texts: Derived keys usable by threshold signatures

texts:
Suppose there are $n$ members in a $(t,n)$ threshold signature scheme. The global secret key $sk$ is not known to any single party, as the keys are generated distributed. The parties are able to construct their global public key $pk$. So each member $i$ can sign a message $m$ with their secret share $sk_{i}$ which will produce $sig_i$. All signatures shares can be combined to create $sig$ which is verifiable under $pk$.

Is there any key derivation function $f$, such that each member can produce derived keys $sk_i^1$,$sk_i^2$,$sk_i^3$,...$sk_i^n$, that will be able to fulfil the threshold scheme? E.g. every member signs $m'$ with $sk_i^1$ and the combined signature $sig^1$ is verifiable under $pk^1$ which is constructed from the shares $pk_i^1$.


texts:
$\DeclareMathOperator{\GF}{GF}$
I cannot figure out how should I determine the matrix for transmission over $\GF(2^8)$ to $\GF(((2^2)^2)^2)$ in compact hardware implementation of inversion based 8-bit s-boxes.

In https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=8&ved=0ahUKEwjTrd3xsPzVAhVD5xoKHbHWDVAQFghUMAc&url=https%3A%2F%2Fcore.ac.uk%2Fdownload%2Fpdf%2F36718483.pdf&usg=AFQjCNFhSmTqjJz99DmRt8-19g7S-nXqaw , the author has searched among all potential $\GF(((2^2)^2)^2)$ to find the isomorphism tower field for inversion computation with the least area resources; and in page 24 it is showed that how the transmission matrix should be determined. However, I do not know if my $\GF(2^8)$ is different from AES, how should I build the corresponding matrix.

In fact, I do not know if the values of y, z and w would be different, and how should I determine them in the new $\GF(2^8)$!

I would appreciate if someone help me with this problem?


texts: Can you help me with this DES variant analysis?

texts:
I'm struggling with some DES variant that I got as an exercise (exercise taken from Katz-Lindell Ex5.14).

The variant is as follows:

The left half of the master key is used to derive all the sub-keys in rounds 1-8, while the right half of the master key is used to derive all the sub-keys in rounds 9-16.

My direction is to execute a meet-in-the-middle attack. We can observe that if we guess the 28 bit left-half of the master key we can completely compute $L_8$ and $R_8$, also, if we guess the 28 bit right-half of the master key we can completely compute $L_8$ and $R_8$ too, but now by the inverse direction. So we extensively guess all the possible keys for the right-half and for the left half which will take $O(2\cdot2^{28})$ time and space - since for each guess $L_k$ of left-half key we store $L_k:<L_8,R_8>$ computed by it and we store all those key-value pair in the set $S_L$, we do the same for the right-half guesses and store the values in set $S_R$. Of course the correct $L_k$ and $R_k$ will apply the same $<L_8,R_8>$.

My question

How many $L_k$ and $R_k$ would I find? How to analyse this?
How many plaintexts & ciphertexts pairs would I need to find the key with high probability? How to analyze this?


texts:
Given $F(x) = a^x \bmod p$, where $a$ is a primitive root of $p$,
Is it possible to work out what $F(2x)$ or $F(3x)$, etc if you know
what $F(x)$ is but not $x$.

If you use $F(x)$ then $F(2x)$, etc as session keys for a cryptosystem would be knowing a previous key compromise future keys.


texts: Number of cycles in cipher feedback mode (CFB)

texts:
How many cycles are there in a CFB mode of operation?

Say for example I use AES encryption in CFB mode. How many times will this cycle before outputting the final ciphertext? In the picture below this is done in 3 cycles. Are there any rules on the amount of cycles before outputting the final ciphertext? I may be way off but it's a bit confusing with this specific mode of operation.


texts: Why do the outputs of parties in an MPC protocol have to be indistinguishable from the ideal / real world (as opposed to inputs)?

texts:
In this paper at the bottom of pg. 1235 and beginning of pg. 1236 it says:

  An MPC protocol is said to be secure, if for every real world leakage
  adversary A there exists an ideal world simulator S, such that the
  output of all the parties (including the adversary) in the real world,
  is computationally indistinguishable from the output of all the
  parties (including the simulator) in the ideal world.

Why do the outputs have to be indistinguishable? Why not the inputs? The paper talks about a "secret state".  Is the secrete state different from input/output ?


texts:
What happens to entropy after hashing?

Suppose you have a key with entropy $k$. Can entropy $k$ be increased by hashing the key?


texts:
We know discrete logarithm leaks last bit and factoring is easy if half the bits of factors are known.

Are there similar trivia associated with SVP based schemes, NTRU scheme, McEliece scheme etc.?


texts:
I was at my College Security Lesson, the professor said that Certificate Revocation Lists (CRLs) violate some of the Secure Design principles.
Secure Design Principles:

Fail-Safe Defaults
Economy of Mechanism
Complete Mediation
Open Design
Separation of Privilege
Least Common Mechanism
Psychological Acceptability

I can't really face this thing!

Which Secure Design principles are violated with the use of CRLs? Why?


texts: Is it possible to combine digital signature to provide message addition?

texts:
Let's assume we are using the textbook RSA where $Sig(x)=x^d$. Alice has public key $(e,N)$, and private key $(d,p,q)$.

Now, if Alice sends $Sig(5)$ and $Sig(10)$ to Bob, where $5$ and $10$ is just numbers, is there a way to combine them on Bob's side to get $Sig(15)$?

If this is not possible in RSA, is it possible in other schemes like, for example, ElGamal) ?

Please note that I'm looking for a solution to handle this via "addition", not "multiplication".


texts:
What is the computational time to break McEliece on a quantum computer?

I've seen that polynomial time algorithms exist, but for special conditions. What about the general case?


texts:
Can anyone explain the following text passage to me?

  Most real-world block ciphers build even permutations,
  because it's hard to build odd ones using small operations (32 bit)
  on larger (128 bit) block size.

I don't understand the connection between parity of a permutation and small operations.


texts: How to rotate keys for plaintext in DB encrypted by RSA?

texts: I have encrypted plaintext with an RSA public key. It is stored in a database. This public key will be encrypted by another key with a different encryption algorithm. What does key rotation look like here? How would I rotate the keys that are directly encrypting the plaintext.


texts:
Does SHA-1024 cryptographic hash function exist similarly to SHA-512? If not, what's the reason for that?

Links:

SHA-2 at Wikipedia
SHA-3 at Wikipedia


texts: Security benefits of Ed25519 generating signatures deterministically

texts:
I am reading on the Ed25519 curve, and I am trying to understand a claim. Here is the claim:

  Foolproof session keys. Signatures are generated deterministically;
  key generation consumes new randomness but new signatures do not. This
  is not only a speed feature but also a security feature, directly
  relevant to the recent collapse of the Sony PlayStation 3 security
  system.

Does that mean a node or device in the system will have its own unique key? (The Sony PlayStation 3  reference is confusing me).

Since Curve22519 is Diffie-Hellman based, does that mean a Ed25519 curve simply assigns a different base point on the curve? (And derives the public point from a serial number or other hardware characteristic).

Its also not clear to me why a "fast" verification is needed in this case. It seems to me it should not matter how fast (or slow) a node or device is when verifying a signature since its not a frequent operation.


texts:
In cryptography, a block cipher mode of operation is an algorithm that uses a block cipher to provide information security such as confidentiality or authenticity. A block cipher by itself is only suitable for the secure cryptographic transformation (encryption or decryption) of one fixed-length group of bits called a block. A mode of operation describes how to repeatedly apply a cipher's single-block operation to securely transform amounts of data larger than a block.
Most modes require a unique binary sequence, often called an initialization vector (IV), for each encryption operation. The IV has to be non-repeating and, for some modes, random as well. The initialization vector is used to ensure distinct ciphertexts are produced even when the same plaintext is encrypted multiple times independently with the same key.[6] Block ciphers may be capable of operating on more than one block size, but during transformation the block size is always fixed. Block cipher modes operate on whole blocks and require that the last part of the data be padded to a full block if it is smaller than the current block size. There are, however, modes that do not require padding because they effectively use a block cipher as a stream cipher.
Historically, encryption modes have been studied extensively in regard to their error propagation properties under various scenarios of data modification. Later development regarded integrity protection as an entirely separate cryptographic goal. Some modern modes of operation combine confidentiality and authenticity in an efficient way, and are known as authenticated encryption modes.


texts:
As far I know, the Serpent cipher is the only cipher that uses legit bit shifts (<<) along with circular left shift (<<<) (correct me if I am wrong).

I have two questions on it:

What security advantage added by bit shift? Why is it used in the first place?
Does the bit shift add vulnerability in differential power attack?

As for the second point: a bit shift adds more zeros, resulting in an unbalanced bit distribution (Hamming weight biases).


texts:
Let $\mathcal{E} = (E,D)$ be a CPA secure cipher.

Let's define $\mathcal{E'} = (E', D')$, where $E'(k,m) = E(k, E(k,m))$.

How can I prove that $\mathcal{E'}$ will be CPA secure if $\mathcal{E}$ is?

My guess: Let $a$ be the CPA advantage of an attacker over $\mathcal{E}$, that is, $\mathrm{CPAadv}[\mathcal{A, E}] = a$.

As $\mathcal{E}$ is CPA secure, then $a$ is negligible, thus $E(k,m)$ provides a negligible advantage to some arbitrary efficient attacker.

Let $E(k,m) = e$. If I repeat the prodecure $E(k,e)$, $E$ should give the attacker another negligible advantage $b$.

Then, the total advantage given by $E(k,E(k,m))$ would be $a+b$, and since they are both negligible, $a+b$ would be negligible and $\mathcal{E'}$ would be secure.


texts: Is the first version of the Message-Digest algorithm by Ronald Rivest publically available?

texts:
Diving into the history and evolution of the Message-Digest algorithm by Ronald Rivest, I have been able to track back papers from MD6 down to MD2. Yet, somehow I can not seem to be able to find any papers, specifications or even the slightest indications of MD1.

As the numbering (MD2, MD4, MD5, MD6) seems to be a constant, it would be logic to expect that MD1 did exist at some point in the past. Since I can not find anything related, I'm reaching out for help...

Has MD1 ever been published or was MD2 indeed the first Message-Digest algorithm that Ronald Rivest showed to the world? And if MD1 has been published, where can I find that publication (or a copy of it)?


texts: Why are matrices so common in symmetric encryption?

texts:
Matrices have been used in symmetric ciphers since the Hill Cipher (before?) all the way up to modern ciphers such as Twofish and AES.

I understand matrices can be invertible, therefore making them useful for decryption, but what other benefits do they have over other methods? For instance:

Are they notably fast/efficient?
Do they take up little memory?
Are they particularly easy to implement?
Do they (somehow) offer better protection against side channel attacks?
At what point might a matrix become unmanageable/too large/insecure? For example, a 1024-bit square matrix.

I am interested in any particular benefits they might offer and problems they might cause or weaknesses they might have. I wonder also if there are different types for different purposes; it seems most are used for diffusion.


texts: Using a Caesar Cipher with a key higher than 26?

texts:
When I have experimented with using a key higher than 26 on a Caesar cipher, I have had some very ...interesting... results. The encryption works fine, but when I attempt to decrypt the encrypted message, I am unable to decrypt the message successful.

I understand that a Caesar can theoretically have a key size of 26, I am just curious as to what would happen with a longer key.
Can somebody assist with both the mathematical side, and if it is possible to use the cipher with a key size higher than 26?

EDIT: In my program I am converting the message to ASCII, adding the key size. To decrypt, I convert it back from ASCII to characters.


texts: Do Korea and Japan have their own national hashing standard?

texts: I know China has SM3 and SM4 commercial cryptographic hash and block cipher standards, and I know Japan has Camellia block cipher and Korea has SEED. Do Japan and Korea have an industry standard for hashing? Are they available online (either paid or free)?


texts: Formal taxonomy for cryptographic vulnerabilities

texts:
There are several areas in which cryptographic vulnerabilities can be introduced.

Length extension attacks are inherent to hash functions using Merkle–Damgård.

Heartbleed was a vulnerability caused by the specific implementation of a protocol.

Using weak ciphers such as DES is a configuration issue.

Is there a formal taxonomy for issues such as this, to make communicating issues easier?


texts: Big block cipher as memory-hard function

texts:
I'm wondering, if something like block cipher with big block size is a good memory-hard function?

All memory-hard key derivation functions I've seen look more complex than that, which made me question my understanding of memory-hardness.

The following function looks memory-hard (memory tradeoff looks expensive) to me:

size = 16MB / (F() word size in bytes)
rounds = 1024
state = constants ⊕ (key || salt)

for (i = 0; i < rounds * size; i++)
   state[i mod size] = state[i mod size] ⊕ F(state[i + 1 mod size])

result = state ⊕ key

How memory-hard is this type-I generalized Feistel network key derivation function?


texts:
I working on multiuser project, where users can share data. The data that users upload to the server will be encrypted before it leaves the client with a symmetric cipher, and then the symmentric key is encrypted with a public RSA algorithm to those who the data is ment for (Basic PGP). In this way I can guarantee that unauthorised users don't get access to the data, even if they are able to gain root access to the server.

The question is how should I handle the private RSA keys. By using public-key cryptography the user is very much «locked» to that one devices that contains the private key. But let assume that user wants to switch between smartphone, laptop and desktop. Is it secure to encrypt the private key with symmetric cipher and use PBKDF2 to iterate the password before I upload the private key to a centralized server?

Or is there a better way to share private keys between multiple devices?


texts: AES - Encrypting multiple blocks of files

texts:
On my site, users can download files which are stored on public hosting, so I need to encrypt them. A downloaded file is divided into blocks of 1 kB and I want encrypt them individually, using the same key. I have read that the best option for performing the encryption is AES, but I don't know which mode should I use.

Also, I want also ask, is using similar keys insecure? If that practice is safe, I needn't generate long keys and store them, because all can have same beginning. The main problem is user could find the encrypted files, then they will have the file both before we perform encryption, and afterways; does this raise the possibility of finding the key?


texts: Do PGP keys with expiration date set expiration date in Encrypted messages too?

texts:
So I am little confused about a type of encryption I read about. You can encrypt your E-mails and pretty much all kind of information using PGP key pairs.

However, I am confused if an encrypted message has an expiry date if a key used to encrypt the message has an expiry date too?

Let's say I am using a Key1 to Encrypt a Message and Key1 has an expiry date of 1 week from now, Can a person who received a message decrypt an encrypted message after a 1 week?


texts:
How does certificate revocation list (CRL) work? How can I send a request to the CA to add my current private key to the CRL, so no one except me can add my certificate to the CRL?

Related:
- How can we get CA's public key?
- I've got my private key compromised. How does CRL work?
- What happens when a root CA has its private key compromised?


texts: Using RSA encryption to encrypt large files

texts:
The following post discusses the use of RSA for file encryption:

https://medium.com/@ismailakkila/black-hat-python-encrypt-and-decrypt-with-rsa-cryptography-bd6df84d65bc

The file encrypted is a JPEG image. My question is: what if we were to encrypt larger files say, 10 MB, in a similar manner and are able to reach acceptable encryption speed with a modern i7 processor?

Is the resulting ciphertext practically decryptable in anyway without the private key?
What factors affect the speed of encryption in this case? The RSA key size? The block size? The padding type?

Note: I do realize that RSA is not meant for file encryption in this manner and that a hybrid encryption scheme is more suitable (encrypt data with a session key, then encrypt session key with the RSA key). Please do bear with me and assume that we must encrypt a large file with RSA. I'm merely trying to understand the practical impacts and limits in doing so and I realize that hybrid encryption is more appropriate here.


texts:
Below is a short excerpt of available DH cipher suites available on a machine.

I understand EDH is ephemeral DH, and that ECDH is for Elliptic-Curve DH which is computationally faster.  ECDHE is both of those aspects together.  The confusing bit how there are EDH cipher suites and DHE suites.  The wikipedia article says both acronyms can be used to describe Ephemeral Diffie-Hellman suites, but it also mentions that DHE can stand for "Diffie-Hellman Exchange" which would have no ephemerality.  I am very interested in Perfect Forward Secrecy for my application and it is vital that I only use a suite with brief ephemerality.  How can I be sure which is which?

ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA
DHE-DSS-AES256-SHA
ECDH-RSA-AES256-SHA
ECDH-ECDSA-AES256-SHA
ECDHE-RSA-DES-CBC3-SHA
ECDHE-ECDSA-DES-CBC3-SHA
EDH-RSA-DES-CBC3-SHA
EDH-DSS-DES-CBC3-SHA
ECDH-RSA-DES-CBC3-SHA
ECDH-ECDSA-DES-CBC3-SHA
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
ECDH-RSA-AES128-GCM-SHA256
ECDH-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-RC4-SHA
ECDHE-ECDSA-RC4-SHA
ECDH-RSA-RC4-SHA
ECDH-ECDSA-RC4-SHA
EDH-RSA-DES-CBC-SHA
EDH-DSS-DES-CBC-SHA
EXP-EDH-RSA-DES-CBC-SHA
EXP-EDH-DSS-DES-CBC-SHA


texts: How to determine which type of crypto is used in a text file?

texts:
is there a tool or a way to determine which type of crypto is used in this type of text:

U3RlZ2Fub2dyYXBoeSBpcyB0aGUgYXJ0IGFuZCBzY2llbmNlIG9m
IHdyaXRpbmcgaGlkZGVuIG1lc3NhZ2VzIGluIHN1Y2ggYSB3YXkgdGhhdCBubyBvbmV=
LCBhcGFydCBmcm9tIHRoZSBzZW5kZXIgYW5kIGludGVuZGVkIHJlY2lwaWVudCwgc3VzcGU=
Y3RzIHRoZSBleGlzdGVuY2Ugb2YgdGhlIG1lc3M=
YWdlLCBhIGZvcm0gb2Ygc2VjdXJpdHkgdGhyb3VnaCBvYnNjdXJpdHkuIFS=
aGUgd29yZCBzdGVnYW5vZ3JhcGh5IGlzIG9mIEdyZWVrIG9yaWdpbiBhbmQgbWVhbnMgImNvbmNlYW==
bGVkIHdyaXRpbmciIGZyb20gdGhlIEdyZWVrIHdvcmRzIHN0ZWdhbm9zIG1lYW5pbmcgImNv


texts: Does length prepending fix the key reuse problems with CBC and CBC-MAC?

texts:
As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea.

Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ensure CBC-MAC is resistant against length-extension attacks.

Now my simple question is:
Does this simple length prepending also fix the security vulnerability with re-using the key?

For clarity: The attack scenario is a standard CCA(2) scenario, the message length is feed into CBC-MAC but not CBC and there's no intent (by me) to use or even implement this.

From what I can tell, this "fix" should indeed fix the issue, because it relies on the ciphertexts being used for CBC-MAC and CBC to be the same (at the same positions) and so this sounds secure.


texts: Public-key encryption with associated data

texts:
In the symmetric-key world, we have authenticated encryption with associated data (AEAD).  I'm looking for something similar, but for public-key encryption: public-key encryption with associated data (PKEAD?).

Here's how it should work.  Given a message $m$ and a header $h$, let $E(m,h)$ denote the public-key encryption of $m$, bound to the data $h$.  Similarly, given a ciphertext $c$, let $D(c,h)$ denote decryption of $c$ under the corresponding private key, bound to $h$.  We want $D(E(m,h_0),h_1)$ to be $m$ if $h_0=h_1$, or $\bot$ (failure) if $h_0 \ne h_1$.  There is no requirement to provide confidentiality for $h$ (we assume it is public) and no need to include $h$ in the ciphertext (he assumption is that the header $h$ will be transmitted via some out-of-band means).  This binds the ciphertext $E(m,h)$ to $h$, so that decryption will succeed only if the sender and receiver have the same value of $h$ and the adversary hasn't tampered with $h$ in transit.

Also, I want the public-key encryption to be IND-CCA2 secure.

Are there any schemes designed for this task?

I can think of some trivial constructions, but I suspect they are not optimal.  One simple scheme is to let $E(m,h)$ be the public-key encryption of $m||H(h)$ under some standard public-key encryption scheme.  Then $D(c,h)$ decrypts $c$ to get some $m||d$, and returns $m$ if $H(h)=d$ or fails otherwise.  However, this causes message expansion (alternatively, it reduces the maximum length of the message $m$ that can be encrypted).  I suspect one can avoid any message expansion.  Has anyone designed schemes for this task?


texts:
Can someone please check my work and correct me if I am wrong, I am just starting to learn about DES. I am trying to solve the following problem:

  Show that S1(x1) XOR S1 (x2) != S1(x1 XOR x2).
   x1 = 000000, x2 = 000001

So, we get S1(x1) first: 00 is our row, and 0000 is our column which is (0,0) and in the S1 Box table is the value 14. 14 in binary is 1110.

Now we get S1(x2): 01 is our row, and 0000 is our column which is (1,0) and in the S1 Box table is the value 0. In binary, it's 0000.

Now we XOR the two outputs:

    1110
XOR 0000
  = 0001

Thus, S1(x1) XOR S1(x2) = 0001.

Now we XOR X1 and X2 first:

     0000000
 XOR 0000001
  =  1111110

Now we lookup our output in the S1 table: Our row is 10, and our column is 1111 which is (2,15) and in the S1 Box Table is the value 08 which is 1000.

Thus, 0001 != 1000. Is that correct? (And in case it isn’t, where did I take a wrong turn?)


texts:
PRNG (Wikipedia):

  "The PRNG-generated sequence is not truly random, because it is completely determined by an initial value, called the PRNG's seed (which may include truly random values)."

My questions are:

Is a PRNG-generated sequence with a truly random seed considered a cryptographically secure PRNG?

If not:

How does a CSPRNG-generated sequence differ from a PRNG-generated sequence?


texts:
I'm tired and can't seem to get the right answer for the following exercise:

  Alice sends a message to Bob, but he doesn't know the key. He knows only that the first two plaintext letters are C and R.

  The ciphertext is turgifsfsferbi.
  The plaintext is cryptananalyst.

The first two plaintext letters are ${\rm C} = 2$ and ${\rm R} = 17$, while the corresponding ciphertext letters are ${\rm T} = 19$ and ${\rm U} = 20$.  The encryption formula is $f(x) = ax+b$, so we have:

\begin{aligned}
19 &= \phantom{0}2a+b \\
20 &= 17a+b,
\end{aligned}

which I solved to get $-1=-15a \implies a=15$
and $b=3$.

For decryption, we use the formula $f(c)=a^{-1}(c-b) \bmod 26$.  The inverse of $a=15$ modulo $26$ is $a^{-1} = 7$, so for the first ciphertext letter I get:

$$7 \times (19-3) \bmod 26 = 7 \times 16 \bmod 26 = 8 = {\rm I} \ne {\rm C}.$$

So where is my mistake?


texts: Why is $S(y) = y^{2^8-2} = y^{254}$ a one-to-one function and a permutation on $GF(2^8)$

texts:
I'm taking a course on cryptography and I have some confusions concerning the materials in our notes. Say we have the field $GF(2^8)$, we create a substitution algorithm (the S Box in AES) so we need a bijective function that maps from $GF(2^8)$ onto itself.

The total number of one-to-one functions is 256! because $| GF(2^8)| = 256$ and we can find a mapping by permutating all elements within the set.

We use the mapping function $S(y) = y^{2^8-2} = y^{254}$ which is a permutation on $GF(2^8)$

Why is this a permutation? How do we show this?

It is also mentioned in other notes such as here: SubBytes Transform circuit for AES Cipher (Version 1.0)

that

$S(y) = y^{-1}$ for all $y \neq 0$
and
$y^{255} = 1$

I don't understand why however.

Just to summarize, I don't understand
why  $S(y) = y^{2^8-2} = y^{254}$ is a one-to-one function and a permutation on  $GF(2^8)$ and why $S(y) = y^{-1}$ for all $y \neq 0$

Could someone help explain the details behind? Thanks!


texts:
Shamir's Secret Sharing Scheme uses arithmetic in a finite field of prime order.
In a secret image sharing scheme, what are the advantages of Galois field $\mathrm{GF}(p^m)$ over finite field $ F_p$?


texts: Converting a C25519 curve into a NIST-supported curve for FIPS crypto

texts:
If I have a cryptosystem based on C25519 ECC crypto, is it possible to use the same public/private key pairs for key agreement in a FIPS compliant way by deterministically converting C25519 public and private keys into keys under some other ECC curve?

In other words let's say Alice and Bob have C25519 key pairs. Alice has her public and private key and Bob's public key, and Bob has Alice's public key and his public and private. Alice and Bob want to convert their keys into NIST P-256 keys (or some other NIST curve) and then execute ECC key agreement using a FIPS compliant cryptographic module in order to run in a FIPS compliant mode of operation.

Is this possible? Is it secure?


texts:
With a fixed key size – key has 128 bits, while block size is 8 byte – how do I calculate how many different keys and texts I have to test for an cryptanalytic statistics study?

Differently worded: I am planning to encrypt multiple samples and see how many bits have changed, compared to the input block. Finally I plan to create a Histogram and get conclusions. If the cypher algorithm is good, half of the bits should have changed (50%).

The problem is that I do not know how many samples I have encrypt to gain a good statistical foundation. How many blocks do I have to (or should I) encrypt, and what formula should I be using?


texts: I'm getting a non-integer (float) private key in Paillier encryption

texts:
I'm trying to implement the Paillier cryptosystem in Matlab using the key generation guidance available here: https://en.wikipedia.org/wiki/Paillier_cryptosystem#Key_generation, but the problem is that with any combination of prime numbers I try, I get a float mu required for the private key.

The first step is:

  Choose two large prime numbers p and q

Just for a starting point I chose p = 17 and q = 19.

  Compute ${\displaystyle n=pq}$ and ${\displaystyle \lambda =\operatorname {lcm} (p-1,q-1)} $.

Which I achieved in Matlab using:

n = p*q;
lambda = lcm((p - 1), (q - 1));

This gives me n = 323 and lambda = 144

Third step:

Select random integer  ${\displaystyle g}$ where $g\in {\mathbb Z}_{{n^{{2}}}}^{{*}}$

I read that g = n + 1 satisfies all the required conditions so I went with that, which gives me a g = 324.

  Fourth step is to compute ${\displaystyle \mu}$ using:

${\displaystyle \mu =(L(g^{\lambda }{\bmod {n}}^{2}))^{-1}{\bmod {n}}}$

where,
 ${\displaystyle L}$ is defined as ${\displaystyle L(x)={\frac {x-1}{n}}} $

I achieved this using:

a = (powermod(g, lambda, n*n) - 1) / n;

gMu = mod(inv(a),n);

So at this stage, the public key is supposed to be (n,g) = (323,324) and the private key would be (lambda,mu) which in my case comes to (144,0.0069).

Why am I getting a float value of gMu whereas all the implementations I have seen online provide a integer value of private keys.

Where am I getting this wrong?


texts: I am a bit confused on the hardness of the discrete logarithm problem. Does it become intractale only when it is mod n, where n is a large composite number  (Like RSA key). What about if it is mod a prime number p? what is the complexity and method for solving it? Can we reduce the problem of integer factorization to discrete log problem and vice versa?


texts: Tweakable Even-Mansour scheme where the block size is twice the key size?

texts: We have the functions $E(K, T, X)$ and $D(K, T, X)$ where for both it is the case that $\{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{T}} \times \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$. The value of $\ell_{X}$ is twice that of $\ell_{K}$. The values of $\ell_{K}$ and $\ell_{T}$ are equal. I know that in the case of the single-key Even-Mansour scheme, up to $2^{0.5 \times \ell_{X}}$ blocks can safely be encrypted, but what is the case in the scheme I just outlined? Is it the upper bound $2^{\ell_{K}}$?


texts: HKDF is used in one of my projects to derive separate keys from a common master key. But profiling has shown it to be the performance bottleneck under certain circumstances. Is there any faster alternative? The only things I get after googling "key derivation function" are HKDF and password stretching algorithms like PBKDF2 or scrypt.


texts: Using single EC cert/keying material to derive symmetric encryption key (for storage)?

texts:
The situation involves a single party (single certificate) who would want to AES encrypt a file that they can later decrypt. Assume the EC certificate + EC keys have a purpose i.e. "File encryption" (similar to EFS perhaps), issued to a human ("Mr CSO") or an application ("My cat photo app"). Certs would be off existing organizational PKI.

EDIT: Certificate's are involved as there is already a PKI being maintained. We'd like to reuse that instead of introducing another (AES)-Key-Infrastructure. The AES key is encrypted in file header and it later decrypted via the private key. It's a usability issue.

EDIT#2: It's a storage use-case, the receiver IS the sender, timeshifted. Storage medium itself is untrusted. Actually the signature might be an overkill since the internal AES is authenticated AES.

With RSA Certs, at an abstract level can be as simple as

AESKey=KDF(nonce)
AESKey_encrypted = RSA_Encrypt(public key, AESKey) ---- (1)
AESKey_signed = RSA_Sign(private key, AESKey)      ---- (2)

File = AESKey_encrypted | AESKey_signed | AES(File_clear, AESKey)

FYI, the AES is authenticated AES which is why there is no separate HMAC. Anyway, a customer wants Elliptic curve crypto (the 521p curve) instead of RSA. The EC counterpart for (2) is clear (ECDSA) but the EC counterpart for (1) is something I'd like to hear from you guys. Any other comments also appreciated. Just to remind, there is no 2nd party/2nd party's cert.

Finally, any algorithmic concerns on mixing public key + bucket of bits AND private key + same bucket of bits (1, 2 above)? To the best of my understanding, those interactions have no proven algorithmic or structural weaknesses.


texts: How to determine proportion of quadratic residues in elliptic curve group?

texts:
I'm using a 'try and increment' method to hash to an Elliptic Curve point, explained below.

With security parameter $k$, EC equation $y^2 = x^3 + ax + b \mbox{ mod } q$, we have:

$ u = sha256(\mbox{message}) $

$\mbox{for } i = 0 \mbox{ to } k - 1, \mbox{ do:} $

$ \quad x = (u + i) \mbox{ mod } q$

$ \quad \mbox{if } x^3 + ax + b \mbox{ is a quadratic residue in } \mathbb{F}_q \mbox{ then }$

$ \quad \quad \mbox{ return } Q = (x, \sqrt{(x^3 + ax + b}) $

$ \mbox{return Q = nil, nil}$

With the EC group generator order $n$ and the field order $q$, I would imagine that the proportion of $x \in \mathbb{F}_q$ that do not result in quadratic residues is calculated $\frac{q - n}{q}$, which would be negligible, and hence require a very small security parameter, but I have read (for example here and here?) that the proportion is close to $\frac{1}{2}$, which would require use of a much larger $k$. This is also stated here, with $p$ as $q$ and $E$ as the EC group:

  An element $a$ of $\mathbb{F}_p$ is said to be a quadratic residue if there exists a nonzero $b \in \mathbb{F}_p$ such that $b^2 \equiv a \mbox{ mod }p$. In $\mathbb{F}_p$, there are exactly $(p-1)/2$ quadratic residues.

  Finding points $(x, y)$ on $E$ amounts to finding those values of $x$ such that $x^3 + ax + b$ is a quadratic residue modulo $p$; hence we might expect $x^3 + ax + b$ to be a square modulo $p$ about half of the time.

How large should the security parameter be?

How do I work the proportion of $x$ coordinates, knowing $n$ and $q$, that will not result in $x^3 + ax + b$ that is a quadratic residue?


texts: Where do key generation algorithms take the randomness from?

texts: I was just wondering, because in many encryption tools like Veracrypt or GnuPG you have to generate pseudo randomness with your mouse movement. So, where do automatically generated keys take that randomness from? For example, when you generate a RSA certificate with OpenSSL.


texts: Does a concatenation of hashes of differently prefixed variations of any chosen message contain all possible finite bitstrings?

texts:
Let $A$ denote a sequence of bits.

Let $H$ denote a cryptographic hash function that has no limit on the length of its input (for example, SHA-3).

Consider the following infinite sequence of bits: $$B = H(A) \mathbin\Vert H(0 \mathbin\Vert A) \mathbin\Vert H(1 \mathbin\Vert A) \mathbin\Vert H(00 \mathbin\Vert A) \mathbin\Vert H(01 \mathbin\Vert A) \mathbin\Vert H(10 \mathbin\Vert A) \mathbin\Vert \ldots$$ (that is, the prefix goes through all possible bitstrings, sorted by their lengths).

Can we assume that for any chosen $A$, its corresponding $B$ is unique and contains all possible finite bitstrings (similarly to a binary representation of a fractional part of Pi)? If yes, can we use such technique as a cryptographically secure pseudo-random number generator that has no theoretical period?


texts:
When i see this problem,
 i think that it is similar to 'baby step, giant step' because of gauss symbol.

But in here, i don't know how to prove both (a) and (b).

What i have done is that $A= [p]$ or $A=[p]+1$. here $[p]$ is the lower integer version of gauss symbol.

Also, $$A=p^{1/2}$$ (when this is integer) or $$p^{1/2}<A<p^{1/2}+1$$ (when the square root is not an integer)


texts: Show that CPA-security implies security against plaintext recovery

texts:
Consider the following experiment:

$k = Gen(1^n)$
$m \stackrel{u}{\in} \{0,1\}^{l(n)}$
$c = Enc_k(m)$
$m' = B(1^n,c)$

Define the winning event as $m' = m$. I would like to show that if the encryption scheme $Enc$ is CPA-secure thn every PPT-algorithm $B$ can only succeed with negligible probability in the above experiment.

Proposal

This is the solution I have come up myself with:


texts: ANSI X9.31 standards for generating random numbers

texts:
The NIST-Recommended Random Number Generator Based on ANSI X9.31 Appendix A.2.4
Using the 3-Key Triple DES and AES Algorithms has 3DES being used three times for each 64-bit block of random data desired, e.g.

$I = ede_K (DT)$, $R = ede_K(I \oplus V)$ and a new $V$ is generated by $V = ede_K(R \oplus I)$.

OpenSSL seems to be using 3DES in ECB mode (fips_rand.c).

My question is...  if you have a cipher running in CTR mode could you just encrypt a string of null bytes as long as desired instead of doing three different encryption rounds on each block?

Also, what is the recommended format for DT? Normally timestamps are 32-bits, not 64-bits.


texts:
From the perspective of a Birthday Paradox attack, isn't it true that CMAC based on AES-128 is weaker than HMAC-SHA-1? The attack on CMAC-AES-128 requires about $2^{64}$ operations whereas the same attack on HMAC-SHA-1 requires $2^{80}$.

Regardless from the comparison of the CMAC-AES-128 with HMAC-SHA-1 it seems to me that running the birthday attack with about $2^{64}$ operations on CMAC-AES-128 is "somewhat trivial", so it can't be considered to be secure anymore. DES that has a key size of 56 bits can be broken easily with $2^{56}$.

What are your thoughts?


texts: Question about CTR_DRBG Instantiation specification

texts:
NIST SP 800-90a defines the CTR_DRBG in section 10.2.

There is a comment within the document that I don't understand.

Let's assume we want to achieve a security strength of 256 bits, using as underlying algorithm AES-256 and we do use a derivation function.

Therefore in Table 3 the entropy string is supposed to be within $[256,2^{35}]$ bits and the personalization string is up to $2^{35}$ bits.
The seedlen is equal to $384$ bits.

But in section 10.2.1.3.2 "Instantiation When a Derivation Function is Used" step 1 seed_material is defined as

seed_material = entropy_input || nonce || personalization_string

with the comment "Ensure that the length of the seed_material is exactly seedlen bits".

What is the sense of this comment ?

If personalization_string and entropy_input are allowed to grow up to $2^{35}$ bits, how can their concatenation (excluding the nonce) be forced to be exactly $384$ bits ?


texts: Multi User limited Time Encryption of big Datasets

texts:
Updated Question: New Thread

Original Question: (Thanks cypherfox for answering that one)

I am in need to store data > 100 TB on a local network share (NAS/SAN) and grant individuals access to the encrypted data. For all users, besides me, the data can be read only, and sequential access to the data (only one user can access the data at one time) is fine.

The biggest problem is that I need to revoke individual users access from time to time (in addition to the recall of the network share access). I could encrypt the master key with user individual keys but this would not prevent technical experienced users from stealing the master key right? So I would need to re-encrypt the data every-time a user is recalled. Is there a way to do this more efficient than copying all data to a new encrypted image/disk? For 100 TB this would need more than 9 days.

Maybe someone can give me an advise which system/tools/techniques I should use and where the decryption should take place (client/server). Here the summarized key facts:

~ 100 TB Data
max 5 user at the same time or 20 over the whole time span
data stored an a local NAS/SAN connected to an 'offline' network
the files have easily multiple GB, so some kind of transparent decryption to avoid copying the data would be necessary
even a user could copy the data while he is a regular user, and even if he has no network share access anymore, we need to depreciate his decryption access


texts:
Alice has a long message to send. She is using mono alphabetic substitution cipher. She thinks that if she compresses the message it may protect the text from single letter frequency attack by Eve. Does the compression help? Should she compress the message before the encryption or after the encryption? Defend.

Will compression help defeat single letter frequency attack against a mono alphabetic substitution cipher?


texts: Cost of attacking Mobile OTP with a fake server

texts:
You want to obtain a 74-bit secret $K$. There is an oracle that will provide you with the following value for several values of $T$:

$$(\mathrm{MD5}(T_{\mathrm{dec}}||K_{\mathrm{hex}}))_{\mathrm{hex}}[0..5]$$

$T_{\mathrm{dec}}$ is the number of seconds since 1970 divided by 10 (i.e. it's the current time in units of 10s), written out in decimal notation and encoded into bytes in ASCII;
$K_{\mathrm{hex}}$ is $K$ written out in hexadecimal notation and encoded into bytes in ASCII;
$x_{\mathrm{hex}}[0..n-1]$ means the first $n$ hexadecimal digits of $x$.

In other words, the oracle provides the first 6 digits of the MD5 hash of a time-dependent string concatenated with the secret.

The practical application is that you are impersonating a mobile OTP server, and the oracle is a client tricked into attempting to authenticate with you. $K$ is the client secret (in-device secret plus user PIN) which you are trying to obtain. And this question is inspired by Mobile OTP - Secure? on Security Stack Exchange.

Since each value from the oracle provides 24 bits, with $4$ values from the oracle, you should have enough information to brute-force $K$. (Assume $T$ is perfectly known, i.e. your clock is synchronized with the client's, but can't influence it.) The cost of a brute-force search is $2^{74}$ MD5 computations.

Are there known weaknesses that make finding $K$ less expensive? (We're taking the MD5 hash of several strings with a common prefix and a common suffix.) Would more values from the oracle help?


texts: Webapp password storage: Salting a hash vs multiple hashes?

texts:
For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better.

But, if bad guys steal your database, they still could brute-force against the hash and conceivably retrieve many passwords.

The question I have is: Is salting a hash as effective for the effort as say, combining multiple encryption methods with a signifier?

For the sake of example, let's say MD5 = 1, DES = 2, and AES = 3. During the first time the password is stored, why not generate a random sequence of these numbers (i.e. "231"). Then, hash the password in that order (e.g. for "231", DES, then AES, then MD5) and add the digits to the front of the hash. Then, comparison does all three hashes in a random way, by taking the first three digits to see how it should be compared.

I know this is more computationally expensive than adding a salt before hashing, but given the random algorithm assignments plus the task of brute forcing (and taking into account that the attacker would have to have source-code access to see your enum of what numbers are what, etc.), would it be more effective?


texts:
Here in the proof of Elgemal one-wayness:

Consider an adversary V that can invert random Elgamal encryptions with $ε$ probability.
$V *$ : Adversary to compute the Diffie-Hellman function:
On input ($A = g^{a},B = g^{b}$), we must output $g^{ab}$.
Give $A$ to $V$ as the public key.
Pick a random $Z \in G$ and give $(B,Z)$ to $V$ as the ciphertext.
When $V$ outputs $m$, we output $Z / m$.
Note that the distribution $(A,(B,Z))$ does indeed correspond to a random Elgamal public key and encryption of a random message under that key. Thus, with probability $ε$, $V$ outputs the "correct" plaintext $m$ (that is, $m$ such that $Z = mg^{ab}$). When this is the case, the output of $V^*$ matches the Diffie-Hellman function. By our assumption that the CDH assumption holds for the underlying group, $ε$ must be negligible, as desired.

For the first CPA security proof described here, I think it makes adversary guess the value of $a$ or value of $b$. If it can guess one of those values, then it can know which message is encrypted ($m0$ or $m1$). Even it can guess one of those values, and decrypted plaintext is neither $m0$ nor $m1$, then it can know that $c$ is randomly generated. Is it right? But in the second proof for one-wayness of encryption described above, as $Z$ value is selected randomly from $G.$ I can't catch the purpose of checking  $Z = mg^{ab}$. Can anybody help me?


texts:
I was just thinking about my own chance and the way chance can defeat even the most advanced algorithm.

My thought was : you can make a strong session id, but what if by chance, a hacker set this exact match up ?

hypothetical : 454{à"_çé89)hjdsHHKZmdsjYds"#

just try to imagine that someone, by typing a nonsense makes it happen.

You could say, the chances it happens is subminimal. And you may be right.

But what can we do against it ?
Ip lock is impossible since the ip is ever changing for some users. Geographical checks, if possible, will lead to severe performance hits (checks),
dynamic session may or may not add an interesting enough layer of security since you could take another people session id.

So what can crypto propose against chance ?

Thanks,


texts: Can $d$ and $e$ be the same number in RSA?

texts:
I'm reading about RSA and I have doubts:

1) To choose $e$, this value have to be between $1$ and $\phi=(p-1)(q-1)$, with $\gcd(\phi, e) = 1$, right?

2) In my example, $p = 139$ and $q = 491$. So $n = 68249$ and $\phi = 67620$. Assuming my point 1 is correct, $e$ can be $67619$. But $d$ can be $67619$ too, because $67619^2 \equiv 1 \mod 67620$.

Is this reasoning incorrect?


texts: How are private keys handed to users in Identity-based Encryption?

texts:
I'm using IBE in my applied-crypto project in primitive form. I saw many articles about IBE, but didn't find how user can get private key is generated by PKG after EXTRACT method.
So, my question: What is the best practice to hand private key to user after EXTRACT method?


texts: In NTRU digital envelope, do everyone know the hash function $H$ used?

texts:
I have a simple question about the NTRU original cryptosystem using a digital envelope.

The article can be found here: http://grouper.ieee.org/groups/1363/lattPK/submissions/ntru.pdf

It is said that we need a generating function $G$ and a hash function $H$.

Suppose that Alice wants to send a message to Bob. Then she will use some generating function $G$ and some hash function $H$.

Bob recieves the ciphertext $e$ and at a certain point of decryption it is said that Bob should compare $c''$ and $H(c',b)$.

Suppose that Eve exists.

My question is: Do Bob and Eve know $G$ and $H$? In the way the decryption is described, Bob needs to know $H$, but it's not clear if he knows it.

Thanks in advance.


texts:
I was playing with a function that I think is collision free and uninvertible assuming the hardness of integer factorization. I am unfortunately not as skilled at math as I would like to be, and do not know how to prove or disprove the function as being collision free. My only proof so far has been from unit testing all possible inputs, which for all 2 byte combinations has proven successful, but is obviously not concrete.

The algorithm iterates over a sequence of bits. It counts upwards through prime numbers, beginning at 2. For each contiguous '1' bit in the input bits, an exponent counter is incremented. When a '0' bit is encountered, the current prime is exponentiated and composed into the running output, the exponent counter reset to 0, and the current prime is set to the next prime.

For example:

"11001101"

Is interpreted as:

(2 ** 2) * (3 ** 0) * (5 ** 2) * (7 ** 1)

Is this function provably collision free, assuming the output is not truncated?

Is the function uninvertible for sufficiently large inputs/outputs?

Lastly, does the function become harder to invert if the output is modified (i.e. truncated or rotated)?

Edit in response to an answer:
Let me rephrase the question to be more accurate with what I was actually doing. Suppose we iterate through integers, starting at 0 and incrementing by one. Convert each integer to it's binary form and process it in the manner described above. Do any output values produced this way ever collide?


texts: Compression function to guarantee randomness of one time pads?

texts:
First of all, I would like to note that I am not building my own crypto.  I am simply curious and would like to learn.

What I am wondering is this: if we are worried about randomness of something like a one time pad, why don't we run the pad through a compression process (like bzip) to eliminate any patterns?  Wouldn't we essentially then be working with data guaranteed not to have patterns (at least over the chunk size of the compression algorithm)?

Is anyone doing this?  Would it even work?  If not, why not?


texts: Can spatial filters be used to factor composite numbers?

texts:
$Z=(N-XY)^2$ is a surface with absolute minima ($0s$) anywere $Y=N/X$.

I know this question is naiive, but shouldn't it be possible to apply a lossy compression filter to this function which preserves values only at discrete boundaries and then search for absolute minima?

If the answer is no, is there any online reference which describes the difficulties of this approach?

POSTSCRIPT

Some things crystalised in the discussion below, and need more space than can be added in the comments.

First, this question originates from the interaction of 3D rendering software and its interaction with the function $Z=(N-XY)^2$ (tested for small N only).  The interaction results in a surface denoted by $LC(x,y)$ below.

Now let $f(x)=N/x$, and $m(x)=\frac{df}{dx}=-N/x^2$, then the line normal to $f(x)$ at $\mathbf{x^\prime}$ is:

$$(y-f(\mathbf{x^\prime})) + (x-\mathbf{x^\prime})/m(\mathbf{x^\prime}) = 0$$

Expressing $y$ as a function of $x$:

$$y(x) = \frac{N^2-\mathbf{x^\prime}^4}{N\mathbf{x^\prime}} + x\frac{\mathbf{x^\prime}^2}{N} $$

Let the mouth of the valley below $\{\mathbf{x^\prime},f(\mathbf{x^\prime}),z\}$ be:

$$
r(\mathbf{x^\prime},z)=\sqrt{(x-\mathbf{x^\prime})^2+(y(x)-f(\mathbf{x^\prime}))^2} \,\,\, \text{where} \,\, LC(x,y(x))=z
$$

What is the likelihood of finding a suitable function $LC(x,y)$ such that $r(\mathbf{x^\prime},z)$ is maximum when $\mathbf{x^\prime}$ and $f(\mathbf{x^\prime})$ are integers?

Some things to note about $LC(x,y)$ and $r(\mathbf{x^\prime},z)$

$r(\mathbf{x^\prime},0) = 0$ iff $\{\mathbf{x^\prime},f(\mathbf{x^\prime}),0\}$ is rendered (i.e. sampled); otherwise $r(\mathbf{x^\prime},0)$ is undefined.
$r(\mathbf{x^\prime},z)$ is defined for $z>=z_{sat}$ where $z_{sat}$ is implementation dependent.
if $LC(x,y)$ is perfectly lossless, then $r(\mathbf{x^\prime},z)$ can be computed for all positive $\mathbf{x^\prime}$ and $z$ by solving the quadratic: $$\sqrt{z}-N+x\frac{N^2-\mathbf{x^\prime}^4}{N\mathbf{x^\prime}} + x^2\frac{\mathbf{x^\prime}^2}{N}=0$$


texts: What functional encryption scheme can be used to compute a linear function?

texts:
I am looking for a functional encryption scheme that can compute a linear function. I do not need to work with attributes.

All I want is to compute the result of a function $y = a*x+b$, where $x$ is the hidden value, which I don't want to reveal.


texts: Can we share an n-bit string by using shamir's secret sharing n times?

texts:
For Shamir's Secret Sharing, with a secret of size $n$, instead of having a finite field of order $n$, can we just use Shamir's Secret Sharing $n$ times, once for each bit, using a field of order 2?

Is this still as strong as using Shamir's Secret Sharing once with a field of order $n$? Are there any other drawbacks to this method?


texts:
I am a newbie to the cryptography world. I am working on a custom algorithm that encrypts the data multiple times and results in a cipher text. It uses a different key in each round to encrypt it. I researched a lot but couldn't find any answer to this question. What do you think is the ideal number for the rounds of encryption when the keys are different in each iteration? Could you show me some math?

Alex


texts:
For part of my bachelor thesis (which will be involved in a commercial product), I need to build a cryptosystem that will be used to encrypt and decrypt continuous medical data that is transmitted from a patient to their doctor. The data must be encrypted and decrypted very fast in case of emergency.

Which encryption algorithm should I use? I think I should use AES. Should I involve a public key encryption to exchange shared keys? But I am afraid it may slow down the system and compromise the consistency of data transfer.

Update: The data will be sent from wearable devices on a patient to their doctor so the computing power might be limited.
My thesis will not touch on the hardware and networking aspects directly. However, they should be included in the discussion and analysis of my report.


texts:
I am not sure whether this is common sense, but I really don't know what this $c$ means in an equivalent sign, from Lindell's How to Simulate It:

$$\big\{(S_1(1^n, x, f_1(x,y)), f(x,y))\big\}\stackrel{c}{\equiv}
\big\{(\mathsf{view}^\pi_1(x,y,n),\mathsf{output}^\pi(x,y,n))\big\}_{x,y,n}$$
$$\big\{(S_2(1^n, x, f_2(x,y)), f(x,y))\big\}\stackrel{c}{\equiv}
\big\{(\mathsf{view}^\pi_2(x,y,n),\mathsf{output}^\pi(x,y,n))\big\}_{x,y,n}$$


texts: Is LibreSSL affected? - Downgrade Attack on TLS 1.3

texts:
https://news.ycombinator.com/item?id=19111707

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/february/downgrade-attack-on-tls-1.3-and-vulnerabilities-in-major-tls-libraries/

No one knows that LibreSSL is affected by CVE-2018-12404, CVE-2018-19608, CVE-2018-16868, CVE-2018-16869, and CVE-2018-16870 or not.

Does anybody has any info about it?


texts: Complete crypto attack explanation or hierarchy including statistical attack, entropy attack, correlation attack, differential attack?

texts:
How exactly statistical attack(resistancy tested using histogram analysis), entropy attack(resistancy tested using entropy information), correlation attack(resistancy tested using correlation coefficient), differential attack(resistancy tested using npcr & uaci) and brute force attack(calculated from keyspace) are categorized in common cryptographic attack?
Can anyone give me a brief explanation or a good reference that explain complete set of crypto attack which include statistical attack, entropy attack, correlation attack, differential attack and brute force attack?
It would be great to have a complete crypto attack hierarchy that include all of those attacks. i've been trying to find a good literature that explain it completely but cant find any that include all of the above mentioned attack completely.


texts: if a hash is difference-unpredictable, will it keep unpredictable given an offset?

texts:
Let $H(k,m)$ an universal hash function that is difference-unpredictable.

Let $\mathcal{A}$ be an attacker who sends tuples $(m_0, m_1, \delta)$, and $\mathcal{A}$ wins the game if one of the tuples satisfy $H(k,m_1) -H(k,m_0) = \delta$.

$H$ will be difference-unpredictable when the chance of $\mathcal{A}$ win is negligible.

Suppose $H$ is difference-unpredictable, how can I show that the function $H'((k,x),m) = H(k,m) + x$ will also be?

Both functions' image is all naturals smaller than a given prime $p$, one can think of the functions like $H(k,m) = (...)\bmod p$.

I think the proof remains on this argument:

the attacker chooses $(m_0, m_1, \delta)$
let $H(k, m_0) = h_0$ and $H(k, m_1) = h_1$
let $d$ be the "wrapping" distance from $h_0$ to $h_1$, that is:

$d = h_1 - h_0\;$ if $\;h_0 \leq h_1$
$d = p - h_0 + h_1\;$ if $\;h_0 > h_1$

If $H'$ only offsets $h_0$ and $h_1$ by $x$, the "wrapping" distance will be the same and it will give no better chance for the attacker to guess a difference change in the results and his chance will remain negligible.


texts: I want to know if we use function H as random oracle in RSA Blind Signature and assume that RSA Assumption is correct, is it true that the RSA blind signature schema is secure?(i.e. There isn't any adversary who can create a valid signature on a message that he doesn't queried to signer oracle). Intuitively, I think this is true, but I can't prove it formally. Does anyone have an idea?


texts: Are two outputs of a PRF computationally indistinguishable when the keys are somehow related?

texts:
This question is related to my previous question “Are two outputs of a PRF computationally indistinguishable when using two different keys??”, but in this question the keys are related.

Assume $c_i$ is a counter: $c_i \in \{0,1,..., n\}$. Also, let $k$ and $k'$ be  two independent keys.
Let $f(.)$ be a pseudorandom function. Let $x$ be an input (or fix value).

When $c_i=0$  : $\ z_i=f(k,x)$
When  $c_i \in \{1,2,... n\}$: $\ z'_i=f(k+k'_i,x)$, where $k'_i=f(k',c_i)$.

Question: Are $ z_i$ and  $z'_i$ computationally indistinguishable?


texts: Security of certain homomorphic encryption scheme

texts:
Is the following homomorphic encryption scheme:

Ahmed El-Yahyaoui and Mohamed Dafir Ech-Chrif El Kettani, A Verifiable Fully Homomorphic Encryption Scheme for Cloud Computing Security (April 2018, at arXiv)

known to be secure/vulnerable against certain attacks? It sounds a bit to good, to be true.

___________-


texts: Is there an algorithm to derive a 1-of-N shared secret from a set of N private keys?

texts:
This is different from Shamir's Secret Sharing in that we are starting with the keys and deriving a shared secret, rather than the other way around.

Let me be more precise:

We are given keys $k_1, \ldots, k_N$. We wish to derive a shared secret $S$ and a public datum $D$ such that:

$S$ is the same size as the $k_i$ (i.e. it is an element of the same key space).
$D$ is as small as possible -- hopefully no bigger than $S$ (but I'll take what I can get).
$D$ together with any one $k_i$ is sufficient to recover $S$, but insufficient to recover any of the $k_j$ (for $i \ne j$).
$D$ alone is insufficient to recover $S$. (This is to preclude trivial solutions like making $S$ constant.)

Can anyone suggest an algorithm, or convince me that this is impossible?

If no one solves this I may accept a partial solution that satisfies a subset of the above criteria.


texts:
Show that if $n = 35$ is used as an RSA modulus then the encryption exponent $e$
always equals the decryption exponent $d$?

What I have so far:

$n = 35$

Therefore $p = 5$ and $q = 7$ or vice versa, which means Euler's phi function is

$\varphi  = (5-1) \cdot (7-1) = 24$

Then to find $e$ we need the fact that $\gcd(e,\varphi) = 1$

$\gcd(e, 24) = 1$

Therefore the possible values of $e$ are only prime. $e = 5, 7, 11, 13, 17, 19, 23$

Then $d$ must follow the equation $d \equiv e^{-1} \mod \varphi$ or $(d\cdot e) \equiv 1 \mod 24$

Then I've tried for all those values which solve that equation. Why is that true? How can I explain this?


texts:
Alice holds a secret $a \in X$. Bob holds a secret $b \in X$. Is there a protocol that lets them compute

$f(a, b) = \begin{cases}
1 & \textrm{if } a = b \\
0 & \textrm{else}
\end{cases}$

If $a = b$ the protocol must always succeed.

If $a \neq b$ they should not learn anything else about each others secret.

Of course an adversary could always just pick a random value and succeed with probability $\frac{1}{|X|}$. So an error rate $\frac{1}{|X|} + \epsilon$ is accaptable.

If $|X|$ is sufficiently large, then they could just exchange hashes and compare.

Is there also also a protocol for very small $|X|$?


texts: Can I get successful signature verification with just altering message and signature?

texts:
Assuming I can modify a message and also modify the verification signature, and I also have the public-key but not the private-key. Can I create a message that can be verified with a signature that I can create and get a successful verification operation ?

I'm using the RSACryptoServiceProvider.VerifyHash method, we calculate rgbHash = sha1(message)

RSACryptoServiceProvider.VerifyHash(
      byte[] rgbHash,
      string str, //we used SHA1
      byte[] rgbSignature
)

Is there any possiblity to make a successful verification with just modifying message and signature, and without modifying public-key ?


texts:
We know that a good hash function is a one way/trapdoor function.  Easy to calculate one way, harder to work out a previous state.
I was wondering if anyone knew a good hashing system that allowed you to calculate an arbitrary number of steps into the state future.
E.g. instead of running the hash function 10,000 times to find out the h^10000(X), you could use a function to calculate what that would be , e.g.  H(X,10000).
Thus, having a "fast forwarding" hash function that is fast in one direction, but provably hard in the other.
Anyone have knowledge/experience/ideas here?  Much appreciated.


texts: How can one construct the weakest S-box ever?


texts:
Can anyone tell me the specific equations and steps for dividing a point on an elliptic curve by 2?

For instance, I have the point $(P_x, P_y)$, and I would like to find the point $(R_x, R_y)$ which when doubled yields $(P_x, P_y)$.

It was suggested that I use the point doubling equations and solve, but I am looking for the specific equations and steps and perhaps a reference to thorough discussion of the topic.

Thanks for your time.

EDIT:  I was under the impression that it would be the same steps for all curves.  In this instance I am trying to do it on the secp256k1 curve.


texts: What is the best way to attack enigma without any a priori knowledge about the plaintext?

texts: I know in great (great great great) detail about how they cracked enigma during the second world war. Looking into it, I decided to have a crack at breaking it. I've come apon a single problem with my (theoretical) attack(s) - the most efficient way to crack plugboard settings. So, is there an attack that is more efficient than bruteforcing the plugboard, when the plaintext could be anything (Cribbing being useless)


texts: Shamir secret sharing scheme only works with certain parameters

texts:
im doing a small programming project, where I have to implement shamirs secret sharing scheme.
I want to share the secret S = 21426848149916227113669602
I want a k of three, meanng that three shares can recontruct my secret, so I need a second degree polynomium.
First I create my function of the form:
f(x) = ax^2 + bx + c

and pick random values 8 and 10 for a and b. I then plot my secret in for c, which is where f(0)
 f(x) = 8x^2 + 10x + 21426848149916227113669602

I then create three shares by generating 3 integers between 1-5, as an example. this can results in the following shares as points
(3.0, 21426848149916227113669704.000)
(4.0, 21426848149916227113669770.000)
(2.0, 21426848149916227113669654.000)

And now using these three points, I can reconstruct my function, and call f(0). If ayone would like to see, this is how I have implemented it in kotlin:
fun langraged(cord0 : Pair<BigDecimal,BigDecimal>,cord1 : Pair<BigDecimal,BigDecimal>,cord2 : Pair<BigDecimal,BigDecimal>) : (BigDecimal) -> BigDecimal{
    val L0: (BigDecimal) -> BigDecimal = { x -> ((x - cord1.first)*(x - cord2.first)) / ((cord0.first - cord1.first)*(cord0.first - cord2.first))}
    val L1: (BigDecimal) -> BigDecimal = { x -> ((x - cord0.first)*(x - cord2.first)) / ((cord1.first - cord0.first)*(cord1.first - cord2.first))}
    val L2: (BigDecimal) -> BigDecimal = { x -> ((x - cord0.first)*(x - cord1.first)) / ((cord2.first - cord0.first)*(cord2.first - cord1.first))}

    return { x -> cord0.second * L0(x) + cord1.second * L1(x)  + cord2.second * L2(x) }
}

But here's is the thing, if I choose some other values for a and b, it fails once in a while in reconstructing f(0), with output values that are just slightly off. THe same starts happening when I generate my shares in a higher interval than 1-5.
Am I missing some important points in how I am picking these parameters to the secret sharing scheme?


texts: practically verifying block ciphers strength

texts:
How do we verify practically the strength of a block ciphers? Most of the security analysis of block ciphers is usually around theoretical analysis and proofs in some random oracle model etc.

For example, for our recently designed FNR encryption scheme, we have only given results based on previously done theoretical work by Naor and Reingold. That is
if $r$ is round count, $n$ is number of bits of input domain, $m$ is number of queries an attacker needs to make, then the security measure for FNR, is defined as below.

\begin{equation}
\begin{split}
& ( r/2 * m^2 /  2^{(1- 1/r)* n }) \; \textit{ where r $\geq$ 4 }
\end{split}
\end{equation}

But how do we practically verify this by experimental results? What about cryptanalysis tools?

I believe such tools would help any one who is designing block ciphers in general.


texts:
Assume that $F: \{0,1 \}^n \rightarrow \{0,1 \}^n$ is PRF. Examine if the following functions are PRFs:
$$
\begin{align}
1. \, F_1(k,x) &= F(k,x) \oplus x \\
2. \, F_2(k,x) &= F\left(F(k,0^n), x\right) \\
3. \, F_3(k,x) &= F\left(F(k,0^n), x\right)|| F(k,x)
\end{align}
$$
where $||$ denotes concatenation.

Attempt:
For $1.$ a standard distinguisher would be: $x_1 \oplus x_2 == y_1 \oplus y_2$, where $x_1, x_2$ are two inputs and $y_1, y_2$ are their outputs respectively. So $F_1$ is not a PRF.
For $2.$ I believe that $F(k,0^n) = k'$ acts as a key, so $F_2(k',x) = F(k',x)$ should still be a PRF.
For $3.$ I would say that the concatenation of two PRFs would still be a PRF, since you combine two pseudorandom outputs together to yield $F_3$'s output.
Can you verify my results?


texts: Honest Verifier Zero-Knowledge Game for Sigma Protocols

texts:
I am looking for how an adversary to special HVZK would work. In Boneh and Shoup's book (BonehShoup) they have Attack Game 20.4 for special cHVZK.
Here, the adversary produces a pair (x,y) (witness and statement) and sends it to their challenger, who either uses P and V or Sim to produce the transcript.

Can I modify this game in the following ways?

Can the adversary generate the challenge?
Can I have the adversary ask on polynomially many challenges instead of just one? Why is he limited to a single output here?


texts: How to perform Multiplicative Inverse Modulo in IDEA

texts:
How to perform the Multiplicative Inverse Modulo in International Data Encryption Algorithm? I don't understand on how to perform it…

For example, let's say I have a value of cf80 and the value that is appearing to me is this 3080. This is the thing that I've done based on my understanding:

answer = 53120 % 65537
53120(integer value of 3080) = 3080

When I convert the result in hexadecimal, the value is 3080 but the correct result should be 9194.


texts: Uses of digital signature in asymmetric cryptography

texts:
May I know what could be some advantages and disadvantages of doing the below in an asymmetric crypto process. What could be some of its primary and common uses?

Produce a digital signature on the plaintext, encrypt both plaintext and digital signature, and then produce another digital signature on the ciphertext


texts:
Oblivious Ram (ORAM) is a cryptographic technique that is used for secure DB querying without leakage on the access patterns. There are several schemes for ORAM, amongst the most popular ones, there is Path ORAM.  However, and as far as I understand it, ORAM is tied to a client/server(s) configuration, in other words, it let a given client outsource DB services. In this, case the DB belongs to the client, and security follows from the server not learning anything from the DB content and the access pattern. My Question is as follows:

In the case the DB does not belong to the client, and the definition of security is expanded such that the server does not learn anything from the query but also the client does not learn anything from the DB, except the result of query (A third party DB), can I still use ORAM, how should I do it? and how an scheme like Path ORAM would work instead? Any insight on this precise topic is more than welcome!


texts: How to distributively compute a secret of that form $\mathsf{s=sk\cdot g^a}$?

texts: Is there a standard way to distributively compute secrets shares such that any $t+1$ combination out of $n$ of them constructs the secret $\mathsf{s=sk\cdot g^a}$, for a generator $\mathsf{g} \in \mathbb{Z}_p$ and $\mathsf{sk,a}$ chosen uniformly at random from $\mathbb{Z}_p$


texts: order between adversaries and type of resources given

texts:
We have a game $G0$ for which an adversary $A$ has access to a certain amount of ressources. Let us suppose that the maximum advantage for the adversary to win this game is $Adv_{G0}$.

If we modify slightly the game $G0$ into the game $G1$ in such way that we give an additional information (useful or not) to this adversary.

Can we state that $Adv_{G0} \le Adv_{G_1}$ ?

If we consider indistinguishability games for encryption, the first one with CPA attack, the second one with CCA attack. Can we state that $Adv^{CPA} \le Adv^{CCA}$ ?


texts: Does the timing of cycle-walking pose a threat?

texts:
Cycle-walking is a technique for format-preserving encryption that involves repeating an encryption process until the result is inside a desired range.

For example, given an input P, a range R, and an encryption function E.

C := E(P)
Is C in R?
  yes?
    Output C and quit
  no?
    C := E(C)
    Try again

My question is, does the variable timing of this pose a threat? It isn't constant time, but the time is dependant on E(P), which in theory shouldn't be a problem.


texts: Is Shamir's Secret Sharing Scheme insecure for larger field?

texts: According to wikipedia, if you are using shamir's secret sharing scheme with a field of order $p$, "High values of $p$ are risky because Eve knows that the chance for $f(x)\pmod{p}=f(x)$ increases with a higher $p$". Is this true? It seems wrong.


texts: Can I use my random IV (for AES) as a salt for PBKDF2?

texts: Also, where do I store my salt (can I just store it at the beginning of the encrypted file)?


texts: Is power of non-negligible function non-negligible?

texts: If I have a probability which is > negl(n), i.e., non-negligible, will be this probability raised to the power of n also non-negligible?


texts: Key derivation with Curve25519 for data encryption

texts:
I'm new when it comes to cryptography so this question might be a little bit stupid:

Can I derive a key with Curve25519 from a (let's say) root key and encrypt the file with a secret key algorithm? Or should I better use a key derivation function like PBKDF2?


texts: How to construct a strong Fiat-Shamir in zero-knowledge proof?

texts:
I'm new to zero-knowledge proof. Recently, I'm implementing a non-interactive zero-knowledge proof using the Schnorr scheme. I understand the non-interactive zero-knowledge proof needs random oracle for a prover to generate a proof along with a hash. Others suggested that I need to use Strong Fiat-Shamir to generate the hash.
Could you please give me some points about how to use and implement the strong Fiat-Shamir?  What should be included in this Hash?


texts:
I need an algorithm for "key generator". It should be initialized with some secret data, such as a (hashed) passphrase, or something generated once by some 3rd-party code.

Given some small input it should be able to generate N bits in a deterministic way, which'd be used as a material for some key. The input consists of a needed key index, and, perhaps, some other flags and parameters.

Naturally the generated keys should not reveal other keys or the generator secret.

What is the preferred way to do this? Is it ok to just hash all the input?
I mean:

K = H(input | secret)

whereas H - is a common hash function (such as SHA-256)?

To be concrete, I need a sort of a DRBG, whereas:

I don't really care about preimage attacks and etc. It's not intended for message authentication. I believe there's no need in HMAC.
The generator must be immutable, i.e. should not mutate after each generation (like auto-hashing).
It should work in O(1) wrt the key index. In simple words, generating k'th key should be no harder than generating the first one.


texts: Break an encryption made with XOR of a key and a known Nonce

texts:
My questions is general, but in my case regards the Kerberos protocol and the communication between the client first message and the KDC.

Is there some problem in encrypting using a: (secret key XOR public nonce), instead of the reply that only use the secret client key?

That is - the key is known only to the user, but the nonce was sent public and is known to all.

Now, the reply would be encrypted using the XOR of them both.

Is there a way to manipulate this situation, maybe to use a XOR of nonce^(-1) or to send a "bad" nonce (which is good for the attacker) in order to decrypt the reply from the KDC in order to get the ticket of another user?
I have a feeling that there might be something wrong here but can't think on any attack.

Thank you,

Oron


texts: Why does a Galois field have to have an order of $p^n$ where $p$ is prime?

texts: I was reading about this in a cryptography book last night.  I have a hunch about this, but I can't quite put my finger on it.  I think this is a similar situation to an affine cipher, where the multiplication factor has to be relatively prime with the size of the alphabet in order for the function to be surjective.  Obviously for practical purposes, it would have to be $p^n$ where $p$ is the arity of the number system and $n$ is the bit width of a memory unit.  But is there also a theoretical basis for requiring that a Galois field be of size $p^n?$


texts: How can one protect against a Man In The Middle attack during key exchange without using certificates?

texts:
Besides using a certificate to defend against a man in the middle attack

during a key exchange, what methods can be used?


texts:
Sorry if I don't express myself well in English.

The solutions $h$ and $k$ of

$$[(h+1)^2]*[(2*h+2)^2/2-1]=X* M$$

and

$$[(k+1)^2]*[(2*k+2)^2/2-1]=Y*M$$

are such that each $M$ number divisible by $9$ has these characteristics:

$$(h+1)/3=(k+1)/6$$

and

$$k+h+2=M$$

and $M$ is a divisor of a sum of odd consecutive cubes from $1$ to $u=2*h+1$ and from $1$ to $v=2*k+1$

So we're going to look for numbers divisible by $9$ in this way:

let $N =a*b$ be a number to be factored then $N-(2 * s)^2-2*s*n=M$

where $n=b-a$ and $s$ goes from $1$ to $8$

Therefore, if $N != 9*c$ we will have $8$ formulas.

Solving:

$[(h+1)^2]*[(2*h+2)^2/2-1]=X*(N-(2*s)^2-2*s*n)$

,

$[(k+1)^2]*[(2*k+2)^2/2-1]=Y*(N-(2*s)^2-2*s*n)$

,

$(h+1)/3=(k+1)/6$

,

$k+h+2=(N-(2*s)^2-2*s*n)$

,$h$,$Y$,$X$,$k$

example $N=209$

for $s=1$

Solving:

$[(h+1)^2]*[(2*h+2)^2/2-1]=X*(209-4-2*n)$

,

$[(k+1)^2]*[(2*k+2)^2/2-1]=Y*(209-4-2*n)$

,

$(h+1)/3=(k+1)/6$

,

$k+h+2=(209-4-2*n)$

,
$h$,$Y$,$X$,$k$

We will have:

$-16*n^3+4920*n^2-504282*n+17228405=X*81$

Now comes the part I don't understand, and I thought I'd use the Coppersmith method (if one can use it).

Since the maximum $n$ in a generic number to be factored in the integer part of $N/3-3$, so in our case the integer part of $209 / 3-3$ = $66$.

$[(66^3)/81] = 3549,...$ so we will take $P = 3557$

$-(3557*16)*n^3+(3557*4920)*n^2-(3557*504282)*n+(3557*17228405)=X*(3557*81)$

Now we know that there exists n0 such that |n0|<(3557*81)^(1/3) and that

$-(3557*16)*n0^3+(3557*4920)*n0^2-(3557*504282)*n0+(3557*17228405)=0 \pmod{81*3557}$

Now to use the Coppersmith method my questions are:

should the coefficient of $n ^ 3$ be $1$?
should the $GCD$ of all the coefficients of $n$ and $P * 81$ be $1$?
If we know the factorization of $81*P$, can we benefit from it?
What is the problem with using the Coppersmith method for $N$ with $1000$ digits?

EDIT $13$ September $2019$ :

$-16*n^3+4920*n^2-504282*n+17228405=X*81$

to make the coefficients less than $81$

we can do so

$-16*n^3+4860*n^2+60*n^2-504225*n-57*n+17228376+29=X*81$

$-16*n^3+(60*81)*n^2+60*n^2-(6225*81)*n-57*n+(212696*81)+29=X*81$

then

$-16*n^3+60*n^2-57*n+29=A*81$

Now is it easier to solve it?


texts: Does size matter in case of attack on LUKS partition?

texts: Does the size of the LUKS partition affect the difficulty of a brute force attack, or would it not make difference? For example, would a 100MB partition be easier to attack than a 100GB partition?


texts: Is there any SRP-like key exchange only using "standard" cryptographic primitives?

texts:
I am looking into PAKEs (password-authenticated key exchanges), and it seems like SRP (Secure Remote Password) is essentially the de-facto standard.

However, implementing SRP actually requires doing modular arithmetic, and is similar to, say, implementing Diffie-Hellman. That is, you'd have to have constant-time exponentiation algorithms, a fast bignum library, and getting one of any of these subtly wrong and you might have a terrible side-channel attack.

And unlike algorithms like AES or Curve25519, there aren't many crypto libraries that contain a primitive for SRP, so "rolling your own" is often unavoidable anyway.

Are there any PAKEs that instead of using "custom" mathematics like SRP, simply is implemented in terms of more standard primitives, such as "any secure cryptographic hash", "any secure Diffie-Hellman-like exchange", "any secure signature scheme"? It would be a lot more obvious that it's secure - SRP isn't obviously secure at first glance unless you actually follow the reduction to the discrete log problem - and a lot easier to securely implement providing you have secure implementations of the primitives.

For example, I could think of a weak PAKE, where you simply do a Diffie-Hellman key exchange, but both parties attach a MAC to the ephemeral public keys derived from the password. This is obviously secure if the password is strong, but unlike SRP an attacker gains enough information for an offline brute-force attack, and the server has to store the password in plaintext.

I'm looking for whether there are PAKEs similar to SRP in strength that are as easy as the above weak scheme to intuitively understand and implement in terms of other primitives.


texts: Can every signature scheme be transformed into a public-key encryption scheme?

texts: I am reading about Signing vs. Public-Key encryption and a question pop up in mind that is it possible to transform any signature scheme to a public-key encryption scheme?


texts: Let's consider a random variable X that can produce the output $c$ with probability $1/4$. I was told that $-\log_{2}(\frac{1}{4})$ represents the number of bits needed to represent $c$. But, imagine that X can produce the output $c$ with probability $1/4$ and the output $b$ with probability $3/4$, then I only need $1$ bit to express $c$, for example, $0=c$ (and $1=b$). Why am I wrong?


texts: What does "circuits" mean in Cryptography?

texts: I am not a hardcore cryptographer so this might be a really stupid question. I am looking through some papers in homomorphic encryption and discovered they describe computation as "circuits", why do they use this particular term? Isn't algorithm a more suitable word? Do "circuits" have some special meaning in cryptography?


texts: Decrypt RSA ciphertext with two middle bits leak

texts:
Given RSA public key (e.g. 1024 bits) and decryption oracle that outputs 2 middle bits of decrypted ciphertext (pow(ciphertext,d,n) >> (1024/2)) & 3, how can we decrypt whole message?

Question related to "Pinhole Attack" task from Tokyo Westerns/MMA ctf.


texts:
I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity.

My key derivation function currently looks like this:

Please note that scrypt could just as easily be subbed out for PBKDF2 or bcrypt, that remains to be seen.

I have a couple questions:

Does input truncation using SHA-256 expose any potential weaknesses?

My reasoning for doing it in the first place is because many algorithms like bcrypt only accept a limited password input size. (bcrypt seems to accept up to 55 or 72 characters, not sure on the source of this)
Would it be better to prefer a hash method with a longer output, ie SHA-512?

When generating the HMAC authentication and encryption keys, would I benefit at all from using SHA-512?

AES-256 IIRC needs 256-bit keys, so if I either used AES-192 or used SHA-512, how would I go about fixing the discrepancy in required size?


texts: Why is the server's public key always used in SSL encryption and never the client's public key?

texts:
I spent a lot of time looking for an answer to this question, but the majority of answers never explicitly explain why the client's public key is never used; it's always the server's public key that's used in SSL encryption. Similarly-phrased questions (such as this, this, and this) don't actually explain why the server's public key is not used. Rather, they just explain why public-key encryption is not used for the actual messages, or they explain some other topic instead.

So, my question is: why do we not use the client's public key in SSL encryption instead of using the server's public key? Theoretically, it shouldn't matter whether the client's public key or the server's public key is used, right, since in either case a master secret key is always established?


texts: How are boolean functions used in cryptography?

texts:
I recently started becoming interested in Boolean functions. Because they are defined as $f: \{0, 1\}^n \rightarrow \{0, 1\}$, or in other words only over $\{0, 1\}$, I guessed they can somehow be applied in cryptography. After all in cryptography (in some sense) we have an input which can be defined as bits, and then we do some kind of operations on those bits to scramble them.

Additionally, many algorithms (like BLAKE, ChaCha20, etc.) use the ARX (addition-rotation-xor) method. And as long as I know some parts of AES does the same. I have already read that Boolean functions are important for the design of S-boxes, but I want to learn how more they are applied in cryptography.

So, how and where (hash functions, block ciphers, stream ciphers, public key cryptosystems, etc.) are the Boolean functions used in cryptography (either for designing algorithms or cryptanalysis)? Can they be used in some more complex algorithms that are based on things like finite field arithmetic, elliptic curves, lattices, etc?


texts: What encryption types are illegal in the U.S.A

texts:
I live in the USA. I am a developer, interested in creating an application with encryption. I am interested in learning what the illegal/restricted encryption types are.

Clarify:

What are the encryptions that are not accessible to a regular programmer that is not working for a company.


texts:
The National Institute of Standards and Technology (NIST) recommended elliptic curve domain parameters to have names such as “secp…” and “sect…”.

For example: “secp224k1” and “sect571k1”.

What is the difference between “secp…” and “sect…”?


texts: How does the polynomial modulus work in the Fan-Vercauteren scheme?

texts:
I'm reading this introductory blog on the Fan-Vercauteren
 scheme and there are a few things I don't understand about polynomial moduli. The author uses practical examples:

  Because we are considering remainders with respect to $x^{16}+1$, we only have to consider polynomials with powers from $x^0$ to $x^{15}$. Any larger powers will be reduced by division by the polynomial modulus. This can also be understood by considering that $x^{16}\equiv −1(\mathrm{mod} \ x^{16}+1)$, meaning that $x^{16}$ can be replaced by -1 to reduce the larger powers of x into the range 0 to 15.

I don't understand the third sentence at all, $x^{16} \equiv -1$?

Further down the tutorial, there is a practical example of polynomial multiplication followed by a division by polynomial modulus:

  When we multiply two powers of x, say $2x^{14}$ and $x^4$, we add their exponents - making $2x^{18}$. One might assume that finding the remainder of this polynomial with respect to the polynomial modulus might involve just rotating the exponent back through 0 at $x^{16}$, to give $2x^{2}$, like it does for the integer coefficients shown above. This would be the case if the polynomial modulus was just $x^{16}$. However, our polynomial modulus is $x^{16}+1$ - as mentioned above, the extra plus one factor introduces a sign change which helps further scramble the result of the multiplication.

How does this extra plus one factor introduce a sign change?

and finally:

  ...multiplication of a term $2x^{14}$ by $x^4$ modulo $x^{16}+1$ takes this term (represented by the red dot above), rotates it forward 4 powers around the torus, and then reflects the value across the 0 point, making $22x^2$ (or $−2x^2$ if we consider numbers from -12 to 11 rather than 0 to 23).

$2x^{18}$ modulo $x^{16}+1 = 22x^2$, how?


texts: Computing the powers of hash (ripemd-160) function

texts: Is there a way I can compute $2^{100}$th power of ripemd-160 of my string, just like I can do with square matrix powers? I.e. can I easily compute ripemd-160 large amount of times?


texts:
Say we have a public network and lots of peers.   Each may need to communicate with another peer.

Would there be any huge security issue to each peer making the the public part of their key openly available across the network?

In this way, any other peer in the system could automatically calculate a secret to communicate with them.   (e.g. using the secret as the AES encryption key)

Any caveats or issues welcome, thank you.


texts:
What is the expert cryptographic opinion on the following?

Assume that there is a web server and a Client on web page who calls an OTP ([One-Time Password]) web service on the server which:

creates a RSA key pair
generates a random 10 digit string - the Message
Encrypts the Message with the Public Key component to generate an OTP
Returns the Message and Private Key to Client
Sends OTP via an alternate channel (say SMS) to User on a mobile

The reason for this kludge is that the web service return can be a script that gets added to the DOM on the fly. The script contains the RSA decrypt method with a built-in Private Key and has the Message as the validator. When User enters the OTP into the web page, the validator succeeds or not.

The advantage in this method is that the OTP does not need to be stored in a server-side database, and there is only one web call-out with the browser doing the validation. However, I am unsure whether RSA was meant to have a private Public Key and a public Private Key.

What is the analysis on whether a malicious user can get the Private Key and Message and then compute the OTP? If so, then could I make the OTP entry time bound so as to minimize the attack possibility? Is there a better way to fulfill my requirements?


texts: Do a 160-bit SHA-1 hash and a 160-bit slice of a SHA-256 hash have the same strength in terms of collision-free?

texts: Take OpenPGP fingerprint for example. If the 40-digit hex standard remains unchanged, would it be helpful to upgrade SHA-1 to SHA-256 (but only taking the last 160 bits), in terms of reducing the risk of collision?


texts: In the McEliece cryptosystem, is choice of the code known to the attacker? And if a structural attack succeeded and the attacker found the generator matrix of the code, how did the attacker decode the encrypted message?


texts: Subexponential algorithms that apply only one of factoring and discrete logarithm?

texts:
Shor (quantum polynomial), Number Field Sieve (subexponential), Pollard rho (square root) all have both factoring and discrete logarithm over $\mathbb F_p^*$ variants.

What are the subexponential techniques that only applies to

balanced semiprime integer factoring but not to discrete logarithm over some cryptographically important structures including $\mathbb F_p^*$ and Elliptic Curve Discrete Logarithm?

balanced semiprime integer factoring but not to discrete logarithm over all cryptographically important structures including $\mathbb F_p^*$ and Elliptic Curve Discrete Logarithm?

discrete logarithm over some cryptographically important structure including $\mathbb F_p^*$ but not to balanced semiprime integer factoring?

Please provide references appropriately.


texts:
I just stumbled across a Stack Overflow post which points out that the libmcrypt library (notably used in PHP) implements a somewhat unusual set of block cipher modes: it calls the usual CFB and OFB modes, with full-block feedback, "nCFB" and "nOFB" respectively, and implements the CFB-8 mode as just "CFB".

Besides the somewhat unconventional (and potentially confusing) naming convention, there's nothing novel there.  However, it turns out that libmcrypt also features an 8-bit shift register variant of OFB mode, called simply "OFB", which is described rather curiously in the documentation:

  "OFB: The Output-Feedback Mode (in 8bit). This is a synchronous stream cipher implemented from a block cipher. It is intended for use in noisy lines, because corrupted ciphertext blocks do not corrupt the plaintext blocks that follow. Insecure (because used in 8bit mode) so it is recommended not to use it. Added just for completeness."

Ignoring the weirdness of a library supporting an encryption mode that its own developers describe as "insecure" and recommend "not to use it", I started wondering — is it really insecure?

It's well known that OFB mode keystream generation is equivalent to encrypting an all-zero message in CFB mode.  Thus, if CFB-8 mode is IND-CPA secure (and it is, at least when used with a random IV), so that, in particular, the encryption of an all-zero message cannot be distinguished from a random bitstring, then neither can the XOR of this ciphertext with an arbitrary message.  Doesn't that imply that this "OFB-8" mode is IND-CPA secure, too?


texts: Is this a safe way to prove the knowledge of an ECDSA Signature?

texts:
I think that I've found a good solution to prove the knowledge of an ECDSA signature without revealing it.
In short terms it consists in generating an ECDSA signature using the point $R$ as generator, $s$ as private key and the result of $s*R$ as public key. So the $r$ part of the signature would be revealed but the $s$ part is still kept secret.

The usual ECDSA signature generation consists in proving that given a point $Qa$ where $Qa = da*G$ you know the number $da$ without revealing it.

To do so, the signing process works as following:

step 1. The signer calculates a new point R such that $R = k*G$ and where $k$ is a nonce that needs to be changed for every new signature.
step 2. The signer sets $r$ such that $r$ is the x coordinate of the point $R$
Step 3. The signer calculates $m$ such that $m = HASH(message)$.
Step 4. The signer calculates $s$ such that $s = k^{-1}(m+da*r)$
Finally the signature are the values $(r,s)$

The verification of the signature's authenticity is verified by ensuring that:

$R = s^{-1}m*G + s^{-1}r*Qa$

or that:

$s*R = m*G + r*Qa$

So what is done to prove the knowledge of the $s$ part from the signature such that $s*R = m*G + r*Qa$ and this without revealing $s$. This is exactly what we already did with $Qa = da*G$! The only difference is that instead of using the point $G$ as a generator we use $R$ and instead of generating a private key $da$ we use $s$

So the solution is to reveal:

$m$
$R$
$Qa'$ such that $Qa' = s*R$
$R'$ such that $R' = k'*R$ where k' is a nonce you generated
$s'$ such that $s' = k'^{-1}(m'+r'*s)$ and where $m'$ is the hash of a message you want to sign with your derived private key $s$.

The verification is done in a two step process:

step 1. verify that $Qa' = m*G + r*Qa$
step 2. verify that $s'*R' = m'*R + r'*Qa'$

Is this process vulnerable to forgery?
Are there other known proof of signature knowledge for ECDSA signatures?


texts:
I was learning Asmuth-Bloom's threshold secret sharing scheme. I was working out an example as given in this Wikipedia article.
As per the example, the secret, d is 2, the number of shares, n is 4 and threshold, k is 3.
The list of relatively prime integers, m is [3,11,13,17,19] and it follows the criteria $m_1.m_2.m_3 > m_0.m_3.m_4$.
As per the example, the shares are generated as $1$ $mod$ $11$, $12$ $mod$ $13$, $2$ $mod$ $17$ and $3$ $mod$ $19$. The example then regenerates the secret using the shares $1$ $mod$ $11$, $12$ $mod$ $13$, $2$ $mod$ $17$.

However, when I tried to reconstruct the secret using two shares ($1$ $mod$ $11$ and $3$ $mod$ $19$) I could regenerate the secret, which is against the threshold property.

I tried for multiple examples and this was true for all cases.

Can somebody explain if I am wrong somewhere or if there is a limitation in the threshold scheme?


texts: What would make it impossible to deny that decryption of a package has taken place?

texts:
I'm part of a team designing a system where a user have to be able to read a certain package, if he has preformed an action or series of actions that makes it legal for him to do so.

The tricky part is that the user contacts the server, receives the data he needs to work with, along with the package he might have to open, performs a series of actions with the data, and reports his actions to the server. As said the package should not be read unless the right actions is reported.

So what I'm interested in knowing is if there's a way to make decrypting the file impossible without leaving traces of decryption?

I've looked into allot of different cryptographic methods, but all of them require reporting your actions to another party, but i would prefer to be able to do this without leaving the clients device.

I am hoping the bright heads of stackexchange crypto would have some ideas that might work, or at least be able to tell me if what i want isn't possible.

A specific use case could be that if for an example we're playing a game, and your opponent have a hidden unit, you can be allowed to view that unit if you choose to sacrifice some of your units, or something like that.


texts: Does Off-The-Record protocol provide future (backward) secrecy?

texts: I know Signal provides future (backward) secrecy, and that it is based on Off-The-Record protocol. However, does OTR by itself also provide future secrecy?


texts: Is CMAC vulnerable to length extension attacks?

texts:
Given $m_1, m_2$ such that $MAC_k(m_1) = MAC_k(m_2)$ is it possible to construct more collisions with pairs of the form $m_1|x, m_2|x$?

Here is the CMAC picture from Wikipedia where it is only part of the one-key MAC article:

I don't see how it could be because it treats the last block of the message differently but this was mentioned in the comments of another question so I wanted to clarify.

Here is the quote from poncho:

  CMAC and XCBC are similar to the UMAC case (even though a universal
  hash is not involved); if you find two messages that have the same
  CMAC value, it is likely that a simple length-extension to the two
  messages will allow the attacker to create other pairs of messages
  with the same MAC.

Bonus question: Are there other ways to exploit a collision?


texts: Can quantum computers solve NP-Complete problems?

texts: As far as I know, quantum computers are able to solve only some of the NP-Problems in polynomial time, using the Grovers algorithm. I read that if one manages to create a reduction of Grovers algorithm on one of the NP-Complete algorithms, for example 3SAT, then it will be a huge milestone, since we could solve all other NP-Complete problems. I also read that current quantum computers lack error-correcting qubits to create a reduction of Grovers algorithm on 3SAT. What would be a sufficient amount of qubits to solve such problem and what amount do we currently have?


texts:
Is there a difference between  PRF and a hash function?

For example: Creation of a secret key is using PRF and creating a secret key is using hash function.


texts: Generating a random number using a quantum computer

texts:
I have been looking into the creation of truly random numbers using a quantum computer, but I have been having trouble with finding resources on this problem. Is it possible to create a truly random number using a quantum computer?

In theory, my thinking is that we can prepare a qubit in the $|0\rangle$ state, apply a Hadamard to obtain a $|+\rangle$, and then measure in the logical basic to get a 0 with probability $\frac{1}{2}$ and a 1 with probability $\frac{1}{2}$. Repeat the process as many times as you want to create a random number in binary (i.e. 0110001...)

Now there are obviously problems with this practically (regarding the accuracy of our state initiation, Hadamard transform, and measurement). But is the theory correct? In theory can we therefore produce a truly random number using a quantum computer?


texts: Does knowledge of original file size provide a cryptographic weakness?

texts:
I'm encrypting files using an AES-256 CBC cipher and an SHA-256 HMAC every 64KB in the file. Since AES CBC needs an amount of input bytes to be divisible by 16, I use PKCS#7 padding to bring the amount of bytes up to a count divisible by 16 at the end of the file.

For this and for most cases of cryptography, does knowledge of the original file size expose a weakness enabling an attacker to gain an advantage in decrypting the data? If someone had knowledge of the way an encryption system works, it may be feasible for them to guess the original file size. Is this a problem?


texts: What are some design considerations for S-Boxes?

texts: My studies in cryptography have been quite detailed so far, however, one area that hasn't been explained to me is how S-Boxes are typically designed. Typically, the S-boxes are provided "as is" by the developers of the algorithm, but I am looking for information on what type of considerations cryptographers evaluate when they design an S-box. Are the numbers in the lookup table chosen at random? Are they generated mathematically? If so, what are some types of maths used and why? Feel free to choose an example cipher or two in your explanation.


texts: Do we have any library or any mechanism where we can use true 7 byte key for DES instead of 8 byte key. I need it for keys analysis in DES and 8 byte key requirement for associated library is creating problem in getting actual keys analysis.