted edwards
    fe_sub(t1  , x1, z1);
    fe_add(t2  , x1, z1);
    fe_mul(p->X, x1, t2);
    fe_mul(p->Y, y1, t1);
    fe_mul(p->Z, y1, t2);
    fe_mul(p->T, x1, t1);
}

Can someone tell me what I did wrong?


texts: Multi-Party Encryption for a Shared Document

texts:
Is there an encryption algorithm/protocol where any of a pre-defined set of keys/passwords will succeed in decrypting a document? The number of keys can be fixed, say, 10 or 20 possible passwords.

The context is a single application (with a single embedded document), with no server-side component. It should be shareable amongst users, where any password, within a pre-defined set of passwords, will succeed in gaining access (decrypting the document).

EDIT: In thinking about this, can I append a (symmetrically) encrypted key to the document, where the password to decrypt this is a user's password? I.e. for each user, append the master-key after encrypting it with the users password. I'm not sure what algorithm is appropriate here, or whether this is at all secure.

Disclaimer: I'm fairly new to cryptography beyond the basic concepts and implementations - I don't know the terminology very well, and therefore I was unable to find a similar question posted.


texts:
Given $a, p$, $c$ where $c = a b + e \mod p$, can $e$ be recovered?

Additional details:

$p$ is prime
$a, p$ are re-used across many instances of the problem
$b, e$ (and by extension $c$) are always unique for each instance of the problem
$a, p$ are about 783 bits, with $a$ being smaller then $p$ by a no more then a few bits
$b, e$ are uniformly random 256-bit integers

What I have tried:

If the problem was not done modulo $p$, but was over integers, then it would be a simple matter of performing $c \mod b$ to obtain $e$.
The modular inverse of $a$ is about the same size as $a$, otherwise we could do $a_i c \equiv b + a_i e \mod p$ followed by $\mod p_i$ to recover $b$.
I noticed that:

$a b \equiv p - b(p - a) \mod p$ which lead me to this little
algorithm:

$x = p - a\\
     b = c / x\\
     e = c \mod x\\
     y = x q + e \mod p\\
     y \equiv c\\
     y = c - e - 1\\
     b = (y * inverse(a, p)) \mod N\\
     output\ b, e$

but for whatever reason, this only seems to function when $p=65537$ and $a=256$.

Applying the above algorithm to a random instance of $a$ for the actual $p$ does not output $b, e$ correctly.
If $b, e$ were the same size as $a$, I'm pretty sure it would be information theoretically secure.
Since $b, e$ are smaller, it makes me think there is leakage somehow.
Since $a b \mod p$ is about 783 bits in size and $e$ is only about 256 bits in size, then much of the upper bits of $a b + e \mod p$ are equal to the upper bits of $p q \mod p$.

I don't know how to take exploit this information.

The answer might be obviously simple, but I just haven't been able to figure it out for a few weeks.

Here is a gist with python code for what I am attempting to break.


texts: What's the purpose of secret message numbers in CAESAR ciphers?

texts:
The CAESAR call for submissions specifies that ciphers may accept as a parameter a secret message number. The requirements are that:

It must be possible to recover the plaintext and the secret message number from the ciphertext, associated data, public message number, and key;
Ciphers may impose single-use requirements on the secret message number, but can't otherwise assume any specific generation scheme (e.g., counter or random selection);
Ciphers must provide authenticity and confidentiality for the secret message number.

While this is quite clear about the requirements, I'm still at a loss at the purpose.  What uses or features do such secret message numbers enable?  Are there generic benefits to having such a message number, or is it something that individual ciphers would exploit for different ends?

Answers to the following older questions suggest that they may be used to provide some sort of nonce-reuse resistance or "hybrid encryption," but don't explain those scenarios in depth:

Single-algorithm authenticated encryption
What do associated data and message numbers mean?

And scanning through the third-round candidates' submissions doesn't shed a lot of light either—most of them don't support secret message numbers, and the one or two that did provide it as an optional feature


texts: Why Rabin fingerprints assumes data is prefixed with a "1" bit?

texts:
(I know that a Rabin fingerprint is not a cryptographic hash, sorry in advance if my question is considered out of topic)

In the paper Some applications of Rabin's fingerprinting method, it is written that implementations should prefix the data to hash by a '1' value.

Does anybody know why?


texts: Usage of Zero-knowledge proofs for NP-complete languages

texts:
It is well known that if OWFs/PRGs exist, then there is a zero knowledge proof for any NP-complete language, say G3C (graph coloring in 3 colors). The zero-knowledge notion maintains that any malicious verifier that interacts with the prover can be simulated by a PPT algorithm (including the communication) and thus, doesn't gain any advantage from the prover's replies.

Yet, if a PPT algorithm can find a coloring in a graph with non-negligible probability (even without interacting with a prover), then the whole notion of zero-knowledge proofs for NP-Complete languages becomes useless!

Is there a distribution over graphs that enables generating graphs for which no PPT algorithm can find a 3-coloring in non-negligible probability?? (under the assumptions of P!=NP and OWF & PRGs exist). Or a distribution over graphs that enables generating graphs for which no PPT algorithm can determine if they are in G3C or not with non-negligible advantage?
 Otherwise I can't see how such a ZK proof can be beneficial.


texts: I've been reading a bit about cryptographic protocols and I keep seeing the phrase "rewinding argument". I've been unable to find a good source that would explain what is meant by this. It seems like proofs that use this technique cause trouble against active adversaries? I would appreciate if someone would explain what a rewinding argument is and why this is the case.


texts: A hash functin based on XOR and matrix multiplication

texts:
Imagine an $n$ bit to $n$ bit hash function defined as follows: Let $K$ and $K'$ be two random predetermined $n\times n$ matrices. Then the hash function $h$ of an $n$ bit number $a$ would be:

$$h(a)=K\cdot a\oplus K'\cdot \bar{a}$$

Note that addition in matrix multiplication is done on one bit, so it's equivalent to $\oplus$ operation, Now my question is that if this function is reversible.


texts: I would like a multiparty protocol, secure in the honest-but-curious model at least, but hopefully other situations as well, that can do the following: every party among $\{P_1, P_2, \ldots P_n\}$ puts in a value $v_i$, and the set of $v_i$'s is computed, in such a way that no one knows which party contributed which $v_i$. In the real world this can be done by putting folded slips of paper into a hat, but I cannot come up with a good search term. References are most appreciated.


texts: set of integers modulo an integer q in lattice

texts: Some literature about lattices set $\mathbb{Z}_{q}$ in $[-\frac{q}{2}, \frac{q}{2})\cap \mathbb{Z}$ but not $[0,q-1]$ such as "lattice signatures without trapdoors" and "lattice based  blind signatures", I don't know the reason. Thank you for explain the reason for me if you know it.


texts:
I have the following problem:
There are $n$ users and each users fills in three data points per day, this are three integers between say $-10$ and $10$. I have access to the database and hence I am able to modify this data. However, I want to "sign" the data.

How can this be done in such a way that I am unable to change the data without that this can be detected? The users login, so I do have the md5 hash of their password, could I use this in any way to sign the data?

It should also not be possible preferably that I delete everything, change a couple of values and generate the "checks" again.

The threat: Let me make an analogy to what can be the threat (my case is more abstract). Say that people with a schizophrenia would give every day a number about "how psychotic" they are. On the basis of long-term data there could be made conclusions about "how severe" the case is. The users might claim that there has been messed with the data to make their case look more severe (say because of conflict of interest with pharmaceutical companies).


texts: I am very interested in cryptography and would like to learn more about it and how to code. However, I dont know how to start. I would love to know some more mathematical background and how to apply it. I enjoy creating little codes and such in my free time, but there is a limit to what you can just "think up". I honestly dont know what alot of these things such as 'AES-GCM' or 'md5'. I dont know where to start or where to apply cryptography in my life besides for fun. Any advice would be appreciated! Thanks!


texts: What are the theoretical memory requirements for these factoring algotihms?

texts:
Given an $n$ bit integer quadratic sieve takes $L(\frac12,1+o(1))$ time and number field sieve takes $L(\frac13,1.922)$ time where $L$ notation is given in https://en.wikipedia.org/wiki/L-notation.

What are the theoretical memory requirements for these two sieving techniques, specifically for the relation collection and the sparse matrix inversion stages?


texts: How are old encrypted messages recovered for the sender?

texts: Take ProtonMail as an example. It encrypts all emails with some kind of asymmetric keys. But obviously, they can't store my private so the key must be obtained when I log in. This means, they must be able to generate the same key multiple times. I thought they used my password to deterministically generate the keys, but then I changed my password and I was still able to open my old emails. How is that possible?


texts: Reason why “XOR” is a linear operation, but ordinary “addition” isn’t?

texts:
I'm new in cryptography and try to read some articles in this field.
Many of these articles talk about non-linear S-boxes, and nothing more on what they mean by their non-linearity.

I have a simple question which I think will guide me through my problem:

why  is the XOR operation is linear, but ordinary adding (+) not‽
what is the definition of linearity?


texts: Signature scheme with two private keys, neither derivable from the other

texts:
Is there any scheme, ideally one widely used or at least widely available, where you can treat both the signing and verifying keys as secret?

Basically, the functionality I'm looking for is this:

You derive two keys, $S$ and $V$.
$S$ cannot be derived from $V$, nor can $V$ be derived from $S$.
A signature can be made with only $S$ and verified with only $V$.
$S$ has no special structure. That is, it is not easy to tell if a given string is a valid $S$ or not.

The intended application is authentication. The idea is that either the user or the server would generate the two keys. The server would store $V$, and either the user or the server would store $S$ encrypted with a passphrase. An attacker with only the encrypted $S$ would not be able to launch an offline attack to decrypt it because he'd have no way to tell if his decryption was valid other than asking the server. And, if the server was compromised, an attacker still couldn't impersonate a client because he can't derive $S$ without breaking the passphrase.


texts: Why does decryption fail after modification of the ciphertext for RSA with OAEP padding

texts:
I have ciphertext which was encrypted using RSA with "OAEPWithMD5AndMGF1Padding" - i.e. OAEP using MD5 for the Mask Generation Function.

I understand the general idea of how the randomized padding works, but I'm not completely sure why the decryption process completely fails if I change one byte of the ciphertext. How does the algorithm spot that there were changes and why does it not return some random plain text?

For demonstration purposes, here is my code in Java:

        int              ilgis = 0;
        BigInteger       ct = new BigInteger("2D9487AA09DBE708084A97CC466A7CB2CAE2E00100D11FF8C79CF0568858F91E2A5CFC8FD3007F530FC12695870F", 16);
        byte[]           inputBytes = ct.toByteArray();
        SecureRandom     random = new SecureRandom();
        Cipher           cipher = Cipher.getInstance("RSA/None/OAEPWithMD5AndMGF1Padding", "BC");
        KeyFactory       keyFactory = KeyFactory.getInstance("RSA", "BC");

        RSAPublicKeySpec pubKeySpec = new RSAPublicKeySpec(
                new BigInteger("00A17DE2DBF5C2C68AF8EA044547670D3C8E2F4F9693804B7EC6FBCA5F09D0ABF85A73DB4DFC8FFF0EADF9B040375D", 16),
                new BigInteger("03", 16));
        RSAPrivateKeySpec privKeySpec = new RSAPrivateKeySpec(
                new BigInteger("00A17DE2DBF5C2C68AF8EA044547670D3C8E2F4F9693804B7EC6FBCA5F09D0ABF85A73DB4DFC8FFF0EADF9B040375D", 16),
                new BigInteger("6BA941E7F92C845CA5F1582E2F9A08D30974DFB9B7AADBEF595662C4E29DD76FDEDF48F5CBBD4ED2E961355F2013", 16));

        RSAPublicKey pubKey = (RSAPublicKey)keyFactory.generatePublic(pubKeySpec);
        RSAPrivateKey privKey = (RSAPrivateKey)keyFactory.generatePrivate(privKeySpec);

        System.out.println("Ciphertext: " + toHex(inputBytes, inputBytes.length));
        cipher.init(Cipher.DECRYPT_MODE, privKey, random);
        byte[] plainText = new byte[cipher.getOutputSize(inputBytes.length)];

        ilgis += cipher.doFinal(inputBytes, 0, inputBytes.length, plainText, 0);
        System.out.println("Plain text : " + toHex(plainText, ilgis) + " length: " + ilgis);
```


texts: How re-encryption can be done through RSA

texts:
Both RSA and Elgamal have homomorphic properties. So both can re-encrypt the ciphertext. Re-encryption with Elgamal works as seen here.

How does re-encryption work using RSA?

What modification / addition is needed to transform simple RSA to RSA with re-encryption?

The keys for RSA:

Public key: $e$ & $n$

Private key: $d$

Encryption: $C=M^e \bmod n$

Decryption: $M=C^d \bmod n$

I read this answer and it's very similar to what I am looking for. But I have practically a few limitations (as it is textbook RSA, and I have security flaws).
I have an arbitrary length (large) plaintext. I want to encrypt it with RSA. I want to re-encrypt the ciphertext (independently and multiple times). Also I don't understand this formatted plaintexts in this question.

Is there a practical scheme / implementation available?

What changes are there needed in RSA to re-encrypt a ciphertext without compromising security?


texts: Construct another ciphertext that decrypts to same message without knowing key in Elgamal

texts:
I read about ElGamal from various resources and I was wondering if the following is true. Would appreciate if you could elaborate on it so I can understand better:

Is it possible to construct, given an encrypted message $c_1=E(m)$, another encrypted ciphertext $c_2$ that will be decrypted to the same message without knowing the key that was used for the encryption? I mean to create a $D(c_2)=m$ where $c_1 \neq c_2$

I am asking this because ElGamal from what I understand, this cryptosystem is not defined as injective because the results of the encryption depend on some random value.

To elaborate further on my thoughts: I think that ElGamal is not deterministic in the way each message can have several legal encryptions: for each of the $p-1$ of $k$, there would be a different encryption, but of course, the decryption will be reliable and return the same decrypted message: it will return the same $x$ without dependency on chosen $k$. So basically,

$x\bmod p = x\cdot b^k\cdot (b^k)^{-1}$ but $ x\cdot b^k =y_2$ and

$(b^k)^{-1} = (\alpha^{k\cdot a})^{-1}$, and $(y_1^\alpha)^{-1}=(\alpha^{k\cdot a})^{-1}$.

So we get $x \bmod p =(y_2)(y_1^\alpha)$. Basically to encrypt we only need $(p,\alpha,b)$ and to decrypt we need the private key $a$.

I would very much appreciate understanding this.


texts: Is there any code available online for CHA-1?

texts:
Is there any code available online for the chaos-based hash algorithm CHA-1?
I am trying to apply the methodology of this paper to blockchain applications.


texts: Building large S-Boxes from smaller ones

texts:
I would like to make an exhaustive list of all relevant techniques that have been studied in order to build a large S-Box from smaller ones.
As far as I known, three structures are usually preferred:

The Lai-Massey construction (used to design the IDEA block cipher)
Feistel networks (used to build $2n$-bit permutations from $n$-bit permutations)
MISTY networks (initially combines an $(n-1)$-bit S-Box with an $(n+1)$-bit one in this document)

Notably, this publication analyzes pros and cons of using either Feistel or MISTY networks to build 8-bit S-Boxes.

Are there any other relevant techniques to design large S-Boxes from smaller ones?


texts:
I'm using Java to generate encrypted strings, and I get this warning at build time:

  ECB encryption mode should not be used

So I'm wondering why I shouldn't use ECB and what I can use instead?


texts:
The Wikipedia entry Fair exchange has only two lines, and the only paper I can find describing such a protocol is extremely complicated.

Is this a new field in cryptology or can someone give an example of actual use or provide a simple implementation?


texts: Embedding a secret private key in a homomorphic encryption system

texts:
Is there a way to create a homomorphic encryption function F such that given an input it would produce an output and also cryptographically sign the input and output? More formally, an F such that: F(x, S) = y | sig(x | y), where:

x is the input
S is an optional publicly known "helper" state
y is an output of some computation
| is concatenation
sig(x | y) is a signature of x and y, with a secret private key
Anyone can verify the signature according to the public key, but no one knows the private key, and therefore no one can generate the signature without running F. Hence the signature proves the correctness of y for the given x.

Optionally, the state S can be created in an initialization phase using a secure multi party computation (MPC), so the parties could figure out the private key but only if they all collude.

The idea is that given some x, someone could run F(x) and then give { x, y, sig(x | y) } to verifiers, proving the computation was done correctly without needing the verifiers to run the computation themselves.


texts: Difference between computational complexities in General Number Field Sieve

texts:
I'm told that General Number Field Sieve works with computational complexity $e^{\sqrt[3]{\frac{64}{9}+o(1)}\;(\ln n)^{\frac{1}{3}}\;(\ln\ln n)^{\frac{2}{3}}}$. However, without some computation work it should run with computational complexity $e^{\sqrt[3]{3+o(1)}\;(\ln n)^{\frac{1}{3}}\;(\ln\ln n)^{\frac{2}{3}}}$.

This does not seem to be as a big difference but according to the following table it is:

How can be the difference so huge if only a constant changes?


texts: Is there a crypto system doing sqrt during encryption?

texts:
This is a theoretical question to solve an argument with a friend..

Is there a working cryptographic system that do square root operations during the encryption process?

"Working" means that it is really implemented, and not just an academic research.

Hint: I suspect that it is not possible as computer hardware has floating point limitations as it is based on binary, causing infinitely small numbers to truncate, hence doing sqrt during encryption loses information, and cannot be undone during the decryption.

Please help me win the bet :)


texts:
I am developing a network where potentially many many nodes (billions, in principle?) should be able to agree on a random number. I would really prefer to avoid $O(N^2)$ procedures where everyone contributes with some randomness and then everything is shuffled together. So I am looking for a random beacon.

I would also prefer to avoid random beacons generated from $O(N^2)$ sources, like Bitcoin. So I wonder: is there a random beacon that is:

Unpredictable
Universally verifiable
Impossible to pilot (i.e., no organization, no matter how powerful, could alter its values or predict them)

I don't really care about its bitrate (if it produces just a few random bits per hour, so be it).

Here are some solutions I thought about (but they don't seem very feasible):

Solar flares: their occurrence is random, and they interfere with VLF communications. But their time is not so narrowly defined, and their occurrence is really rare, in then order of once a week. Also this requires everyone to have an antenna. And maybe an attacker might interfere itself with VLF transmitters.
Lightnings: they strike much more often, but their signal can be detected (also with VLF antennas) only maybe a few thousands kilometers from the lightning. So it wouldn't be global.
Earthquakes: detectable everywhere, but again, not such a precise time definition, and requires a very sophisticated instrumentation.
Random beacon satellite: we could send a cubesat in orbit to generate random numbers and broadcast them down to Earth. I could add proximity sensors or accelerometers so that any approach results in terminated communications to prevent tampering. This would also be great because I would only need a receiver station and then the numbers could be broadcasted via the Internet. But maybe a motivated enough organization could find a way to... I don't know, tamper with it so as alter its behavior? Even in space?
Same as above, but with an hidden verifier that knows the satellite seed and is able to check that the numbers are correct, and is always silent and undetectable. But then, how do I hide it? Without a human that can be tortured or whatever and disclose its position? Also this wouldn't protect the satellite from having its seed copied. And how would I go about maintenance for the hidden verifier?
One that might also work: VLF receivers tuned on encrypted shore-to-submarine transmissions of multiple nuclear powers. Transmissions can be received basically anywhere in the world, but being encrypted I guess they can be used as a more than decent source of randomness? Obviously a nuclear power could send gibberish to its submarines to make its beacon non-random, but if I use multiple sources then multiple nuclear powers should agree to at the same time jam their own communications with their nuclear submarines... while also letting every other nuclear power know about it, since they should coordinate! Quite unlikely. Might this work? But (sigh) it requires everyone to have a VLF antenna.

Here is where I stop. Any more sensible solution?


texts: A Simple Provably Secure Key Exchange Scheme Based on the LWE

texts:
In this paper (A simple provably secure key exchange by Ding et al.), I am trying to understand the correctness (which is given on page number 8) of the key exchange technique based on LWE.

To understand the correctness of the scheme, there is a very important lemma (on page number 6). The lemma is as follows:

  Lemma 2. Let $q>8$ be an odd integer, the function $E$ defined above is a robust extractor with respect to $S$ with error tolerance $\frac{q}{4}-2$.

I'm confused by the proof of Lemma 2:

How does the author derive the condition that Lemma 2 is true for $q\gt 8$?
How does $|y+ \sigma$ $\frac{(q-1)}{2} \mod q| \le \frac{q}{4}+1$?
At the end of the proof of Lemma 2, the author writes that

  Our robust extractor enjoys a very nice property which says that for uniformly random $x\in$$
 \mathbb{Z} _q$, $E(x, \sigma$) is uniform in $\{0,1\}$ even conditioned on $\sigma$, where $\sigma \leftarrow S(x)$.

This property becomes Lemma 3 of this paper.

Can anyone  answer the above three questions and thus the proof of Lemma 2 and Lemma 3? Thanks!


texts: Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?

texts:
I am going to store secrets from users. The secrets need to be stored confidentially. For this question, I am concerned only with confidentiality (not integrity).

Here is how my encryption scheme is:

We start with a 20-character randomly generated alphanumeric password.
A new 128-bit salt is generated randomly for each user secret to be stored.
The 20-character password and the 128-bit salt is passed through a HMAC-SHA256-based PBKDF2 function to derive a new 256-bit encryption key for each user secret to be saved.
A new 128-bit initialization vector is generated for each user secret to be saved.
The 256-bit encryption key and the 128-bit initialization vector is used to perform AES-256-CBC encryption of the secret and arrive at the ciphertext.
The salt, initialization vector, and the resulting ciphertext are all saved together.

I want to know if in steps 2 and 3, is it necessary to run the password through PBKDF2 every time for every new secret to be protected?

Or can we just run the password through PBKDF2 only once and use that key for all secrets to be protected?

Is there any provable benefit of generating a different key (with PBKDF2) for each user secret even if we start with the same alphanumeric password every time?


texts:
Is there the way to generate new Koblitz curves, over $\mathbb F_{2^n}$ and $\mathbb F_p$?

The Certicom SEC 2 standard says:

  The recommended parameters associated with a Koblitz curve were chosen by repeatedly selecting parameters admitting an efficiently computable endomorphism until a prime order curve was found.

What does "efficiently computable endomorphism" mean? Maybe it means that trace of the Frobenius map should be equal 1? I am confused about all the Frobenius maps, endomorphisms, traces, etc.

So, is there the way to generate Koblitz curves, or find efficiently computable endomorphisms?


texts:
From what I know, the HMAC constructions has two strength:

It's resistant to length extensions
Since the key is consumed before the message, the attacker does not know the initial state, preventing simple collision attacks.

But the simple construction $ \mathrm{Hash}(\mathrm{Hash}(\mathrm{key} ∥ \mathrm{message})) $ would offer those properties too.

HMAC on the other hand uses the more complicated construction $ \mathrm{Hash}((\mathrm{key} ⊕ \mathrm{opad}) ∥ \mathrm{Hash}((\mathrm{key} ⊕ \mathrm{ipad}) ∥ \mathrm{message})) $. I assume the more complicated construction of HMAC is required for some security proof, but I don't immediately see why.

For SHA-3 candidates, Hash(key||message) is claimed to be secure, since they're resistant to length extensions, without consuming the key twice. I believe Skein even has some security proof for a very similar mode.

So why does HMAC need to inject the key twice?


texts: Why Boneh-Franklin BasicIdent IBE is not chosen-ciphertext secure? Why use random oracle?

texts:
I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example.
Moreover, I don't know random oracle and its usage for security analysis.


texts: Equal hashes for different messages when doing key length extension attack sha1

texts:
I was doing the cryptopals challenge 29, and I found something weird.
When I try to create a forged hash for a forged message I get always the same hash for different forged messages.

    def attack(self, hash, message, payload, oracle):
        for k in range(100):
            forged = self.glue_padding(b'a' * k + message)[k:] + payload
            ml = (k + len(forged)) * 8
            r = self.get_register(hash)
            sha1 = SHA1(payload, r, ml)
            forged_hash = sha1.digest()
            # SAME VALUE
            print(forged_hash)
            if oracle.validate(forged, forged_hash):
                print("[*] forged message : " + str(forged))
                return True
        return False

is this the normal behaviour?


texts: Is it possible to generate an infinite number of collisions given an infinite amount of strings?

texts: Let us assume that we have a string $w$ such that it belongs the set $C$, where every member of $C$ is not null, and contains every string of characters that can be permuted (numbers, letters etc.). For a secure crypto-hash function such as SHA-512, is it possible to generate an infinite amount of hash collisions given an unbounded amount of time and computation for every possible string $w$?


texts: Security guarantees of Shamir's secret sharing when some co-efficients are zero

texts:
Shamir secret sharing techniques rely on polynomials for splitting and reconstructing. It's security properties are very good, i.e. it is impossible to reconstruct the secret when $t-1$ shares are given.

The coefficient for the highest term of a polynomial should be non-zero.
But is it mandatory for other co-efficients of polynomials to be non-zero ?

Is there an impact to security guarantees when few co-efficients (other than the highest term) are zero ?


texts:
I'm a starter to cryptanalysis and in fact to cryptology. Last night I was decrypting a message from a book that I would quite odd. It doesn't make sense. The decrypted message is "Royal Flags Waves Kings Above".

This is what the book says:
"The plaintext message is a mnemonic to remember the turnover positions on the first five Enigma rotors."

My question is what the message means? What does it have to do with Enigma?


texts: ECB vs CBC for encrypting high entropy data

texts:
I have a master AES key and I need to encrypt other AES keys with this key. Is ECB safe to encrypt highly random data (a key)? What benefit would I get if I use CBC instead?

In particular, are the following methods secure, which one is more secure and why:

AES-ECB(random_data)
AES-CBC(random_data, iv = zero)
AES-CBC(random_data, iv = random)


texts: Given hash(x) and y, can I verify z = hash(x + y)?

texts:
Here's the problem I'm trying to solve:

y is public, it's a timestamp
there is A who knows x - it's a file
A can send B some information about the file (a hash?), but not the full file (it's too big)
A then sends the file x to C

The role of B now, is to periodically verify that at given time y C still has the file x. C could send something like hash(x, y) to B, and B (who doesn't have the full x) needs a way to verify that C indeed has the full file x at time y.

Here's the original question I've asked (it includes the solution approach I've been trying to take):

Say I only know hash(x) and y.

I receive z that is supposed to be hash(x + y)? Is there any way I can verify that without knowing x?

I'm interested in any mechanism that could make such check possible rather than particular hash and + operations.


texts:
I have been reading these slides about Hill cipher.

And there it says that the value of K is the following:

\begin{equation}
K=
\begin{pmatrix}
11&8\\3&7
\end{pmatrix}
\end{equation}

Now I need to calculate $K^{-1}$, so for that reason I calculate the adjoint matrix by using the cofactors. For what I know it should be:

\begin{pmatrix}
7&-3\\-8&11
\end{pmatrix}

but in the slides it appears that is:

\begin{pmatrix}
7&-8\\-3&11
\end{pmatrix}

which is different from the one I calculate, what am I doing wrong?


texts: Which stream cipher can we replace the RC4 in the SSL?

texts:
In cryptography, the Fluhrer, Mantin and Shamir attack is a particular stream cipher attack, a dedicated form of cryptanalysis for attacking the widely-used stream cipher RC4. The attack allows an attacker to recover the key in an RC4 encrypted stream from a large number of messages in that stream.
  The Fluhrer, Mantin and Shamir attack applies to specific key derivation methods, but does not apply to RC4-based SSL (TLS), since SSL generates the encryption keys it uses for RC4 by hashing, meaning that different SSL sessions have unrelated keys.

From here. Does it mean that RC4 is not so secure as we want? And which stream cipher can we replace the RC4 in the SSL?


texts: Why is it said that if we know few bits of pseudo random sequence we can predict the whole of it?

texts:
I am new to this cryptography and in the source from which i study it is said that if we know the first few bits of a pseudo random sequence we can predict the whole of it.How is it possible?
The source:http://www.youtube.com/watch?v=NjedHm04ETM
move to 7min 40sec and this is the source.


texts: How does the TLS cipher suite DHE-RSA-AES128-CCM8 work without hashing algorithm

texts:
I came across cipher suites without hashing algorithm, when inspecting the mbedTLS (previously Polar SSL) TLS cipher suite list.

For example:

TLS-DHE-RSA-WITH-AES-128-CCM-8 (OpenSSL: DHE-RSA-AES128-CCM8)
TLS-DHE-RSA-WITH-AES-256-CCM-8 (OpenSSL: DHE-RSA-AES256-CCM8)

As stated in other questions, the hashing algorithm has applications in TLS, even with AEAD ciphers/modes of operation.

How do these TLS cipher suites work without hashing algorithm and how do they compare to their counterparts with a hashing algorithm, considering the security?


texts: Shamir Interpolation Problem (Recovering secret with fewer parts than the threshold)

texts:
I'm studying about polynomials and interpolation with shamir secret sharing. I have some questions about it.

I found that there are always lower-degrees polynomials that intersects with 2 or more points (passing through 0) with another polynomial of degree at least 3 (in Zp).

Example: Supose a secret sharing scheme with threshold $5$, with the polynomial $x^4$ in $Z_{11}$ and the secret is $0$. Theoretically i could only recover the original polynomial and consequently the independent term (secret = $0$) if i have at least 5 points, right? However, if i combine correctly some shares $(x, f(x))$, i could recover another polynomial with the same independent term, and consequently, the secret. For example, instead of combining 5 points, i could combine the points $(1, 2, 8)$ with their evaluations and recover the polynomial $g(x) = 7x^2 + 5x + 0$. This gives to me the secret $0$.

Now supose all the polynomials $a_4x^4 + a_3x^3 + a_2x^2 + a_1x + a0$ where $\{a_4, a_3, a_2, a_1, a_0\} \in Z_{11}$.

All polynomials of degree 3, 4, ..., $n$ have this property. Some secrets could be recovered with 2, 3, ... points and others only with 2 or 3 or more points. Note that even using less points (2 or 3) its not monotonic.

Questions:

1 - Is it correct to say that there is some kind of "failure" of shamir secret sharing scheme because of this combination of points?

2 - Could i prove that there are always less degree polynomials that intersects with high degree polynomials in point 0 and another one in $Z_p$?

Edit: I've made some experiments.

I have picked all combinations $C^p_2$ and $C^p_3$ of $(x, (fx))$ to all polynomials $ a_3x^3 + a_2x^2 + a_1x + a0$ where  $\{a_3, a_2, a_1, a_0\} \in Z_{5}, Z_{7}$ and $a_3 > 0$. I can always recover the secret using less points than the threshold.

Thanks to everyone!


texts: How to make a "zero knowledge" cache/key-value store

texts:
I'd like to use a possibly insecure cache for storing expensive-to-calculate sensitive information. My requirements are:

If the cache ever gets compromised it should reveal nothing about its ids or values (except for the number of records/size of the database).
If both the client and the cache are compromised, but not (all of) the ids, then attackers should not be able to get access to values they do not know the id of.

What would be a simple secure way of accomplishing this? I've tried to create a scheme matching these requirements:

Each client has their own strong password $P$.
A per-id encryption key is derived from the password: $K = HMAC(P||"key", id)$.  (A HMAC with as key the password with the literal  key appended and the actual id as message)
The plain text value $V$ is encrypted using AES-CTR into ciphertext $C$: $C = AES-CTR(key=K, message=V)$
Instead of using plain ids, they are one-way hashed: $I = HMAC(P||"id", id)$
The combination of $(I, C)$ is then stored in the cache.

To get a value from the cache we calculate $I$ and use it to retrieve $C$. We then recalculate $K$ and use it to decrypt the message.

Would this scheme be secure? Or is there a better way of solving this problem?


texts: SPDZ- How to do secure less-than comparison

texts:
The SPDZ paper explains how the SPDZ protocol can be used to find the sum/product of secret values and find the sum/product of a secret and a non-secret value (page 6).

The paper seems to say that from this you can do any other operation. How would you use this to do secure less-than comparison?

The Bristol SPDZ implementation tutorial program (line 19) shows that their implementation has a way of securely comparing two secret values to get a secret result. How did they implement this? It doesn't seem to be in the paper.


texts:
This is a reprise of an earlier question of mine, and I'm sorry if it's repetitious; I'm going at it with a different strategy.

In an exercise I was given a 1-round Feistel network which uses $H(k \oplus x)$ as a round function. The key is 128 bits and the block length 256 bits, but we're asked to find the key in roughly $2^{64}$ work.

My intuition is the following. Since the hash takes inputs and outputs of size 128 bits, it seems likely that a collision resistant hash would be roughly 1-1, so we could expect that if we find $H(x) = H(x')$ then we would probably have $x = x'$. In roughly $2^{64}$ time, if I query the hash $2^{64}$ times on random inputs $x_i$ and query the round function $F(x) = H(k \oplus x)$ $2^{64}$ times on random inputs $y_i$, then I expect to have a collision in the hash owing to the "birthday attack" results, where $H(x_i) = F(y_j)$. But then by the earlier hash property, we expect $H(x_i) = H(k \oplus y_j)$ $ \implies x_i = k \oplus y_j$. This (probably) gives us the key, in $O(2^{64})$ time.

Am I correct? Is there a better analysis that makes more sense?


texts: How can a message encrypted with the public key be decrypted with the private key?

texts: I've been reading about encryption and have a basic understanding of the concept. What I don't understand, however, is how a calculation with one key can result in a number that, through calculation with a different key, leads back to the same number you started with. Are they doing the same calculation (what I mean by this is for example: first multiplying the number with the first key, then dividing it with the second one)? If anyone could in a simple way describe how this works to me; and add some examples with actual numbers in them as well perhaps; that'd be be wonderful.


texts: Is it safe to use the same IV for multiple encryptions in AES CBC mode when you are always encrypting random bytes?

texts:
I am generating random bytes (16 or 32 bytes at a time), and I want to encrypt them using a 128 bit AES key in CBC mode. Am I really weakening this horribly if I am reusing the same IV and key each time I encrypt a set of random bytes, given that there is no structure at all in the data I am encrypting?

We can add a nonce to our scheme and change the IV each time, I am just trying to understand why (if) it is really required when encrypting data with no structure?


texts: How to show that Cx is a commitment to a integer of length lm

texts:
With reference to Jan Camenisch and Anna Lysyanskaya's paper A Signature Scheme with Efficient Protocols, in proceedings of SCN 2002, I need some help to understand How to verify that $C_x$ is a commitment to an integer of length $l_m$.
$$C_x = g^x * h^r$$, where $x$ is the secret and  $r$ is the randomness; $g$ and $h$ are known parameters


texts: Friedman Index of Coincidence, pruning multiples of the keylength

texts:
I'm trying to write a Vigenere decipher script. I defined a couple of possible keylengths using the Kasiski method, using roughly this method:

find recurring strings in the ciphertext between 3 and 12 characters
make a list of the distances between them
loop through the list of distances and calculate the greatest common denominator between each distance[n] and distance[n+1]
count the GCDs and send the top 3 to the Friedman function

In the Friedman function:

For each of the GCDs (= possible keylengths) that my Kasiski function returns I calculate the IC, but sometimes a multiple of the keylength is closer to the standard English IC than the actual keylength. This is usually a difference of only 1-3%. Since I do not weigh them by the amount of times the keylength came out in the GCDs counter, it sometimes happens that for a key of 3 characters my function returns 6 as the most likely keylength.

My question is, should I:

Preserve the amount of times a GCD was established between two distances in the Kasiski function, weighing the outcome of the Friedman function with it  to prefer the most occurring GCD
In the Friedman function, check if a possible keylength is a multiple of another possible keylength, comparing the ICs and discarding the multiple if the difference is (for example) less than a few %
Both, neither, anything else?


texts: Why don’t all AES encryption tools produce the same key from the same password?

texts:
Alice and Bob meet regularly. They have agreed face-to-face a 128 bit password which they want use to encrypt/decrypt emails written between them.

They decide to use 256-bit AES. Alice wrote her message, but found that every AES 256 application she used to encrypt her text provided a different ciphertext. She could not therefore communicate with Bob without specifying the tool that had encrypted her text, and she couldn’t check that the tool was genuine by comparing it with others.

Why is there seemingly no standard algorithm?
Why is there no simple and trusted tool (e.g. a javascript file) that can be downloaded and used offline for this purpose?


texts:
Imagine the following scenario:

Select known data (known to several parties)
Mix data with secret key and generate SHA-1 hash
Mix SHA-1 hash with secret key and generate HMAC

The purpose is to verify the integrity of the data - to ensure that data has not been altered after the generation of the HMAC.

My question is:

Is there any weakness to using a SHA-1 hash rather than for example SHA-256 in this scenario?
Does the use of SHA-1 make it easier to for example extract the secret key compared to SHA-256?


texts: NTRUSign (considered broken) as a one or few time PQ signature scheme

texts:
As many know, original NTRUSign is considered broken as signatures leak information about the private key.

It takes a number of signatures to accomplish a break though, with the original break paper claiming a few hundred.

Could this signature scheme still be used as a one-time or few-time signature scheme? What would its security be in this case? The advantage over WOTS would be that it's faster.


texts: Encryption that could have multiple decryption key

texts:
The title looks strange but it is to deal with this situation.

The data we have should only be accessible by our end user and data administrators, not anyone else. Ideally, each user should have different encryption key.

Even with administrators, I wish only when two of them agrees, then they could access the data by join two pieces of the key. I could think of doing this by breaking up the key into two half, and each one of them holds half the key.

Is there such a cryptography can achieve this? So the file could be decrypted by more than one key. Or any other recommendations?


texts: RSA 3072 is 65,536 more difficult to factor than 2048?

texts:
If RSA 3072 is equal to 128 bit symmetric and 2048 is equal to 112 bit symmetric then 128-112= 16 and 2^16= 65,536. In that case wouldn't this make 3072 more future proof against quantum computers or does Shor's algorithm mean they will both be equally useless?

Also, how many bits of symmetric is RSA 4096 equal to?


texts:
I have a list of numbers. I will be calling a service(let's say accountant service) which is going to perform some operation on these list of numbers and will return me the final result number.

I don't want to pass my data in plain format. I want to encrypt numbers in such a way if service performs any arithmetic operation and return me the result, I will be able to decrypt it back with actual result.


texts: Let $n=pq$ be the RSA module and at least one of $p,q$ is a weak prime.It is proved that  the number of such $1024$bit $n$ is at least $2^{759}$. With lattices we can factor these $n$ in a second (I implemented it). Are you know the methods that  are more powerful than this method?


texts: Can not reproduce security estimates of Primal and Dual attack in Kyber round 3 specification

texts:
In Kyber round 3 specification, the table 4 gave the security estimates of Primal and Dual attack with respect to Kyber 512, 768 and 1024 (see the figure below). However, using the python script given in the paper (see the github, run Kyber.py), it seems that I cannot reproduce the same result (however the numbers are closed). The result I get by this script is:
Kyber512 (light):
--------------------
security:
Primal attacks uses block-size 406 and 486 samples; dim d=999
Primal & 486 & 406 & 118 & 107 & 84
Dual attacks uses block-size 403 and 512 samples; dim d=1024
shortest vector used has length l=3294.02, q=3329, `l<q'= 1
log2(epsilon) = -41.82, log2 nvector per run 83.63
Dual & 512 & 403 & 117 & 106 & 83
params:  {'n': 256, 'm': 2, 'ks': 3, 'ke': 3, 'ke_ct': 2, 'q': 3329, 'rqk': 4096, 'rqc': 1024, 'rq2': 16}
com costs:  (800.0, 768.0)
failure: 0.0 = 2^-139.1

Kyber768 (recommended):
--------------------
security:
Primal attacks uses block-size 626 and 650 samples; dim d=1419
Primal & 650 & 626 & 183 & 166 & 129
Dual attacks uses block-size 620 and 650 samples; dim d=1418
shortest vector used has length l=5003.21, q=3329, `l<q'= 0
log2(epsilon) = -64.32, log2 nvector per run 128.66
Dual & 650 & 620 & 181 & 164 & 128
params:  {'n': 256, 'm': 3, 'ks': 2, 'ke': 2, 'ke_ct': 2, 'q': 3329, 'rqk': 4096, 'rqc': 1024, 'rq2': 16}
com costs:  (1184.0, 1088.0)
failure: 0.0 = 2^-165.2

Kyber1024 (paranoid):
--------------------
security:
Primal attacks uses block-size 878 and 860 samples; dim d=1885
Primal & 860 & 878 & 256 & 232 & 182
Dual attacks uses block-size 868 and 838 samples; dim d=1862
shortest vector used has length l=5920.11, q=3329, `l<q'= 0
log2(epsilon) = -90.06, log2 nvector per run 180.13
Dual & 838 & 868 & 253 & 230 & 180
params:  {'n': 256, 'm': 4, 'ks': 2, 'ke': 2, 'ke_ct': 2, 'q': 3329, 'rqk': 4096, 'rqc': 2048, 'rq2': 32}
com costs:  (1568.0, 1568.0)
failure: 0.0 = 2^-175.2


texts:
I am implementing support for TLS 1.2 for the IBM mainframe operating system z/VSE in Assembler language, but am having difficultly getting the PRF to work. I am validating with the values described in:
https://www.ietf.org/mail-archive/web/tls/current/msg03416.html
The first 32 bytes of my output are correct using this test case.
After the first 32 bytes I place the HMAC-256 32 bytes into a buffer and call the HMAC-256 again with the same secret. Is that correct or should I be concatenating the label and/or original seed date onto the first HMAC output?


texts: How much is slower GCM AES-128 than one of the stream chipher eSTREAM?

texts: Evaluate the speed of the algorithm GCM AES-128 and compare it whith speed of one of the stream chipher in eSTREAM. Can someone give such an assessment?


texts: How to construct a "toy" version of Gimli permutation for three (instead of twelve) 32-bit words?

texts: I am interested to see a "toy" version of the Gimli permutation for three (instead of twelve) 32-bit words. I see that the "core" sub-permutation of Gimli operates on three 32-bit words, but I don't know how to use it for constructing a 96-bit unkeyed permutation. Is it possible to modify the Gimli algorithm to devise such a function? If yes, how?


texts:
We have an application which embeds NTLMv2 password hashes into its configuration.  In attempting to assess the security of this practice, I'm not finding much straightforward information about how an NTLMv2 hashed password is generated or shared (used) between a client and server.
As far as I can tell, part of the hash is used to initialize a Diffie Hellman key exchange.  In a sense, this makes it an equivalent to an ssh private key.  The big differences (setting off warning flags in my mind!) are that the account password is required to generate the hash and that the hash is generated on the server.  The password and hash appear somehow linked.
This raises a few concerns:

If the NTLMv2 hash is compromised, is there anything to stop it from being used by another user or host?  If not, this would be in line with an ssh private key.
Given only the NTLMv2 hashed password, is it possible to recover the original password in any practical manner?


texts: Inversion Free Direct Conversion between Twisted Edwards (X,Y,Z) and Montgomery (X,Z)

texts:
The Wikipedia page for Montgomery curves shows how to convert points on a twisted Edwards curve to and from points on an equivalent Montgomery curve. However, their description and the original twisted Edwards curve paper use affine coordinates for the conversion.

Is it possible to convert directly from projective twisted Edwards coordinates (X,Y,Z) to projective Montgomery coordinates (X,Z) and back without expensive inversions in the underlying field $\mathbb{F}_p$? Does anybody know explicit formulas for this or a method on how to produce the projective equivalent of the description found on Wikipedia?

The ultimate goal is to convert to Montgomery points with as little cost as possible, do the scalar multiplication using cheap Montgomery arithmetic and at the end convert the point back to twisted Edwards coordinates.


texts: How can an amateur introduce a cryptographic algorithm?

texts:
I have a new cipher, and I want to get it properly vetted, but I don't have a strong way to prove its security properties.  I'm an amateur without ties to a strong cryptographer/university.  I have attempted a few indistinguishability proofs, but these are "back of the napkin" proofs and are likely not rigorous.  (I have colleagues that have done cryptanalysis on it, but they are not theorem types.)

As a result, I feel that I don't stand a chance of getting it published without a proof of security, but I feel that I can't find someone to help without it being published.

How can I find someone willing to join on and help write a compelling proof, and generally help write a compelling paper, (or identify a weakness that prevents me from doing something stupid with the cipher)?

Given that I have done these things:

Review previous ciphers, find they're not what you want, invent new cipher
Internally analyze it (plots, prototype code, etc.)
Socialize it to cryptanalyst peers, get tentative green light (rather, absence of red light - no new findings in a while)

Is this a reasonable path going forward:

Brief it at an IACR rump session
Have follow-on discussions at conference, express my need, find someone that way
Submit as a work-in-progress in lower tier, but bonafide crypto conference
Submit as a journal article

Is a rump session a good way to go to find interested math types, and/or as a first step to announcing the idea?  Are there other alternatives, such as quarterly meetings of some group that might be willing to hear the idea?

Similarly, is there a good "starter conference" for crypto open to new ideas that might lack the mathematical rigor?

In contrast to this thread, How to publish a cipher (concept), the main answer suggests that formalisms are a prerequisite to publishing: "If you submit a cipher, one would expect at least a formal analysis of why you think this is a good idea."  My question is what if you don't have that ability - how do you find someone that can help with that?  The rest of the answers on the thread went into how to make it into a bachelor's thesis.

In additional defense of this thread, there are many great suggestions that don't appear on that other post.  While I'm biased - but have nothing to gain - these threads are unique.  I'm okay with marking as duplicate as long as somehow you can merge the useful answers below into the other question.


texts: Finding the cycle set of specific polynomial

texts:
I have a school assignment where the problem lies in finding the cycle set of two different polynomials.

I tried to look up different tools on how to solve these problems, but I have a hard time finding it.

If anyone were so kind to help me, solve but also, understand the way to figuring things like this out.

The problem states:

Determine the cycle set for these polynomials:

$x^4 + x^2 + 1$ over $F_2$.

$x^3 + x + 1$ over $F_3$.

Thanks!


texts: Combining algorithms for password storage?

texts:
Is it more secure to combine algorithms for password hashing, for example, Scrypt, Bcrypt, SHA-3, etc.? If an attacker wants to use dedicated hardware, he would need one for each algorithm. However, I know having multiple algorithms increases the probability of having bugs and leaks.
If having multiple algorithms for EACH password can create leaks, what about having different algorithms for different passwords: If the attacker only has hardware for Bcrypt, he can't brute force passwords hashed with Scrypt.
EDIT : By combining, I mean, hash2(hash1(hash0(password))). In the second paragraph, I mean hash0(P0), hash1(P1), hash2(P2), hash0(P3), hash1(P4), hash2(P5).
EDIT : What about hash0(P0), hash1(P0), hash0(P1), hash1(P1), ... ?


texts: Is there a ready report about character order frequency in most common passwords?

texts: There are charts about most used letters in English. What about the letter order? For example letter X has a bigger chance to appear than letter Y as the first character and something else for the 2nd character.


texts:
I understand that with more encryption rounds the more complex the ciphertext becomes due to multiple substitutions and permutations. What I don't understand is the purpose of these features.

I am under the impression that key length and the number of subkeys are the dominant factors in deciding the strength of a cipher as they are what encrypts the  plaintext. I’m not disregarding the fact that plaintext must also undergo diffusion to avoid statistical analysis and confusion to obscure the relationship between the texts.

What benefits do substitution boxes and permutation boxes offer in DES? Don't these permutations and substitutions become redundant after a few rounds? Do the effects eventually plateau?


texts: OpenSSL des-ede3 not producing same output as test vector implies it should be

texts:
I'm encrypting one of the standard TDEA/3DES/DES-EDE test vectors with openssl:

<?php
$key = pack('H*', '0123456789ABCDEF' . '23456789ABCDEF01' . '456789ABCDEF0123');

$result = openssl_encrypt('The quick brown fox jump', 'des-ede3', $key, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING);

echo chunk_split(bin2hex($result), 16, ' ');

(des-ede3 is ecb mode)

This gives 1ccf23869d09333e cce21c8112256fe6 68d5c05dd9b6b900 as the result.

But the test vector for TDEA in ECB mode in NIST SP 800-67 Appendix B.1 states that the output should be A826FD8CE53B855F CCE21C8112256FE6 68D5C05DD9B6B900.

So what's up?


texts: If we composed (as in function composition) multiple CPA-secure encryption schemes would the result also be CPA-secure?


texts: Are Diffie-Hellman, RSA and other types of public key cryptography different?

texts:
Are these schemes fundamentally different? Are other schemes fundamentally different in the sense that you can do different operations with them (or the same operations, but needing different primitives)?

For instance, Whit Diffie is on record as saying that he originally much preferred RSA because it provided signatures (at the time, things like ElGamal etc were not invented so RSA seemed superior).

RSA is often used as “key transport”, which seems like something Diffie-Hellman cannot do? But in a sense you can do it: Merely compute $k=g^{ab}$ and use $k$ and some symmetric cipher to “transport” your session key $k_s$? This requires the use of a symmetric cipher, whereas RSA key transport does not. Maybe there are other ways of doing it that only require the same primitives as RSA?

In addition, DH schemes like ElGamal seem to all require randomness to produce signatures (I could be wrong?), whereas RSA does not (except for padding I suppose?), but RSA does seem to require a hash function (I could be wrong)? Are they fundamentally different?

So my question is, are there fundamentally different properties of certain public key encryption schemes? Especially RSA and DH?


texts:
I'm studying the Integrated Encryption Scheme and I did't understand which are the main differences between ECIES and DHIES. Can someone help me ?

Thank you in advance.


texts:
Given

$$c_1x = k_1 + y_1 $$
$$c_2x = k_2 + y_2 $$
$$\vdots $$
$$c_nx = k_n + y_n $$

where the values of $\{c_1 \ldots c_n \}$ and $\{ k_1 \ldots k_n \}$ are known, and $x, \{y_1 \ldots y_n \}$ are unknown. $y_i$ is chosen uniformly at random.

We are working in a field of $GF(p)$, so all $c_i, k_i, x, y_i ∈ \mathbb{Z}_p^*$. $p$ is some prime.

From here, how can we recover the value of $x$ ?

(suppose $c_i = c_j$ OR  $\ k_i = k_j$ for some $i,j$ that we know )


texts: where does the prime number taken in DH algorithm in IPSEC

texts:
I am studying & configuring IPSEC ikev1 and in between i am analysing the wireshark captures. I am using the linux kernel for TCP/IP stack and user-space i took ipsec-tools.

In the first two packet exchanges initiator is offering the proposals & responder will respond to the supported proposal.

Next two packet exchanges(packet 3[initiator] & 4[responder]) will perform DH key exchange.Here how the responder will came to know that which prime number the initiator uses & how it will be exchanged.