texts:
Although this question maybe looks silly, I have searched similar questions in this forum and googled it but got no desired answers.
IND-CCA security has already been deeply studied in public cryptography. And it is also known that some symmetric constructions (e.g. CBC model) are not IND-CCA secure (for example, see this chapter). However, I didn't find so many results about IND-CCA secure symmetric encryption. The only construction I found is the one provided by Desai in Crypto2000
I was wondering, are there any other well-known constructions of IND-CCA secure symmetric encryption (classical secure)?
Besides, could they still be easily converted to a post-quantum version (for example, by double the length of the secret key)?


texts: How do you use the Tiger hash function with GPG?

texts: I've searched Google and the GnuPG documentation and I haven't been able to find an answer. Some pointers in the right direction would be greatly appreciated.


texts: El Gamal existential forgery using Pointcheval–Stern signature algorithm

texts:
I found that there exists an algorithm that claims to make the El Gamal signature generation more secure. The algorithm can be found here as a pdf.

I'm mainly interested in the two-parameter forgery that goes as the following:

Let $1 < e,v < p-1$ be random elements and $gcd (v,p-1)=1$. If $r = g^e \cdot y^v  \bmod{p}$ and $s = -r \cdot v^{-1} \bmod{p-1}$, the tuple $(r,s)$ is a valid signature for the message $m = e \cdot s  \bmod{p-1}$.

My question is how does this work? Is there a well explained proof?


texts: How to use Rényi divergence for noise flooding

texts:
Let $\chi_\sigma$ be a discrete (or continuous) Gaussian distribution with standard deviation $\sigma$.
Then, it is known that for $y \in \mathbb{Z}$, a statistical distance between $\chi$ and $\chi + y$ is at most $|y|/\sigma$.
Similarly, I heard that there exists a similar result about Rényi divergence between $\chi$ and $\chi + y$.
The statistical distance provides us a noise flooding by choosing extremely large $\sigma$, which implies parameter inefficiency.
To overcome this limitation, some papers about lattice based cryptography deal with a noise flooding technique using the probability preservation of Rényi divergence even if the divergence is NOT small.
I have no idea how to control statistically close using the Rényi divergence.
As I understood, Rényi divergence is not metric, but it looks like a metric as intuitive sense. However, it is still hard for me how to show the statistically close of two distribution based on Rényi divergence.
Moreover, for distributions $\chi$ and $\chi + y$, if we want to set $\sigma$ to satisfy the statistical difference $2^{-k}$ using R`enyi divergence, how much large $\sigma$?


texts: Differential attack on repeating pairs of zeros in blocks

texts:
Let's consider $5$ types of vulnerabilities in one round of encryption in 128-bit cipher.

We got 00 at the beginning of the block (the first two bits are two zeros).
We got 00 in the middle of the block.
We got 00 at the end of the block.
We got 00 randomly put in the block (it depends on the key).
We got 00 shifted in the block in consecutive rounds (let's say in first-round they are $3,4$ bits, in the second-round $5,6$, then on the $7,8$ position and so on).

And let's say they will occur only if the number is equal to $0+4n$ or $2+4n$ (it depends on the key). Let's say these are only vulnerabilities in that encryption. If we consider $20$ rounds which type is hardest to attack?
For sure in case 3., if we will have a bit of luck and in all-around such vulnerabilities will occur for $0+4n$ numbers we can find 00 at the end of every encrypted number of the form $0+4n$. Case 1. is also insecure for similar reasons. So I think it would be best if such two zeros will occur somewhere in the middle or will be shifted by some number of bits in consecutive rounds or maybe put randomly in the block.


texts: Von Neumann Extractor - Which bit is retained?

texts:
Which bit is retained in the Von Neumann debiasing algorithm?  00 and 11 are discarded and 10, 01 are retained but is the first or the second bit retained or does it matter?

In other words:

first: 10 -> 1 , 01 -> 0

second: 10 -> 0 , 01 -> 1

Original Paper (appears to be first but could be interpreted either way):

https://dornsifecms.usc.edu/assets/sites/520/docs/VonNeumann-ams12p36-38.pdf

Examples (first digit accept):

https://en.wikipedia.org/wiki/Hardware_random_number_generator#Software_whitening

https://en.wikipedia.org/wiki/Randomness_extractor

http://pit-claudel.fr/clement/blog/generating-uniformly-random-data-from-skewed-input-biased-coins-loaded-dice-skew-correction-and-the-von-neumann-extractor/#more-410

https://people.seas.harvard.edu/~salil/pseudorandomness/extractors.pdf

Examples (second digit accept):

https://www.researchgate.net/publication/38359648_Iterating_Von_Neumann's_Procedure_for_Extracting_Random_Bits

https://www.esat.kuleuven.be/cosic/publications/article-2628.pdf

Examples of the second are present in papers regarding an Iterated Von Neumann algorithm.


texts: What is the largest performed/possible bruteforce attack to date?

texts: I've read that cracking 128-bit key is currently out of reach of all humanity. However, I can't seem to find any information on what scope of brute force attacks have been performed or are possible at the current time. Can someone provide some information on this subject with quotable reference?


texts: What aspect of elliptic curve encryption paradigms makes them especially susceptible to quantum based attack algorithms?

texts: This was a statement made during a talk at today's DFN-CERT conference but unfortunately it wasn't explained further. Can anyone shed light on why elliptic curves are susceptible to quantum based attacks ?


texts:
As we know the well-known hash-based commitment is as follows:

Prover: given a message $m$, it:

(1) picks a fresh random value $r$

(2) computes $H(r||m)=c$.
Verifier: given $c$ and the commitment opening: $(r,m)$, checks $H(r||m)=c$

Question: Am I right that in the random oracle model, the above scheme is IND-CPA?


texts: BouncyCastle Elliptic Curve implementation

texts:
I'm implementing ECDH key exchange in C# using the BouncyCastle library and I'm having a hard time understanding the elliptic curve side (FpCurve).

FpCurve curve = new FpCurve(
    new BigInteger("883423532389192164791648750360308885314476597252960362792450860609699839"), // q
    new BigInteger("7fffffffffffffffffffffff7fffffffffff8000000000007ffffffffffc", 16), // a
    new BigInteger("6b016c3bdcf18941d0d654921475ca71a9db2fb27d1d37796185c2942c0a", 16)); // b

ECDomainParameters ecSpec = new ECDomainParameters(
    curve,
    curve.DecodePoint(Hex.Decode("020ffa963cdca8816ccc33b8642bedf905c3d358573d3f27fbbd3b3cb9aaaf")), // G
    new BigInteger("883423532389192164791648750360308884807550341691627752275345424702807307"), // n
    BigInteger.One); // h

I'm wondering if this is correct, what it means and why would this be static? What are these BigInteger values?


texts: Is public-key cryptography the correct choice?

texts:
I'm working on a project which requires encryption of sensitive data, with communication of said data between a mobile app and a website (via an API).

I'm new to encryption and security, but my current thoughts are this:

Data will always be input into the app and viewed via the website, so only users of the website will need a public and private key as only they need to view the information (could use hybrid, but messages will be short)
Encrypt the data server-side using the public key of the correct user authorised to view the information
The encrypted data will be stored in the database
Keys will be stored on the server (not sure how this works in terms of access controls)

It is important that other users of the website are only able to see the data they are authorised to view, hence the public and private key cryptography. Obviously, querying the database here could prove difficult, but I think the use of IDs and other non-identifiable information would make it easier.

Is this a realistic idea or completely wrong in terms of how encryption works?


texts: On modeling a random oracle hash function which maps $\mathbb{G}_1 \rightarrow \mathbb{G}_2$

texts:
How can one model a random oracle hash function which maps $\mathbb{G}_1 \rightarrow \mathbb{G}_2$?

(Assume $\mathbb{G}_1$ and $\mathbb{G}_2 $ to be additive and multiplicative groups of prime order $q$.)

Normally, for a hash $H: \mathbb{G}_1 \rightarrow \mathbb{G}_1$, we would model it as something like as follows

pick $t ∈_R \mathbb{Z}_q$
output $tP$ ($P$ is a generator of $\mathbb{G}_1$)


texts:
I'm trying to find a sufficient encryption mode that supports random read and write access. It seems like XTS is a perfect fit, since in my use case authentication and integrity insurance are handled elsewhere, and from my current understanding, these are the only two drawbacks of XTS.

The only thing I don't get (yet) is: I'm not supposed to encrypt any data with the same key and IV twice, right? Now, what if I edit one of the XTS encrypted blocks? The tweak will stay the same since it depends on the block location, so if I use the same key again, this premise is violated. If I use a new key, I'd have to encrypt the whole file again, which means I don't really have random access anymore.

I feel like I got something wrong here. Can someone enlighten me please – and/or maybe even suggest a sufficient mode if XTS is not it?

Thanks in advance.


texts:
I'm using OpenSSL 0.9.8 on OSX Maverick, and I want to use a PBKDF but I can't find any doc/man about it on OpenSSL's website.

I'm working on QCA, an OpenSSL wrapper for Qt, and when I arrived there was PKCS5_PBKDF2_HMAC_SHA1 as PBKDF2, a function I can’t find either on the OpenSSL website. It's marked as DEPRECATED on OSX, so my questions are: Is there one or multiple PBKDF2 on OpenSSL? If there is/are, does anyone know where I can find the documentation please?


texts: Storing password or derived key in keychain?

texts:
Currently I am developing an application that stores and reads encrypted data. The data is encrypted with AES and the actual AES key is derived from the users password (and some nonce) with PBKDF2 with many rounds (taking 500ms on my Intel i5-3570).

I want to use the keychain (like available in Mac OS or some other pendant like keyring in Linux) to store the information needed to access the users data. My assumptions on the keychain are:

The keychain is strongly encrypted and hence can be considered secure
The keychain might be synchronized to the internet (like Apple allows to synchronize the keychain with iCloud)

I see two possible solutions:

Store the users password in the keychain
Derive the AES encryption key and store that in the keychain

My question is, which one is better both from the security standpoint and in general (if there is a general answer)? I guess solution 2 is better because of two reasons:

The user password has not to be stored at all (even if the keychain is itself encrypted again, I find the user password deserves more protection than the derived AES key, since the user password might be used for some other accounts)
Accessing the encrypted data is faster, since the slow task of deriving the AES key must only be done once

Is there anything I missed?


texts:
I will be writing some code to implement a non interactive proof of shuffle. I intend to use it on a voting application that supports Borda voting.
The voter must prove that her vote is valid, that is a permutation of 0..c-1 where c is the number of candidates.The vote is encrypted using lifted El Gamal.
However the bibliography is huge on shuffle proofs and I am kind of lost.
Can you recommend a paper/scheme that is easy to implement, practical and correct of course.


texts: What is the precise NP statement of Zcash?

texts: It would be great if you can point out the mathematical formulation or R1CS form of the NP statement of Zcash.


texts: How long would the 100 Year Cryptography Project have secured its data had it been started 100 years ago?

texts:
The goal of the Tahoe-LAFS 100 Year Cryptography project is to "enhance Tahoe-LAFS's cryptographic system so that Tahoe shipped today/next year might remain safe from cryptographic attacks for a 100 years."  Its developers are openly collaborating knowledgeable experts in the field, with at least all the information on the internet today at their disposal.

How long would such a project have secured its data had it been started 100 years ago?

Is the length of the secure period monotonically increasing as we ask the question with starting points less distant in the past?


texts: What would be the value in having a true prime number generator algorithm instead of a prime number test algorithm? Also, if such a thing existed, what would be the impact on not only cryptography?


texts: How to measure the complexity of the discrete logarithm problem?

texts: I looked here. The answer basically says that to calculate the complexity of the logarithm problem we have to take the length of the number representing the size of the group into accounts. It seems arbitrary, why don't we chose the size of the group as the argument? Is there a criterion to know what argument to chose? In fact, I know I overlooked something important since the complexity changes hugely if we do it by the size of the group. So please give me an answer.


texts: How do I get the equivalent strength of an ECC key?

texts:
I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in their publications: for RSA you can calculate running time of the field sieve:
$$\exp\left( \left(\sqrt[3]{\frac{64}{9}} + o(1)\right)(\ln n)^{\frac{1}{3}}(\ln \ln n)^{\frac{2}{3}}\right)$$
What's the equivalent for ECDHE? Eg. what is the running time for the best known algorithm for attacking a given ECC curve?
RFC 4492 states:

the following table gives
approximate comparable key sizes for symmetric- and asymmetric-key
cryptosystems based on the best-known algorithms for attacking them.

Symmetric
ECC (binary curve)
ECC (prime curve)
DH/DSA/RSA

80
163
160
1024

112
233
224
2048

128
283
256
3072

192
409
384
7680

256
571
521 (not a typo)
15360

How can I replicate the ECC column's numbers?
Edit: some some research, the paper mentioned in the RFC now 404s but a copy found at http://infoscience.epfl.ch/record/164526/files/NPDF-22.pdf mentions:

2.6.3. Attacks. A DLNFS equivalent or other subexponential method to attack EC
systems has never been published. The most efficient method published to attack EC
systems is Pollard’s parallelizable rho method, with an expected run time of 0.88√q group operations.

However I still don't know how to replicate the results: an elliptic curve has P and Q but how do I know what Q is, for, eg, secp521r1?
Edit: Deirdre Connolly on Twitter mentioned an approximation:
$log_2(0.88 \cdot \sqrt{2^{n}})$
Which matches the RFCs results. Will do some more research and post it as an answer in the next few days if she doesn't.


texts: Rate my idea: is that a stronger GPG-like algorithm?

texts:
I came up with a simple idea but I don't know if it is really secure or not. I know that you shouldn't create any algorithm on your own. I'm just curious, that's all.

Algorithm explanation:

First of all, Alice and Bob agree on a common secret password, lets say P1 (this should be done using a secure channel, like meeting in real life just a single time to exchange the password which is more practical than exchanging one time pads)
Alice chooses one secret passwords, lets say A1, which she keeps secret, Bob does the same, B1
Alice hashes her password and Bob does the same, so we have:

HA1 = hash(A1)    Alice's hashed password

HB1 = hash(B1)    Bob's hashed password
Alice sends her hashed password (HA1) to Bob, even on a insecure channel, because it's hashed. Bob does the same: he sends her his hash HB1
Let's say Alice wants to encrypt something. She would to the following:

Take P1 (the common password) and hash it so HP1 = hash(P1)
Take Bob's hashed password HB1
Encrypt the message using this long password (just a concatenated string) =  (HB1 + HP1)

When Bob's gets the message, he has to:

Insert two different passwords: his private password + the common shared password
The algorithm transforms those two words in their hashes and then tries to decrypt the message

In my opinion, this would be great because:

If Alice encrypts a message with Bob's hashed password, even if someone knows the shared password, only Bob can decrypt the message
If someone finds Alice's or Bob's private password, he can't still encrypt/decrypt anything because he doesn't know the common one
Only Alice knows the common password, so Bob's is sure that the cypher is surely made by Alice (no MITM attacks, fake identity like in GPG)
You have to share a common word just once. This solves the key distribution problem of the OTP method

What do you guys think?


texts: Finding missing bits mathematicaly in a DLP situation

texts:
Here is a DLP exercice

$g = 51234,\; h = 90403 ,\; N = 311 \cdot 359 = 111649$.

Define $r$ as the smallest positive integer with $g^r \equiv h \pmod N$.

Define $s$ as the smallest positive integer with $h^s \equiv g \pmod N$.

(Here, $r=33497$ and $s=27663$ ).

Questions:

If one looses some bits of $(r,s)$ can they be recovered? (do not use brute-force attack)

In other words: with the following information:

$\quad g=51234,\; h=90403,\; N=311 \cdot 359 = 111649\\
\quad r=3@497,\; s=276@3$

how can one recover the missing digits '$@$' ?

Editor's note: It emerged this is part of a complete problem.
The original statement is ambiguous about the minimality of $s$, has a typo in the value of $N$, and uses $\mathrm{gr}$ and  $\mathrm{hr}$ where there is now $r$ and $s$, per the notation in this answer.


texts: Does the McBits cryptosystem work without permutation matrix?

texts:
I'm studying post quantum cryptography and recently found McBits (PDF) that is a version of the Niederreiter cryptosystem.

I think I understand most of how the system works, but got a bit confused when I looked at the generation of the keys. In the Niederreiter scheme there is a non singular binary matrix S and a permutation matrix P which I cannot seem to find in McBits.

Do they not use these matrices or have I missed something?
If not, does it work without them?


texts: Finding p and q in RSA with a given n, |p-q|<10000

texts:
I've got an RSA encryption I need to crack, but to do it I need to find the p and q values of an N I am given - it's quite large, around 308 symbols.
I know that N is the product of primes p & q, but I don't know what kind of searching algorithm I'd implement to find the exact p & q that fit |p-q|<10000. Since it needs to be an efficient method, I'm looking for a way that excludes finding ALL possible combinations of p*q = n.
How would I go about doing it? How would I even start with inputting the 308 symbol number anywhere? It's too large to fit any kind of variable in c# for example...


texts: How to tell if a hardware RNG is rigged?

texts: On a related note of building my own RNG, as someone suggested to use several commericial solutions how can I check if it is rigged against me? (although I am still strongly biased to a homebrew solution that is designed to be hard to subvert, taking the shortest possible route from a quantum random source to the ADC)


texts: Parallel hashing function that always gives the same hash despite a variable number of cpus

texts:
The title pretty much sums it up :)

I'm looking for a hashing algorithm that does not need to be cryptographically secure beyond reducing the number of accidental collisions. There is no need to protect against a determined attacker.

Naively I thought I could take a file, cut it up into 1Gb chunks, hash each chunk individually, then hash the concatenation of the chunk hashes, as detail in this post: https://stackoverflow.com/questions/7015544/calculating-a-hash-code-for-a-large-file-in-parallel/36201575

This gives consistent hashes, however there is no relationship between the number of free processors, and the number of chunks. This is a shame, because you might have 100 cpus and you want to hash a 50Gb file, but you will only be 50% efficient. Alternatively, you might have 1 cpu and 100Gb file, and now there's overhead for making 100 1Gb chunks, hashing chunks, concatenating hashes, hashing again, etc, when the most efficient thing to do would be to just hash the file in 1 go.

So im looking for an algorithm that will essentially use up all my processors, but always give the same hash for the same data, irrespective of the number of processors used. Thank you so much!!


texts:
I have to send small (~10 bytes) authenticated messages over an insecure channel. I was thinking of an alternative to the "conventional" AES128-CTR-MAC, which will take 16 bytes for the CT and additional 2 or 4 bytes for the MAC. The motivation is that I'd like to reduce the message size as much as possible.

My alternative is to use a nonce and a counter, pass it to a HASH function, xor with the PT, and then AES encrypt. This would produce the CT.

Since PT is small, I was thinking off zero padding it (with two or 4 bytes).
Then on decryption, I can compare the zero padding and use it as an authentication.

As I see it, this method is not prone to "bit switch" attack (as changing the CT will totally ruin the PT).

Do you think it's a reasonable way to do authentication? Is it enough to use a plain HASH function, or is it better to add a key to the HASH?

If, in addition, I also want to authenticate a non encrypted part of the message, It is OK to concatenate this message to the HASH input?

In addition: The transmitter and the receiver are time synchronized. and keep their internal (and equal) counter value. on each transmission, the transmitter and receiver increment their counter. The message is sent once every 10 seconds, and the receiver will accept only one packet on scheduled time. That way, the attacker can't brute force the MAC.


texts: Complexity of AES key reconstruction from state 1 output and plaintext

texts:
Assuming that I am able to read the plaintext as well as the output of round 1 of an AES-128 encryption: Is it possible (if yes: how?) to obtain the RoundKey with a lower complexity than brute-force search? Would this key be unique? (I currently think so)?

The output of round 1 is:

r1out = MIX(SHIFT(SUB(plaintext xor rk0))) xor rk1

with rk0 being the round key of round 0 and rk1 being the round key of round 1. The plaintext as well as r1out is available. Only one sample is available, thus, I assume that I cannot run the algorithm twice (excluding chosen-plaintext etc.).


texts:
I'm currently doing the cryptopals challenges and for it's first set of problems it tells you to use frequency analysis of occurring letters to determine the likelihood of a key guess being correct and yielding legible english.

I was wondering, would calculating the entropy of the resulting plaintext not serve the same purpose, if not to a better degree seeing as it's not confined to the english language? Are there any benefits or drawbacks that one approach has over the other I'm missing?


texts: Let $\operatorname{F}$ be a $\operatorname{PRF}$, how to prove $\operatorname{F^3_{k_1,k_2}}(x) = \operatorname{F_{k_1}}(x) \oplus \operatorname{F_{k_2}}(x) $ is aslo a $\operatorname{PRF}$?


texts: Proving that a function is not invert-able (one way function)

texts:
I am having problems with proving if the one-way function (https://crypto.stackexchange.com/tags/one-way-function/info) is hard to invert or not.

$2^\sqrt {m} $ one-way function  $ f: \{0, 1\}^{2m} \to \{0,1\}^{2m} $

and $ g(x) = f(0...0^m || x_1, x_2, \ldots, x_m) $  $ g: \{0, 1\}^{m} \to \{0,1\}^{2m} $ (the || means here concatenation). Is function g one-way and what could be told about its security?


texts: What are the benefits of the two permutation tables in DES?

texts: Why do we use a permutation table in the first step of DES algorithm and one at the end of the algorithm?


texts: Does this describe an invalid key share attack?

texts:
I recently came across a mention of invalid key share attacks on this site. It is done with DH groups over $\mathbb{ℤ}_p$ :prime $p$, where $p = qh + 1$, where $q$ is the prime order of DH subgroup used, which can reveal $s$ s.t. $s \equiv x \bmod t$, given public key $X = g^x$, $x$ being a DH private key and $g$ being the generator of the subgroup. Where $t$ is some factor of $h$. I looked for it and could not find anything about it. I thought for a while and I think I know what it is. Can you please correct me if I am wrong?
For a simple example, I consider $p$ to be a safe prime so the subgroup should be the subgroup of quadratic residues modulo $p$. So let's say we have DH oracle with private key $x$ which takes as input a DH public key $Y = g^y$ and outputs $S = Y^x$. An attacker instead of feeding $Y = g^y$ to the oracle instead feeds $Z = g'^z$ where $g'$ is a primitive root modulo $p$ and $z$ is odd. It is an invalid public key because it does not belong to our subgroup. But the oracle ignores it and outputs $S' = Z^x = g'^{xz}$. Using the Legendre symbol, we calculate whether $xz \bmod p-1$ is even or odd which reveals whether $x$ is even or odd since $p-1$ is sure to be even. I am sure it is similar for other values of $h$ as well. Of course, it can be easily thwarted by having the oracle check whether or not the query is indeed a quadratic residue modulo $p$.
why to use a safe-prime in Diffie-Hellman key exchange?
EDIT:
I thought of a new way that does not need oracle access. Since $p ≡ 3$  (mod 4), as $(p-1)/2$ is a prime number, each member of the subgroup must have two square roots, one quadratic residue and one non-residue. By choosing $g'$ as one of the square roots of $g$, whichever is a non residue, the attacker can get a diffie-hellman shared secret by trying  $(\pm \sqrt{X})^z$. If authentication with shared key succeeds with the quadratic residue one, $x$
was even otherwise it was odd. This way we don't need an oracle that just spits out DH shared result.


texts:
I am currently working on a huge PHP project and we are seriously considering to use the Libsodium PHP library in it.

My question is related to the "sodium crypto box" functionality. We would use this functionality to implement public key authenticated encryption. We would generate keypairs using the "sodium crypto box keypair" function, nonces using the "sodium crypto box noncebytes" function, and seal/open the crypto boxes through the "sodium crypto box" and "sodium crypto box open" functions.

My question is basically "how safe is this"?

Public keys will be public, so our concern is that someone might be able to generate a correctly sealed box by "cracking" somehow the secret key of the sender, or to open a sealed box by cracking the SK of the receiver. These keys are 64-digit hexadecimal strings. Is my assumption correct that this means that there are 16^64?

If yes, this would mean that brute forcing all possible combinations at a rate of 1 million tries per second would take 3.6717430630808 * 10^63 years? Or are there more "efficient" attacks?

On the official Libsodium website I found the following algorithm details with respect to the functions we want to use:

  Key exchange: X25519
  Encryption: XSalsa20 stream cipher
  Authentication: Poly1305 MAC

Can someone try to explain me what this means ? Is following interpretation correct:

X25519: This is the keypair generation algorithm?
XSalsa20: This is the encryption algorithm?
Poly1305: This is the nonce generation algorithm?


texts: If you had to implement the BGN Cryptosystem, how would you do it?

texts:
If you had to implement BGN, how would you do it?

I'm looking for an implementation of the public-key cryptosystem due to Boneh, Goh, and Nissim (aka BGN), or at least some suggestions on implementing it myself. My goals are to explore/learn/play around with its structure, and, eventually, to produce some kind of timing data.

For those not familiar with BGN, it offers homomorphic addition of plaintexts (similar to Paillier and exp. Elgamal), but also a single homomorphic multiplication. So you can do things like homomorphically evaluate quadratic functions (with some bounds, mind you), or even do binary range proofs without a random oracle. Thus it seems like it would be incredibly useful in a range of cryptographic protocols, yet I can't seem to find an existing implementation, nor can I seem to account for why it hasn't been done already.

Nevertheless, it's not exactly something you can just whip up in Mathematica (with apologies to @PulpSpy).

Stanford's Pairing Based Crypto library (PBC) seems like a possible place to begin, but I don't know enough about the elliptic curves or pairings to modify their default curves to the one suggested in the paper. For example, the order of the default curve in PBC is based on a Solinas prime, whereas the order of the underlying curve in BGN is a prime that is functionally dependent on a large semiprime $n=q_1q_2$ such that the order of the bilinear group is $n$. The point is, it might take some doing to get PBC working for a BGN implementation.

Maybe CHARM would be a better option. Any thoughts?


texts: Transmit half the bits of the $g^a$ and $g^b$ as MITM countermeasure in DH key exchange?

texts:
I remember this trick from one of my crypto courses way back then, but I can't find the details, and I'm unable to figure out the logic behind it.

I'm talking about a countermeasure to the MITM attack on "plain" (textbook, unauthenticated) DH key exchange.  It was something like Alice and Bob compute $g^a$ and $g^b$ (respectively, where $a$ and $b$ are their randomly chosen not-to-be-disclosed values), but first transmit half the bits, and only after receiving the first half bits of the other party, then transmit the remaining half (example, if Alice's $g^a$ is 0x12345678, then transmit first 0x1234, and only after receiving Bob's first half, then transmit 0x5678).

My memory of the description of such trick is that Mallory (the MITM attacker) somehow needed to commit to something based on the first halves, but somehow what Mallory needed required the complete $g^a$ and $g^b$, which, by the time he/she gets those, it is too late and he/she cannot change the value now without being detected.

Does this ring any bells to someone?  What part am I missing?  I can't see how simply transmitting the first half, and only transmitting the second half after receiving the other party's first half would prevent Mallory to play MITM --- he/she just plays the game with Alice and Bob separately.

Thanks!


texts: Asmuth-Bloom Secret Sharing $m_0$ public?

texts:
i am trying to figure out how Asmuth-Bloom secret sharing works and followed the example on wikipedia and replaced it with own numbers.

Namely, i used:
$S=3$
$k=3$
$n=4$
$m_0 = 13, m_1=45, m_2=46, m_3=47, m_4=49$

I've been able to construct the shares

$s_1 = (17, 45), s_2 = (2, 46), s_3 = (34, 47), s_4=(6,49)$

I then result in $x \equiv 692 \mod 46*47*48$ which is correct, since $S = 692 \equiv 3 \mod 13$ which is my secret.

However, i wonder where $m_0 = 13$ is coming from for the final secret reconstruction, it seems like it is not explained anywhere. The only thing i could find is this stating it would be "kept secret by the dealer unless stated otherwise".

Is $m_0$ just either a public parameter? Or do i need the dealer to store it "secretly" (which would require the dealer to reconstruct the secret)?


texts:
In order to complicate rainbow table attacks, salt must be provided as input to PBKDF2 when a key is derived from a low-entropy password.

I have decided on my algorithms and key lengths to achieve certain bit strength. How long salt should I use for PBKDF2?


texts: change in bits leads to change in rounds the reason?

texts:
In AES algorithm why there are 10 rounds for 128 bits
whats the reason behind it like we have in raid storage technology or something else


texts: Are there key collisions in AES-192, AES-256?

texts:
Suppose we have a single, fixed plaintext block $p$ of 128 bits. Call the set of all possible 128 bit blocks $B$.

We could define fixed plaintext AES-128 as a function $f(k) \to B$ that takes a 128 bit key $k$ and outputs a 128 bit ciphertext block $c$.

As far as I know, AES-128 is a bijective function in this manner (is this assumption correct? edit: it is not). Additionally, the range spans $B$.

So how does AES with larger keys work? It must be a surjective function. What does this mapping look like? Are there, for every plaintext $p$, simply $2^{128}$ keys that map it to ciphertext $c$? Or is it unevenly distributed? Since the very same set must map $c$ back to $p$, it implies some sort of pattern in which bits are ignored/canceled out, dependent on the key.

Does any of this have any implications? Or are there no patterns here, and this is simply the way it is?


texts: Trying to calculate the strength of a Bitcoin brain wallet created with a custom diceware password

texts:
I want to create a brain wallet using a custom diceware since I don't like the original one. Instead of 7776 words it has 46656 because I use 6 dice for each word instead of 5, and also it only has words with many characters.

So this is what I got so far, please tell me if I made a mistake:

$$\frac{2 ^ {\log_2(46656) · 5} }{ (1 · 10^{15}) · (60 · 60 · 24 · 365)} = 7 \text{ years}$$

$2 ^ {\log_2(46656) · 5}$ is the entropy for a password of 5 words
$1 · 10^{15}$ is 1 Phash/s, which is the hashing power I'm assuming for this attacker. I don't even know if this makes sense, because an attacker doesn't need to start over for each brain wallet he wants to crack, and also there might have been huge databases of precomputed sha256 hashes before Bitcoin even existed.
$60 · 60 · 24 · 365$ represents a year in seconds.


texts:
I currently have this TOFU protocol:

First connection:

Client generates salt and inputs a password
Client saves salt
Client hashes password with argon2 and salt
Client generates Ed25519 keys
Client sends to the server: Ed25519 public key, argon2 hashed password
Server saves received Ed25519 public key and argon2 hashed password

After first connection:

Server sends to client a newly generated nonce
Client receives nonce inputs a password
Client hashes the password with argon2 (salt is retrieved from file), then the nonce is appended to it, then the result of the append is hashed with SHA-2, then the final hash is signed with a Ed25519 private key
Client sends signature to server
Server verifies with the Ed25519 public key (Ed25519 public key is retrieved from file) and argon2 hashed password (argon2 hashed password is retrieved from file) which also goes through the SHA-2 with the nonce which was earlier generated and sent

So my question is, is this protocol secure to verify the user has both the Ed25519 private key and the correct password? If yes is there a way to keep the same level of security while making it simpler, also is the SHA-2 necessary in after connection step 2? If not what are the flaws and how do you recommend to fix them?

Also, does a protocol like this already exist?


texts: Shamir secret sharing: calculate rest of shares when you know secret and one share

texts:
Using Shamir secret sharing, one is starting with a secret and end up with a number of shares based on a polynomial.

For example:

INPUT: secret: 123456 Shares:4 Threshhold:2

OUTPUT (4 shares calculated):

8017f1267477aa02cf0e6c6b36c29
802fd24948eab5d04fd84912dd801
8038336c5c9e4fd1c0d5157acb419
804e4486f0114ba54e7403f0cad51

My question is whether one can start with both a secret and a string - representing ultimately a share in the end state - and work his way into finding the rest of the shares?

For example:

INPUT: secret: 123456 Shares:4 Threshhold:2 Future Share: 8017f1267477aa02cf0e6c6b36c29

OUTPUT (Shares Calculated):

802fd24948eab5d04fd84912dd801
8038336c5c9e4fd1c0d5157acb419
804e4486f0114ba54e7403f0cad51

At the end you can express safely a secret in the form of shares as before - only this time you provided one of the shares as input to the process?

The benefit I see in the above process is in sharing secrets with a structure and very low entropy i.e. a Credit card number or a username. Splitting the secret in shares and sending them encrypted will still leave them vulnerable to brute force attack due to the inherent structure of the secret.

If though you:

use Diffie–Hellman key exchange for sharing 1 secret and use it as one of the future shares
produce the rest $t - 1$ shares
send the $t - 1$ shares encrypted

might this make the process more secure?


texts:
I am using Adium and wondering how secure it is.

I believe it uses AES-256 (I do not understand what that means) by default.  It also requests that users exchange fingerprints with each other before encrypted conversations can occur, and that a unique key is used for each conversation.  Logging can be turned on or off, depending on user preference.

Does this allow users that suspect snooping to breathe easier, or is it all show?


texts: Why restricting SHA3 to have only two possible capacities?

texts:
I just read the presentation slides of John M. Kesley (from NIST) for his invited talk at CHES 2013 about SHA-3 and learned that NIST is going to standardize Keccak with a possibly modified padding scheme. Ok, so far so good. But what I don't understand is why they thought it was a good idea to limit the possible capacity values to 256 and 512 when an implementation could easily support just about any value for the capacity that is a multiple of the word length of 64 bits.

Why did they restrict SHA3 to have only two possible capacities?


texts: What aspects of information theory are used in modern cryptography?

texts: In studying modern (and classical) cryptography, many notions from information theory crop up. Unicity distance, min-entropy, compression, encoding, etc. What parts of information theory should be part of the knowledge corpus of a working cryptographer?


texts:
There is an encryption scheme using elliptic curves given by @tylo explained here: @tylo's answer on ElGamal with elliptic curves and here: ElGamal with elliptic curves I. The encryption idea is to multiply (in the field) the message $m$ with the $x$-coordinate of a specific point on the elliptic curve (which is assumed to be hard to compute without breaking discrete log).

My question is why this is a secure encryption -- basically, only about half the $x$-coordinates are in use on an elliptic curve, so I guess it's a bit hard to say that the $x$-coordinates are really random. Is it assumed that the $x$-coordinate of a random elliptic curve point is pseudo-random? (There is no mentioned hashing)

Could anyone please supply a link to further reading or a brief explanation on the security of this scheme? Another question (also appearing in the mentioned questions) is if using addition in the field (instead of multiplication) is also secure.

EDIT: Following the discussion in the comments, I have a concern regarding the security of the scheme -- let's suppose that there are only two possible messages, $m_0$ and $m_1$. Then, the encryption is done by multiplying, in the field, the chosen message with the $x$-coordinate of an unknown point on the curve. A challenger receiving the cipher-text $c=x\cdot m_i$ can then compute $x_0=c/m_0$ and $x_1=c/m_1$. If only one of these is an $x$-coordinate of a point on the curve, then the other cannot be the chosen message. Can someone tell me what I missed in this "attack"?


texts:
For learning purpose, I'm trying to implement HMAC using SHA256.

In the pseudo code proposed in Wikipedia, the algorithm first focus on how to shorten or expand the key :

if (length(key) > blocksize) {
    key = hash(key) // keys longer than blocksize are shortened
}
if (length(key) < blocksize) {
    // keys shorter than blocksize are zero-padded (where ∥ is concatenation)
    key = key ∥ [0x00 * (blocksize - length(key))] // Where * is repetition.
}

Given I'm using SHA-256 that has a blocksize of 64 bytes and an output of 32 bytes :

if the key length is greater than 64 bytes, it will be shortened to 32 bytes
if the key length is less than 64 bytes, it will be expanded to 64 bytes

From what I read 32 bytes should provide enough security. But doesn't that seem odd that a 65 bytes key will provide less security than a 63 bytes key ?


texts: Why are leaf nodes hashed in merkle tree?

texts: I was reading the following on Wikipedia, it appears that the leaf nodes are hashed. What are the benefits of this? Why is it done?. I fell like they are done so that they can be transferred securely. However, I am not sure about this, would like some points to resources


texts: CDH between two groups implies weakness of El-Gamal

texts:
Let $G$ a cyclic group of prime order $p$ with a generator $g$.

Let $H$ a cyclic group of prime order $p$ with a generator $h$.

Suppose that you have an algorithm $\mathcal{A}$ that given two elements $g^a$ and $g^b$ in $G$ outputs $h^{ab}$ in the group $H$.

Show that El-Gamal encryption is not secure in the sense of ciphertext-indistinguishabiliy.

Let $a$ the secret key and $(g,g^a)$ the public key.

I observed that if we can control $H$, we can take $H=G$ and $h=g^a$ and we can actually decode an encryption using $\mathcal{A}$.

So, given an encryption $(g^b,g^{ab}m)$ we can run $\mathcal{A}(g,g^b)=h^{1\cdot b}=(g^a)^b=g^{ab}$ and using this we can easily obtain $m$.

My question

If we cannot control $H$ is it still possible? Can we use group isomorphism to prove that we can adjust $\mathcal{A}$ to deal with our choice of $H$? or maybe we can use $\mathcal{A}$ to only break ciphertext-indistinguishabiliy rather than full decryption of messages?


texts: Any shortcut to compute the cipher text for AES applied $n$ times to initial message $m_0$? Or compute $n$ for given $m_0, m_n$?

texts:
Knowing all AES parameters (including the key k) with

$AES(m_0,k)\rightarrow c_0$
$c_0\rightarrow m_1$
$AES(m_1,k)\rightarrow c_1$
$c_1\rightarrow m_2$
...
$AES(m_{n-1},k)\rightarrow c_{n-1}$
$c_{n-1}\rightarrow m_n$

Is there any (much) faster way to compute $m_n$? (instead of computing AES $n$ times)

Or compute $n$ for given $m_0$ and $m_n$?


texts:
I have a question regarding AES-GCM. Is is possible de parallelize the decryption.
From what I understood, that is one of the main features of CTR, right?
However, from the structure of GCM, I cannot see if that is possible. I guess one need to go and compute all the intermediate authentication parameters. I have searched for some documentation on that topic, but could not spot anything.
Thanks!


texts: Use Pohlig-Hellman to encrypt large files

texts:
I have an application that needs to combine two cascaded (symmetric) encryption keys using the Pohlig-Hellman cipher.

For example:

The system needs two keys for encryption $c = E_a(E_b(x))$ while it only needs one key for decryption $D_{a\otimes b}(c)=x$. The system may NOT need to consider Known Plaintext Attack or Chosen-plaintext Attack because the key is only used once.

Is it possible that the PH-based method can support encrypting large blocks? For example, can it support 1GB file encryption?

I am quite new to this area. Very much appreciated it if you could provide any tutorials on this.


texts: Why did NIST remove The Lempel-Ziv Compression test from the Statistical Test Suite?

texts:
NIST removed "The Lempel-Ziv Compression" test from the Statistical Test Suite in revision 2008 and above and has not incorporated it since – see revision 2010.

Why was it removed? Does it no longer provide sufficient testing of a PRNG or was it simply superseded by better tests?


texts: Decrypt a public encrypted message and Sign a signature, how the math is different?

texts:
As I understand, when you want to send a confidential message to someone, you encrypt the message with his public key. And he use his private key to decrypt the message.

At the same time, one can use his private key to sign a message, and other people use his public key to verify that it's him who sign it.

How the math is different between decrypt the message and sign a message?


texts: Does salt size affect password hash security?

texts:
I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of things about the salt size, but I have been unable to find a definitive answer. All of them agree that there is a minimum salt size, but I have found nothing about a maximum salt size.

So, here's my question: is there a point where the salt size doesn't matter anymore in terms of security and where it might even decrease it? If there is no maximum salt size, does it mean that the size we choose is actually a sweet spot among performance/space for salt storage/protection against precomputed tables?


texts: Recommended Shake256 digest size for KMAC based HKDF

texts:
On the wiki page for HKDF, in the Python Implementation, there is a hash_length variable for the sha256 digest length, used in the hmac in the hmac_sha256 function.

However, if I wanted to replace the hmac with a kmac, I would have to change the hmac(...) into kmac(...), where the underlying hash algorithm is the shake256 algorithm (XOF) - with variable output length.

So my question is what is the recommended length to set the shake256 digest size to when incorporating it into a KMAC based HKDF?


texts: Is a layer of classical encryption plus a layer of post quantum encryption equivalent to a classical/post quantum hybrid?

texts:
My company builds an encrypted data transfer app that has two layers of encryption.  There is an outer layer of TLS encryption using ECDHE with Curve 25519 that runs between app clients and servers.  There is also an inner layer of encryption that encrypts data end to end between clients using a 1024-bit Diffie-Hellman key agreement (yes we need to replace that)

Our customers are asking for post quantum protection now because of the long term value of the data they want to protect.  Instead of replacing one layer of encryption with a classical/post quantum hybrid scheme (which seems to be popular) we would like to leave the key management for our outer layer TLS protection with Curve 25519 intact and replace the only inner layer key management (the 1024-bit Diffie-Hellman) with a post quantum hybrid scheme like Kyber, New Hope, or SIDH.

Would it be accurate to tell our customers that a layer of classical public key based encryption covering a layer of post quantum public key based encryption is an roughly equivalent to replacing one layer of the encryption with a classical/post quantum hybrid?  We need to replace our inner layer key management anyway and putting in a post quantum solution there would be convenient.


texts: In using Boolean Circuits model of Computation in Homomorphic Encryption why is is considered fast?

texts: I am currently doing some reading on Homomorphic Encryption for research purposes and based on my reading using the Boolean Circuit Model of Computation specifically in regards to Fast Fully Homomorphic Encrytion over the Torus(TFHE) how is it considered fast and why is the noise growth and depth negligible?


texts: Is it secure to concatenate two 16-bit random numbers into a 32-bit one?

texts:
I'm working on a security application for RF modules aimed to protect a communication between an autarkic sensor and a line-powered receiver against MITM (man-in-the-middle attacks). I decided to use a communication approach based on a unilateral authentication using a 32-bit random as Nonce with time limited validation. I'm using for that a specific development tool, a specific library written in C and a compiler(C51 of Keil microvision for those who heard about it).

This specific library is offering me the possibility to generate a 16-bit random number reading the noise of an ADC. I suppose it is a true random. So I thought of calling this function twice and concatenating the outputs to produce a 32-bit random but I'm not quite sure if it is a secure way to process a random number. So I'm asking you guys:

What is the entropy in the resulting value? (I read an Intel post
saying that it is 17 bits of entropy in my case but I'm wondering if
it's correct and I heard others saying that it is always 32 bits of
entropy.)
How to evaluate the distribution of the resulting values over the
whole range of 32 bit values [0...2^32]?
By calling my function twice to generate the 16-bit random values,
the noise of the ADC will be read twice but considering that the
process of generating these numbers is based on microscopic phenomenon  I  suppose it is unlikely to have two equal values such as 0x12341234 or 0xAABBAABB or whatever. It means maybe that these numbers are less likely to come than the others. Correct?
And last but not least, does using a cryptographic mixing (quadratic
residues maybe?) after concatenating the two improve the
level of security (entropy) of the resulting value or not?


texts: Does AAD make GCM encryption more secure?

texts: Does additional authenticated data (AAD) make AES GCM encryption more secure? What if we drop AAD in AES-GCM 256? If we drop it, how will it make the encryption less secure?


texts: KCV scheme that encrypts a hash over key and IV

texts:
Is there anything wrong with this key-check value scheme?

This question is a follow-up to an earlier question of mine.  In summary, I want to devise a key-check value scheme that will enable my decryption function, when given a key K and a cyphertext C, to determine whether K is actually the key used to generate C, and to do so without having to decrypt all of C.

At the time of encryption, a key K and a nonce initialization vector IV are available (in addition to the plaintext P).  Define KCV as follows:

KCV = encrypt(key=sha256(IV || K), plaintext=IV)

...where encrypt stands for AES256 encryption in ECB mode, and IV || K stands for the concatenation of IV and K.  Both IV and KCV will be stored in a header right before the encrypted "payload" C.

At the time computing decrypt(key=K, header=H, ciphertext=C), the program will first read IV from the header H, use it and K to compute an expected KCV, and compare the latter with the KCV stored the header H.

Are there any obvious problems with this scheme?  In particular, is there a feasible way to deduce K based on the knowledge of KCV and IV?


texts:
In the official documentation for the Noise Framework there is a section with an overview of the identity hiding for each pattern. The numbering of properties there, obviously, from weaker properties to strong ones, and the last property is:

  An active attacker who pretends to be the initiator and records a single protocol run can then check candidates for the responder's public key.

The NK1 pattern has this property.

NK1 pattern itself
  <- s
  ...
  -> e
  <- e, ee, es
  ->

What does this property mean?

What mean check candidates for the responder's public key?
How can recording a single run of a protocol help this? (preferably with an example)
Why is this property the latest in the list (i.e. supposedly the strongest)?

(here is not any tag related to Noise Framework, this is strange)


texts: How to derive the curve Ed25519 from Curve25519?

texts:
According to the paper "Faster addition and doubling on elliptic curves" by Bernstein and Lange, the Montgomery curve (Curve25519) $$v^{2}=u^{3}+486662\cdot u^{2}+u$$ is birationally equivalent to the Edwards curve (Ed25519)
$$x^{2}+y^{2}=1+(121665/121666)\cdot x^{2}y^{2}.$$The paper says that the transformation is easy and can be done with$$v=\sqrt{486662}\cdot u/x$$
$$u=(1+y)/(1-y).$$
However, when I try to do this transformation I do not obtain the Edwards curve, but I get
$$(2+d)x^{2}+dy^{2}=d+(d-2)x^{2}y^{2}$$ with $d=486662$.

So I wonder how, starting from Curve25519, I can get to $e=121665/121666$ and
$$x^{2}+y^{2}=1+e\cdot x^{2}y^{2}?$$ Thanks!

The detailed transformation:


texts: Security of Even-Mansour scheme with keyed shuffle?

texts:
I was researching the Even-Mansour scheme and had a question that wasn't addressed in the paper that I saw, and google was minimally helpful.

What if a permutation that uses secret data like the Fisher-Yates shuffle was used as the F permutation instead of a publicly known one? Would the scheme still be equivalently secure?

I noticed the section in the paper that if F is an involution the security proof no longer holds. So there appear to be certain restrictions, and I'm not sure if this idea would violate them.


texts: How to prove that a ciphertext is encrypting multiplication of two values?

texts:
Zero-knowledge proofs with soundness, completness and zero-knowledge enable a prover to convince a verifier that a witness validates successfully a predicate without giving any information about the witness and without the verifier being able to extract the witness from the commitment C. Such kind of functionalities are useful in ecash,evoting,anonymous credentials, etc. In an abstract way the sender wants to convince a set of parties that he knows how to open the commitment and also that the commitment entails a message with specific properties.

So a Zero-Knowledge proof can be seen as an extension of a commitment scheme but without giving the opportunity ever to the receiver to open the commitment and with allowing the receiver to verify a statement-predicate.

If we work in a public key setting with DLP as the hardness assumption such as ElGamal then the sender without giving the key to the untrusted verifier can provide proofs of zero-knowledge that the encrypted values does contain a value that follows some properties, using Schnnor or Pedersen protocols as a building block.

However i am not aware of any kind of proofs that the encrypted value under some stream cipher for instance:$E(m)=m \oplus k=c$ for some random key k can be used to convince the verifier that c is the encrypted value of $m=a*b$ for some $a,b \in [0,range]$. Or more generally how i can prove that i have encrypted some specific values by giving the receiver only the ciphertext. Because it might be trivial that in a protocol you can prove a zero-knowledge of a value that you hold and you can use (for obtaining access anonymously to some credentials) but in most of the times this value is sent encrypted so there must be an association between the ciphertext that truly contains what is supposed to be known in the ZK proof and the ZK proof itself


texts:
I found this article on SO, but the answer was short, and the subject was closed,

What i don't understand, is:
Which one of the two limits memory usage to avoid custom Hardware to break the password?

Edit: there is an excellent discussion for beginners like me here:


texts:
According to many sources, the first few (n) bytes of the RC4 keystream are strongly biased, and therefore should be discarded before using the keystream to encrypt anything; this precaution is commonly called RC4-drop-n.

There are variants of RC4 available in SSH that do exactly that (arcfour128 and arcfour256).

I've not been able to find any hint on whether the SSL/TLS specifications take that into account. The RFC don't include any specification of the RC4 algorithm itself, just a reference to a source that is not available online.

So are they using RC4-drop-n, and if so, what is their value for n?


texts:
This is going back a ways... Schneier discusses SKIPJACK at Declassifying Skipjack. Schneier offers a link to a reference implementation at ftp://ftp.funet.fi/pub/crypt/cryptography/symmetric/skipjack (it is still alive). The unoptimized reference implementation is written by Panu Rissanen.

NIST provides the SKIPJACK test vectors in SP800-17, Table 6, pp. 140-42. NIST withdrew the the encryption specification, but left the decryption information and test vectors for interoping with legacy systems.

What I find is the reference implementation and NIST implementation differ. Rissanen's code does not arrive at a NIST Known Answer for the KAT's offered by NIST.

I'm trying to understand why Rissanen's code is not conforming to the NIST KATs. My question is, what is the history of SKIPJACK back then? Did the algorithm have several variants?


texts:
I am looking for a proof-of-work scheme which cannot be effectively parallelized.

For example, in hashcash (and by extension bitcoin) you have some collision-resistant hash function $f()$, a target $T$ and some constant $C$. You obtain the proof of work by running $P=f(C, N)$ for some nonce $N$ which gets incremented with each iteration, untill $P\lt T$ (intuitive definition). The computee then publishes $C, N$ and the verifier verifies the condition by running the hash function once.

This can be easily parallelized by using multiple processors and assigning a portion of $N$ to each one.

I know scrypt aims to be memory-intensive and thus expensive and that bcrypt does something similar.

My approach so far is to use a secondary proof by obtaining $P$ as described above and then running $C' \gets P$ and $P'=f(C',N')$ untill $P'\lt T$ as above. This forces a parallel environment to do the same job as the first scheme, provided the adversary can only afford $max(N)$ processors. It also prohibits the use of single-processor systems (and it's kind of a dumb solution anyway).

I tried to look into literature but unfortunately I'm not mature enough for it. I also understand my question is borderline reference-request but I think I could argue it is acceptable. I leave judgement to you.

To conclude: Is there a proof-of-work scheme based on some hard-to-parallelize (P-complete) problem? Intuition tells me this is a problem based on work (repetition) so it is inherently parallelizable.


texts: Need literature or link to family of cryptographic invertible polynomials which has distribution similar to inverted bell curve

texts:
Please help me identify a family of polynomials P(x,k) with the following properties:

$x\in Z_{2^n} $
$\forall k, \forall p_k\in P,\ \exists\ p_k^{-1} |\ p_k^{-1}(p_k(x)\equiv x\ mod\ 2^n $
Frequency distribution of $y = p_k(x)\ mod\ 2^n$ is an inverted bell curve

Thanks for suggestions


texts: Merkle tree vs chronological merkle tree

texts:
I've been reading some papers about using blockchain in VANETs (Vehicular Adhoc Networks).
Some of them have mentioned something called a chronological merkle tree (CMT). Is this different from the normal merkle tree? Here is a quote from one of them:

  The chronological Merkle tree (CMT) is the underlying data structure
  of the conventional blockchain

this paper can be found here:
Here


texts: How to distribute symmetric key between $n$ entities?

texts:
If there are $n$ servers for broadcasting a symmetric key in such a manner that following holds:

No server alone can find the key $K$ alone.
Any two servers can pass $k_i$ and $k_j$ such that $K=f(k_i, k_j)$ where $i\neq j$

How can a symmetric key be distributed between $n$ entities?


texts: How can we efficiently resync a stream cipher

texts:
If we have a stream cipher and the key but have lost a significant part of the beginning of the cipher stream of unknown length.  Obviously we can add syncing information outside but I was wondering what can be done without extra info.

I was thinking of a scenario where there is a pattern we expect to find periodically in plain text to know if we are synced. If we lost up to $n$ bits and the first occurrence of our sync pattern is no more then $k$ bits into our part of the stream then there is a trivial $\mathcal{O}(n \cdot k)$ algorithm.

Can we do better?

What can we do if we can't hold $k$ bits of the cipher stream in memory and may need to throw out more cipher text before we find the sync?


texts: Decrypting RSA encrypted messages with repeated use of p,q

texts:
I require help with the following assignment.

The Assignment

  A company by the name "Secure Keys" is very good at creating random prime numbers, however a new CEO decides to cut costs and use random numbers more than once in generating RSA key pairs.

  100 messages from this company were intercepted, all messages contain the cyphertext and the modulo used for decryption, we also know that their RSA encryption uses e = 65537 (2^16 + 1)

  You are to decrypt the files and find the message containing the flag.

I'm lost in how to approach this problem, since I know that having the n,e isn't enough to decrypt a single message and I failed to connect the repetition on prime numbers used part.


texts: Web Crypto API - deriveKey vs. deriveBits?

texts:
I have some questions about deriveKey and deriveBits for web crypto API.

I am confused about the state of these APIs. I do understand deriveKey generates a native key object whereas deriveBits just generates a byte array. However, when I look at Mozilla documentation https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto it doesn't even include deriveBits() in the API list. Is this one of those features that are "experimental" and may be dropped in the future? Or is this some political gesture?
What makes this even more confusing is how Safari doesn't even implement deriveKey() for PBKDF2 at all, whereas they did recently implement deriveBits() for PBKDF2 https://webkit.org/blog/7790/update-on-web-cryptography/ Does this mean I have to give up on using deriveKey() and use deriveBits() in order to support all platforms?
Assuming that #2 is true, I'm thinking of

using deriveBits() to first generate a bytearray
and then feed it into importKey() to generate a symmetric AES key
and use this process as an alternative to using the deriveKey() API. Is this the way to go?


texts: Using plain Diffe-Hellman for server authentication with known public key

texts:
Other considerations aside, is it possible to use DH with an established public key (together with fixed g, p, q) to safely authenticate a server instead of using some signing algorithm?

In other words, we will replace $SIG_S(Data)$ in some protocol with this scheme. The steps described below can be merged with whatever protocol is used, so it doesn't need to add more steps.

Client $C$ knows $g$, $p$, $q$ and $g^s$.

$C \rightarrow S : \{ g^c \} $
Server generates a random value $N_S$.
$K \leftarrow KDF(N_S, g^{cs})$
$S \rightarrow C : \{ N_S, HMAC_K(Data) \}$ where $Data$ is the relevant data signed in the protocol we're modifying.
$C$ constructs $K$ and verifies that the HMAC calculation matches.

Assume that none of $K$, $N_S$, $g^s$ or $g^c$ is ever recycled for any other use (such as key generation).

What I wonder is if this would be an acceptable replacement for signing with DSA/RSA/etc to prove identity in this particular setup.

Examples:

Plain STS with server authentication only

$C \rightarrow S: \{ g^x$ }
$S \rightarrow C: \{ g^y, S, \{ SIG_S(g^x, g^y) \}_{K_s} \}$

Plain STS modified

$C \rightarrow S: \{ g^x, g^c \}$
$S \rightarrow C: \{ g^y, S, \{ N_S, HMAC_K(g^x, g^y) \}_{K_s} \}$

Plain SIGMA with server authentication only

$C \rightarrow S: \{ g^x$ }
$S \rightarrow C: \{ g^y, S, SIG_S(g^x, g^y), MAC_{K_m}(S) \}$

Plain SIGMA modified

$C \rightarrow S: \{ g^x, g^c \}$
$S \rightarrow C: \{ g^y, S, N_S, HMAC_K(g^x, g^y), MAC_{K_m}(S) \}$


texts: Performing differential cryptanalysis for randomly generated S-boxes

texts:
As far as I know, performing differential or linear cryptanalysis always requires a knowledge of the S-boxes' content and order. Yet in Bruce Schneier's Applied Cryptography, it is stated that random key dependent S-boxes and/or randomly reordered S-boxes for DES can make the algorithm weaker.

So my question is, how would an attacker perform such attacks on a cipher without knowing the content of the S-boxes ?


texts: Key derivation using the main AES encryption key and some plain text?

texts:
I am using AES 128 bit encryption in java.
I have an encryption key and 10 digit plain text.

I want to derive a key for HMAC using the AES encryption key and the 10 digit plain text. This plain text will remain fixed in my case.

How can I derive key for HMAC using the above ingredients.

To be more precise please refer below diagram:- How can I achieve to get a new key from the respective input.


texts:
The high security of RSA is granted, because it is very hard to factorize
$$
N = p * q
$$

Nevertheless, there is actually no need of factorizing $N$, in order to generate the $Private$ $Key$, but the need of knowing
$$Φ (N) = (p - 1) * (q - 1) = N - (p + q-1)$$
If we think of $N$ as a rectangle with the width $p$ and the height $q$, we are able to find this geometrical coherence

That means, if there is an efficient way to find pairs of square numbers with a distance of $4*N$, RSA would be broken.

Please leave opinions on that.


texts: Criteria for public modulus of RSA accumulator

texts:
What are criteria for generation of an RSA public modulus used in an RSA accumulator, and their rationale? Are there special requirements in some sub-cases, like for «one-way» accumulators?

Josh Benaloh and Michael de Mare's One-way accumulators: A decentralized alternative to digital signatures, in proceedings of Eurocrypt 1993, prescribes the public modulus to be a rigid integer. That's defined as $\,n\,=\,p\,q\,$ with $p$ and $q$ safe primes and $\,|p|\,=\,|q|\,$ (equal bit size). Then $\,n=(2p'+1)\,(2q'+1)\,$ with $p$, $p'$, $q$, $q'$ (large) primes. The subgroup of quadratic residues of $\mathbb Z_n^*$ has order $n'=p'\,q'$. And the function $e_{n,y}(x)\underset{\text{def}}=x^y\bmod n\,$ is a permutation of this group when $\gcd(y,n)=1$. The authors argue:

Thus, if the factorization of $n$ is hidden, “random” exponentiations of an
element of this group are extremely unlikely to produce elements of any proper subgroup. This means that repeated applications of $e_n(x,y)$ are extremely unlikely to reduce the size of the domain or produce random collisions.

More precisely, what kind of disaster can strike if we used random primes? Is there a positive security argument relying on safe primes? Also, is there a justification for $\,|p|\,=\,|q|\,$ beyond getting $\,|p|\approx|q|\,$, which helps against ECM factorization?

What about the different recommendations in Michael T. Goodrich, Roberto Tamassia, Jasminka Hasic's An Efficient Dynamic and Distributed RSA Accumulator (arXiv), 2009), originally in proceedings of ISC 2002? They ask strong primes without justification, referencing the HAC's definition:

A prime number $p$ is said to be a strong prime if integers $r$, $s$, and $t$ exist such that the following three conditions are satisfied:
 (i)    $p−1$ has a large prime factor, denoted $r$;
 (ii)   $p+1$ has a large prime factor, denoted $s$; and
 (iii)  $r−1$ has a large prime factor, denoted $t$.

When the application is RSA signature and encryption, these requirements are obsoleted¹ by the need to dimension $\,n\,=\,p\,q\,$ for resistance to GNFS. Are these requirements appropriate in the case of RSA accumulators, and if so for what quantitative meaning of large?

¹ FIPS 186-4 appendix B.3 drops these requirements for 1024-bit or larger primes, and that seems conservative. There's a discussion in Ronald L. Rivest and Robert D. Silverman's Are ‘Strong’ Primes Needed for RSA?, but it does not consider the interest of (i) and (ii) in multi-target attacks, where the adversary's goal is to factor any of many public moduli.


texts: Security Implications of Fixed & Opposite Fixed Points of Sbox

texts: Fixed point means when Sbox Input is equal to Sbox Output whereas Opposite Fixed Point means when Sbox Input is complement of Sbox Output. How does Fixed and Opposite Fixed Point affect the strength/ security of Sbox?


texts: StoredKey in Salted Challenge Response Mechanism (SCRAM)

texts:
In SCRAM (RFC5802, page 8) the client generates ClientKey to server, which is a derivation of the original password. This is communicated to the server in a secure fashion, which then performs a single hash operation H(ClientKey) and check if that's equal to StoredKey. That is, the client proves knowledge of something which, when hashed, equals something stored on the server.

I understand that SCRAM puts a lot of steps in between to include a challenge-response mechanism and never actually sending the real key over the wire and such. However, I don't to see how this is conceptually different from sending PlaintextPassword and comparing it to the server's H(PlaintextPassword). Note that this is a single hash operation, not the original PBKDF2 used to derive ClientKey in the first place. In SCRAM wouldn't the ClientKey be just as sensitive as PlaintextPassword? If an attacker were to gain knowledge of ClientKey then PlaintextPassword is not needed anymore. Since it's only secured in storage using a single hash operation, doesn't this make SCRAM in it's defined implementation vulnerable to rainbow tables on a leaked database?

Bonus question: would there be any problem with taking that single hash operation and replacing it with something stronger, like another round of PBKDF2 or even scrypt?


texts: Does the following linear equation hold in bilinear pairings?

texts:
Does the following hold in bilinear pairings?
$$e(g^{a_1x_1}g^{a_2x_2},g^{c_1}g^{c_2})=e(g^{x_1+x_2},g^{a_1a_2(c_1+c_2)})$$


texts: Dimension of secret key vector tensor with itself?

texts: In the algorithm FHE.KeyGen on page 18 of BGV, the dimension of the secret key $\textbf{s}_j$ is $n_j+1$. Why would the dimension of the long secret key $\textbf{s}_j' \leftarrow \textbf{s}_j \otimes \textbf{s}_j$ be $\binom{n_j+1}{2}?$ Wouldn't it be $(n_j+1)^2?$


texts: DES — Can I recover the key when I have both ciphertext and the plaintext?

texts: Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data?


texts: Terminology: What is the word describing a hash key, a crypto key, and a certificate?

texts:
If I want to check the integrity of some piece of data, I can check that a cryptographic hash of the data corresponds to a known hash.

Alternatively I can also check a digital signature on the data and see that it corresponds to a known authority for the data.  I can use certificates or not for this.

I can also verify a MAC for the data using a secret key.

Lastly I can decrypt the data using an authenticating cipher mode using a secret key that is known only by me and the known authority for the data.

In these three cases I have some key or hash material.  What is the word that correctly describes the material I have?


texts: Generating bilinear pairing parameters - running time of finding member of p-torsion group

texts:
Update: Question completely rephrased.

I want to create the parameters for a bilinear pairing (the Tate pairing in this case).

In case you're interested I'm following this thesis, specifically the type $F$ curves (page 61) which has embedding degree $k = 12$. But it's probably not necessary to refer to the thesis to answer this question, since my question is likely elementary.

Using the method I've so far generated a finite field of size q where q is prime, an elliptic curve over $F_q, E(F_q)$, a prime of size $p$ so that $p | (q^{12} - 1)$ and a point $P$ on $E(F_q)$ of order $p$. Now the last step is to generate a point $Q$ which must also have order $p$ over the curve $E(F_{q^k})$ which must not be on $E(F_q)$. I've searched around and found the following suggested algorithm (where n is the number of points on $E(F_{q^k})$):

1) Generate a random point $R$ on $E(F_{q^k})$

2) Calculate $Z :=(n/p) R$

3) If $Z != O$, return $Z$ - otherwise, go to 1.

I.e. keep generating random points, scaling them by $(n/p)$ and repeating this until one gets a point different from the point-in-infinity, in which case the result should be a point of order $p$.

My question is - what is the running time of this algorithm? I.e. what is the per-iteration probability of getting $Z != O$ in step 3? I've tried to let it run but it doesn't find any points, it just keeps getting $O$ in step 2. Now, since calculation over $E(F_{q^k})$ are quite slow, I've only tried a few hundred iterations.

In this case $p$ and $q$ are primes of size 256 bits and $k = 12$. This means that $n$ is of the order of $2^{3072}$ (since n is the number of points on $E(F_{q^k})$). The p-torsion group has size $p^2$ meaning that such points are extremely rare and would be impossible to find by "random checking". But in this case, the algorithm doesn't operate by just generating a random point and checking if $p R$ is O. Rather, it generates a random point and multiplies by $(n/p)$. So it could be this increases the probability of finding a point.

But still, it seems to take forever! So it would be nice to know what the expected number of iterations is. Thanks!


texts: Cryptography systems based on NP complete problems

texts:
There is any cryptography system that have a good reputation based on NP complete problem?
I read about the knapsack, but it was cracked.


texts: Is it overkill to run a key generated by OpenSSL through pbkdf2?

texts:
I'm generating a key & iv with OpenSSL via:

key = OpenSSL::Cipher::Cipher.new('aes-256-cbc').random_key
iv = OpenSSL::Cipher::Cipher.new('aes-256-cbc').random_iv

Then I am running the random key through:

salt = OpenSSL::Random.random_bytes(32)
OpenSSL::PKCS5.pbkdf2_hmac_sha1(key, salt, 2000, cipher.key_len)

My question being, is this overkill or make the random key generated by OpenSSL weaker? Would it be sufficiently secure to just use the key without running it through a pbkdf2 function?

Any advice would be greatly appreciated.

Thanks!


texts: Government root SSL certificate possible vulnerabilities

texts:
I'm writing an article about new government law in Kazakhstan. The law was accepted in December, but now one of our providers announced information for small and medium business how to install government-provided root SSL certificate: https://www.beeline.kz/b2b/sme/ru/press_centers/10040

Yes, they really want to listen the whole traffic of all citizens.

I want to show in my article that this is really-really bad solution. And I need all information about possible vulnerabilities of it.

The certificate is valid for 4 years, data size, as I think, 1024 bytes.

Link to the cert: https://www.beeline.kz/uploads/document/file/11120/QAZNET.rar


texts: computing inverses in truncated polynomial rings manually for NTRU encryption

texts:
Can someone explain how to find inverses in truncated polynomial rings manually (i.e. on pen and paper)?
As an example from the tutorial:

  Example. Take $N=7$, $q=11$, $a=3+2X^2-3X^4+X^6$. The inverse of $a \bmod 11$ is
  $a^{-1}=-2+4X+2X^2+4X^3-4X^4+2X^5-2X^6$, since

  $(3+2X^2-3X^4+X^6)*(-2+4^X+2X^2+4X^3-4X^4+2X^5-2X^6) \equiv -10+22X+22X^3-22X^6 \equiv 1 \mod 11$.

How to find $a^{-1} = -2+4X+2X^2+4X^3-4X^4+2X^5-2X^6$, manually, not using the pseudocode?


texts:
At the time of this writing, there are 3 sources for parameters for the McEliece public-key cryptosystem out there.

The first paper is the original McEliece paper ("A Public-Key Cryptosystem based on Algebraic Coding Theory" by McEliece), which only specifies $(n,k,t)=(1024,524,50)$, which is known to be broken as of today with an effort of around $2^{60}$ in "Attacking and defending the McEliece cryptosystem" by Bernstein, Lange and Peters (2008).

The next source is the exact same paper that broke McEliece, by Bernstein, Lange and Peters. They propose $(1632,1269,33)$ (80-bit), $(2960,2288,56)$ (128-bit) and $(6624,5129,118)$ (256-bit) as $(n,k,t)$.

"Selecting Parameters for Secure McEliece-based Cryptosystems" by Niebuhr
, Meziani, Bulygin, Buchmann, as of 2010, proposes new sets of parameters, based on Lenstra-Verheul-Style modelling. The authors also mention the above paper, but only for their attack. They propose $(1702,1219,45)$ (80-bits) and (computed by myself with same parameters) $(3807,2891,77)$ (128-bits).

So you may note that there's some difference between those recommended parameters. The difference between the public keys of the two 80-bit sets is 230,000 bits, so here comes my question:

Why is there this difference in the parameters and which ones should rather be used?


texts:
To construct a secure multiparty computation function, we need to use the cyclic group G = Z*p^2 with p is a large prime. However, we are uncertain that DDH holds over this group.

Can you show that DDH holds/doesn't hold over the cyclic group Z*p^2?

Note that: the order of G is q = p(p-1) and q is multiple of the large prime p.

Thank you very much!


texts: Size of bitwise OR between vectors represented as polynomials

texts:
I am using polynomials to represent bit vectors, such that the value of the d-th coefficient is $1$ if the d-th bit in the vector is $1$, and $0$ otherwise.
For example, the vector $A = [1, 1, 0, 1, 0]$ is represented by the polynomial $P_A(x) = 1 + 1x + 0x^2 + 1x^3 + 0x^4 = 1 + x + x^3$.

I understand that I can find the number of bits $1$ in the bitwise AND of two vectors, $|A \wedge B|$, by multiplying $P_A(x)$ and the "inverted" $P_B(x)$ and checking the (d-1)-th coefficient in the resulting polynomial, as explained in Scalar product of vectors over polynomial rings.

Now I want a similar way to find the number of bits $1$ in the bitwise OR: $|A \vee B|$.
Considering $|A \vee B| = |A| + |B| - |A \wedge B|$, so far I thought about of $|A|$ by multiplying $P_A(x) \cdot P_1(x)$, where $P_1(x)$ is the polynomial having the value $1$ for all coefficients. Then, I would do the same to find $|B|$.

This would require three polynomial multiplications and two additions: $P_A(x) \cdot P_1(x) + P_B(x) \cdot P_1(x) + P_A(x) \cdot P_B(x)$.
Since the first two have $P_1(x)$ in common, it is possible to simplify it a bit: $(P_A(x) + P_B(x)) \cdot P_1(x) + P_A(x) \cdot P_B(x)$, using a total of two polynomial multiplications.

My question is: Is there a way to do this using fewer polynomial multiplications?


texts: How to communicate by email with forward secrecy and deniability?

texts:
My correspondents and I would like to communicate privately by email. We used to employ PGP but that might have been shooting ourselves in the foot. PGP doesn't have forward secrecy. If any of our private keys are ever compromised (by law, hacking, or rubber hose), then all our past conversations can be immediately decrypted. And our signatures shown in court.
So we switched to instant messenger conversation with Off-the-Record (OTR) messaging because it gives

Encryption
No one else can read your instant messages.
Authentication
You are assured the correspondent is who you think it is.
Deniability
The messages you send do not have digital signatures that are checkable by a third party. Anyone can forge messages after a conversation to make them look like they came from you. However, during a conversation, your correspondent is assured the messages he sees are authentic and unmodified.
Perfect forward secrecy
If you lose control of your private keys, no previous conversation is compromised.

As explained eloquently at http://www.cypherpunks.ca/otr/otr-wpes.pdf
Is there anything like that for email?


texts: Known Plain Text Attack DES-OFB on Crack.sh

texts:
I am trying to do a known plaintext attack on DES-OFB through crack.sh. I have been having trouble lately. I keep getting blank text file back with no keys returned. Does anybody know if DES-OFB is supported by Crack.sh? I tried contacting them but did not get a response. Here is what I have last submitted.
$ ./des_kpt.py parse -p 6c42e85de2e82693 -m fffffffffffffff -c 57ef7750e24ab08f

                 PT = 6c42e85de2e82693
                  M = ffffffffffffffff
                 CT = 57ef7750e24ab08f
                  E = 0
crack.sh Submission = $98$bELoXeLoJpP////////1fvd1DiSrCP

I am not sure what exactly the mask dose either. I set it to all F's. Here is the key if it helps. There is 3 due to what DES_KPT spits back out when I run a decrypt command, which also does not produce correct PT. 345E207C6D2FE679 34bc83e6c5f9bc 345e207c6c2ee678
Any help or other tools is appreciated!


texts: How to find Y on an elliptical curve in a finite field?

texts: For example, let's use secp256k1, the curve used by bitcoin, y^2 = x^3 + 7, and x=12. Over the real numbers, that calculation is trivial - I can simply use a calculator. But in a finite field, how does it work? If I say "X is 12", how do I calculate Y? The equation (when using real numbers) almost always results in fractions. And modulo P only works with integers.


texts: Is it safe to reuse an IV 100 times to a single key with AES CBC?

texts:
I have a unique 6 digit number that I am generating a IV from. I am trying to make it as unique as possible. From my programming, I am able to get it down to only have 100 duplicate IVs per unique 6 digit number.
Now I have read that reusing IV's is a big no no because it leaks information.
My question now, assuming I am only using 1 key and if someone has gained access to my database of 1 billion records and has the encrypted string as well as the IVs. If each IV is only reused 100 times, would they be able decrypt the encrypted string based off only that information?
If so, how would they be able to?


texts: Using a hash of data instead of the full raw data for authenticated data in AES-GCM

texts:
I am serialising JSON objects, and would like to encrypt some of the values.  I plan to do this with AES-GCM.

I would also like to ensure the integrity of the overall object.

The requirements are for integrity of the overall object, confidentiality for some of the values, plus a requirement for plaintext for other values.

There are a small number of known top-level keys.

For example, if my "plaintext" JSON object were

{
    "id":"823623672",
    "address": {
        "line1": "2000 Broadway",
        "line2": "New York",
        "zip": "12345"
    },
    "telephone": "+1 212 555 1234",
    "last-accessed": 1543946340
}

I would like an "encrypted" object to be something like

{
    "id":"823623672",
    "address": "URAVvDTOrovXBehz2ms8ej9BRCaKdx8LsmuA81IkESM=",
    "telephone": "0gAtx7Hh/kPD7chfNGy90A==",
    "last-accessed": 1543946340
}

Now, I can easily serialise the address and telephone and encrypt them, and provide the values of id and last-accessed as the associated data.

However, the actual objects I will be using will have quite a bit more data in the "do not encrypt" keys.

So instead of using the values of id and last-accessed as the associated data directly, I would like to hash these values and use the hash as the associated data.  (Probably SHA-512/256, if it matters.)

To decrypt, I will re-create the associated data (hash) from the input data, then decrypt each of the encrypted keys; if any of the decryptions fail then the overall decryption fails.

(And using the hash means I can create the associated data using hash "updates" with the values of the known keys one after the other, rather than having to create a single contiguous data item with the values all concatenated.  In this instance I would be hashing 823623672 then '\0' then 1543946340 then '\0'; the separators are to ensure an attacker couldn't change the id to "82362367" and the last-accessed to 21543946340, for example.)

(I do not have to worry about an attacker adding additional top-level keys; the ones that have semantic importance will be in the associated data/hash.)

It seems to me that using the hash should not weaken the security of the encryption, but I'd like to check.

Is using a hash rather than the full data going to weaken the security of the encryption?


texts:
What are the consequences, in terms of security, of using a padding rule at the beginning of the message? Instead of the end?

For instance, in most hash functions, we are using the following padding rule: appending of a bit 1, followed by a number of 0 such that the total length is a multiple of the block length.

What happens if we change this rule in: prepend a bit 1. Then, prepend a number of 0 such that the total length is a multiple of the block length.

I would like to know if the various security properties that can have a hash function are preserved.

Thank you.


texts: Why does the random oracle receive much more criticism than the ideal cipher?

texts: The random oracle model seems to be criticized a lot as lacking practical relevance, making wrong predictions, being programmable, etc. However, I have never heard such criticism about the ideal cipher model even though the random oracle and the ideal cipher are equivalent. Therefore, the random oracle model and the ideal cipher model are equivalent. Why is one of them being heavily criticized while the other is not?


texts:
I want to know how to factor this number only given $n$ and $e$, I have tried to factorize $n$ using Fermat's little theorem and also tried primefac module in python (running for the past 4 days) but had no luck, and I want to know how $n$ can be factorized.
For the values follow this link: https://pastebin.com/37WFzBvm


texts: Safe way to derive IV from the DH shared keys for AES-GCM?

texts:
I am preparing to use AES-GCM to make a secure communication program.
Here is the procedure

DH key exchange to get shared keys
SHA256(shared keys)
Use AES-GCM to encrypt a message while the key only used once.

However, I was confused about the way to get IV in step3. I know IV/nonuse must be unique. The size of the IV should be 96 bits. I know we can use the timestamp to generate iv. However, I need to generate the IV from the shared key. Is there any method to do it safely?


texts: What is actual difference between POODLE and BEAST?

texts:
I know that both attacks are based on the fact that the cipher used for communication is block cipher with CBC mode of operation and that is vulnerable because of predictable IV. Furthermore the original paper of POODLE claims that

  "Unlike with the BEAST [BEAST] and Lucky 13 [Lucky13] attacks, there is no reasonable
  workaround."

But openssl library seems to have implemented some mitigation technique known as 0/n split(to be fair I did not understand how that works either) and that seems to mitigate POODLE as well as BEAST. Then why research paper claims so?


texts: How to falsify RSA signature with known message

texts:
I have a question about the RSA signature.
Let's say Alice has $(d,n)$ as the private key and $(e,n)$ as the public key. In order to sign a message $m$, Alice computes $y = m^d \bmod n$ and sends $(m,y)$ to Bob. In order to verify the signature, Bob computes $x = y^e \bmod n$ and accepts the signature if $x = m$.

My question is to find a message $m$ that lets Eve falsify in an easy way the signature by only knowing the public key.


texts: Why doesn't “Classic McEliece” need scrambling?

texts:
The original McEliece scheme uses two random matrices S and P to scramble the generator matrix and uses $\mathsf S·\mathsf G·\mathsf P$ as the public key. The Niederreiter variant also does about the same thing.

However, in the Classic McEliece proposal (based on Niederreiter in spite of its name), they don't do any of that.
They are giving lots of details as to why the two other modifications by Niederreiter (msg is the error instead of codeword, transmitting the Generator matrix in systematic form) don't reduce security, but they don't detail why the can just remove this scrambling. Why can they? (Can they?)

References:

Original 1978 McEliece Paper
Niederreiter (beware, very big PDF)
Classic McEliece


texts:
I have learned from Applied Cryptography that triple encryption with three independent keys in encryption-decryption-encryption (EDE) process gives security not higher then $2^{2n}$ when it comes to meet-in-the-middle attack, where $n$ is keysize. If the triple encryption is done in encryption-encryption-encryption (EEE) process instead, is the security still the same as in EDE process or less?

I'm just curious to know how and how much security does this middle decryption provide?


texts: How to prove that finding a cycle in a cryptographic hash function is hard?

texts:
I want to show that finding cycles in a cryptographic hash function is hard.

My thought: assume there a black box, that given a cryptographic hash function $h$, finds some $x$ and $r$ in polynomial time, such that applying $h()$, $r$ times gives $x$:
$$ h(h(h\ldots(h(x))) = x $$

Can this be used to prove the function is not collision resistant or pre-image resistant?


texts: Does "hash than sign paradigm" apply to ECDSA cryptography?

texts:
From wikipedia https://en.wikipedia.org/wiki/Digital_signature#How_they_work
and other articles I see that: "There are several reasons to sign such a hash (or message digest) instead of the whole document."
But they are related to RSA.

Does it make sense to follow this rule for Ed25519 signature scheme?


texts:
I'm trying to find the logic for introducing the S-box, but having trouble understanding why. In a simple cipher, e.g.

c = pt xor key

I understand that I can easially find the key when choosing the plaintext myself

key = pt xor C

But I don't see why an S-box can help in this at all, given that the S-box is public.

C = S[pt xor key]

Because then I could just do

key = S^-1[pt xor C]

I understand by adding multiple rounds and keys, this gets harder, but what is the S-box giving, when we can just reverse it?


texts: Is this method of string encrypting "uncrackable"?

texts:
I was thinking of unique methods of encrypting strings, and I thought of this.

Given a string, for example "Hello, World!" we can convert it into a char array using a computer program, and then convert each char into the corresponding number from the ASCII charcode table. (For example, H is 72, e is 101 etc.) then multiply each number by a random "key", which is just an integer (which will be the same for each number), in this case lets say it is 3042 (So 72 is now 219024, 101 is now 307242).

Then, remove from each number a value, which will be our second key (In this case, lets say it's 287), So 219024 becomes 218737 etc.

Now you see, if 2nd key wasn't removed from the result of the number * key1, then we could simply find the common factors of all the numbers, and grab the key.

However since a second key is removed, is this method of encryption practically uncrackable without knowing at least the 2nd key?


texts: OpenSSL - What Data Is Used To Create A Certificate's Digital Signature?

texts:
I am coming up-to-speed on OpenSSL certificates.  In all of my research I see where "data" is hashed to create a hash value that is used as the basis for a certificate's digital signature. This hash value is encrypted using the sender's private key, at which point it becomes the certificate's digital signature.

What "data" is hashed?  Is it specific information from the certificate?  Is it all certificate information?  Does the the data include the certificate's public key?  Or, is the data some random number or string that is generated by OpenSSL when the certificate is created?  I'm assuming that the "data" is certificate data since one of the functions of PKI is to validate that the contents of a message (in this case a certificate) haven't changed since the message was created.


texts: Cryptosystems defined over the real numbers

texts:
In a computational setting it is clear that we cannot do computation over the real numbers, as we couldn't generate, much less store them, so we have to instead deal with numbers that approximate them.  If a cryptosystem has some component defined over the real numbers, or uses "real valued" functions such as $\sin$, then does using such systems over the discretized space compromise the theoretical security of the system?

I am particularly thinking of chaos based cryptosystems for example, where encryption consists of iterating a map over an interval of the real line.  Are such systems inherently less secure because they cannot be actually implemented over the reals, and instead are approximations?  Can such approximations be used to cryptanalyze the systems?


texts: how much is secure to encrypt a password using itself (as encryption key) for storing it on an insecure media?

texts:
I want to store a password securely on a storage (suppose in a usual unencrypted file).

I use this password as AES key to encrypt itself (using AES-ECB) & then store it on the media (the password length is at most 16 bytes).

When user wants to confirm it's identity, I decrypt this saved encrypted content with user input & compare it with the same input, if they were equal it means that user has authenticated successfully.

Know I've two important questions:

Is it a CORRECT solution? If not, why not?
Is it the BEST solution? If not, why not? (and please give me the better suggestion)


texts: Looking for commutative asymmetric cipher for data matching

texts:
I need some crypto operation for matching data privately between two peers (let say Alice and Bob). Alice should be able to encrypt her data with Alice and Bob public keys and pass the cipher text to Bob. Bob could not decrypt the cipher text but could match it with the same cipher text produced on the Bob side. As a result Alice and Bob will know which source messages have both of them.

So I am looking for asymmetric cipher which allows to change the order of encryptions providing the same cipher text (I suppose it is called commutative). So given $M$ - plain text message, $pub_1$ - first public key, $pub_2$ - second public key. I need the crypto function $F(message, pubkey)$ with such property:

$F(F(M,pub_1), pub_2) = F(F(M,pub_2), pub_1)$


texts: How to get the value of the subkeys in IDEA decryption?

texts:
So I saw this example of IDEA ..

If the key is : 5a14 fb3e 021c 79e0 6081 46a0 117b ff03

The encryption subkeys are:
http://imgur.com/a/bZGMF

The decryption subkeys are:
http://imgur.com/a/FnF2c

And I can't figure out how the decryption keys
were computed.. How is additive inverse and multiplicative inverse done to calculate the decryption subkeys? plss helppp!!


texts: Derivation of many (Key, IV) pairs from random 128 nonces and one secret 512 master key

texts:
The ext4 encryption system encrypt files with aes-256-xts. Each file uses two unique keys which are derived from a 512 bit master key and a per-file 128 bit nonce randomly generated when the file is created (see the design doc).

In order to derive two 256 bit keys for each file, the 512 bit master key is encrypted with AES-128-ECB using the 128 nonce as a key.

One disadvantage noted in the design doc is that if the file keys are leaked then the attacker can retrieve the master key by decrypting the file keys with the nonce.

My question is : why not use a one-way KDF to derive the per-file keys instead ? I would have derived the keys using something like :

  key1||key2 = hmac_sha512(master_key, nonce)

Is there any downsides with this approach ?


texts: How does darkmail (DIME) work to hide email metadata?

texts:
While Email encryption can protect the content of an email, the metadata are still readable and can be used to gather important information about the sender and the receiver.

There were several news articles about the Darkmail project, which aims to increase privacy in email communication. The initiative is developing a new mail protocol which shall also protect metadata. However, the news articles generally avoided going into the technical details about how this is to be achieved. The official site https://www.darkmail.info, on the other hand, provides mostly very technical information and specifications of the protocol.

Can anyone please explain in layman terms how Darkmail works?


texts: Cryptsetup | Given Enough Passphrase Entropy, Is It Necessary To Use a High Iteration Count?

texts:
Let's assume that, for creating a LUKS volume, I generate a random, 40 character passphrase that includes numbers, symbols, and upper and lower case letters, using the pwgen utility.

Given that the passphrase contains roughly 256 bits of entropy, if I use aes-xts-plain as my cipher, a 512 bit key, and sha512 for the hash, then would it be necessary (worth any reasonable gain) to also use a high iteration count -- say, 1 million, for the sake of example?


texts: Can one build a one-way function from AES?

texts:
We change the AES block cipher encryption:

we delete the key schedule algorithm
the user now provides a string of 1408 bits
we divide the string to 11 sub keys, and use them directly in the encryption part of AES as the round keys.

We call the resulting function $AES' : \mathbb Z_2^{1408} \times \mathbb Z_2^{128} \to \mathbb Z_2^{128}$.

Then we use this function $AES'$ as cryptographic compression function in the following way:

Given text $M$, we divide it to blocks $M_1, \dots M_n$ of size 1408 bits each. Then define $g_i \in \mathbb Z_2^{128}$ as

$g_0=0$
$g_i = AES'(M_i,g_{i-1})\quad$   (Each $M_i$ is used as the round keys in one AES encryption.)

Then the hash function $h : \mathbb Z_2^{n·1408} \to \mathbb Z_2^{128}$ is defined as follows : $h(M)=g_n$

Is $h$ a one way function? If not, how could an attack reveal $M$, given $h(M)$?

(I don't want you to solve, I just want some hints to solve this problem.)


texts:
NIST FIPS.186-4 has standardized 5 ECC curves on field $\mathbb{F}_p$ (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. I need to use ECC curves without pairings for my scheme.

I am not sure which of these curves have pairings, and which of them don't.


texts: OpenPGP/X.509 bridge: how to verify public key?

texts:
I'd like to use OpenPGP authentication over TLS, but lack of implementations made me use a temporary solution: an OpenPGP/X.509 bridge certificate.

The approach is very similar to the approach used in Foaf:
https://svn.java.net/svn/sommer~svn/trunk/misc/FoafServer/pgpx509/src/net/java/dev/sommer/foafserver/utils/PgpX509Bridge.java

  Basically, you create a certificate request starting from a converted PGP private key, including your converted PGP public key into the certificate request. Then you sign the request with your converted PGP private key.

I'm using the word "converted" because OpenPGP and OpenSSL key formats are incompatible: I have to extract the key parameters from the OpenPGP key and use them to form a new X.509-compatible (OpenSSL) key. Nevertheless, it works as expected.

The result is a X.509 certificate with the PGP public key parameters used in the public key of the X.509 certificate, but without the user IDs and the public key signatures, thus making it unusable for authentication purposes.

The missing piece here is server authentication. The server has previously signed the user's PGP public key, but how do I verify that through the X.509 bridge certificate?

Even if I use my PGP user ID as my CN (Common Name), how do I certify that it's the same user ID used in the originating OpenPGP key?
There are no public key signatures on the X.509 bridge certificate, only the same key parameters. Can I safely just check against those?