texts: How to ethically publish the result in case we prove that P = NP?

texts: Suppose a researcher discovers that $P=NP$, and has an efficient algorithm for some common NP-Complete problem.  Given the implications for cryptography, what would be the most ethical way for them to reveal this knowledge to the world, without causing the downfall and destruction of technological civilization?


texts:
the worst-case one way function is defined as follows
$$\forall A \exists x : pr(A(f(x))\in f^{-1}(f(x)))\neq 1$$
can you give any example of such function?


texts:
I know that perturbation should be proportional to the $\text{L}_1$-sensitivity of the function if someone wants ($\epsilon,0$)-differential privacy, and proportional to the $\text{L}_2$-sensitivity of the function if someone wants ($\epsilon, \delta$)-differential privacy for $\delta > 0$.

But why is that? Can anybody describe the intuition behind the use of these two norms? Or maybe share some resources?


texts: Will two KEK's provide the same KCV or should these be different?

texts:
If you were to have an MDKac key that you need to send to two parties you would need to encrypt this key with two different KEK/ZCMKs.

Will the KCV of the MDKac under KEK1 provide the same KCV as MDKac under KEK2?

This is using DES3 - ECB encryption.


texts: AES-256 example code encrypting multiple subsections of plaintext with the same initialization vector

texts:
I have been dabbling a bit into encryption in C++ using Brian Gladman's implementation found here:

https://github.com/BrianGladman/AES

I also found some example code that uses this library found here:

http://forums.devshed.com/programming-42/aes-encrypt-decrypt-687368.html

The relevant bits of code are as follows:

void encrypt(const char *fileIn, const char *fileOut,
    const unsigned char *key) {
    ...
    /* pick a random initialisation vector */
    for(i = 0; i < 16; ++i)
        iv[i] = rand() & 0xFF;
    fwrite(iv, 1, 16, outFile);

    aes_encrypt_key256(key, ctx);
    while((i = fread(inBuffer, 1, sizeof(inBuffer), inFile)) > 0) {
        aes_ofb_crypt(inBuffer, outBuffer, i, iv, ctx);
        fwrite(outBuffer, 1, i, outFile);
    }
    ...
}

void decrypt(const char *fileIn, const char *fileOut,
const unsigned char *key) {
    ...
    /* read initialization vector from file */
    if(fread(iv, 1, 16, inFile) < 16) {
        ...
        return; /* error: file doesn't even contain an initialisation vector */
    }

    aes_encrypt_key256(key, ctx);
    while((i = fread(inBuffer, 1, sizeof(inBuffer), inFile)) > 0) {
        aes_ofb_crypt(inBuffer, outBuffer, i, iv, ctx);
        fwrite(outBuffer, 1, i, outFile);
    }
    ...
}

However, after reading through the last answer on:

Why is AES resistant to known-plaintext attacks?

It seems like that chunking the input text and encrypting each chunk using the same initialization vector is a bad idea.  I just wanted to ask if this implementation is flawed from a security perspective or is there a valid reason for encrypting each chunk of text with the same initialization vector?

In addition, are there compelling reasons for chunking the plaintext in this way to begin with (where each chunk has its own initialization vector, that is)?

Thanks in advance for any responses.


texts: What is the proper return code for C_Login when a CKU_SO attempts to log into a non-initialized token?

texts:
Looking at the PKCS#11 2.4 spec, C_Login returns CKR_USER_PIN_NOT_INITIALIZED when a "normal user's PIN has not yet been initialized with C_InitPIN".  However, I can not find anything that would be analogous to a situation when a user calls C_Login for a CKU_SO user on a token that has not been initialized using C_InitToken.

Is this just a hole in the specification or am I missing something obvious?


texts:
This may be a silly question but while reading this paper Circuit ABE from LWE, I came across this question on 2nd page - Is there an ABE scheme for general circuits with unbounded attribute length under standard complexity assumptions?.

So what exactly are general circuits? My intuition is

Suppose we have $f : {\{0,1}\}^m \rightarrow {\{0,1}\}^n$ . So the circuit implementing this function is a general circuit. Am I right?


texts: Cryptographic Principles: Bit-Flipping Attack

texts:
I'm working and reading about bit-flipping attack and how to set it up. I just got a question, which I am not sure, how I should answer.
Question: 'Why is this easy with a stream cipher but not possible with a block cipher in, e.g., CBC mode?'.
Stream cipher is a symmetric-key-encryption algorithm, which encrypts a stream of bits, where block cipher is an algorithm that allowing us to encrypt blocks of a fixed length. But I can't really find an answer why it's not possible with block cipher and possible with stream chipher.
From what I understand and can read from this thread, that it is possible, but this thread may not be relevant for me.
Anyone, that got an explanation on this?


texts: Does Ed25519 support cryptographic threshold signatures?

texts:
This is a loaded question so I'll list the concerns, not all of which need to be satisfied.

Does there exist a threshold-signature scheme for Ed25519 that...

Does not require a trusted dealer to set up the key shares (required)
Does not require interaction to set up the key shares (optional: ideally users can independently generate key pairs, but if all n users need to interact to compute the key shares, that's acceptable)
Supports arbitrary m-of-n composition, as opposed to having restrictions on m (required)
Does not require interaction to reconstruct the threshold signature from signature shares  (optional: same as 2, non-interative schemes are preferred)

Some sources claim that this is possible (e.g. https://ripple.com/curves-with-a-twist/) but I haven't seen an implementation yet.


texts: Turning a 64 bit block cipher into a 128 bit block cipher

texts:
There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical.

Is there a generic method of combining two blocks together in such a way that two 64 bit blocks can be seen as one 128 block? Is there an efficient method that could be used for CTR mode of operation (the underlying primitive for most popular AEAD ciphers)?


texts: Are Two Ciphers Better Than One? i.e. RC4 and AES

texts:
OK It's cringe time (or hopefully not)

I know this is probably a variation of an old and dragged out question or so you may think but let me ask away and hopefully get some insight.

Google a while ago famously changed from AES to RC4 because of BEAST.
RC4 however, is riddled with all kinds of leaks and problems that are well studied. RC4 can reveal a lot of information to somebody who does not know the key. In theory this can be done. In practice this has been done. WEP being the example that springs to mind strongly.

If we use the same 128 bit key to form some kind of AES (block cipher) encryption. In any mode whatsoever, whether that's ECB or more advisably CBC, CFB or whichever (you get the idea). Then we also run the same data through the RC4 (stream cipher) algorithm: do we have a distinctly stronger, much harder to break cipher-text in effect?

It then goes without saying to decrypt, we just decrypt with RC4 then AES.

Would we solve any weakness issues this way? Or is this just a waste of computing time? Any thoughts really appreciated.


texts: Deriving an encryption private key from signature private key

texts:
If I have a cryptosystem in which I require both signing and deriving a shared secret key for encryption, what is the recommended way of achieving that?

Is there any vulnerability in generating a private key and having the other private key as the sha256 hash of the first private key?

Or should I use the same keys for both signing and encryption?


texts: How does the rejection sampling lemma work in the proof of HVZK?

texts:
In this protocol,
Q1: how does the commitment work? What if the prover sends $\textbf{t}$ directly, and then sends $s_m,s_r,s_{\textbf{e}}$?
Q2: How does the rejection sampling lemma work?
refer to this paper Reference


texts: How do I attack an RSA setup where e is even?

texts:
As a challenge, we were shown an RSA setup where we have a big $n$ (617 decimal digits), $e=4$, and asked to recover three messages. (However, the messages are padded to the same length as the key with random bytes.)

I don't have a very strong background in cryptography, and this is apparently so poor that nobody bothered to explain how you'd wreck it. For instance, I've been reading the Wikipedia article on Coppersmith's attack, and it reads:

  [e=3, 17 or 65537] are chosen because they make the modular exponentiation operation faster. Also, having chosen such e, it is simpler to test whether $gcd(e, p-1)=1$ and $gcd(e, q-1)=1$ while generating and testing the primes in step 1 of the key generation.

I'm not super good at this, but given that $e$ is even, I'm pretty sure that it can't be coprime with $p-1$ or $q-1$.

How would I go around to crack it?

EDIT: as some of you have guessed, this was not RSA. Instead, the single number $p$ was a ~2048 bits prime. The crypted message was essentially $pad(m)^4 \mod p$, which could be deciphered using the modular square root twice.


texts: Encryption & decryption of integers using modular multiplicative inverse and extended euclidean algorithm

texts:
I'm looking for a neat algorithm, which is capable of encrypting an integer to another integer and decrypting it again AND is secure.

When I was in university, my professor showed me an awesome way to encrypt and decrypt integers using the modular multiplicative inverse combined with the extended euclidian algorithm. We then combined it with a base base10 to base16 conversion to make it shorter.

Now I wanted to use that algorithm again and tried to reproduce it for a whole day, but simply can't remember and/or figure it out again. I tried using Google for research, but haven't found anything usable, or let's say only non-understandable stuff for a math noob like me.

So, what I'm looking for is something like this:

n = 12345678        // number to encrypt, whereas 0 < n < 16^6
k = ????????
m = ????????

// I can't remember the exact calculation,
// but if I'm not too mistaken, it should
// look very similar to this
i = n * k % m       // 1 - 8 digits

r = base10to16(i)   // 1 - 6 letters

// Now it should be possible to decrypt it
// again... and that's where I'm stuck,
// because everything I tried didn't result
// in the expected result (12345678), which
// may also be due to a wrong calculation in
// the first step...

Can someone lead a total math noob to the right directions? Some easy-to-understand online lectures would be nice as well.


texts: Easily reversible hash functions as a method of data transmission

texts:
I've been looking through the literature because I want to see if anyone has implemented this idea I have. I know data compression algorithms work by removing redundancy in data. I was wondering though if this scheme I have would work.

Ordinarily the idea of a hashing function $H$ is designed so that $H(x)$ (where $x$ is the message) is easy to compute in the forward direction, but difficult to compute in the reverse direction (computing $H^{-1}(x)$ is intractable). But I also notice another thing about $H$. In practice the length of $H(x)$ is can be as large as 512 bits (I'm referring to the SHA-512 hash). This means that $H$ can map $2^{512} \approx 1.34 \times 10^{154}$ hashes to theoretically an infinite number of pieces of data. It's just that in practice the message space of all possible messages are not necessarily messages that have any meaning to humans. The number of total human readable messages may be on the order of say $2^{520}$ (meaning the total number of unique messages in the entire history of mankind).

So now let us suppose we have a hashing function $h$ which is easy to compute in both directions. We could compress our large data file $D$ into a short hash $h(D)$ that maps to $D$ and several other unintelligible "messages." So now to transmit $D$ all we have to do is to transmit $h(D)$ (which is short) and then the receiver would reverse $h(D)$ until they find a possible intelligent message and they could reconstruct $D$. If such a thing could work it would be possible to compress large amounts of data into short messages.

Does anyone know if such a thing has been done before?


texts: What should be used as a source for entropy?

texts: I have hardware-based RNG which consists of TRNG and PRNG. TRNG is giving out a 512-bit number which is being used as a seed for PRNG. RNG is generating a 160-bit random number using PRNG and reseeding is done after $2^{20}$ numbers. I want to use hardware-based RNG as an entropy source. What should be used as a source of entropy i.e. output of TRNG or PRNG?


texts: As I understand, for RSA $n = p \cdot q$. For the key to be safe enough from getting factored, $p$ and $q$ have to be far from each other. How far do they have to be? For example, if I have two $1024$-bit primes that both start with a 1 and the difference between them $(p-q)$ is ~$1022$-$1023$ bits, is that good enough?


texts: Impact of algorithms for factoring using elliptic curves over $\mathbb{Q}$

texts:
Recently a few papers have appeared that describe a new approach to factoring, using elliptic curves over $\mathbb{Q}$.  See, e.g.,

Factoring integers and computing elliptic curve rational points, Iftikhar A. Burhanuddin and Ming-Deh A. Huang.
Factoring integers using elliptic curves over Q, Xiumei Li, Jinxiang Zeng, arXiv:1207.0274v2.

However, these papers don't seem to describe the complexity of these novel methods.  What is the running time of these methods?  Are these methods faster than the standard known algorithms for factoring?  What is the impact of these new ideas on the security of RSA and other factoring-based cryptosystems?  Should we be concerned?


texts:
Let's suppose that two entities, A and B, are establishing a secure channel and then require a mutual authentication.

A has only a RSA key pair and B has an ECDSA key pair. Both of them trust the public key of each other.

Do you feel comfortable with having A signing it's message with RSA and B signing its message with ECDSA ?

They do have an equivalent key length for both key pairs (keylength.com)


texts: What is the link, if any, between Zero Knowledge Proof (ZKP) and Homomorphic encryption?

texts: What is the link/relation, if any, between Zero Knowledge Proof (ZKP) and Homomorphic encryption?


texts:
PHP supports hashing of the following Tiger algorithms:

tiger128,3
tiger160,3
tiger192,3
tiger128,4
tiger160,4
tiger192,4

Wikipedia's entry on Tiger says there's Tiger and Tiger2 and provides samples of Tiger and Tiger2 with 192-bit hashes of "The quick brown fox jumps over the lazy dog". So I tried to get PHP to tell me what the hashes of tiger192,3 and tiger192,4 are and...

The output of tiger192,3 matches what Wikipedia says the output is for Tiger(1). But tiger192,4's output does not match the output for Tiger2.

Tiger2's output is as follows:

976abff8062a2e9dcea3a1ace966ed9c19cb85558b4976d8

tiger192,4's output is as follows:

c1f3a704e9f6267e9f75fa47191f83c354100a04c4f1dc6f

tiger192,3 and Tiger's output is as follows:

6d12a41e72e644f017b6f0e2f7b44c6285f06dd5d2c5b075

So what is tiger192,4?


texts: What is the NIST recommended maximum bias for random number generators?

texts:
What is the maximum bias recommended by NIST for random number generators?
This answer says that it is $2^{-64}$.
Is it same for all applications? Does NIST have a publication with more information?
I tried to browse through NIST Recommendation for Random Bit Generator Constructions, but couldn't find it.


texts: GPG and PAR2 error correction data from the plain archive, will it compromise security?

texts:
I have the following scenario:

Archives compressed with 7z, hundreds of MiB in size
GPG to encrypt the archives (binary, without ASCII armor)
PAR2 to create error correction data

Question

1. Encrypted archive + plain archive error correction data

If I encrypt the archive, will it compromise the security of the GPG-encrypted data if the error correction data created before the encryption will be stored along with the encrypted archive?

2. Encrypted archive + encrypted archive error correction data

As an alternative, would it be better to calculate the error correction data from the encrypted data after encryption and would this in any way affect security (common sense tells me no, but you never know).

Why?

Rationale

I need to archive the data in question and want to make sure it can be restored even if it gets damaged in some way. But all of that of course without compromising security.


texts: Defining Symmetric vs Asymmetric cryptosystems

texts:
I'm writing a project on the advantages and disadvantages of symmetric vs asymmetric cryptosystems. At the moment I am trying to define both systems using mathematical notation. Under the heading "Basic Cryptosystems" I have this:

  We can define the cryptogram functionally as
  \begin{equation}
\mathit{C=f(M,K)}
\end{equation}
  It will also be helpful to think of the cryptogram as a family of transformations with one parameter like this
  \begin{equation}
\mathit{C=T_{k}M}
\end{equation}
  The transformation $T_{k}$ applied to the message $M$ produces cryptogram $C$. The operation of the transformation $T$ will depend on which cryptosystem is being used. The index $k$ corresponds to the particular key being used.
  Assume there are a finite number of keys, each with associated probability $P(T_{k})$. There will then be some discrete statistical process which chooses a transformation from the set $T_{1}, T_{2}, ..., T_{n}$. These transformations have associated probabilities $P(T_{1}), P(T_{2}), ..., P(T_{n})$ respectively.
  We should also assume a finite number of possible messages $M_{1}, M_{2}, ..., M_{m}$ with associated a priori probabilities $P(M_{1}), P(M_{2}), ..., P(M_{m})$.
  Once $C$ is received, it can be deciphered with $k$ in order to reveal $M$. This is achieved with a unique inverse transformation $T^{-1}_{k}$ such that $T_{k}T^{-1}_{k}=I$, the identity transformation. So
  \begin{equation}
M=T^{-1}_{k}C
\end{equation}
  The inverse transformation must be unique for every $C$ which can be deciphered with key $k$ to reveal $M$.

My question is: does this definition apply to both symmetric and asymmetric systems? If not, how can I change it to account for asymmetric systems?

thanks


texts: Energy necessary for brute-forcing or decryption

texts:
I am trying to understand how the physical limits of computation apply to crytography, and came up with the scenario below as a sort of gedanken. I would be grateful to see how others answer it.

Assume that Alice

used the default GnuPG (aka "GPG") settings, except for the following:

--s2k-cipher-algo AES256
--s2k-digest-algo SHA512
--cert-digest-algo SHA512

and then used GPG to create a 4096-bit RSA PGP encryption key pair whose private key is protected by a 10-word Diceware passphrase;
and then used the public key of that key pair to encrypt a plain text 1kB long;
and then stored the resulting ciphertext, along with the key pair, on a CD-ROM which she then gave to Bob, and nowhere else;
and then perished, vaporised by a meteorite along with the laptop she used to perform the above tasks, leaving Bob's CD the only record of her key pair and ciphertext.

Assume also the existence of a computer, bound by the physical limits of computation as presently understood (e.g. these), but otherwise optimised to efficiently perform the tasks in question (e.g. a hypothetical quantum computer).

Finally, assume that this computer is adequately powered, and immune to catastrophes (such as the death of the Sun), during its tasks.

What is the minimum energy, in SI units (i.e. J, or kJ, or MJ, etc), such a computer would require, in order to determine the plaintext, if the CD-ROM's data are available to it?

Please explain your answer, thanks!

P.S. Please migrate this question to security.stackexchange.com if you believe it would be more appropriate there.


texts: Blowfish Encryptions in Bcrypt hashing algorithm

texts:
I am trying to understand the ExpandKey function used in the bcrypt hashing algorithm. As per the documentation of bcrypt hashing algorithm on USENIX here:

http://static.usenix.org/event/usenix99/provos/provos_html/node4.html

There is only one invocation of the ExpandKey function with the 128 bit salt value.

After this, the invocations of the ExpandKey function in the loop (2 ^ work factor), all have the second argument as 128 0 bits.

ExpandKey(state, 0, key)
ExpandKey(state, 0, salt)

Using these as inputs to how the ExpandKey function works, there will be repeated blowfish encryptions of 64 0 bits of salt which are used to replace the contents of P-Array and Sboxes.

If we take, ExpandKey(state, 0, key) as an example:

First all the subkeys in the P-Array are Xored with 32 bits of the encrypted key one by one (treating the key as cyclic).

Next, the first 64 bits of the salt (all 0 bits) are blowfish encrypted and the result is stored in P1 and P2 (first 2 32 bit sub keys).

The above result is Xored with the second half of the 128 bit salt (remaining 64 0 bits). Then blowfish encrypt it and store the result in P3 and P4.

This process goes on till the contents of all the subkeys are replaced followed by S-box entry replacement.

I wanted to know if my understanding is correct or not? We are effectively blowfish encrypting 64 0 bits every time in the loop.

What is the purpose of using the second argument of the ExpandKey function as all 0 bits instead of the actual 128 bit salt?

The key schedule would be more expensive, had they chosen the same 128 bit salt (as in the first invocation) for the remaining iterations. Or would this make bcrypt hashing algorithm computationally infeasible?

Thanks.


texts: How to save keys and other paras in HElib

texts: Recently I'm using HElib for project. Here I hope to init a Client-class,which has pub&pri keys. However when I was building class, I found that I don't know how to save Keys and other paras like Context. The code I use is "example" of HElib. Could someone who is familiar with HElib tell me more about saving in HElibs, thank you very much.


texts: Knowing pre-encryption data, can we find the private key CryptoLocker used?

texts:
One of our users seems to have been hit by CryptoLocker. As a result, he has a hard drive full of encrypted files. The ransom-ware claims to have used public key encryption on  the files.

If we know exact contents of some of the files prior to them being encrypted, would it be feasible to use those files to discover the private key?


texts: Strength of CBC with Ciphertext Stealing

texts:
Is CBC with Ciphertext Stealing (CTS) considerably weaker than CBC with padding such as PKCS7?

I would imagine the most common situation where CTS is necessary would be due to some size constraint of an existing system, and redesign of the system is inconvenient. So, while it clearly reveals the length of the encrypted data, (in general) is this a significant enough weakness such that CTS should always be avoided?

I've read through the addendum to NIST SP800 38A on CTS variants, and while one could perhaps take this NIST recommendation as tacit approval of CTS's relative safety, there's no real mention of any weakness considerations and I've not been able to find any resources speaking directly to this topic.


texts: Is it possible to decrypt a message if a hash of the message was used as a key to encryption

texts:
I encountered a scheme where a hash of a message was used to encrypt the same message:

result = Encrypt(message=m, key=hash(m))

Specifically:

result = AES-256-CBC(message=random(1..2^132), key=SHA3(message))

Is it possible for an adversary to decrypt the message if he knows the result?


texts:
I have an architecture where:

a user can have multiple devices (phones)
the server needs to broadcast the payload to all devices through the same channel
(basically, all devices listen and receive the same payload)

Now, I need encryption for messages from server to devices.

the first phone will have to create a private/public key
server will use this public key to send encrypted messages.
How do I solve the problem for the other devices? Is this mechanism (private/public) wrong and not appropriate in such case? User can't obviously ssh between devices to exchange data here...

The encryption protocol itself has not been chosen yet. If you believe one is more appropriate in this case, let me know!


texts: Signature using RSA (as described in Cryptography engineering)

texts:
In the book "Cryptography engineering" (2010, Ferguson), I found, page 209/210, these 3 functions: MsgToRSANumber, SignWithRSA, VerifyRSASignature (see below).

I can't understand how the last function VerifyRSASignature works. It seems that it checks if "the given signature $\sigma$ raised to exponent $e$ mod $n$" (this part is ok) is equal to $s$, which is the result of MsgToRSANumber, i.e. the result of a random choice!

How can this work? Isn't there a mistake here?


texts:
I have a plaintext about 18 bit size.
I have to encipher it using RSA.
How large have to be p and q?
So M (message to encipher) = 2**18 bit
I tried, using a Python coded RSA alghoritm, different sizes for p and q, and my results are these:

p=61, q=31 not working
p=61, q=127 not working
p=997, q=4253 OK working

I tried them randomly but I think there's a way to decide the size.
Thank you for attention. I hope you can help me.


texts: Having access to multiple servers, would additional usage of “Secret Sharing” for password storage enhance security?

texts:
I am currently learning about secret sharing and I’ve started wondering why larger companies that have access to whole server networks (like – for example – Google, Facebook, etc.) don't use “Secret Sharing” for password storage in addition to hashing and salting.

I know that such companies tend to use many different stages for storing passwords (hashing, salting and encryption in various combinations), but wouldn't more security be achieved by using “Secret Sharing” and storing the resulting shares on independent servers?

The advantage I see is that an adversary would have to have access to at least the threshold number of servers in order to retrieve the hashed passwords. Or am I missing something?


texts: Security of integrity protection with HMAC vs AEAD

texts:
I'd like to know how the security of the integrity protection compares between:

HMAC-SHA-256 with an 32 byte tag or a truncated 16 byte tag
AES-GCM with a 16 byte tag
AES-CCM with a 16 byte tag or with a 8 byte tag

Assuming that no side-channel data is leaked and all algorithms are used securely.


texts: Reusing AES-CTR Keys and IVs for File Encryption

texts:
I’m implementing some file encryption module with random-access capability and AES-CTR seems the right way to go.

I understand that reusing Keys and IVs can expose the file to ‘Stream Cipher Attacks’ when portions of the file are being modified (assuming previous versions of the file are still available).

I want to avoid re-encrypting the entire content of the files when they are modified and so I thought to combine CTR with ECB.
First encrypt the block with CTR and then re-encrypt the resultant cipher text with the same key again:

CTR-Cipher = Plain xor AES(IV + counter, Key)
Final-Cipher = AES(CTR-Cipher, Key)

Would that allow me to reuse the key and the IV? Or are there other secure alternatives to support random-access based encryption without a lot of re-encryption?


texts: How does order-preserving encryption work?

texts:
Order-preserving encryption (OPE) is, apparently, a method of encrypting data so that it's possible to make efficient inequality comparisons on the encrypted items without decrypting them.

I've been coming across this term in various places (including here) lately, but I have no idea how such encryption schemes are supposed to work.  Any obvious methods I can think of to allow such comparisons on encrypted data would result in catastrophic security failure.

Certainly, I assume that OPE must involve some kind of security tradeoff compared to traditional encryption, but given that it seems to be actively studied and used, it seems that it must be possible to implement in a way that retains at least some level of useful security.  I just don't see how.

Given that a quick Google search didn't turn up any convenient Wikipedia articles or other popular summaries of OPE, I figured I'd try asking for one here before diving into the academic literature.  (At worst, I may try to answer my own question later, if nobody else beats me to it.)

So, to summarize, my question is: How does order-preserving encryption work, and what security properties does it provide?


texts: What is the difference between perfoming Correlation Power Analysis (CPA) in the first AES round and doing it in the last round?

texts:
I have a script that helps me to make to make a Correlation Power Analysis (CPA) attack. I am trying to attack the first round. As input, I put:

my traces
my plaintexts
my key

The steps to make the attack are:

Reading the data, which consists of the analog waveform (trace) and input text sent to the encryption core.
Making the power leakage model, where it takes a known input text along with a guess of the key byte.
Implementing the correlation equation, and then looping through all the traces.
Ranking the output of the correlation equation to determine the most likely key.

What must I change if I want to attack the last round please?


texts: Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)

texts:
When you know the Salsa20's keystream, how do you know the next keystream?
In other words, can I infer the next keystream when I don't know the Key and IV of Salsa20, but the keystream is 0x100000?
If you have any related attack papers, please recommend it.
Or, I'd like to ask for some search keywords.


texts: Is double encryption using AES using different key lengths (128 bit and then 256 bit) vulnerable?

texts:
I know that AES 256 bit is far more than enough to secure a file. I just want to know if there are any vulnerabilities or known attacks which can make such this combination less secure "double encryption using AES using different key lengths (first 128 bit and then 256 bit)".

Say, for example, I have a program that can encrypt a file using AES 128 bit and another program which uses AES 256 bit. Also, I have assumed that either one of these encryption programs have a flaw.

Case 1: So, is it possible that if AES 256 bit program fails (because of the flaw in its implementation by the programmer), the attacker will only find the file encrypted by the strong AES 128 bit and won't be able to proceed forward?

Can Case 1 be true?

Please note that the keys are not related in any way. I'm not an expert in Cryptography and I'm trying to understand its basics. So, if you may please reply in simple terms, that would be much appreciated. Thank you. :)


texts:
I am thinking of a variant of RSA.
I know that RSA itself is not semantically secure as it is "deterministic". I have a "randomized" variant of RSA in mind.

Suppose that the public key is $<e,n>$. To encrypt a plaintext $p$, this variant first randomly choose a value $v$, and output the ciphertext as:
$$E(p)=<v,(v+p)^e \text{ mod }n>$$
The ciphertext consists of 2 parts, the value of $v$ in clear, and the ciphertext of $(v+p) \text{ mod }n$ computed using the original RSA.

Is this variant of RSA semantically secure? How do I prove it?


texts: Let a, b be two statements. Given succinct (fixed size) zero-knowledge proofs z(a), z(b) that a, b are true, how easy is it to build z(a AND b)?


texts: Question about lower bound and upper bound key collision

texts:
I'm reading this article and I have a doubt in the page 7. First I going to describe the required definitions and next I formulate my question.

Let be $$F(n)=\{f_k: \{0,1\}^n\rightarrow \{0,1\}^n| k\in \{0,1\}^n\}$$  a family function.

Definition: The upper bound $\kappa$ is defined as follows: For each pair $(x,k)$, there is at most $\kappa-1$ different keys $k_1,\cdots,k_{\kappa-1}$, which are also different from $k$, such that $f_k(x)=f_{k_i}(x)$ for $i=0\cdots,\kappa-1$. Equivalent we define the lower bound $\kappa '$: For each pair $(x,k)$, there is at most $\kappa  '-1$ different keys $k_1,\cdots,k_{\kappa  '-1}$, which are also different from $k$, such that $f_k(x)=f_{k_i}(x)$ for $i=0\cdots,\kappa '-1$

My question is with this claim:

  The values $\kappa$ and $\kappa ′$ restrict the number of different
  images $y$ some preimage $x$ can be mapped to by functions in $F(n)$, i.e.

  $$\dfrac{2^n}{\kappa}\leq |\{f_k(x): k \in \{0,1\}^n\}|\leq
\dfrac{2^n}{\kappa '}$$

  for all $x \in \{0,1\}^n$

Why $|\{f_k(x): k \in \{0,1\}^n\}|\geq\dfrac{2^n}{\kappa}$, resp. $(\leq \dfrac{2^n}{\kappa '})$?
I make this question because the number maximum of equals images are $\kappa$ and the total number of keys is $2^n$ then for me there are at least $2^n-\kappa$ diffentent preimages.


texts:
I'm trying to understand the logic of CAs, trust and client certificates. I have a general understanding but am having a tough time bridging some gaps.

In a hypothetical situation a software system might be composed of n machines. I want to generate a custom CA for this system and have it self signed. The CA would consist of a certificate and a private key. The private key would (I assume) stay private on one machine, be used only for making other certs and not be used for any inter machine communication. From what I understand, each machine that will have a certificate created in this way has to have the public key of the CA in order to validate itself AND other machines that it tries to communicate to/from.

To generate the CA key, I make a private key as normal and self sign it. That will generate a private key AND a certificate. To make client certificates I make a private key and then a signing request using the certificate of the CA.

Here are my questions about this:

Is the certificate of the CA actually the public key? If not, does it contain the public key?
Does every machine that needs to communicate need to have a local copy of the CA certificate in order to validate other certificates?
Were my assumptions incorrect or incomplete?

Thanks for any help and understanding!!


texts: Initialization vector in symmetric-key encryption

texts:
Can we use symmetric-key algorithms without an initialization vector?

I am making an app where both the sender and receiver share a key and there is no way to create an initialization vector for each encryption. So I was thinking about setting the initialization vector to NULL while encrypting. Am I allowed to set the IV to NULL or can I use symmetric-key algorithms without an initialization vector?


texts: Is there any way to find out two numbers such that the XOR between them is a given number?

texts:
I have the following operation I took from a cryptanalysis I'm performing for a specific CBC encryption where the challenger has provided the key:

C1 = Encryption (K, IV⊕P1) ⇒ P1 = IV ⊕ Decryption (K, C1)

I know the value of Decryption (K, C1) and I also know it is equal to IV⊕P1.

Can I compute the value of IV or P1 without brute force?


texts: Why does NaCL have different keys for signing and encryption?

texts: I want to start using NaCL to sign messages that will go into a message queue, and I noticed that it generates different keys for each operation. Is there a reason for this? Can I not use the same PK for signing and encryption?


texts: Historical algorithm which is frequency analysis resilient

texts:
Long ago, I read an article on Wikipedia which described a cipher algorithm, used by the KGB (if I remember well), with the property that all ciphered letters had the same (or nearly the same) probability to appear, without adding symbols to the alphabet of the ciphered text (i.e. unlike how homophonic encryption does). The algorithm was computable by hand.

But I cannot find this article again. Does anyone know the article I mentioned?


texts: complexity of iterative squaring in relation to factorization

texts:
I've run into a question dealing with the number of

modular multiplications of O(n) bit numbers in the following situation:

Given two n bit primes p,q define m=pq.    Choose some 'a' so that  $2<a<m\hspace{-0.04 in}-\hspace{-0.04 in}2$

and look at a^(2^t) for some integer t.    This is done using iterated squaring.

The question asks about the number of modular multiplications needed for the

case of not knowing the factorization of m and the case of knowing the factorization.

The question hints at using t and n to quantify things.

Me question is, what does the factorization of m have to do with this?

The trick in integrated squaring is using the 'on bits' of a b (call them bi for i: 0 -> n) to calculate a^b by multiplying all (a^(2^i))^bi. I don't quite understand where this question is headed.

Could anyone shed a little light on things?


texts: Smart card Strong authentication / Verification ( fingerprints)

texts:
I'm trying to make a strong authentication software and embedded software in a java card. I have found many papers and publications about the subject… too much information to process and I'm working on a very tight schedule, given that the Java card implementation I have supports ECC ( Elliptic curve cryptography ) and RSA, this paper has a very interesting secure method ( the proposed scheme can be viewed on pages 11, 12 and 13).

The problem is, I can't see how I can actually implement this scheme with RSA or ECC, or how to add the fingerprint factor to the equation (seeing how there are plenty of other papers and schemes for biometric authentication paper1). Does anyone have any idea about how I should go about implementing this ?


texts: What kind of attack could one perform if you generate private keys using SHA3(master_key || nonce)?

texts: I'm aware HMAC is more appropriate than SHA3(master_key || nonce), but I do not understand what kind of attack could be performed against that strategy. How could an attacker use this fact to figure out your private keys?


texts:
Suppose I want to encrypt and authenticate a large file.  The file is so large that it cannot fit entirely in memory, and I will be processing it in a streaming fashion.  Truncation of the file and forgeries must be detected, but it is okay to if it is not detected until after all data so far has been processed.

My current plan is to encrypt the file in chunks.  Each chunk is of a fixed size, and generates an authentication tag $T$.  I don't release $T$ directly.  Instead, I have a state $S$ (initialized to some arbitrary value).  At each step, I execute $S := \mathop{PRF}(N || S || T)$.  Here $\mathop{PRF}$ is an arbitrary PRF, such as keyed Blake2b or HMAC; the details are not important.  $N$ is a chunk counter.  Each $S$ is emitted to the output stream immediately upon computation.

Truncation attacks are detected by ~~including the number of chunks to be transmitted as the first bytes of the first chunk~~ having the last chunk have a flag set.

Decryption works as usual.  Each tag is used to compute the corresponding $S$, which is checked against the transmitted values.  If at any point the two don't match, then a forgery error is reported.

I need to be able to authenticate incrementally.  The input might be an infinite stream.

Does this provide $\text{IND-CPA}$ and $\text{INT-CTXT}$?


texts:
I have a research paper on data security using proxy re-encryption, and I need to provide an answer to a reviewer's comment. However, I have no idea on what to do or how to answer it.
The security analysis of the proposed method is based on indistinguishability against chosen plaintext attack. This is the comment:

The security analysis is based on or is limited to known attacks, but no security model/framework is provided that could guarantee security in front of unknown attacks.

What is the "unknown attack" the reviewer is referring to? What is the best answer I can give for this?


texts: Generating non-repeating N-bit IVs, which are indistinguishable from randomness

texts:
I'm implementing a protocol which needs a 64-bit IV for every encrypted packet.  The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only that they are not repeated for any given key.  However, the protocol imposes the additional requirement that every byte on the wire be statistically indistinguishable from randomness.

What I need, therefore, is a PRNG that produces successive 64-bit numbers, and is guaranteed not to repeat itself until all 264 possibilities are exhausted.  I don't think this PRNG has to be cryptographically secure, but I imagine it would not hurt.  I would seed this PRNG at the same time as I generate the AES key (which is a short-lived session key) from a source of true randomness.

What PRNG algorithm should I use?


texts: Serpent intermediate rounds differs from example code, but result is still correct, is it a problem?

texts:
Through great pain and suffering, I've been able to successfully implement Serpent. For example, when using the key 00112233445566778899aabbccddeeff, and encrypting the plaintext 0123456789abcdeffedcba9876543210, the result is 929dd890dcc881c9a7d8b94b0aa0bad5.

However, when I compare my internal rounds to those of the example implementation, there are differences in all rounds except the final one, which is correct. Notice the difference too, my last round is the ciphertext, but it's not the case for the example.

Is that difference a problem, or not ? All other plaintext and keys output the correct ciphertext, so it's correct. Will that difference mean any issue for implementing different modes, is it an attack vector ?

For the key 00112233445566778899aabbccddeeff, and encrypting the plaintext 0123456789abcdeffedcba9876543210 I obtain:

R[00]=763c678fe817625f538ba6e05b920db9
R[01]=3d2fdec36f875b312c3b4dff7bdfd128
R[02]=bd9e4ae53f686b1da714cf4a9d2e6868
R[03]=8acc4503741256b9225d581711eacf4d
R[04]=d765bcb8c133fea981064ec5eb09f56f
R[05]=baa2fd5c5628e8445e79ee7ea5cf9cb5
R[06]=25023893d3789b727be0440a5cfa39e3
R[07]=2d93f0484f3dbc800c4537fd742b62f5
R[08]=6f36c03ab9a62671d418cfb487d45fe7
R[09]=b3d6210bf3bbd2d702a208ef25cfdbe0
R[10]=5c9af1c0d10ce8a3818b22f17f0e097b
R[11]=efb1e65f22e8e68826ce7db29492e5e2
R[12]=97443a983133cbe233b9fef910b96bce
R[13]=5f827660c8f7a489092ca20651ba18a4
R[14]=0a415d75cfe2d976980ac48c41fc5efd
R[15]=f23153c6a50110eead08f8b1cfdcbd47
R[16]=ef002fc254c43e7990da5474d7879461
R[17]=d7b61d1a39aee4c8a14cc4b1d8dc4226
R[18]=7b8cdd49398741c0d0ae6e095812b6a6
R[19]=34d5f60fd24717e0c4dcd1214e502833
R[20]=de5ba6aa229feebc9f34f62001ddc55f
R[21]=9fbd25551344a04b6a6744f9c2739b5a
R[22]=4f25a8e314d8ca550d99451ed02d1e67
R[23]=51880459ded93b04a54327624424c37d
R[24]=da4457c92effe0fe6956a25daa628f22
R[25]=82c6ef91a38269c14ca8b3b8c0f988f1
R[26]=cd2ecf8555c299fc37a7d9df59359b58
R[27]=cf8e350c9738ce9a45b63843eb175c00
R[28]=779285520a7e22fdbb4d7a83984944b2
R[29]=c66612592163cb3c0c83d2a4801ebe86
R[30]=c5be4758e4241f04383888de8aa432d6
R[31]=929dd890dcc881c9a7d8b94b0aa0bad5

And the example implementation is supposed to output this:

R[0]=4fcb58b3308dac762ce01be9b635dccd
R[1]=05f9fe5d51a3bdff9f0deac7aa7632ae
R[2]=b0eddf6f845adb902f50f2e68b947c2c
R[3]=846584a19b16ba521f063d59414653af
R[4]=fd18189f08c41a6dd7ddef61e3d8d317
R[5]=969ea7e193e27193fee9fb281e3baf21
R[6]=47a7396e37755090429dd245955c20f9
R[7]=0591ef4c825c569fc9fe46327b33a303
R[8]=7ac6cb9d51cb2dc0ab41377335fe8395
R[9]=c4dc01edf96c59f5558530597734a6ee
R[10]=6d1d9917a008f5b2cce85029eb731057
R[11]=98e18be8f6c96238dff22fc3793ac8b8
R[12]=806f08ae3877384767baf2f5f76ab152
R[13]=4d09e88bd47536d468e91ca058904324
R[14]=6502e4c55d5131686f0ddb1c3ddd3f49
R[15]=f9e837971189310c3a3f3189ed624dd3
R[16]=bd878d997602253112c7cfc88f764285
R[17]=b96d588ed3c97fc067488e18643ac192
R[18]=2bcfd08ce021ae749e39ab3c5c10a11a
R[19]=678c1b50af0b2e4caa9e1cc64471889b
R[20]=a84aaae3592fd7cdf7e24fe1c1e5d591
R[21]=932ca8fc87b98e3b52c11a192f2b785e
R[22]=1905ae8a6496790bc681d3528d9627bd
R[23]=6d2c474ac614c12611644a770b399529
R[24]=9a78f4d24f564e747c6819b9ce56e65a
R[25]=d34022c4f93138c1bce2d8aef53b200d
R[26]=8d279e2f64b18be3fa07f89fe7477e2a
R[27]=db149edfa067cbb145ab7d484204c862
R[28]=38ab78ea874c76c3836229687c5d44b6
R[29]=98402a842cc119f6761b51f4386cc718
R[30]=dc623c1890faad8028156cdc3b0ba730
R[31]=e42c56b2f61ae808f83bb016d7096127
CT=929dd890dcc881c9a7d8b94b0aa0bad5


texts:
I'm using XTEA to encrypt passwords that I store in a database. (I need to be able to decrypt these passwords later to log in on another system.) But now I have noticed something: if I decrypt a password using a different key I can still see some of the patterns in the plain text. I am not worried about an attack against the XTEA encryption, I am worried about an attack against the other systems that use the encrypted passwords.

For example:

Password A = "111222111"
Password B = "222111222"

I encrypt these with some key, then decrypt them with another key. The output is something like:

A: qqqwwwqqq
B: wwwqqqwww

(Using q and w for readability, it's actually 2 illegible characters.) As you can see, for weak passwords this can reveal a lot of information that can make brute force or dictionary attacks against these passwords a lot easier:

The length of the password.
Patterns of the same character in a password.
Patterns in different passwords.

The assumptions here are:

The attacker has access to several encrypted passwords and salts.
The attacker has no access to the encryption key and this key is sufficiently strong.
The attacker is only interested in the plain-text. Getting the encryption key can be a means but is not an end.
The attacker has decompiled the code, obfuscation won't do any good.
The users are idiots and the passwords are as weak and similar as the above examples.

My questions are :

Can this be considered a weakness in my program? Or can I wash my hands by telling the users to use stronger passwords?
Is this normal behaviour for XTEA, or is there something wrong with the implementation I am using?
Are there other encryption methods that are better suited for this?


texts: Why is variable rotation uncommon in cryptographic primitives?

texts:
Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though:

For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more sophisticated variants like that used in RC6.

To give these values a name: $A \lll B$.

Some good things:

Rotations are fast
Provides some diffusion
Has some nonlinear properties
Can be strong when combined with other operations

Some bad things:

Parity of $A$ is preserved
Differences in $A$ are preserved
Only a few bits in $B$ are used
Differences in $B$ may not have an effect (or have little effect)
Less differences if $A$ is mostly (or all) 0s or 1s
Less differences with alignment in $A$
Multiple variable rotations are not proportionally better

There's probably some more subtle weaknesses that make it more susceptible to differential cryptanalysis, but nothing that totally breaks it I think, or RC5 would be unusable.


texts: Is there a standard padding/format for RSA Blind Signatures?

texts:
I'm working on a RSA blinded signature scheme. RSA Blind signatures are discussed in Chaum's original paper and other places like wikipedia.

The descriptions of RSA blind signatures are straight forward, but they seem to use the original message rather than a formatted or padded message. According to Rabin (1979) we should be using at least H(m).

My question is, is there a standard covering RSA Blind Signatures we should be using? Is there an accepted way to format the message when used in a RSA Blind Signature scheme?

I know the question has some open ends, like security goals being under specified. But we are looking for something that provides intractability of signature-forgery and enjoys some interoperability. I'd like to say we want all the security properties detailed by Bernstein in RSA signatures and Rabin–Williams signatures: the state of the art, but I won't go that far.

Related, here are two questions that explain how to provide a padding function at the author (as opposed to the signer). Both appear to be ad hoc methods.

Usability of padding scheme in blinded RSA signature?
RSA blind signatures in practice


texts:
I was reading this paper about elliptic curves and I saw this graphic:

This paper is pretty new (november 2018) and I was wondering, whether these are all known ecc-families or not. The key point is, that I don't see Weierstraß curves. Can someone explain to me, why Weierstraß-Curves are not included? Are there other curve-families that are not included. If true, which?


texts: Cryptographic hasing functions init-update-final

texts: Does anyone care to explain what is the idea behind the init-update-final functions of cartographic hash functions (e.g. SHA*_Init, SHA*_Update, SHA*_Final from OpenSSL)?


texts: Use Microsoft word and digital certificates to notarize documents (USA)

texts:
I'm trying to figure out how notaries public in the USA could use Microsoft Word and the popular X.509 digital certificates to notarize a document. Lets make four assumptions about the state law:

The notary gets to pick the technology; the state government does not restrict this.
The notary and the signer meet in person with their computers.
The signer and the notary each have their own digital certificate and their own computer.

The notary is required to apply a seal after the signer has signed, and the seal is a jpeg image.

The problem is, the notary isn't allowed to add the seal image until after the signer has signed. But if the notary adds the seal image after the signer signs, Microsoft Word considers the document invalid because the addition of the image is an alteration.

Ideas?


texts: setting the MGF hash to a different value other than the regular hash with openssl for PSS signatures

texts:
In PKCS1's Probabilistic Signature Mode you have the Hash and the MGF Hash. Both appear to be, by default, sha1, with the OpenSSL CLI client, however, I can change it to sha256 with the following:

openssl dgst -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 -out signature.txt -sign privatekey.txt plaintext.txt

What if I wanted to have the Hash be sha256 and the MGF Hash by sha1? Is that possible? I just wonder because with Java the default mode for OAEP encryption changes the hash but not the MGF hash (thus making them disjoint)


texts: How to determine the layers of a circuit?

texts:
In many cryptographic applications like Multiparty Computation (MPC) or Fully Homomorphic Encryption (FHE), you consider a function $f$ described by a circuit over some algebraic structure, typically a field.

Now, it's very typical that the complexity of the algorithm heavily depends on the depth of the circuit, and not necessarily on its size.
For instance, this is the case in Lattice-based FHE, in which low-depth is required in order to perform the bootstrapping, or in some non-constant round MPC protocols where the number of rounds depends on the depth of the circuit.

Given the above, I have two questions.

Given a circuit for $f$, how can we optimize to get a "shallower" circuit for the same $f$? Are there any tools/algorithms available for this purpose?
Suppose the circuit for $f$ if given as a list of gates, where each gate points to the gate or gates corresponding to its input. How can we determine the layers of the circuit from such representation? Are there any tools/algorithms for this as well?

The second point is particularly relevant for MPC, in which the communication for the gates in the same layer can be parallelized, providing a big improvement.

Thanks!


texts: Incorrect answers to queries in Waters' IBE proof by Bellare and Ristenpart

texts:
In "Simulation without the artificial abort: Simplified proof and improved concrete security for Waters' IBE scheme", Bellare and Ristenpart present a new proof for Waters' IBE scheme that does not use the artificial abort technique. As in the original proof, the authors define an adversary $\mathcal B$ that breaks the DBDH problem using an adversary $\mathcal A$ that wins the IND-CPA security game of Waters' IBE scheme.

I'm studying the proposed security proof, and in page 10 it states the following:

  We note that our adversary in fact never aborts. Sometimes, it is
  clearly returning incorrect answers (namely $\perp$) to $\mathcal A$’s
  queries. Adversary $\mathcal A$ will recognize this, and all bets are
  off as to what it will do. Nonetheless, $\mathcal B$ continues the
  execution of $\mathcal A$. Our analysis will show that $\mathcal B$
  has the claimed properties regardless.

I don't understand how if adversary $\mathcal A$ can detect sometimes that the answers to her queries are incorrect, this does not imply that $\mathcal B$ cannot use $\mathcal A$ anymore.

In general, what is the implication of an adversary detecting incorrect answers from the simulator, assuming that this happens with non-negligible probability?


texts: What are the computational benefits of primes close to the power of 2?

texts:
Recently I was reading some article about the Bernstein's Curve25519. This is a particular Montgomery curve over $\mathbb{F}_q$ where $q = {2^{255}-19}$.

What I missed or was unable to understand is what are the particular benefits of using a prime close to the power of 2. How does this for example help practically doing the reduction modulo $q$ of some number?


texts:
I am given the q, p, and e values for an RSA key, along with an encrypted message.

Here are those values:

p                 = 1090660992520643446103273789680343
q                 = 1162435056374824133712043309728653
e                 = 65537
sample ciphertext = 299604539773691895576847697095098784338054746292313044353582078965

I tried calculating d with the Extended Euclidean algorithm, but came out as 1.9404359e+59, which I am almost certain is incorrect. How should I calculate d?


texts: Benchmarks for second round CAESAR competitors

texts: I'm interested in how the second round CAESAR competitors stack up in terms of software performance against each other and against chacha20-poly1305 with both small and large messages. Sadly the only numbers I can find are on their individual websites, and due to most likely different testing methods and hardware those aren't really comparable. Are there any comparison tables or something similar that I just haven't been able to find?


texts: Is this an acceptable implementation of ARC4 encryption for my system?

texts:
I am building an open source hardware system that will be used to control things over the internet. The system consists of a Base Station and Modules which use wireless communication at 2.4GHz to exchange data.

Now I have come to the point where I need to protect the transmitted RF data against re-transmission and decryption. I also need to protect the system so that nobody can pose as a Base Station and send RF packets to some Module and for example turn on my lights or unlock the door.

Details about data that needs to be protected:

Message is always 27 bytes long (this can be reduced to 20 bytes to leave room for proper MAC)
Format of message (protocol) is known to public
Message contents are sometimes known to public because it is usually a simple command such as "1" for turn-on command, and "0" for turn-off command. Other future Modules might contain data that should be kept secret from a potential eavesdropper
Messages are transmitted rarely, there is no constant RF activity

Since this project is implemented on microcontrollers with limited amount of RAM (some 4kB for the entire thing) and FLASH memory for program (usually 32kB) there is not much room for state-of-the-art encryption algorithms and hash generation functions for MAC. There is also a limitation of data that is being transferred to 29 bytes in each packet. Data should not be split to multiple packets and re-assembled on the receiving side, so 29 bytes is all we have to work with.

These are the specifications of my current implementation:

Messages are encrypted using ARC4
Key for ARC4 is 27+1 bytes long
Key is used for maximum of 256 transmissions or for 30 minutes of RF no-activity (whichever comes first). After that new key is generated inside the Module, encrypted and sent to Base Station so it can decrypt further data
Key (27 bytes) is appended with 1 byte (SYNC) which is incremented after each encryption solving vulnerability of re-transmissions. After rollover this byte starts from 0 again (0-255). In the end this makes the key for ARC4 28 bytes long and different for each transmission

Encryption process

27 bytes of unencrypted data message is first padded with SYNC byte (the last byte of final ARC4 key), then this is padded with CRC-8 checksum calculated over the previous 28 bytes. These resulting 29 bytes are encrypted using current ARC4 key (27 bytes and the SYNC counter (1 byte)).

The CRC-8 checksum in combination with the SYNC byte is used as a MAC on the decrypting side. The packet is decrypted using current KEY+SYNC and if the SYNC byte in the decrypted packet is the same as the one expected and used during the decryption, and if the CRC-8 is calculated over the entire decrypted package as the one received - all is good.

Questions

I think this is not a very smart way to implement MAC. Is there something else that I could implement here that would take at most 9 bytes of my unencrypted data space? I could reduce the application data space from 27 to 20 bytes to make space for improved MAC.
How safe is this current implementation of the system because I am worried that someone might inject their own RF packets that will be decrypted by Modules and matched the SYNC & CRC-8. Is there any way to analyze this?

I hope I didn't give too much irrelevant information in this post, this is my first time to implement some kind of encryption, and first post on SE.

UPDATE

I have decided to abandon this design as it is not safe. Thanks to poncho for suggesting the alternative. I have found CMAC AES implementation in AVR411 document which also targets the same hardware I am currently using. You can find this document by simply searching for AVR411 on Google.


texts: Pohlig-Hellman on ECDLP over extension field $\mathbb{F_p}^6$

texts:
Suppose there is an elliptic curve $E$ in form $y^2=x^3+b$ defined over $\mathbb{F_p}$, where $p$ is large prime. #$E(\mathbb{F_p})$ is also a large prime but #$E(\mathbb{F_p})\ne p$. ECDLP on this curve is in the form of $Q=[k]P$. Now let's define the same curve but over extension field $\mathbb{F_p}^6$. #$E(\mathbb{F_p}^6)$ is composite with many small primes (this composite number for sure is divided by #$E(\mathbb{F_p})$ and factors of an order of sextic twist of $E$). $P$ on $E$ over $\mathbb{F_p}^6$ have the same prime order as it has on curve over $\mathbb{F_p}$.
Can I use Pohlig-Hellman algorithm to solve $k$ on curve $E$ over $\mathbb{F_p}^6$?


texts: Discrepancy between 3DES in OpenSSL and PyDES

texts:
I'm trying to encrypt some data using triple DES ECB, but I get a discrepancy between OpenSSL and the pyDES library I'm using.

When trying to get a KCV value, I'm using a file consisting of 8 bytes each with value 0.

I'm using the following OpenSSL command (des-ede3 chosen based on this):

openssl enc -des-ede3 -pass pass:abcdefgh12345678abcdefgh -in empty8.bin -nosalt | xxd

which results in:

00000000: 17f7 b498 bd79 4d55 5e40 aa9c 2907 44bb  .....yMU^@..).D.

I'm using the following Python script, based on this question:

import binascii
import hashlib
import base64
from pyDes import *

key = 'abcdefgh12345678abcdefgh'

fileInput = open("empty8.bin", "rb")
data = fileInput.read()

print('key: ' + str(key))

k = triple_des(key, ECB)
d = k.encrypt(data)

print('KCV: ' + str(binascii.hexlify(d)[0:8]))

which results in:

key: abcdefgh12345678abcdefgh
KCV: b'37c92746'

I've also tried using http://online-domain-tools.com/ for a reference, which gives the same result as the Python code.

Can anyone offer any insights into why OpenSSL produces a different result?


texts: How can we find Public key have only 8 or 16bits? How many messages does Eve need to know the Public key in RSA?

texts:
Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key.

Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public key just by observing the encrypted messages?

And if so, approximately how much data would it take for Eve to discover the public key?

If we know that the public key has only 16bits.

It's have over 6500 primes smaller than 2^16. How long we can find the public key ??
speed : 1.000.000 cal/s.


texts: Krack WPA2 decrypt only some small pieces of packets

texts:
I have gone through the paper (PDF) available at krackattacks.com.

However, from what I understood you force a key reinstallation causing you a nonce reuse over 2 blob of data. As it is a keystream, you might be able to decrypt the data.

Limitations are:

You MUST know clear text of one of both data
It is one shot as the counter gets incremented, you need to perform another key reinstallation to be able to decrypt further data

This doesn't sound very practical in my point of view, am I missing something?


texts: Does Schnorr's 2021 factoring method show that the RSA cryptosystem is not secure?

texts:
Claus Peter Schnorr recently posted a 12-page factoring method by SVP algorithms. Is it correct?
It says that the algorithm factors integers $N \approx 2^{400}$ and $N \approx 2^{800}$ by $4.2 \cdot 10^{9}$ and $8.4 \cdot 10^{10}$ arithmetic operations.
Does this lead to the conclusion that the RSA cryptosystem is no longer secure in some sense?

Moderator note: a fourth version dated 2021-04-08 has appeared; this is pretty normal for eprint. It seems settled Claus Peter Schnorr (of Schnorr group and Schnorr signature fame) intends pre-publication of this paper, including abstract as on eprint.


texts: RSA: revealing the modulus factorization by choosing a bad message

texts:
I started reading the book Cryptanalysis of RSA and its variants by M. Jason Hinek and I stumbled upon a phrase that intrigued me:

  plaintext
  messages that are relatively prime to the modulus (i.e., $gcd(m, N) > 1$) should
  be avoided, since their ciphertexts $c = m^e\; mod \; N$ reveal the factorization of
  the modulus.

Firstly, if $m$ is relatively prime to $N$, shouldn't $gcd(m, N) = 1$?

Secondly, how is it possible to extract the factorization of $N$ by choosing a bad message $m$?


texts:
Based on the "obliviousness" definition of the access pattern of the ORAM:
Given the RAM, after a sequence of read/write operations, the physical addresses accessed will be computationally indistinguishable with what simulator outputs only given the number of the operations.
Does it implicitly mean the sequence of operations can be picked adaptively by the adversary, or, it only provides selective security guarantee?
Adaptive security is defined in this paper: OptORAMa: Optimal Oblivious RAM.


texts: Does GCM improve the strenght of weak passwords?

texts:
If I am encrypting a file with GCM/AES256 with a weak key (say a sha256), does the fact that it takes time to brute force a long message improve my security?

Example:
I use the sha256 of "ARainyDay" to encrypt a 1kB file.

To brute-force it, one must still try and decode my file 5429503678976 times (26^9).

Even considering 1ms/try, it still takes 62841 days.
That makes my key more secure then?


texts: If hashing algorithms such as MD5 or SHA1 both use Merkle-Damgard constructions at their cores, why is it so easy to break them, and yet so much harder to break SHA3, which is also MDC based?


texts: I'm looking for Test Vectors to test my implementation of PRESENT. I would like to test a different input from the usual where the key and the plaintext are either 000..000 or FFF...FFF.


texts: Can the fingerprint of a PGP key be combined with a phone number?

texts:
Lets say I wanted to text a friend but I didn't want my carrier seeing my texts. I could just ask for a phone number, and have him/her text me a PGP public key. But, as everyone knows, the carrier can do a MITM attack easily. So what if we exchanged a different number, but kind of a combination of the 10-digit number and a PGP public key fingerprint using a pair function. Then I separate the phone number and the key, ask for a public key, and check the fingerprint.

Is it possible for me to do that while keeping that "number" down to about 15 base-36 or 64 characters? I want to keep the ID short so it can be easily typed on a phone. I am planning on using the 16 hex digit fingerprints. I've been trying for a solution but the best I can do for "FFFFFFFFFFFFFFFF" and 9999999999 is 19 characters of base-64 by concatenating the bits which is surprisingly shorter than using a pair function.

More information about Pairing Functions

Edit: Got a few comments about the exchange of the public keys.

The phone separates the fingerprint from the phone number using that ID number your friend gave you. Then the your phone sends a message to the phone number, which returns a public key. Since you gave your friend the key combined with the phone number, the phone is able to check the key against the fingerprint to see if the carrier attempted to do a little "trickery". Sorry if I didn't explain that well in the question.


texts: Is fingerprint authentication meaningless if the server/client is closed source?

texts:
I'm talking about when two chat users want to verify their identities via public key fingerprints.
If the Client app is closed source, and we cannot see what it is doing, isn't the Server able to play "Man in the middle" attack here? Client app would just need to display fake but matching fingerprints to both users, and therefore the fingerprint authentication proves nothing?
Maybe I'm missing something, I hope you guys can help me figure this out.
P.S.
I had this question while examining signal protocol, but I believe it applies universally.


texts: Is it bad to tell someone what encryption algorithm your system uses?

texts:
We have a customer asking about what methods we use to secure our system. Specifically they want to know what encryption algorithm we use for how we manage passwords. My philosophy is the harder it is for the bad people the better, so my mind set is keep as much secret as possible no matter how miniscule or how easily inferred the details can be. So I'm very hesitant to say anything.
We of course don't want to lose any business over this, so I guess my question is, is it ok to say we use "********" encryption algorithm? In other words, if you told someone what algorithm you use how much of a security breach could that be considered? Thanks in advance!


texts: Bleichenbacher's Attack on high public exponent RSA keys?

texts: Why can't Bleichenbacher's Attack work for RSA public exponents with values equal to 65537 and above? Does the fact that 65337 is a prime number have any relevance to it?


texts:
Is it safe to use ECDH for challenge-response authentication, with server key being ephemeral?

The goal is that server does not store sensitive data (hashes) and allow clients to use additional security if needed (for example generate and store their key in a smartcard and skip key derivation).

Client derives private key from the password, using a strong hash algorithm (similar to bitcoin address generators using passwords)
Server generates a key and sends its (ephemeral) public key and a challenge string
Client must reply with the challenge, encrypted with the shared key
Server checks if decrypting response yields the challenge

Assumptions

A secure channel is already established
Server has the client's public key stored


texts: ElGamal scheme signature: if private key a mod p is equal to private sig. key k mod p-1, can an attacker notice and determine the value of a?

texts:
If someone is signing a document using the ElGamal signature scheme, and if the random involved in the signature $k \mod (p-1)$ is equal to $a$ (the private key), can an attacker notice? If so can he then determine the value of $a$?

Would it be because the $\beta = \alpha^a \mod p$ from the published key ($p$, $\alpha$, $\beta$) and $r = \alpha^k \mod p$ from the signed message triple ($m$,$r$,$s$) are the same?


texts: Decrypting the password from SHA-512 hash value

texts:
I am currently studying AES algorithm and writing a Code using Python.
I am trying to add 'Salt' into the user input password,

Here is what I am doing,

import hashlib
import os
password = "Sufiyan Ghori"
salt = os.urandom(32) # 32bytes * 8 = 256bits
# Adding the Password into the first 128bits of SALT
# So that the password could be encrypted
Encoded_Password = password.encode('utf-8') + salt[:16]
# Output will be, Password + Salt

I've added comments above for better understanding.

If the 32-byte salt is equal to

b'\x937{\xa0\x9bo\x9f\x8b1\xbf\xa9\xc9\x01\x86\xa1\xd9\xc7\x00+\x81\t\x0f\\\xdc\
x9a\xe5\x84r\xce$EJ'

then Password + Salt[:16] would be

b'Sufiyan Ghori\x937{\xa0\x9bo\x9f\x8b1\xbf\xa9\xc9\x01\x86\xa1\xd9'

If I then create its digest using sha512,

sha512 = hashlib.sha512( Encoded_Password ).digest()

the output will be

b"\xe8\x02\xcc\xa9\x1a\xd3\x1b\x80\x1f{\xd2\xa6E7\x9d\x87\xcf\x17\xb1\xb4\x07\xb
1\xfe\xf2\x9a\xa5\xcc\xe7\x92\xc0\x81\xed\xf8HPu\xe2'\xfc\x0b\xc1\xa6\xc8\xd0N5a
\xc1;\xf7\xbc\xe3\xafN\xcaN\xdfqhc&A#%"

How am I supposed to recover the original password — which is Sufiyan Ghori — from this fixed-length hash value now?


texts:
In Table 12 (page 23) of the GIFT paper, the "Division property" table is given. I could not understand how it has been computed.
My questions:

May I have an algorithm on how to compute the table?
Is there any public implementation available? For example, Sage seems to have several SBox related implementations, but not this one.


texts: The probability of breaking symmetric encryptions

texts:
The probabilty of cracking AES is $1 \over 2^n$, n being the size of the key. Would this hold true for every encryption of the same size?

This is from RC4's Wikipedia page:

  In March 2015 researcher to Royal Holloway announced improvements to their attack, providing a $2^{26}$ attack against passwords encrypted with RC4, as used in TLS.

This might answer my question, but I'm not sure.


texts: Is there any way to track if a ciphertext has been decypted?

texts: Just like the case of a box that has been sealed. We can detect if the box has been opened or not by looking at the seal. Is there any way in cryptography or any encryption scheme that allows this to happen? If we have a ciphertext, I wonder if there is a mechanism that can detect if someone has decrypted it?


texts: What is the intuition of canonical-embedding in homomorphic encryption based on RingLWE?

texts:
In the cryptosystem based on Ring-LWE, the noise amount is measured by canonical-embedding norm.
What is the intuition behind canonical-embedding?


texts: What are the implications of allowing a zero-length GCM nonce?

texts:
NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting multiple messages with an empty nonce) would be to high in any system that supported empty nonces at all. As NIST does not allow it, my GCM implementation does not support empty nonces.
However I was recently directed to Apple's CoreCrypto library which has a special function ccgcm_set_iv_legacy to enable empty nonces, and the documentation for this function includes the statement
"Zero-length IVs nullify the authenticity guarantees of GCM."
[https://opensource.apple.com/source/xnu/xnu-4570.41.2/EXTERNAL_HEADERS/corecrypto/ccmode.h.auto.html]
Can anyone explain what is meant by this? Of course if you encrypt multiple messages with GCM using a zero-length IV and the same key you have a serious problem. But is there something more to this warning? In particular can you safely encrypt a message with a zero-length IV as well as some number of messages with non-zero length IVs?


texts:
Sorry if this doesn't fit the guidelines, but I believe it is a conceptual issue that is not opinion-based and can be reasonably answered in a single authoritative answer (I'm also struggling to find anywhere else to ask this!).

I'm creating a system that needs to send data securely between a public website and a database, and store some of that data securely in the database. The system will use PHP (either 5.6 or 7.2) and I plan to use Sodium for the encryption (either included in 7.2 or manually included with 5.6). I plan to use libsodium.js on the website side.
I'm fairly new to encryption, but I would like to check that the process I am designing - rather than the actual code at this stage - will allow for the system to be theoretically secure.

Process

Customers will set up an account on the website and log in to use
the service.
The server will create a public/private key pair for each user on
registration (stored in a file outside of the root directory). These
will change very infrequently (and only via a controlled process to ensure data is still decryptable, if necessary).
When a customer logs in, their "server" public key will be stored in their
session, and libsodium.js will be used to create a public/private
key pair on the website side (a new pair will be generated each time someone logs in).
The "website" public key will be sent to the server via Ajax and
stored in the session.
Any data that is entered into the site will be collected via a
jQuery/JavaScript process, encrypted using the website private key
and the server public key via libsodium.js crypto_box and submitted
to the server via Ajax as an encrypted string along with the nonce (this may require a hybrid approach of symmetric and asymmetric encryption for long messages).
The server will receive the data, decrypt it, and then process the
individual fields.
Fields that need to be searchable/joinable in the database will be
stored in an unencrypted way. Other fields will be encrypted using
the server private key and a nonce, using crypto_secretbox. The data
and the nonce will then be stored in the database.
When encrypted data needs to be retrieved from the database, it will
be decrypted using crypto_secretbox and then rencrypted using the
server private key and website public key, before being made
available to the website, where it can be decrypted using
libsodium.js.

Actual coding aside, have I missed anything or got anything wrong with this proposed process?


texts: Minimal Hamming distance of SHA512 hashes at bit flip

texts:
For $n\in\mathbb{N}$ let $\{0,1\}^n$ denote the set of $\{0,1\}$-vectors of length $n$. Let $\{0,1\}^* = \bigcup_{n\in\mathbb{N}}\{0,1\}^n$ denote the collection of all finite-length $\{0,1\}$-strings.
If $x,y\in \{0,1\}^n$ for some $n\in\mathbb{N}$, we let $$d_H(x,y) = \big|\big\{ i\in \{0,\ldots,n-1\}:x_i \neq y_i\big\}\big| \;\;\in \{0,\ldots,n\}$$
denote the Hamming distance between $x, y$.
Let $h:\{0,1\}^* \to \{0,1\}^{512}$ denote the cryptological hash function ${\sf SHA512}$.
Question. Is it known whether $$m_0 = \min\{d_H(h(x),h(y)): (\exists n\in\mathbb{N}(x,y\in \{0,1\}^n)) \land (d_H(x,y)=1)\}$$
is positive? Is a lower bound $\geq 2$ for $m_0$ known?


texts:
Let (Gen1,H1) and (Gen2,H2) be two hash functions.  Define (Gen,H) so that Gen runs Gen1 and Gen2 to obtain keys s1 and s2, respectively. Then define Hs1,s2(x)=Hs1(x)||Hs2(x).

a) Prove that if at least one of (Gen1,H1) and (Gen2,H2) aris collision resisistant, then (Gen,H) is collision resistant.

b) Determine whether an analogous claim holds for second pre-image resistance and pre-image resistance, respectively. Prove your answer in each case.

Now assume H is any collision reistant hash function. Then is the composition H o H necessarily collision resistant?


texts: Could quantum computers "break" symmetric crypto-systems (e.g. AES)?

texts: These days I'm reading about quantum computing and quantum cryptography which I've found extremely interesting. Well, I also read some blog posts of Bruce Schneier talking about how quantum computers threaten our current asymmetric crypto-systems. However, I don't know whether quantum computers also threaten symmetric crypto-systems (AES, Vernam cipher, etc.).


texts: In NIST modulus and key size recommendations is `group` equivalent to modulus and `key` equivalent to exponent?

texts:
Looking at the following NIST recommendations for a discrete logarithm, for 2016-2030 and beyond they list 3072-bit number for the group and 256-bit for the key.

If using Diffie-Hellman, does group equal the recommended size of the prime modulus and key equal the recommended size of the private key exponent?


texts: How exactly is signature verification done in SSH v2 authentication?

texts:
One of the authentication methods in SSH involves the client signing a message with its private key and sending it to the server for verification.
RFC 4252 (page 9) says:
The value of 'signature' is a signature by the corresponding private
   key over the following data, in the following order:

      string    session identifier
      byte      SSH_MSG_USERAUTH_REQUEST
      string    user name
      string    service name
      string    "publickey"
      boolean   TRUE
      string    public key algorithm name
      string    public key to be used for authentication

The same RFC (page 8) says that all the above information other than the session identifier is passed to the server along with the signature. To verify the signature then, the server would have to recontruct the message (adding the session identifier) and then pass it on to the signature verification algorithm, alongside the received signature and public key.
Is this what happens?


texts: Analyzing ECB's and CBC's resistence to a known-plaintext attack

texts:
I'm trying to analyze the strength of a block cipher with CBC mode or with ECB mode on the scenario of an exhaustive search attack with knowledge of pairs of plaintext – ciphertext (known plaintext attack).

I understand that, for a block cipher that receives a key of $k$ bits and processes blocks of $n$ bits ($n>k$), on ECB mode, Oscar would find false keys and because of that he would need to check more than one pair (i.e. two or three for DES).

But how would this attack work in a block cipher that uses CBC mode? I suppose Oscar still needs to deal with false keys, but now a encryption operation over block $i$ needs the knowledge of block $i-1$ and possibly the knowledge of $IV$. This is confusing to me.


texts: Why is c25519 in the GPG “expert” options?

texts: The only way to access the c25519 curve in GPG is through gpg --expert --full-gen-key. Why is that? From my knowledge, Curve25519 is one of the most secure (and fast) elliptic curves in cryptography. So why is RSA fine, but Curve25519 is considered a risk only experts should take?


texts: Could someone explain to me how they formulated the equation and how it equals to $0^{n}$ (like what F(x, x) equals to or how they cancel each other out?) on the first box and if its related to the second. I know that PRF output plus itself would make all the bits 0, so $F_K(x) + F_K(x) = 0^{n}$


texts: Formal verification of elliptic curves. Depence on the equation form

texts:
I'm doing formal verification of the group properties of elliptic curve addition in Weiertrass form. I was taking as a reference this and this articles. The first does the verification for Weiertrass form and the second does it for Curve22519, a Montgomery curve, but his approach can be generalized to Weiertrass form.

My question is, can I proof the group properties for the Weiertrass form and then translate the operation from this form to Montgomery form or Edwards form? I believe the three of them present some "equivalent" families of curves. Would this approach preserve the good properties of each family?

For instance, say I do the verification for Weiertrass form and then I "convert" the results to Edwards form. Would this be still side-channel attacks resistant?


texts: When to prefer exchanging cryptographic certificates over exchanging only public keys?

texts:
Let's think of the following case:

A group of peers want to exchange messages with each other. They use public-key cryptography to sign and encrypt messages. Anyone with any name can join the network. There is no central trusted authority, such as a CA that could issue certificates. When a peer joins, he publishes either, A) a self-signed certificate or B) a public key only, that others can use to him send messages.

Would under such circumstances cryptographic certificates (A) provide any advantage over using just private/public key pairs (B)? As far as I have understood certificates can only make sense if  everyone trusts a central authority that issues certificates.

To my mind, that means if a peer joins the network it is sufficient that he broadcasts a message with his name+public key, signed with his private key. Everyone would know that he is in the posession of a private key for the specific public key.

That also implies that we cannot be sure a peer who claims to have a certain name really has this name. (Let's consider each peer has a name, that we don't know.)

What is your opinion about it?


texts: How can I identify the linear equations for a block cipher with 4 different s-boxes?

texts:
For a block cipher with 4 different s-boxes (each used in an individual round) how can I identify the linear equations?

Normally, for ciphers like AES with a single s-box, linear cryptanalysis can be done fairly easily. But I’m having a problems applying the same on ciphers that use more than one s-box. I’m mainly stuck on how to derive those linear equations after constructing the LAT tables for all such different s-boxes of a round.

For example: in the first round, my plaintext and key are passed as inputs to s-box 1, followed by permutation 1. Then, that output is passed to s-box 2. Now, having this final output, how can I identify which one is the linear expression that is with maximum/high probability bias? Meaning: which LAT table should be considered?


texts:
I am trying to understand the design of Tor(onion router). I am reading the original paper on the 2nd generation onion routing system. Where, under integrity checking on streams, they say, "When Alice negotiates a key with a new hop, they each initialize a SHA-1 digest with a derivative of that key. Then they each incrementally add to SHA-1 digest the contents of all relay cells they create, and include with each relay cell the first four bytes of the current digest. Each also keeps a SHA-1 digest of data received, to verify that the received hashes are correct."

How does this work?

What I think is happening: I believe, after initializing a new SHA-1 digest, all the contents of new relay cell are XORed with the digest to produce new "digest". And the first 4 bytes from this digest is put in the digest field of the relay cell and sent. Back at Bob(OR), a similar process is repeated and the first 4 bytes of the recently computed "digest" is compared with the one received.

I understand that this helps in preventing an insider attack at modifying the cell contents as the attacker must be able to deduce the current digest state. However, I don't understand the use of calculating SHA-1 of the cell contents at Bob's end and how it helps verify that the received hashes are correct.


texts: CBC - a canonical mode, even though there are streaming modes

texts:
Why is CBC considered the canonical mode when there are streaming modes available such as CFB and OFB? One thing that I can think of is that in CBC you can easliy do range-based decryption. All you have to do is load the previous block (whose size is explicit). How would you do it in CFB/OFB? In my previous question I was thinking that in streaming mode it just uses the cipher block versus a larger disk block.
Other things to note?

Diagrams to visualize this on wikipedia.


texts:
As a followup to previously asked question: What's a good strategy for the game "spyfall"?

I was wondering if we could build a pencil & paper solution for the problem resistant against pencil & paper attacker.

$k$ players know a secret integer location $[1-30]$ and another (spy) does not. Those who know the secret want to find the spy without letting the spy find the secret. The algorithm proposed by Thomas Pornin in answer to previous question is secure against even powerful attackers. Yet I do see a reasonable way to size it down so as the main flow can be done on pencil & paper in a short time.
The naive solution of publishing a random $r$ and $H(r+loc)$ could possibly be implemented in pencil & paper (assuming a reasonable pencil & paper hashing exists) but it gives the attacker only a $\times 30$ penalty compared to the legitimate players.

What kind of pencil & paper primitives are there we could use? What are reasonable examples?

Is there a good group with hard discrete logarithms suitable for pencil & paper?
Can we get a better the $\times 30$ while still remain simple? If we move from a factor of $30$ to a factor of even a few hundred I would consider that success.


texts: In which case number field sieve/index calculus is faster for solving discrete logarithm?

texts:
Given the normal discrete logarithm problem:
$$a = b^c \mod{P}$$
with prime $P$ and numbers $a,b,c$
For which kind of $P,b$ the NFS/IC algorithm is faster than Baby-Step/Giant-Step+ Pollard's Rho ($\approx \mathcal{O}(\sqrt{q}) $)?
(with $q$ the biggest prime in factorization of $P-1$, with $P$ big prime)
Or in which cases NFS/IC it used?


texts: Why do we use encryption modes of operation to convert block ciphers into stream ciphers?

texts: Just wondering Why to use encryption modes of operation to convert block ciphers to stream ciphers?


texts: What are implementations of PRNGs based on ChaCha20?

texts:
I thought I'd find an implementation in NaCl, but /dev/urandom is what I find.  Search engines samples revealed most implementations are broken.

What libraries are there currently?  (I'm only interested in the PRNG based on ChaCha20.)


texts:
OpenSSL supports rc4 with 128-bit keys and rc4 with 40-bit keys. It does not support rc4 with 256-bit keys.

My question is...  is it possible to modify the state of the pseudo-random generation algorithm (PRGA), given a 128-bit key, to match the initial state a PRGA with a 256-bit key?


texts: ElGamal signature: Forging a signature of a specific form

texts:
I have a question I can't solve from one of the courses I'm currently taking:

  Show that given a legitimate ElGamal signature $(S,R)$ on a given message $m$, an attacker
  can compute a signature on messages of the form: $m'=(m+bS)a\mod p - 1$,
  when $b\in Z_p^*$ is chosen as the attacker wishes and $a=g^b\mod p$.

  Hint: Observe the value of $g^{ma+baS}$


texts:
I have a use case where I need to encrypt some text in the browser using javascript. Only the encrypted text will be stored on the server. The user should then be able to take the encrypted result and decrypt it with GPG on the command line. I want to use GPG as it's easily available and the AES appears to support iteration on passphrase hashing.

I'm hoping to use AES, however I don't understand what iteration count or salt GPG uses.

For example, http://cheeso.members.winisp.net/AES-Encryption.htm allows you to set parameters for AES decryption using Javascript:

Does anyone know what parameters to use to be compatible with GPG ?


texts: Using $key^{th}$ multiple of $\pi$ as a one-time pad

texts:
With a key $k$ of sufficient length, say 128 bits, is it possible to use $k^{th}$ multiple of $\pi$ as a one-time pad?
Please enlighten on the security as well as practical aspects (only if secure of course).


texts:
Let $a,b,c,d$ be selected at random from $Z_q$. Consider the following two distributions $X_1$ and $Y_1$:

$X_1={(r_1\cdot a, r_2\cdot b, r_3\cdot c, (r_1+r_2-r_3)\cdot d)}$ where $r_1,r_2,r_3$ selected random from $Z_q$

$Y_1={(u_1,u_2,u_3,u_4)}$ where $u_1,u_2,u_3,u_4$ selected random from $Z_q$

I have two questions:

Are these two distributions computationally indistinguishable?
How should I formally write the proof?


texts: Generating password from high entropy file

texts:
Assuming

We want to generate a password of 32 bytes, using a keyfile as source but not using it directly but via an intermediate step;

So:

We have a file of 100MB file with high entropy
We ask the user to give 2 values, (A) one is the offset into the file, the 2nd (B) is chunk size

We then:

Open the file and skip to offset (A)
Read as many chunks of size (B) until end of file
Per chunk scrypt it into value (scrypt set to take ~1 sec), crc the out block to a integer value and add it to the 32 byte array (increment index for each chunk, reset to 0 when at 32)

If I'm correct it would take an attacker ~10 years to go through the whole keyspace with a brute force attack. Would this be correct or am I missing something here (probably) - as in for each byte (offset) there are 100MB/32 possible variations in size (there are some details that are important which I'm skipping over - but it's the general idea I'm thinking of)

J


texts: What technical flaw in the Secure Hash Standard was the NIST referring to?

texts:
On July 11, 1994, the NIST proposed an interesting revision to FIPS 180, about the Secure Hash Standard:

A revision of Federal Information Processing Standard (FIPS) 180,
Secure Hash Standard (SHS), is being proposed. This proposed revision
corrects a technical flaw that made the standard less secure than had
been thought. The algorithm is still reliable as a security mechanism,
but [sic] the correction returns the SHS to the original level of security.

What was the technical flaw?
FIPS PUB 180-1, which specifies SHA-1, was published on 17 April, 1995. It superseded FIPS PUB 180, which was published on 11 May, 1993.
On the first page of FIPS PUB 180-1 it explains:

A circular left shift operation has been added to  the specifications
in section 7, line b, page 9 of FIPS 180 and its equivalent in section
8, line c, page 10 of FIPS180. This revision improves the security
provided  by this standard. The SHA-1 is based on principles similar
to those used by Professor Ronald L. Rivest of MIT when designing the
MD4 message digest algorithm 1, and is closely modelled [sic] after that
algorithm.

However, it does not explain the flaw.
Is it understood now?  If not, can anyone identify that flaw?


texts: Why must we generate the signature before any compression being done at PGP?

texts:
I have done some research on PGP and I found out there are of two reasons why we must generate the signature before doing any compression. Yet, I am not sure I really understand them both.

One reason states that the message must be compressed first and signed later because if we need to do any future validation, we only  need to store the signature – but what I think is if we do the signature first and compression later, we also need to store the signature and compression value. So it will be same as we do the signature first, followed by the compression. Either way, we also need to store the signature and compression value for future validation.

And then there is the second reason… which I do not understand at all:

  Even if one were willing to generate dynamically a recompressed message for verification, PGP's compression algorithm presents a difficulty. The algorithm is not deterministic; various implementations of the algorithm achieve different tradeoffs in running speed versus compression ratio and, as a result, produce different compressed forms. However, these different compression algorithms are interoperable because any version of the algorithm can correctly decompress the output of any other version. Applying the hash function and signature after compression would constrain all PGP implementations to the same version of the compression algorithm

(This 2nd reason is from William Stalling’s book “Cryptography and Network Security”, 4th edition.)

Can anyone help me understand both reasons (especially the later), and/or can you explain to me why PGP expects us to generate the signature before compressing?


texts: Is there a way to do fair exchange between two parties who don't trust each other?

texts:
Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and send the encrypted messages to one another.

Now is there some cryptographic scheme thinkable that lets Alice only decrypt her message (using key B) when Bob is able to decrypt his (via key A)? To guarantee that Alice will tell Bob her key after Bob told his?

The simplest solution would be a third-party which releases both keys at exactly the same time, but maybe there is also a cryptographic way to do this?


texts:
I need to derive a key from a username and a password. These are the only two things I have access to. What I thought is using PBKDF2 with username as the salt and password as the master password.

Could someone help me evaluate / confirm this solution in terms of security?

Update: Since the salts are required to be unique, I have thought about using the following as a salt:

HASH(USERNAME) XOR SOME_GLOBAL_CONSTANT

or perhaps

HMAC(SOME_GLOBAL_CONSTANT, USERNAME)

What do you think of this updated salt value?


texts: What's the main difference between the non-uniform probabilistic polynomial-time adversary and the probabilistic polynomial-time adversary?

texts: When I am reading some secure computing papers, the authors always assumed that there exist some adversaries, such as non-uniform adversary and the probabilistic polynomial-time adversary. So my question is that what are the main difference between the non-uniform probabilistic polynomial-time adversary and the probabilistic polynomial-time adversary ?


texts: OpenSSL - extract hash algorithm from signature data (PKCS#1 v 1.5)

texts:
PKCS#1 v 1.5 stores hash algorithm identifier that was used to digest the original message. I would like to know if and how to extract this information.

I am working on a buffer containing the signature bytes and a buffer with public key.

I know it can be done (e.g. openssl rsautl does it with -verify and -asn1parse), but there is no sensible documentation for asn1 functions in openssl.


texts: Is there any way to test how secure is a new cryptosystem?

texts: I have investigated Elliptic Curves and after that I have designed a cryptosystem using this technique. How can I test the safety of my scheme compared to another cryptosystems that use factoring such as RSA? There's a way to ensure that my cryptosystem can be used in commercial environment ?


texts: Unable to understand hash function representations

texts:
I have some hash function representations, which I find it hard to understand.

I have searched a lot but didn't found anything helpful. Please help me understand the hash function representations given below:

  Choose cryptographic hash functions
  $H_1:\{0, 1\}^*\times\mathbb Z^∗_p\to\mathbb Z^∗_q$
  $H_2:\{0, 1\}^*\times\mathbb Z^*_p\times\mathbb Z^*_p\to\mathbb Z^*_q$
  $H_3:\{0, 1\}^*\to\mathbb Z^*_q$
  $H_4:\mathbb Z^*_p\to\{0, 1\}^{n+k_0}$
  $H_5:\mathbb Z^*_p\to\{0, 1\}^{n+k_0}$
  $H_6:\mathbb Z^*_p\times\{0, 1\}^{n+k_0}\times\mathbb Z^*_p\times\{0, 1\}^{n+k_0}\to\mathbb Z^∗_q$

I saw this from this paper
An Efficient Certificateless Encryption for Secure Data Sharing in Public Clouds (pdf, see section 2.3).


texts: I couldn't find this explained in another question, but is there an actual reason as to why Jacobian coordinates are used for elliptic curves? Do they provide some sort of advantage in terms of performance? Or are they easier to use for security proofs?


texts: Calculating random number in ECDSA based on private key and signature

texts:
In ECDSA (Elliptic Curve Digital Signature Algorithm) we use a random number k in the signature process.

Signature in ECDSA is:

$$ (x_1,y_1) = k * G $$
$$r = x_1 \mod n $$
$$s = k^{-1} (z+rd_{a}) \mod n$$

If we know the private key $d_a$ and signature (r,s) would it be possible to calculate random k? If no how hard would it be to calculate that?


texts: How is a group element converted into a key?

texts:
I've only just started research on cryptography so I apologize if this is a basic question or I'm getting terms confused.

I'm researching braid group cryptography and currently looking at the Anshel-Anshel-Goldfeld key exchange protocol applied to braid groups via the colored Burau representation. Both parties have a shared secret commutator, an element in the braid group $B_n$, and then calculate it's colored Burau representation which is a pair (M, $\pi$) where $\pi$ is a permutation and M is a matrix with entries in $\mathbb{Z}[t_1,t_1^{-1},...,t_n,t_n^{-1}]$. We then apparently reduce M modulo some prime $p$, and "plug in the result to a key
hash function". I have a few questions about this last statement:

What is the point in reducing the matrix M?
Is using a hash function the standard way to convert an abstract group element into a usable key? If so, is there as standard hash function for each particular type of group?
Is the hash function a 'key derivation function' or a 'key extractor'?


texts: Long Term Security of Truecrypt's hash function?

texts:
Does Truecrypt's hash function weaken the security of a chosen cipher cascade?

Considering I want to choose a cipher cascade of 3 ciphers for long term security (50+ years) for my archived data on blu-ray disk. Truecrypt allows me to choose only 1 hash algorithm, but up to 3 cipher algorithms.

Doesn't that make the hash function the ultimate weakest link? If SHA2, Whirlpool and RIPEMD160 were all "broken" - would that result in a broken truecrypt container?