texts: Min Entropy per Bit for Trevisan's Extractor/or An Extractor

texts:
We know that: trevisan's extractor based on min entropy of the relative system. For trevisan extractor, we need source, seed, min entropy value per bit and error rate for per bit
I have the code for trevisan's extractor and if entropy is small, extractor is working very slow, if entropy is big extractor is working quite fast.
In that case,Does it mean that: to have small min entropy means more randomness and advantage for randomness?
Or randomness is just related to error rate per bits and it is not related to min entropy valu per bits?
And I am using this guideline Trevisan Extractor


texts: Application of uni-directional proxy re-encryption?

texts:
What kinds of applications is uni-directional proxy re-encryption applicable to?

I learned some applications that proxy re-encryption can be used, which are email and file sharing scenarios.

All of the scenarios that I am aware do make sense when we use bidirectional proxy re encryption.
When would uni-directional proxy re encryption can make sense?


texts:
I am trying to implement a proposed improved algorithm of RSA . Here the author has increased the number of exponents. However I am unable to understand what $h$ is in the Key generation step. Can someone tell me what $h$ is exactly?

The author's paper is : http://www.jacn.net/papers/47-N024.pdf
I had originally posted this paper : http://iosrjournals.org/iosr-jece/papers/Vol9-Issue1/Version-5/H09154347.pdf

  n = p x q
  Ø(n) = (p-1)(q-1)
  ϒ n, h = ph-p0 ph-p1…ph-ph-1 + qh-q0 qh- q1 … qh-qh-1
  r such as 1 < r < n
  and gcd r, Ø=1 and gcd r,ϒ=1 (r should be small integer)
  e such as r.e = 1 mod Ø(n) and 1< e < Ø(n)
  d such as d.e= 1mod ϒn and 1 < d < ϒn
  Encryption Key = {e,n}… public key
  Decryption Key = {r,d,n}… private key


texts: Is just a bit of random, "fully random"?

texts:
I understand that hashing a datetime is a pseudo-random number, and not good in a security context.

But what about hashing a datetime plus a truly-random but constant string (just a string that an "attacker" could not possibly guess)?

This is not a question for a practical implementation, just a theoretical question.

Is pseudo-random plus a bit of "true random", "fully-random"?

(p.s.: I'm not a security specialist, so please don't use overly-complex terms if possible.)


texts:
Is Public key used directly to encrypt a message or it is used to derive other keys ?
Can we decrypt a message with same public key using which it was encrypted ?

So far I understand, as PKI is based on mathematical functions which are hard to solve in opposite direction, an encrypted message should not be decrypted using same Public key, but article https://blog.cloudflare.com/encrypted-sni/  mentiones that Public key is used to derive some other keys which are actually used for encryption, thus need clarification.


texts: In Groth-Sahai NIZK proof system, they have defined something called Quadratic Equation in $\mathbb{Z}_n$ as shown below. But, my idea of quadratic equation was a second order polynomial equation in a single variable, something of the form $ax^2 + bx + c = 0$. Then how is the below equation a quadratic one?


texts:
I am looking for the best know attack against HFE cryptosystem. Reading this paper DEGREE OF REGULARITY FOR HFE I found the next claim

  However, Faugere and Joux demonstrated that we can solve and break these systems easily in the case when $q = 2$ and $D$ small [15] using the Grobner basis algorithm F4. Furthermore their experimental results imply that such algorithms should finish at a degree of order $log_q (D)$, such that the highest degree polynomials we need to process are of a degree of order $log_q(D)$. Therefore they conclude that the complexity of the algorithm is roughly $O(n^{log_q(D)})$.

But, using the first HFE challenge, i.e. ($n = 80$, $D = 96$) and $q=2^n$, and replace these in that formula I get $80^{log_{2^{80}}(96)}$ that is < $2^{7*0.08}$. I thinking that I make mistake replacing the values of the first HFE challenge, or maybe I am interpreting wrong the claim. Please Could you help?


texts: In which order are the round keys used during AES decryption?

texts:
In the Add Round Key step in AES decryption, which part of the expanded key will I XOR first to the result of the SubBytes step?

Is it the 10th round key?
For example, is this the right order?

addRoundKey(subBytes,roundKey10);
addRoundKey(subBytes,roundKey09);
addRoundKey(subBytes,roundKey08);
addRoundKey(subBytes,roundKey07);
addRoundKey(subBytes,roundKey06);
addRoundKey(subBytes,roundKey05);
addRoundKey(subBytes,roundKey04);
addRoundKey(subBytes,roundKey03);
addRoundKey(subBytes,roundKey02);
addRoundKey(subBytes,roundKey01);
addRoundKey(subBytes,secret key);

Here "secret key" is my secret key that I used in encryption.

In the expansion of my secret key in decryption, is it the same procedure like in encryption?


texts: Possible combinations of 8 digits, 6 upper case letters, 2 distinct numbers

texts:
Assume I want to find out how many combinations there are for a 8 digit word with 6 uppercase letters and 2 distinct numbers, e.g. A7BC9DEF, 1A0CRDEF, ... how many combinations are there?

My approach's solution is : $26^6 \cdot 90 \cdot 8 \cdot 7$

90 because there are 90 possible numbers with two distinct digits, i.e. $01, 02, \ldots, 09, 10, 12, \ldots, 21, 23, \ldots, 98 \rightarrow 99 - 9$ valid numbers)

$8 \cdot 7$ because the digits of the 90 possible numbers can be found at $8 \cdot 7$ different indices.

I had combinatorics a long time ago in school so I thought asking here for clarification might be a good idea. Thanks in advance!


texts: What is the reduction between "random challenge" version of indistinguishability and the more "formal" version?

texts:
The main definition of computational indistinguishability is that, for any ppt $A$, and distribution ensembles $\{C_n\}, \{D_n\}$, $$\bigg| \Pr_{x\sim C_n}[A(x) = 1] - \Pr_{x\sim D_n}[A(x) = 1] \bigg| \le negl(n)$$
Sometimes, one sees the following def. A gets a random "challenge" $x$ from $C_n$ w.p. 1/2 or $D_n$ w.p. 1/2. If no $A$ can output 1 with probability greater than $1/2+negl(n)$ when the challenge is from $C_n$ (and 0 otherwise), then $C_n, D_n$ are comp. indist.
Are they equivalent? What is the difference? What is the reduction between them?


texts: Digesting doesn't require any key and can be performed on the client side. Why does the PKCS#11 token interface standard have a C_digest method? For example, why should I send my data to a PKCS11 HSM whereas I can do this in my client?


texts: extract ciphertext from encrypted SMIME file

texts:
the main question of this message is how to get the true ciphertext from S/MIME file?

I created RSA keys and encrypted a message with S/MIME as follow :

1) generate private key : openssl genrsa -out maCle.pem 1024

2) create certificate(public key) : openssl req -new -x509 -key privkey.pem -out certif.pem -days 1095

3) encrypt using smime : openssl smime -encrypt -in plaintext -text -out mail.msg certif.pem

mail.msg looks like:

MIME-Version: 1.0
Content-Disposition: attachment; filename="smime.p7m"
Content-Type: application/x-pkcs7-mime; smime-type=enveloped-data; name="smime.p7m"
Content-Transfer-Encoding: base64

MIIBnQYJKoZIhvcNAQcDoIIBjjCCAYoCAQAxggEwMIIBLAIBADCBlDCBhjELMAkG
A1UEBhMCRlIxEjAQBgNVBAgMCUZSQU5DRVNFQjEQMA4GA1UEBwwHQ0lUWVNFQjEP
MA0GA1UECgwGT1JHU0VCMRQwEgYDVQQLDAtPUkdVTklUTkFNRTEPMA0GA1UEAwwG
U0VCU0VCMRkwFwYJKoZIhvcNAQkBFgpTRUJTRUJBRERSAgkAvllfFuC1s/owDQYJ
KoZIhvcNAQEBBQAEgYCzD+ShH91R3PEFTFJzcmW5Ie91AT9vHHCVJ1Sb78/oUHVi
PjS3PJyMD55MWGX+FmC/XYxtMNROP6CJ4nQIh6CmQIzXse/Yvg8WQOEJepC6AmDS
0b2xdQmiDO4Zb9C6ZUjWyH9KzOTwdZC+xm0WdAdB/psTXOL1api8P54H+hti9zBR
BgkqhkiG9w0BBwEwGgYIKoZIhvcNAwIwDgICAKAECBUxiu2WmkuFgCjdkDzatfYg
YwvXLmFl135Txjb0GEfl5EhV2zvXB6PLMFscOa6SOioR

when I decode the base64 from mail.msg I can see informations that are in my certificate (certif.pem).
So it seems mail.msg contains a certificate which is NOT encrypted (is that right?) So how can I extract this certificate and how can I extract the true ciphertext that matches with my plaintext?

I thought the certificate in mail.msg was the same in certif.pem but the beginning doesn't match except the first three characters :

certif.pem : MIIC3DCCAkWgAwI...
mail.msg   : MIIBnQYJKoZIhvc...

so what is this certificate?


texts: Trying to udnerstand textbook sample solution

texts:
I am preparing for the final exam in my Data Security class so I am trying to read and understand the textbook's exercise questions. The sample solution at the end the textbook is more like a hint instead of being a step-by-step solution.

Question:

Textbook solution: Yes. They are equivalent.

My answer: I do not know to check if some scheme is equivalent to RSA. So I tried to verify $D$.

Step 2:
$(P-1)(Q-1) - 1 = (PQ -P-Q+1) - 1 = (N -P-Q+1) - 1 = (N-(P+Q-1) - 1 \equiv 0 \ (mod \ E)$

Step 4: $DE = (P-1) (Q-1) (E-1) + 1 = (PQ - P-Q + 1) (E-1) + 1 = (N - P-Q + 1) (E-1) + 1 = NE-N-E(P+Q-1) + 1$

Take $(mod \ E)$ of both sides:

$[DE = NE-N-E(P+Q-1) + 1] \ (mod \ E)$

$0 \ (mod \ E) \equiv 0 - N - 0 + (P+Q-1) + 1 \ (mod \ E)$

$0 \ (mod \ E) \equiv - (N - (P+Q-1)) - 1 \ (mod \ E)$

$0 \ (mod \ E) \equiv  0 \ (mod \ E) \leftarrow$ verified $D$ is correct.

But obviously this is not a concrete reasoning on why this scheme is equivalent to RSA. Any hints would be appreciated.


texts: The multi-linear maps are prone to zeroizing attack. Can anyone explain how the zeroizing attack breaks the computational assumptions?

texts: I read that many cryptographic schemes based on multi-linear mapping are not secure because the zero testing procedure and zero encoding help an adversary to reveal the secrets and because of it, many computational assumptions are solved in the multi-linear pairing. For example, the DDH assumption is solved in the bilinear pairing. In that way, is there any explanation which can show why the multi-linear pairing is not secure.


texts: Does the authenticity of messages by Alice still holds if the state of bob is compromised in Double Ratchet

texts:
In the double ratchet algorithm, let's say if bob's device is compromised including his long term key.

Does the ephemeral keys generated by Alice during the half Diffie–Hellman key exchange produces a new sending chain for Alice which is not yet known to Bob.

Also does the messages from Alice still have the non-repudiation property even if bob's state is completely compromised.


texts: How can I be sure the RNGCryptoServiceProvider is able to produce 12 bytes that can have 2^96 values?

texts:
I am writing code that needs to produce a truly random number of 96 bits. The requirements are:

The code must be able to produce all $2^{96}$ values.
The likelihood for any value to come up must be the same for all values.
It must be impossible to predict the next $96$-bit number that will come up.

So, using RNGCryptoServiceProvider, I have the following implementation:

  Public Function GetRandom96BitNumber() As BigInteger
        Dim random96BitNumber As BigInteger
        'We need 12 bytes, but take 13 in order to ensure a positive number.
        Dim bytesFor96BitNumber(12) As Byte
        Dim cryptoProvider = New RNGCryptoServiceProvider
        cryptoProvider.GetBytes(bytesFor96BitNumber)
        'Set the thirteenth byte to zero to ensure that we get a positive BigInteger.
        bytesFor96BitNumber(12) = 0
        random96BitNumber = New BigInteger(bytesFor96BitNumber)

        Return random96BitNumber
    End Function

Question:

This code (assuming it employs the RNGCryptoServiceProvider correctly) is only as good as the quality of randomness of the RNGCryptoServiceProvider. How can I convince myself and my clients that the three criteria stated above are met? I found this document that compares cryptographic random number generation between Windows and Linux and I think I read there that the entropy used to seed the RNGCryptoServiceProvider is at least 256 bits.

Does this mean that the three requirements stated above are met? If yes: why? If not: why not?

Any further guidance for getting enlightenment are very much appreciated.


texts: How safe is a book cipher? How would you break it?

texts:
This might not be a very specific question, but I was wondering this morning.

If one were to encode a message by making a string out of an entire book and writing the message by searching for a random occurrence in the "book-string" of each letter in the message and replacing it with the string index of the letter. Additionally you could make sure no number appears twice in the message as there is normally more than one occurrence of each letter in a book. This way no "letter" in the encrypted message would repeat.

How safe is this, assuming you passed on the key safely, and how would you go about breaking it?


texts:
How do you calculate the total amount of combinations in the standard 12-word seed from a 2048 word dictionary?

$log_2(2048^{12})$ which equals $2^{132}$? Is this the right way?

And what is the "minimum" sort of recommended combinations for the next 5-10 years, $2^{110}$? $2^{100}$?


texts: Digicipher and other proprietary systems?

texts:
I've always been curious as to how Pay-TV and other Conditional Access systems actually stay secure for any amount of time, given that they are usually one way and (I'm assuming) use symmetric keys for encrypting the video/data streams.

Given that the decoder MUST be able to learn the control word keys via some means, and that the keys change so frequently (every 10 or so seconds), it would seem that the only way this and other systems like this are secure is through obscurity.

I've been under the assumption that "security by obscurity" isn't a viable long term solution. So, I would guess that because the key for decrypting the ECM and EMM messages (which themselves contain the key for the control words) must be known by the receiver, the only way that this system would be secure is if they physically secure access to that one key.

How do they keep these systems from being broken by someone just looking at the information in the smartcard that houses the key?

It would seem that by retrieving that one key, the whole system would be broken in one fell swoop, because then you could just listen for all the ECM/EMM messages and get the new keys for a given channel. I don't understand how this is all that secure, but then again, I don't know of a better way other than securing the card. Am I missing anything?


texts: Pohlig-Hellman exponentiation block cipher

texts:
Let $G$ be a group of order $n$ and let $e,d$ be integers such that $ed\equiv 1 \pmod{n}$. Then the exponentiation maps $x \mapsto x^e$ and $y \mapsto y^d$ are inverse maps on $G$.

These maps give us the Pohlig-Hellman exponentiation cipher.  The secret key is the two numbers $e$ and $d$. The group $G$ and its order $n$ may or may not be secret. This block cipher is not secure (i.e. not a pseudo-random permutation) and very slow. However, it seems to me that it has some interesting properties when a suitable group is used.

The block cipher can be used in OFB mode: We want to encrypt a message $m = m_1m_2\dots m_k$. The first ciphertext block $c_0 = r_0$ is chosen uniformly at random from $G$, then
$$r_i = r_{i-1}^e, \qquad c_i = r_i m_i, \qquad i = 1, 2, \dots, k.$$
Under the assumption that $r,r^e,r^{e^2},\dots,r^{e^k}$ is random-looking, this is secure. (Let me stress that $e$ is secret and $r$ is random.)
This block cipher can be used in CBC mode: We want to encrypt a message $m = m_1m_2\dots m_k$. The first ciphertext block $c_0$ is chosen uniformly at random from $G$, then
$$c_i = (c_{i-1} m_i)^e, \qquad i = 1,2,\dots,k.$$
If OFB mode is secure, then this should also be secure, since the ciphertext is the random-looking sequence $c_0,c_0^e,c_0^{e^2},\dots,c_0^{e^k}$ multiplied with some stuff that only depends on the message and $e$.
The block cipher can be used in CTR mode: Let $g\in G$ be a generator, which may be secret and part of the key. We want to encrypt a message $m = m_1m_2\dots m_k$. The first ciphertext block $c_0=r$ is chosen uniformly at random from $G$, then
$$c_i = (r g^i)^e m_i, \qquad i=1,2,\dots,k.$$
This is not secure. An easy attack is to observe that $c_i/c_{i-1} = g^e m_i/m_{i-1}$ when $i>1$.

I believe all of this is well-known folklore, but the question is: Has anyone written this up anywhere?


texts: SHA-1 – Would using a SHA-1 CSR be a risk?

texts:
If someone would generate a SHA1 CSR and submit it to an CA to receive a SHA2 certificate, would the process as a whole be at risk because the CSR could be malicious?

Assumption:

In this case, the “data” (as used in Q2) is the public key of the end user certificate.  In practice the CA could still generate a SHA2 certificate, even when a SHA1 CSR is being submitted. However, the CSR itself would be vulnerable in theory. So if an attacker would get in between he could put another name on the certificate. However, a proper RA would validate the CN and discover the forgery.

So basically a collision at the CSR would be possible but the validation process around it would keep it safe. However, submitting a SHA-2 CSR would be safer.

Would this even be a real life attack scenario?


texts: Do I understand $P = NP$ correctly in relation to one-way functions?

texts:
If I understand this relation correctly is, that any function whose inverse can be found in polynomial time is not a one way function. The $P = NP$ proved would cause that any candidate for a one-way function could be computed in polynomial time (so $O(n^k))$, thus it would make one-way functions non existent?
Does that mean that a one way function would be such a function whose inverse would be found in $NP$ time ?
Is my understanding correct?


texts: Are there hash functions that dynamically take integers a and b, and output h(a) and h(b) such that if a>b we have h(a) > h(b)?


texts: Let $H$ be a secure hash function (e.g. SHA256), is it possibile to find $H(M1)$ given $H(M1||M2)$ if the length of $M1$ and/or $M2$ is exact the block size of the hash (that is, 64 bytes for SHA family hashes)?


texts: Secret Sharing Scheme with variable share size?

texts:
Is there a secret sharing scheme construction that allows the shares to have different sizes/lengths?

For example a (3,3) scheme, where shares 1 and 2 have large sizes while share 3 has a very small size.


texts: Bijective encryption function in Paillier cryptoststem

texts:
In Paillier cryptoststem many ciphertexts can correspond to the same plaintext. How can I modify the scheme so to make the correspondence between ciphertexts and plaintexts a one to one correspondece? I've already eliminated the randomness from the scheme (i.e. all encryptions are done with the same $r$).

My reason for this is that I want to compute the arithmetic mean of two encrypted numbers by repeatedly subtracting 2 (which I can do no-problem) until I hit 0 which I then need to detect.


texts: Is $f_N$ in this hash function is Matyas-Meyer-Oseas scheme?

texts:
I propose a hash function as following:
H is an Merkle-Damgard hash function with a compression function $f: \{0,1\}^{3n} \to \{0, 1\}^{2n}$. Output function  $f_N: \{0,1\}^{3n} \to \{0, 1\}^n$. M is input message and M* is padded message as follow rule: message M divided into n-bit message blocks $m_i$, $1 ≤ i ≤ t$ and t = $\lceil|M|\rceil/n  - 1$, $m_t+1$ is last block (remaining part) of M is padded with bit ‘1’ and ‘0’-bits to get full n-bit block and $m_t+2$  represent message’s bit length in binary of M.
$M^* = Pad(M) = m_1 m_2...m_{t+1} m_{t+2}, m_i \in {0, 1}^n$, with $1 \leq i \leq t+2$;
Hash computing process is handed according to follow procedure:
\begin{multline}
\shoveleft h_0 = IV_1\\
\shoveleft g_0 = IV_2\\
\shoveleft C_{T_i} = 0
\end{multline}
\begin{multline}
\shoveleft \textbf{for } i = 1 \textbf{ to } t+1 \textbf{ do }\\
\shoveleft \quad\quad (h_i, g_i)  = f(h_{i-1} \oplus C{{T_i}}, g_{i-1}, m_i)\\
\shoveleft C_{T_i} = C{T_{i-1}} + 512\\
\shoveleft (h_{t+1}, g_{t+1})  = f(h_t \oplus C_{T_{t+1}}, g_t, m_{t+1}) \\
\shoveleft H(x) = left_s f_N(h_{t+1}, g_{t+1}, m_{t+2}))
\end{multline}
$H(x)$ is the hash result.
left is get $s$ bits on left of $f_N$
My $f_N$ is:
$$f_N: h = E(h_{t+1}\mathbin\|g_{t+1},m_i )  \oplus m_i$$
$E(K,m)$ is a block cipher with $2n$-bit keylength, block size is $n$-bit.
My questions:

Is $f_N$ in this hash function Matyas-Meyer-Oseas scheme?
And may I use Theorem 6 and 15 in Stam's result in "Stam, Martijn. "Blockcipher-based hashing revisited. for this compress function?


texts: How does AES bit security increase by round?

texts: As AES progresses through multiple rounds, approximately how does it security increase round by round up to its maximum? I'm curious about the shape of the curve. Is it linear, some kind of exponential, a power law curve, etc.?


texts: XTEA brute force 128 bits key, 64 rounds

texts:
Is my calculation correct that to bruteforce XTEA with 128 bit key:

https://www.wolframalpha.com/input/?i=number+of+4-permutations+of+4,294,967,295+objects

Would require that many permutations?

Are there any attacks known to bruteforce it or decrypt? Especially in context of RKE (Remote Key Entry)

Thanks,


texts: Is there a difference between $\mathbb{Z}_2^b$, $\text{GF}(2^b)$ and $\text{GF}(2)^b$?

texts:
I have read a lot about Galois Fields (GF). They are also presented in The The Design of Rijndael: AES - The Advanced Encryption Standard on pages 13 and 14.

  In computer memory, the polynomials in $F[x]|_l$ with $F$ a finite field can be stored efficiently by storing the $l$ coefficients as a string.

  Example 2.1.6. The polynomial in GF$(2)|_8$ $$x^6+x^4+x^2+x+1$$ corresponds to the bit string $01010111$.

In their paper Differential propagation analysis of Keccak, they also use the notation $\mathbb{Z}_2^b$ :

  In general, for a function $f$ with domain $\mathbb{Z}_2^b$, we define the
  weight of a differential $(u′, v')$ as
  $$w(u' \xrightarrow{f} v') = b - \log_2 |\{u: f(u) \oplus f(u \oplus u') = v'\}| $$

While I do understand the meaning of this notation (a binary input of length $n$), I also know that we can use finite fields to model such numbers. Hence my question:
Is there a difference between $\mathbb{Z}_2^b$, $\text{GF}(2^b)$ and  $\text{GF}(2)^b$


texts:
I'm writinig manager for all transformations which is described on https://developer.android.com/reference/javax/crypto/Cipher.html

There are few questions about how cryptographic algorithm works.

I found on Wikipedia that AES can have 128, 192, 256 key sizes. But I cannot define sizes for IV.

I got this error:

java.security.InvalidAlgorithmParameterException: expected IV length of 16

So is it mean that for all AES transformations IV should have only one size (128-bit)?

Except ECB:

java.security.InvalidAlgorithmParameterException: ECB mode does not use an IV

I also noticed that AES/CBC/NoPadding doesn't work with any stream (it should be fixed). What the sense of this transformation if it cannot be applied to all data? But it works with any data if I preferred padding. Any explanations?

javax.crypto.IllegalBlockSizeException: error:0607F08A:digital envelope routines:EVP_EncryptFinal_ex:data not multiple of block length

And the last question. For which modes IV is necessary/optional (it seems like necessary (not optional) for every mode except ECB) while encryption and for which is unnecessary while decryption?

Finally I should to create table for every mode (there is 6): CBC, CFB, CTR, CTS, ECB, OFB. Something like:
1. IV: necessary / optional / unnecessary.
2. IV for decryption: necessary / unnecessary.
3. Acceptable IV lengths.
4. Data should multiple of block length: true / false (block length).


texts: Difference between Hash function and Random Oracle

texts: Going through the blog post, I was under the impression that any cryptographic scheme which makes use of hash function is said to be using random oracle. But, I have come across one construction of ring signature scheme which uses hash function, yet the paper is titled as Sub-linear Blind Ring Signatures Without Random Oracles. Where is my understanding incorrect?


texts:
I'm using AES/ECB with PKCS5 Padding (From what I've read, PKCS7 Padding is actually used internally) and PBKDF2(HMAC-SHA256) to encrypt some passwords in Java. I enter a password, that goes through PBKDF2 and gets a hash, which I use as a key for encrypting. PBKDF2 is set to output a 128b key.

I've realised, that whenever I enter the wrong password, I get a "BadPaddingException" error. I thought, that the output of PBKDF2 should be long enough to not be padded(128b). And even if it is padded, shouldn't the padding be the same for all the passwords (even wrong ones)?

Why does this happen?


texts:
Alice securely gives Bob a secret key so they can exchange 10 different messages encrypted with RC4.  (Messages will include a counter for uniqueness and a MAC for authentication.)  For each message exchange, Alice and Bob both start by permuting the standard byte array using the secret key (ie, the "KSA" key-scheduling algorithm, per Wikipedia):

for i from 0 to 255
    S[i] := i
endfor
j := 0
for i from 0 to 255
    j := (j + S[i] + key[i mod keylength]) mod 256
    swap values of S[i] and S[j]
endfor

At this point, Alice and Bob have each computed identical S[] arrays, and the secret key is no longer used by subsequent RC4 steps.

Shortcut 1:  Alice decides that instead of securely sending Bob the secret key and making him do the KSA step for every message exchange, she'll compute the S[] array, securely send him the 256-byte array instead of the secret key to begin with, and from then on each time they need to encrypt/decrypt they'll both skip the KSA step to save time and just start with Alice's precomputed S[] array.

Shortcut 2:  After using the above algorithm to compute the initial S[] array she had planned to send to Bob instead of the secret key, Alice realizes the KSA step seems to basically just want to scramble the S[] array.  So instead of scrambling the array based on a key, she relies on the operating system random() function and just computes...

for i from 0 to 255
    S[i] := i
endfor
for i from 0 to 255
    swap(S[i], S[random(0..255)]) // swap S[i] with some arbitrary S[]
endfor

...and securely sends Bob her "randomly" scrambled array that doesn't even use a key.

Do those 2 shortcuts weaken RC4?


texts: Key Derivation from random salted seed, HMAC and HMAC based KDF

texts: I would like to generate a key which would be good enough to be used for encryption with AES in a mobile environment. My idea is to use as a seed ''random attributes'' from a mobile device. Is hashing first this seed using HMAC construction (with some salt which is also random but public) and then use a HMAC-based Key Derivation function secure and efficient?


texts: How do RSA and ECDSA differ in signing performance?

texts:
Signature algorithms with elliptic curves have smaller output sizes compared to RSA for the same level of security.

What about the processing time to generate a signature ?

I've seen figures giving the advantage to RSA. That seems curious.

Leaving aside the implementation aspects, what could justify (in terms of number of operations) the fact that ECDSA produces signatures faster than RSA (or vice versa) ?


texts:
In a paper they write once, $(\mathbb{Z}_n^*)^2$. Is this the group of quadratic residues or is it something else?

Here the theorem:

Under the strong RSA assumption, given a modulus $n$, along with random elements $g, h \in (\mathbb{Z}_n^∗)^2$, it is hard to compute $w \in \mathbb{Z}_n^*$ and integers $a, b, c$ such that $w^c = g^a h^b$ and ($c \nmid a$ or $c \nmid b$).


texts: Is collision resistant hash enough for one-block counter mode?

texts:
Let $H:\{0,1\}^*\rightarrow \{0,1\}^\ell$ be a collision resistant hash function (CRH), and let $\Pi = (\mathsf{enc,dec})$ be an encryption scheme with the following properties:

$\Pi.\mathsf{enc}: \mathcal{K} \times \{0,1\}^\lambda \rightarrow \{0,1\}^\ell, \lambda\leq \ell,$ define as follows: $\Pi.\mathsf{enc}(k,m) = m \oplus H(k)$
$\Pi.\mathsf{dec}: \mathcal{K} \times \{0,1\}^\ell \rightarrow \{0,1\}^\lambda$ define as follows: $\Pi.\mathsf{dec}(k,c) = c \oplus H(k)$

is $\Pi$ chosen plain-text secure (CPA)? To the best of my knowledge, if $H$ is modeled as a pseudorandom generator (PRG) or a pseudorandom function (PRF), then $\Pi$ is CPA if a distinguisher cannot distinguish the output of the PRG/PRP from an output produced by a truly random function. However, I am not able to find such a reduction for a CRH.
Let's say Alice uses $\Pi$ to share a message $m$ over pair-wise channels with Bob and Charles (Alice-Bob, Alice-Charles share a symmetric key produced by a Diffie-Hellman exchange).

Alice sends $c_b = m\oplus H(k_{AB})$ to Bob and $c_c = m\oplus H(k_{AC})$ to Charles

Let's assume Decisional Diffie-Hellman. if an adversary is able to break the CRH, can it extracts $m$ from $\{c_b, c_c\}$? (we can assume that besides Bob and Charles, Alice sends the same message to other people).
Edit: I think the answers to this question help explain why CRH is not enough to provide CPA security. However, in my opinion, it does not fully answer this question because, as mentioned in the answers below, simply providing a uniformly distributed output does not imply CPA. Non-determinism is needed.


texts: What is the point of separate links to the download and its digital signature

texts:
I see a statement like this on a product's download page:
"The signature for setup-x86.exe can be used to verify the validity of this binary using this public key."

where each this above is a hyperlink.

I thought the purpose of a sig is so that you could verify the validity of a document.

So what's the purpose of such a statement?

Surely it can't be  a protective measure just in case the site has been hacked to point the download link of the exe to a malicious file? In that case, won't the links to the signature/public-key themselves be altered by the attacker?


texts:
I was reading in Whatsapp group chat the sender encrypts a key individually for each memeber. And everyone invalidates their key whenever anyone leaves the group.

Whatsapp also limits group size to 256 members, making the above feasible.

Can we do better? To support significantly larger groups? While maintaining end to end encryption?
Will we be able to still maintain other properties, like forward secrecy?


texts:
I have many clients and a single server, and on each of these clients I want to be able to verify a message did indeed come from my server. My idea was to send some sort of key with cryptographic significance.

For example, say I wanted to send a boolean from the server to the client, I could send a message like this:

{
    "boolean": true,
    "key": 30
}

In this trivial example, the significance of the key is that it is divisible by 3. So the client would perform a check like this:

if payload["key"] % 3 == 0:
    valid = True
else:
    valid = False

Is this a good idea provided I use a more secure algorithm? If so, what would you suggest?

If not, how should I go about verifying the authenticity of the message?

Thanks.

EDIT:

My understanding of the HMAC approach is as follows:

Firstly you generate a key which will be stored on the server and all of the clients. For example,

import random
key = bytes(hex(random.getrandbits(128)).encode("utf-8"))

Then, on the server when you want to send a message to a client, you generate a HMAC as follows and send it along with the message:

import hmac
import hashlib
h = hmac.new(key, str(payload["key"]).encode("utf-8"), hashlib.sha3_256).hexdigest()

Then on the client, you run this again with your key and if they match then it is a valid message.

I have two problems with this approach. Firstly, there are only two possible HMACs - one for true and one for false. Additionally, hardcoding the secret key into the client doesn't sound like the best of ideas.


texts: How to assess the strength of the avalanche effect for AES?

texts:
Within the scope of a study project I'm looking for an approach to assess the quality of AES encryption in practice. To do so, I modified the OpenSSL source code to be able to log metrics while encrypting thousands of blocks to obtain a representative result.

The first criteria for assessment is to check for the Avalanche criteria:

During (AES) encryption rounds I copy the current block to be encrypted (let's call it $I_o$), flip one bit (let's call it $I_c$) and encrypt it as well, so the same operation is applied (before roundkey is modified, shifting etc.).
This results in the blocks $C_o$ and $C_c$, which I check for their Hamming Distance ($\operatorname{HD}$).
AES seems to do a good job, for each byte the $\operatorname{HD}(C_o, C_c)$ is continuously ~ 4 bit.

At this point I'm struggling with two questions:

Does it matter WHICH bit I'm  flipping? Is it legit to always flip the MSB f.e. or should it be a random position?
The presence of the Avalanche effect implies for an attacker to have a 50/50 chance to predict the input ($I$) state of one bit for each round.
So the benefit of applying several rounds (in my case $b/k=128$ bit -> 10 rounds) is to reduce the probability for an attacker to predict a bit's original (plain) state to $0.5^{10}$?

Thanks for any inspiration! :)


texts: Is my proof of Asmuth-Bloom scheme's perfection correct?

texts:
I am trying to understand how Asmuth-Bloom's secret sharing is perfect. My "proof" so far (in a 3 out of 4 scheme):

$y=s + a * m_0 \bmod m_1 * m_2 * m_3$

Having $k-1$ shares, it will yield a valid solution for the CRT, but not a unique one. 2 shares yield $x = y' \bmod m_1 * m_2$
Therefore, we know that $y = y' + z * m_1 * m_2$ and also that $y = [0;m_1*m_2*m_3]$
But since we do not know the exact range of $y$, since $m_3$ is missing, we can not just simply guess $z$ and therefore guess $y$.
However, I see a sequence of following primes used a lot, so when we know $m_1$ and $m_2$ we could just assume $m_3$ is the next prime and guess values for $z$ and therefore $y$ right?

Example with numbers:
$m_0 = 43,\space m_1=131, \space m_2=137, \space m_3 = 139, \space m_4=149, \space s=42, \space a = 476$
$y = 42 + 476 * 43$
$y = 20510 \bmod 2494633$

$s_1 = (74, 131), \space s_2 = (97, 137), \space s_3 = (77, 139), \space s_4 = (97, 149)$

CRT with two shares:

$x \equiv 74 \bmod 131$
$x \equiv 97 \bmod 137$
$x \equiv 2563 \bmod 17947$

So now we could start guessing

$y_0 = 2563 + 0*17947$
$y_1 = 2563 + 1*17947$
$y_2 = 2563 + 2*17947$
$y_n = 2563 + n*17947$
and, with the knowledge (or assumption) that $m_3$ is the next prime after $137$, a max value of
$y_{138} = 2563 + 138 * 17947$
since $2563 + 139 * 17947$ exceeds $m_1*m_2*m_3$

So we have $138$ values to guess the secret from.
$s_n = y_n \bmod 43$

From my conclusion, this would not be a perfect scheme, but everyone states it is. So where am i wrong?


texts: How to encrypt a string using RSA public key only?

texts:
I have been given the following public RSA key:

MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAl2uzoWA2iEGfeqDYO4XA0mQV8odb6qgdLT0T/k1PsbviMMt+SlAnZpwDkPlFySxNejOv8zAUHwDTWV7NGpYA0y+TrrBLkGGl9uUrzOjQLryJmFWsXxBGFd4emYXYBzROaH+r7pzhK7mIWLw1e2Cj5RL9Ac6wKA56axqCr2UZRNDBcS5A+nKTQTWy5eTrq6EQSBA6Hr81UWtYwlNSo1YbZ9JSNdD75Go7Du/zv1iPI+wWr7tMp0AJVBmieeB0kryXl+8zhli80wa72hDtyTkmfkBJAid5Il1biTrOXtMDaqXdfi9s4xzFp/ilP17KnA+VeAH2eLcqaC6LkEp/A1LApwIDAQAB

Now, I need to encrypt a string with this public RSA key.

What I have tried so far:

Put the key in a file, and name it public. Ran the following command to get the .pem version of the key:

openssl rsa -in public  -pubout > file.pem

But doing so says the following:

  unable to load Private Key

So how can I successfully encrypt a string using a public RSA key only?


texts:
In the context of Fully Homomorphic Encryption, what is the difference between Bootstrapping and Relinearization?
Between two of them, which is the more expensive (computationally) and why?


texts: Why is SHA-512 limited to an input of $2^{128}$ bits?

texts: Both SHA-384 and SHA-512 are limited to an input size of less than $2^{128}$ bits. Considering SHA-512 has a higher output size, couldn't it include more input data?


texts: I want to verify my knowledge of sensitivity. So in $\epsilon$-differential privacy, the noise is added with the Laplace mechanism depending on the sensitivity and the privacy loss parameter. Laplace takes into account the global sensitivity and the noise is scaled on the L1-norm, ιn $\epsilon-\delta$ differential privacy the noise is added with Gaussian mechanism which considers the local sensitivity and uses the L2-norm as a metric am I right or did I miss something? I think that maybe I have confused somehow the concepts.


texts: What is the underlying hard problem in the reduction of game-based proofs?

texts: I am confused by how game-based proofs fit in the provable security paradigm. I understand reductions in the style of proving secrecy of RSA reducing it to integer factorization. However, when proving indistinguishability properties with game-based proofs, I cannot identify the underlying hard mathematical problem of the reduction.


texts: Storing Ciphertext in Firebase - Key Choice and Storage

texts:
I am building an application where I want that data submitted by the user is stored encrypted in the database, such that only the user can access it.

I started reading into cryptography and it looks like I need to convert the data to ciphertext, e.g. using AES, Rabbit, Blowfish or ChaCha20, which are well supported in my environment. These functions take the data and a key as input, sometimes also an iv.

I already know that the iv can be stored next to the ciphertext, it should be random and unique, but doesn't need to be a secret.
Now regarding the key (or passphrase), I have the following questions:

Assuming I choose a single key application wide, it definitely needs to be kept a secret. Is it sufficient to use a single key, assuming it is kept secret?

But choosing a single key for all data means that in theory if it does get leaked, everything can be encrypted, correct? And the 'only the user can decrypt its own data' part isn't fully true anymore either right?

Would it be wiser to choose a key for every user, for example something that is derived from a unique user id, or the e-mail?


texts: Is there any open-source white-box implementation of AES or DES?

texts:
I googled it, but got no result.  There is a binary executable of a white-box implementation of DES (scroll down), but no source code is provided.

The same page also links various papers about white-box cryptography, but these don't contain the implementation.

I want to study such an implementation to learn about the techniques used there.


texts: Proving the right encrypted message was sent

texts:
Total amateur to crypto here but I've searched and searched and am at the extent of my knowledge. I've gone down several avenues to satisfy what I'm looking for but I'm just going to describe what I'd like to achieve and see what comes back.

I am creating a transactional peer to peer pub/sub network and I need the following:

A publisher, Alice, broadcasts to the network an encrypted message. She will then make money by selling the key to decrypt that message to subscribers (say Bob). I need an encryption scheme such that anyone on the network (say Charles) can look at the broadcast from Alice (which can include other items separate from the ciphertext, if needed) and the transaction between Alice and Bob and verify that Alice gave the correct key to Bob without having the key himself.


texts:
I am to give a small lecture on quantum computing in a months' time and I want to shortly give intuition to the fact that Shor's algorithm shows that quantum computers will break RSA. Ideally, I would just state that we have this "evil algorithm" shown by Shor which does prime factorization "much faster" than we know to be possible on normal computers. My problem is that these people don't know what RSA is, they don't know that all numbers consist of prime numbers... they barely know what prime numbers are.
So how I illustrate the concepts of RSA and its relationship to prime numbers without the use of "complicated math"? (I don't want to start throwing around too many terms like modulus and stuff like that).
I was thinking of finding some drawings of keys to illustrate how asymmetric cryptography works, but I feel like there's a decent leap from that to just stating that "hardness of prime factorization is necessary for RSA to be secure".
Any input is greatly appreciated


texts: If Kerckhoff's Principle holds, why do we need a cipher at all?

texts: I understand Kerckhoff's principle, in a very practical sense, that the best attack that can be performed on a given cryptographic algorithm should be only as practical, if not less practical, than an exhaustive key search, that is, testing every possible key. My question is, if this is the case, then why go through the trouble of creating a cipher in the first place? Why not simply use a ridiculously long key, if you're gonna create a cipher that only takes as long as an exhaustive key search anyway?


texts: Detect desynchronization in HOTP authentication

texts: In HOTP authentication, is there a way for a system to detect that the token has been desynchronized? If so how does it know that the OTP was generated from a desynchronized (but valid) token and is not just a fake/random OTP?


texts: CTR vs CBC cycles per byte with OpenSSL EVP

texts:
I did some benchmarking using the EVP calls of OpenSSL in C, for CBC and CTR encryption/decryption.

(1) : I got 3.2 Cycles/Byte for CBC encryption.
(2) : I got 0.7 Cycles/Byte for CBC decryption, CTR encrypt, CTR decrypt.

How is it possible that I get 4 times less CPBs for CBC decrypt and CTR? (I know that (2) can be parallelized in theory.... but OpenSSL runs on a single thread in my benchmark). So how is it possible?


texts: What to do when crib dragging does not work for OTP ciphers?

texts:
7ECC555AB95BF6EC605E5F22B772D2B34FF4636340D32FABC29B
73CB4855BE44F6EC60594C2BB47997B60EEE303049CD3CABC29B
64C6401BAF45F6A930435F3DF875C4E102F8742A45C824AFCA9B
7AC24F5EAF17F0A0754D5834BC3CC3A90ABD7B2A52C222ABC89B
72C24A52B550B3B8624D4F22F86BD2B30ABD642C498122A1D29B
73CC5457BF17E7A4750C5423B178D0A44FFF756355C03CABC28A
74CC0155B443B3A8795F4224AA7E97B507F2632606CF3FA0D59B

This was given to us as a question so it is possible to solve, but how could you do this? I have tried MANY words and crib dragged them, there is just too many possibilities to deduce them all, there must be an easier way to do this.

It is assumed that each line is a different message encrypted with the same pad.


texts: The opponent possesses a string of ciphertext and has access to the encryption machinery as black box. What is the name of this attack?

texts:
a quick example:

The encryption function:
y = E(x) = (13x + 9)(mod 27), when the letters A–Z are taken to be the numbers 0–25 and the Space (punctuation) is the number 26.

The opponent has the ciphertext y = "NZC"

For each letter, he will cipher it again and again until he gets the starting value.

I'll show the letter 'N': 'N' = 13

E(13) = 16

E(16) = 1

E(1) = 22

E(22) = 25

E(25) = 10

E(10) = 4

E(4) = 7

E(7) = 19

E(19) = 13

So, the opponent knows that the letter 'T' = 19 was encrypted to get 'N'

Same goes to 'Z' = 25, the letter 'W' = 22 was encrypted to get 'Z'

and for 'C' = 2, the letter 'O' = 14 was encrypted to get 'C'

From that, the opponent reveals the the plaintext: "TWO"

What is the name of this attack?

Thanks.


texts:
I'm evaluating different hash algorithms for use in my application. One of the kind of algorithms I am looking at are cryptographically secure ones to protect against DOS attacks.

SipHash seems pretty great, but the creators seem very careful to not call it "cryptographically secure".

In the SipHash paper (PDF), they call it “cryptographically strong”, but not secure. Is there any reason to trust SipHash over SpookyHash if both have no known DOS attacks and neither is “cryptographically secure”?


texts: Symmetric key pair on app and low power device

texts:
I have a microcontroller based device that is controlled by a smartphone app. To make the communication between the two secure, I'm encrypting the communication between the two using AES. However, this means that both devices need to know the private key to decrypt the exchanged messages. A single instance of the app (on a single smartphone) can communicate with multiple devices.

If I were to have the same key for all devices and hardcode that key in the app it would work, however, if for some reason if the key is compromised then all the devices are open to misuse and MITM attacks as well. I'm hoping someone experienced here can help me figure out how each device can have its own unique key and how the app should handle this. Any help would be appreciated. Thanks!


texts: Why it is necessary idealized hash functions in Random Oracle Model?

texts:
I have reading about how to bring provable security for cryptographic schemes. There are two models: the standard model and the random oracle model. In random oracle model, is necessary to idealize hash functions, and in the standard model are use reductions from crypographic porotocols to well-known NP-problems. My question is why exist the random oracle model?

I make this question because I think that exist reductions from hash functions to NP-problems. For example, in order to reduce SHA-256 to the the SAT problem, we can represent the algorithm SHA-256 in GF(2) expressions and then, we could convert these to boolean expressions.


texts: ABE Cryptography - Send user private key

texts: I am studying Attribute Based Encryption. Now my study concerns CP-ABE scheme. The authority make users private keys using attributes and a Master Secret Key (of Authority). How can the authority send the private keys to users ? Is there a technology or a PoC (in Java, python or any language). Can you hint me a approch ?


texts:
I am looking for a strong alternative to elliptic curve cryptography. It should be something that could face quantum computing attacks, but nothing created by the NSA.

I heard about isogeny key exchange, i.e. supersingular isogeny, is it really secure? Otherwise, what would be an alternative that fulfills the above?

In addition, what would be a post-quantum algorithm for file encryption? Perhaps snow 3g?


texts: What cipher(s) can or should I use for attribute based encryption? Can I use AES for that, or should I use some other, specific cipher(s)?


texts:
Say I would like to create an app that would allow users to organize treasure hunts for their parties. The host of the party would create a list of GPS coordinates for each hiding spot and distribute the list to the guests. At the treasure hunt, guests would then use the app – offline – to get alerts when they are close to a hiding spot, record how long they took to find each treasure, etc.

Given the above setup, a moderately tech-savvy user will just look at the list of GPS coordinates and spoil the hunt. To what degree can this be avoided? In this example, obfuscation would probably be sufficient, but I am interested in the general case.

I’ve considered distributing the list in this form: HASH(QUANTIZE(latitude) || QUANTIZE(longitude)) with the quantization level set to allow the app to give hints at the appropriate distance, but I’m not sure if this could be tweaked to still be difficult to attack.

Is this a know problem? Are there any standard techniques or approaches that
can be (practically) applied to it? I'd also appreciate pointers to related questions/papers.


texts: Verify partial message given hash of full message

texts:
I need to verify partial downloads (retrieved sequentially), given a (preferably short) hash of the complete download.

Given a message $m_0 \mathbin\| m_1 \mathbin\| m_2 \mathbin\| \cdots$, hash function $H$, and hash value $h = H(m_0 \mathbin\| m_1 \mathbin\| m_2 \mathbin\| \cdots)$, I want to have a verifier function $f$ that can work on partial messages $f(h, m_0) = \mathit{valid}$, $f(h, m_0 \mathbin\| m_1) = \mathit{valid}$, $f(h, m_0 \mathbin\| \mathit{random} \mathbin\| m_1) = \mathit{invalid}$.

Message order is known in advance, retrieved in order.  $h$ is preferably short.  It's okay to spend more time (CPU) or space (memory) during verification.  High collision probability is okay.  I just need to say $f(h, m_0 \mathbin\| m_1)$ = so far so good, you can continue the download.

Is there a construct that can do that, even a probabilistic one?

EDIT: clarify the bits about 'preferably short'. Hash tree adds space burden to transmit O(2*n) hashes. Hash list is O(n). I'm looking for O(1) space requirement.


texts: Computing PGP ed25519 and curve25519 keygrips?

texts:
There are public key algorithmic differences for how PGP computes fingerprints and keygrips. For the v4 protocol, fingerprints are not exclusively computed from public keys while keygrips are. RFC 4880 makes no mention about keygrips.

After digging into code at 10 different places in the the libgcrypt from https://github.com/gpg/libgcrypt/blob/master/tests/keygrip.c, it is still a mystery as to how PGP keygrips are computed for ed25519 and curve25519.

Fortunately, the keygrip.c provides the two normative example test vectors:

 1. ed25519:
    publicKey = 773E72848C1FD5F9652B29E2E7AF79571A04990E96F2016BF4E0EC1890C2B7DB,
    keygrip   = 9DB6C64A38830F4960701789475520BE8C821F47

 2. cv25519:
    publicKey = 918C1733127F6BF2646FAE3D081A18AE77111C903B906310B077505EFFF12740,
    keygrip   = 0F89A565D3EA187CEA39332398F5D480677DF49C

Can someone provide the operations on the public keys prior to the sha1 hash that creates that creates the keygrip output? (Thanks in advance.)


texts: How to show Hash-Then-Encrypt is not AE-secure

texts:
(E,D) is a CPA-secure cipher defined over (K,M,C).H: C → T is collision resistant hash functions.
E(k,m):=E(k,m), H(c)), D=(k,c1,c2):=D(k,c1) if H(c1)==C2 otherwise Reject.
ps:the question is from the book  <A Graduate Course in Applied Cryptography[Boneh]> exercise 9.2
can use cpa and cca to proof


texts:
I read that XMSS generates many private keys and one key must sign only one message. Does it mean though that I sign many different messages, or do I sign one message, which, if its longer than 256bit, will be split into two parts and the 2nd part will be signed with the 2nd private key? Is the signature only meant to sign one message and its parts, or many different messages?
What is the maximal length of the message? XMSS computes 2^h keys, where h is the height, usually of value 20, does it mean I can only sign 2^20 messages or a message with 2^20 parts?


texts: fixing WEP by treating all messages as one long stream

texts:
in the course of introduction to cryptography on coursera
professor suggested treating all messages as a long stream XORing them with the key
this way we will not need to change the key and will not have the IV problem
and the question is
if so how can we generate a key that will encrypt the whole traffic using just XOR


texts: What does approved one-way function mean?

texts:
In one of their documents, NIST recommends using an approved one-way function, followed by a list of such functions, such as HMAC, KMAC, etc.. However, the wikipedia page says:

  Unsolved problem in computer science:

  Do one-way functions exist?

How does something get approved if it may not even exist? Who approves it, and what is the approval procedure?


texts: Would creating a custom human language be stronger protection than encrypting a known human language?

texts:
There are some languages that people haven't been able to read (Cretan Hieroglyphics for example).

Does that mean that you can better protect data by making your own language than by encrypting an existing one?

Or are all human languages really just different mappings of symbols to the same or similar ideas meaning that decryption and translation are the same thing?


texts:
I'm trying to understand cryptosystems and their implementations to understand how to properly implement them. I have a function implementing AES-128 in OFB mode. Let's call it

encrypt(plainText, key, iv)

and assume everything else is properly implemented within the function.

Assume I'm going to encrypt 3 messages: 'a', 'b', and 'a' again, using the same key, k. The outputs are not realistic, I'm just trying to show that this function outputs the same character for the same message, with the same IV.

encrypt('a', k, 1) // outputs 'j'
encrypt('b', k, 2) // outputs 'f'
encrypt('a', k 1) // outputs 'j'

The question is: is my choice of IV for the 1st and 3rd invocation insecure? I've been told to make sure that the IV is unique, but how so? If the same message is supplied, should the IV be unique to that message, or globally unique?

I say it is insecure because I should never get the same ciphertext for the same message, but I do not know how to prove this. Furthermore, I do not know how to generate OR store a properly generated IV for each message.

If anything, I think the proper way to do this would be like so:

encryptWrapper(plainText, key):
    iv = // get some random bytes from /dev/urandom
    cipherText = encrypt(plainText, key, iv)
    //store the IV and the ciphertext in the same database table

So that my decrypt function would look like this:

decrypt(databaseIndex, key)
    //the databaseIndex is used to retrieve the ciphertext and its corresponding IV

Is it safe to store the IV with the ciphertext?


texts: What happens if the plaintext $m1$ from the first block of CBC is known to adversary?

texts: The adversary is has unlimited access to the encryption oracle. My thinking is that upon receiving the ciphertext C = $<c_0,c_1,c_2...,c_n>$ it will just use $c_0$ to XOR it with $F_k(m_1)$ to get the first ciphertext, which does nothing. The subsequent blocks remain undecrypted, right?


texts: Encryption based solely on XORing with concatenated hash values

texts:
I have recently read a bit about Lamport signatures (especially the approach using hash ladders to save disk space) and I found it very interesting that it entirely depends on a hash function.

So I asked myself the following question:

When you have a plaintext $p$ and hash it and concatenate it with its hash again and so on: plain -> $H(p) + H(H(p)) + H(H(H(p))) + ...$ ($n$-times)

is this a good source for randomness? Why not?
Does the attacker having a look at this output have any advantages in guessing the plaintext for large $n$?

You have some file you want to encrypt. Hash the file with a good hash function (e.g. Keccak). Then concatenate this hash with a password you choose.
From this you derive a hash concatenation like above until it is as long as the file you want to encrypt; lets call it "hashchain". Then XOR your file with the hashchain and when you are finished you write the hash of the original file to the beginning of your encrypted file. Destroy original file and hashchain.

When you want to decrypt, take your password and the hash of the original file (which we have written to the beginning of the encrypted file), concatenate and hash this until you have a file which has the size of the original file. XOR both again and you get back your file from the beginning.

Note: Using password and hash of the original file as the beginning for the hash chain makes us able to use the same password for encryption of different files.

Is there a reason why this is not secure?

I have no only superficial knowledge about cryptography, please keep this in mind when answering.


texts: Example of a PRP that is not a strong PRP

texts:
The exact definition of security for a pseudorandom permutation is straightforward - for some encryption scheme $E\,\colon\,\mathcal{K}\times\mathcal{D}\rightarrow\mathcal{D}$, it must be the case that no efficient adversary can distinguish $E_k(\cdot)$ from $\Pi(\cdot)$ (a random permutation on $\mathcal{D}$) except with negligible probability. A "strong" PRP is defined the same way, except $E_k(\cdot)$ and decryption $D_k(\cdot)$ must be jointly indistinguishable from $\Pi(\cdot)$ and $\Pi^{-1}(\cdot)$.

I've thought about this but I can't quite come up with an example of an $E$ whose encryption is indistinguishable from a random permutation but its decryption doesn't have the same property. Does anyone have a nice example?

EDIT: I saw DW's example in the answer of this question. It is a very clever construction but quite 'unnatural' as well. Are there more straightforward examples?


texts: Why is GCM only usable for ciphers with a 128-bit block size?

texts: All block cipher modes of operation that I understand are generic schemes. They are not restricted by key size or block size. So why is GCM restricted to 128-bit block size?


texts: If I have an original file and a WinRAR password protected .rar file containing that file, can I extract the password?


texts:
We all know the basic equation of Elliptic Curve is $y^2 \equiv x^3 + ax + b \pmod p$

How the value of the constants $a$ and $b$ are chosen?
Suppose $\mathbb P\ni p \approx 2^{256}$ then what approach should I take while selecting the value of constants $a$ and $b$?

I have some basic knowledge of Elliptic Curve, EC Cryptography, EC discrete logarithm problem and EC diffie-hellman.
I need some experts help.


texts: Why does encrypting the Diffie-Hellman value with the other side’s public key prevent man-in-the middle?

texts: As far as I understood about Diffie-Hellman, it is easy for the man in the middle to easily decrypt and read the message.


texts: What are easy yet fool proof ways of ensuring that AES encryption algorithm works like it should and no bugs/developer mistakes have sneaked in?

texts:
As a developer when it comes to encryption, there is an insane amount of weakness/mistakes/bugs that the programmer can add to the encryption algorithm.

So a pretty general question to the crypto pro’s, do you guys have maybe a checklist/test cases that you go through after implementing AES-Rijndael-CBC into any application/program to make sure that it works correctly.

The reason for this is when I use any kind of programming language such as python, me and probably most others simply use a prebuilt library for encryptions such as AES CBC and trust that it will simply work correct and be safe. But in reality, I have no idea since it’s just scrambled data in the output...

Is there maybe a trusted online tool or analyzing technique or something similar that we can compare the results to indeed see that our encryption works as good as excepted.
For example, I made IV to all zeros and used an online aes program and the ciphertext was indeed the same so that made me certain that my program was working correctly.
But this is the most simple test of string -> cipher... when we add more functionality to the program such as derived keys and etc, it gets harder and harder to find bugs that we may have accidentally put into the program.

Can we maybe analyze the randomness of bytes in the ciphered text to determine if the entropy is high and random etc... to make sure that our encryption still works as it should?

Thanks beforehand for any tips :)


texts: Is using RSA with SHA-1 considered as secure as HMAC-SHA-1?

texts:
I know SHA-1 hashing is regarded insecure. HMAC-SHA-1 is still regarded secure as this is an encryption process with symmetric key of the hash produced by SHA-1.

So signing using RSA with a key size of 2048 with a SHA-1 hash over the content should be regarded secure just like HMAC-SHA-1, correct?


texts:
In the Type A curve used in Pairing based Cryptography, what is meant by sign0 & sign1 in the expression below?

a_param struct fields:

exp2, exp1, sign1, sign0, r:
  r = 2^exp2 + sign1 * 2^exp1 + sign0 * 1 (Solinas prime)
q, h:
  r * h = q + 1
  q is a prime, h is a multiple of 12 (thus q = -1 mod 12)

Reference: http://crypto.stanford.edu/pbc/manual/ch08s03.html


texts: Calculate a base point on the twist of secp192k1 with maximal order

texts:
I want to calculate a base point on the twist of secp192k1 with maximal order.
'secp192k1': _ECData(
    p=2**192 - 2**32 - 2**12 - 2**8 - 2**7 - 2**6 - 2**3 - 1,
    a=0, b=3,
    Gx=0xDB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D,
   Gy=0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D,

 n=0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D


texts: Why is public-key encryption so much less efficient than secret-key encryption?

texts:
I'm currently reading Cryptography Engineering. After giving a high level explanation of the difference between secret-key encryption and public-key encryption, the book says:

  So why do we bother with secret-key encryption if public-key encryption is so much easier? Because public-key encryption is much less efficient, by several orders of magnitude.

That statement really surprised me, and its not explained which leads me to believe I didn't understand the high level explanation as well as I thought.

Why is public-key encryption so much less efficient then secret-key encryption?


texts: CPA distinguisher for matrix multiplication in GF(256) with randomized padding

texts:
What is the best CPA distinguisher for the function $F_k:\{0,1\}^{8n}\to\{0,1\}^{16n}$ described below?

Let $E_k$ be a $2n\times2n$ matrix with elements in $GF(2^8)$, selected by generating bit strings of length $32n^2$ using a predefined function $PRF_k$, until one is found that is invertible e.g. using Gaussian elimination.

To encode an input bit string $M$, generate random bit string $Pad$ of length $8n$. Let the $2n$ element vector $T$ correspond to the concatenation $M|Pad$. Calculate the vector $C$ using the formula $E_kT^T=C^T$.

The decoding function is given by the $n\times2n$ matrix corresponding to the first $n$ rows of $E_k^{-1}$.

Obviously, you need no more than $4n$ chosen cipher texts and access to a decryption oracle, to be able to derive the decoding matrix. But is there a better CPA distinguisher than statistical analysis of the skew caused by a constant $M$ for a relatively large number of $Pad$ values?


texts: Key-Privacy in Postquantum Public-key Encryption

texts:
is there any post-quantum public-key encryption that achieves "key-privacy" (IK-CPA, IK-CCA) as described in this paper?

I saw one code-based public-key encryption construction, but I wonder if there is any lattice-based construction.


texts: Are there any attacks / weak points with HMAC-SHA3?

texts:
I read about SHA3 and would like to study its weak point,
Are there any cryptographic attacks on SHA3-based HMAC?


texts:
I will be making (in the near future) an app that will contain some pretty heavy crypto. As it is possible that my app will be ported to different devices (initially it will be iOs only, but Mac, Android & maybe even Windows ports will eventually exist). The question is how to make the crypto library as portable as possible. I'm thinking about writing it as a C11 header & .c implementation. That way it would be easy to integrate on every platform ( I may use Androids NDK to access the C code from Java). As I understand, Visual C++ can use C headers and functions.  Then I will just write a wrapper class in the platforms default language (Objective-C 2.0 for iOs) that will access the cryptographic primitives from the C library...

Is this an ok design?
I will be using sleep() to make all operations last the same time (anti-timing attacks); does this work the same on all platforms? Should this be done in the wrapper rather than the C library?
Should I use open source implementations of the algorithms, or just write my own? (I would like all the code in the crypto library to be 100% C11)

BTW: I'm going to use some non-standard algorithms that most public libraries don't have (Serpent, TwoFish, ThreeFish, as a key derivation function I'm thinking about scrypt) ...


texts: What is the best and fastest algorithm to generate a hash collision?

texts: I want to find any two strings with same hash in any hash algorithm ( at least try to find depends on its collision resistance). What kind of algorithm should I follow? Should I constantly produce two random strings and compare them until I find a collision? Or I also think to produce a large rainbow table and check if there is duplicate element. How can I find the collusion as fast as possible?


texts: TLS encryption with a self-signed PKI and Python’s asyncio module

texts:
I want to enable TLS encryption with a custom / self-signed PKI for
a self-contained distributed system built with Python 3’s asyncio.

I’ve read Python’s ssl docs as
well as several tutorials:

http://www.area536.com/projects/be-your-own-certificate-authority-with-openssl/
http://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certificate-authority/
http://carlo-hamalainen.net/blog/2013/1/24/python-ssl-socket-echo-test-with-self-signed-certificate
https://blog.cloudflare.com/how-to-build-your-own-public-key-infrastructure/
http://blog.gosquadron.com/use-tls

From all this, I extracted the following steps in order to create a minimal
example for a simple client and server with a self-signed PKI.

It seems to work as expected, but I’m unsure if I missed anything or create
non-obvious bugs which could reduce or nullify the security of the system.

Here is what I did so far:

I'll create one root CA which signs a CSR for each machine.  Each machine will
have its own certificate and key.

Considerations for the root CA:

The key length should be 2048 bits, or better, 4096 bits.
A strong passphrase should be used.
The key should not leave the machine (except if you store it on an SD card
and hide it somewhere save).  Level of paranoia should depend on the security
needs.
The certificate should not use the same FQDN as any production system.

Generate the key and a self-signed certificate:

$ openssl genrsa -aes256 -out ca.key 4096
$ openssl req -new -x509 -nodes -key ca.key -out ca.pem -days 1000

Create a key and a certificate signing request (CSR) on a machine:

$ openssl genrsa -out server.key 4096
$ openssl genrsa -out client.key 4096
$ openssl req -new -key server.key -out server.csr
$ openssl req -new -key client.key -out client.csr

Now you can sign the device key with your CA cert:

$ openssl x509 -CA ca.pem -CAkey ca.key -CAcreateserial -req -in server.csr -out server.pem -days 365
$ openssl x509 -CA ca.pem -CAkey ca.key -CAcreateserial -req -in client.csr -out client.pem -days 365

Minimal Python example.  We need different SSLContexts for the client and
server, because they do some things differently.  Both, client and server, will
use TLS 1.2 with ECDH-AESGCM.  They will verify each other’s certificates
against the root CA cert.  The client also checks the server’s host name.  ECDH
keys are only used once per SSL session and compression is disabled:

import asyncio
import ssl

@asyncio.coroutine
def handle_client(reader, writer):
    data = yield from reader.read(100)
    print(data)
    writer.write(b'cya')
    yield from writer.drain()
    writer.close()

@asyncio.coroutine
def client(addr, ssl_ctx):
    reader, writer = yield from asyncio.open_connection(*addr, ssl=ssl_ctx)
    writer.write(b'ohai')
    data = yield from reader.read(100)
    print(data)
    writer.close()

addr = ('127.0.0.1', 5555)
loop = asyncio.get_event_loop()

# Setup server
server_ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
server_ctx.verify_mode = ssl.CERT_REQUIRED
server_ctx.options |= ssl.OP_SINGLE_ECDH_USE
server_ctx.options |= ssl.OP_NO_COMPRESSION
server_ctx.load_cert_chain(certfile='server.pem', keyfile='server.key')
server_ctx.load_verify_locations(cafile='ca.pem')
server_ctx.set_ciphers('ECDH+AESGCM')

coro = asyncio.start_server(handle_client, *addr, ssl=server_ctx)
server = loop.run_until_complete(coro)

# Run client
client_ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
client_ctx.verify_mode = ssl.CERT_REQUIRED
client_ctx.check_hostname = True
client_ctx.load_cert_chain(certfile='client.pem', keyfile='client.key')
client_ctx.load_verify_locations(cafile='ca.pem')
client_ctx.set_ciphers('ECDH+AESGCM')

loop.run_until_complete(client(addr, client_ctx))

# Shutdown
server.close()
loop.run_until_complete(server.wait_closed())
loop.close()

The script will output

b'ohai'
b'cya'

as expected and TLS seems to work.  Are there any problems with it or things
that could be done better?

Thanks for your feedback.


texts:
when we say that HSM  stores keys securely we mean that non-authoriszed requester cannot access the keys.

but the key is stored physically anyway in the hardware, so access is still possible

if the keys are encrypted, that means that there is another key in the hardware that encrypted those keys. this key is not encrypted then !!

I'm confused


texts: Talking TLS with EC cryptography and the secp256k1 curve

texts:
How reasonable would it be to speak TLS over the secp256k1 curve? My initial experiments show that OpenSSL supports it (albeit with special flags, see below): Running an OpenSSL client against an OpenSSL server (or some random node.js server that I found) negotiates the suite ECDHE-ECDSA-AES128-GCM-SHA256 and establishes a regular TLS 1.2 session.

On the other hand, neither curl nor browsers appear to like that particular curve. (Although that is not necessary for my use case.)

The reason I'm using secp256k1 is because there is a nice algorithm to derive new keys from an existing key (BIP 32). Those keys cannot be correlated with each other, which is a big plus in peer-to-peer scenarios.

Now my question is: Is it reasonable to use an uncommon curve like secp256k1 for TLS? Or alternatively, is there a secure mechanism to derive a private key for another (more common?) curve from a secp256k1 private key?

The flags I mentioned above: -curves "X25519:P-256:P-521:P-384:secp256k1"

Edit: My question is less about theoretical weaknesses of secp256k1, but rather what kinds of practical problems to expect.


texts: Security of MAC-Then-Encrypt without MAC key authentication

texts:
We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption for some message $D$.

The problem here is definitely the MAC length. But we cannot change neither  the algorithm, nor tag length. Also we cannot get the access to the TLS session keys. So we need a dirty hack to ensure authenticity, without introducing new shared keys.

The idea was to generate some random key $k_m$ at the client side and send the following message: $$m=HMAC_{k_m}(D)||k_m||D$$ via our TLS. So The resulting ciphertext looks like
$$c=E_{k_s}(m||TCBCMAC_{k_a}(m))$$
where $E_{k_s}(m)$ is OFB ciphertext (including IV) of $m$ under the key $k_s$; $k_s$ and $k_a$ are TLS session keys.

At server side the receiver just receives and decrypts TLS packet, gets the the message $m$ and $HMAC$ key $k_m$ and validates the $HMAC$ for message $D$.

What we are trying to achieve is:

Do not change the way how TLS works, do not introduce new session keys.
Ensure something close to authenticated encryption without relying on the security of $TCBCMAC$.
Ensure something close to message integrity if the adversary knows the entire content of $D$.
While CPA security relays on TLS encryption, integrity is mainly depends on security of HMAC.

Yet we realize this solution is a just a garbage (and should be avoided in all possible cases) and this is not the way crypto should be implemented, but we could not come up with something better than this. And it is probably better than just rely on 32 bit CBC-MAC. I also could not come up with any attack on this or formal reduction to anything.

The equivalent scheme is: client generate some random $k_m$, encrypts it and sends to the server without authentication. Then this key is used for MAC-then-Encrypt construction.

The intuition of why this can ever works in case of ensuring message integrity is as follows: since $E$ provides CPA security the adversary cannot learn anything useful about $k_m$ even getting both $c$ and $D$. So the adversary cannot produce valid message-tag pair $(D', HMAC_{k_m}(D')$, so there is no way he can win in MAC message integrity game. Kind of.

So the questions are:

Is there a better solution to this problem?
Is there any advice on proving security / building attacks on this scheme?


texts:
In DH, are algorithms with fixed modulus p (large safe prime) to be avoided?

What if it was changed every x minutes?


texts: Why concatenate the key a second time in HMAC?

texts:
On Wikipedia it is said that HMAC is basically (without taking into account padding):

$H(key\ \Vert\ H(key\ \Vert\ message))$

where $\Vert$ denotes concatenation.

I understand the need to hash twice, but why concatenate the key a second time in the outter hashing?

Why not simply hash twice, but without reusing the key, like this:

$H( H(key\ \Vert\ message))$

A bit like Bitcoin's double-SHA, rumored to be done to prevent length-extension attacks.


texts: What is the relation between honest verifier zero-knowledge and non-interactive zero-knowledge?

texts:
I'm not clear about the relation between the following definitions:

zero-knowledge protocols;
honest verifier zero-knowledge;
non-interactive zero-knowledge.

To my best understanding, zero-knowledge protocol commonly refers to "interactive" zero-knowledge protocol, and non-interactive zero-knowledge is not called a "protocol" because it is not interactive.

For honest verifier zero-knowledge, it is a property belonging to the zero-knowledge protocol, because in interactive zero-knowledge systems, the prover makes a proof relying on some messages sent from the verifier. Therefore, the honesty of the verifier should be considered.

However, in non-interactive zero-knowledge system, there is no interactive before the prover making a proof, so no honest verifier property should be considered.

I'm not sure the correctness of the above. Is there any mistake?


texts: Generating a cryptographically secure, many-time use, symmetric encryption key

texts:
I need to generate a 256 bit encryption key described by the adjectives in the title. Currently I intend to create the key using this RNG.

Is this a secure manner of creating the key, given that it has the following properties:

Private key for symmetric encryption
Used many times (of course with unique IV's)

And given the following facts:

I will literally just get the RNG to produce 32 random bytes
not doing anything with (1) SALT (2) Iterations (3) Anything else

Please note that I am only asking if the key, directly after being generated, is secure. Thanks


texts: Is it possible to change the generator without knowing the private key used?

texts:
For example, prover sends P = xG and verifier somehow sends back P = xH without learning x.

Is this possible?


texts:
Given a server that broadcasts all received data to all connected peers (except the sender), two participants can have an encrypted conversation using a self-synchronizing method like CFB and some error detection.

How secure is this given that anyone can not only listen but also paste in chosen text into the stream? Is it enough to prepend random padding to make it secure? Anything else that could be done?


texts: Two or more initialization vectors with the same key

texts:
I'm studying about WEP and I'm in doubt.

It seems that because it uses a initialization vector of 24 bits, which is relatively short, is easy to determine which key was used to encrypt the data.

But I don't understand why, for example, 24-bit initialization vector is short ok, and probably we will have 2 or more equal initialization vectors. But I don't understand why if we have similar initialization vectors, it will be easier to find the encryption key.


texts:
The question is quite similar to Many time pad attack and I was trying to rely on the top answer, but still am a bit confused, so any explanation and help will be much appreciated.
Assume I have a bunch of ciphertexts with the same key. I need to decipher one of them.
At the moment I understand that I need to XOR the desired one with each of the rest, but I am confused whether I should do it one by one or XOR it will all at once?
Where do I go from there checking whether there's been a space or no, surely all of them will have spaces in different places?
How do I recover the symbols then?
Thank you so much.


texts: Decoding AES with Base64 cyphertext and key

texts:
I have a supposed AES cyphertext and key.
They are both encoded in Base64 as they have trailing = for padding.

The key decodes down into 16 characters, so I am assuming its AES128.

I have tried to use the key and cyphertext to decode the message using
the website “aesencryption.net” and OpenSSL with the following command:

openssl enc -d -aes-128-ecb -base64 -in cypherText.txt -out /dev/stdout -pass pass:key

The online decoder gives me unreadable text, and OpenSSL produces a bad magic number. I have also tried a few of the other supported AES modes in OpenSSL with no luck.

Am I missing a crucial step?


texts: Feasible to find two sets with the same RSA accumulator value if a prime representative hash function is used?

texts:
Consider the RSA accumulator scheme with random oracle as proposed by Barić and Pfitzmann, with the random oracle replaced by a secure hash function $H$ as follows.

For a set $S$, the accumulator value is computed as $acc(S) = x^{\prod_{s \in S} h(s)} \mod N$, where $h(s)$ computes prime representatives by appending $l$ suitable bits to $H(s)$: $h(s) = 2^l H(s) + d$ (using a large enough fixed $l$, and $d$ chosen such that $h(s)$ becomes prime).

Can someone with knowledge of the factorisation of the RSA modulus efficiently compute two distinct sets of elements $S, S'$ that evaluate to the same accumulator value?

While this variant of the RSA accumulator scheme is not universally collision-free because it allows forging of membership proofs for arbitrary elements with knowledge of the factorisation, I can't think of a way how to compute a complete set of elements that evaluates to a particular accumulator value, or to find two sets that evaluate to the same value without computing a preimage of $H$. However I also couldn't find a proof that it is not feasible.


texts: Will length-extension work if secret is not prefixed but appended to the data?

texts:
Possible Duplicate:
  Why is h(m||k) insecure?

Length-extension allows to append any data to the message while not knowing the secret. Any length-extension explaination one the web considers the situation when the secret is prefixed to the data, but is this attack applicable to the situations when the secret is appended to the data?


texts: How can I create a block cipher of a reduced size given a fixed length block cipher?

texts:
I've been reading papers on variable sized block cipher constructions based on fixed-length block ciphers, and they tend to focus on increasing the block size. They either gloss over or speak too generally about decreasing the block size. (Or I'm just not getting it, which is possible)

On the Construction of Variable-Input-Length Ciphers
Efficient Constructions of Variable-Input-Length
Block Ciphers

While these are certainly helpful, I also need a way to encrypt a size much smaller than the usual block ciphers. For example, a credit card has 16 digits, which can be represented in 54 bits. To encrypt a credit card number to another one would require a 54-bit block cipher. (The 54-bits could be brought even lower if you consider that the first and last digits are not random)

Is there a way to do this in such a way that the security isn't brought below the chance of simply guessing the plaintext?


texts:
I was going through this question of nested encryption:
Given $\Pi$ =  $({Gen}, {Enc}, {Dec})$ is authentication encryption we have designed new scheme $\Pi^{'}$ =  $({Gen^{'}}, {Enc{'}}, {Dec{'}})$ and which follows:
$\mathrm{Gen^{'}}(1^{n})$ gives uniformly random keys $(k_{1},k_{2}) = \{0,1\}^{n} \times \{0,1\}^{n}$.
And $\mathrm{Enc^{'}}((k_{1},k_{2}),m)$ =$\mathrm{Enc^{'}}(k_{2}, \mathrm{Enc}(k_{1},m))$ And deccryption algorithm  $\mathrm{Dec^{'}}((k_{1},k_{2}),m)$ gives $\mathrm{Dec^{}}(k_{1}, \mathrm{Dec}(k_{2},m))$ if $\mathrm{Dec}(k_{2},c) \ne \perp $ else $\perp$ otherwise. Proof this is not authentication encryption if attacker gain access to $k_{2}$ but not $k_{1}$.
My intuition is getting key $k_{2}$ somehow definitely compromise authentication scheme and attacker can see cipher text now...so not secure but how to go towards formal proof.
getting key $k_{2}$ somehow definitely compromise authentication scheme and attacker can see cipher text now...so not secure


texts: The Inverse Affine Transformation of AES Sbox uses different additive constant?

texts:
The Affine Transformation for AES Sbox is given by (1)

The straight forward reverse to this transformation is (2)

Where as the inverse of Affine Transformation is given as (3)

where (4)

why did the designers preferred the (3) instead of straight forward reverse (2)?


texts: Count elements with a given order in the multiplicative group $n=pq$ (RSA)

texts:
We know that the order of an element $a$ in the group $\mathbb Z_n^*$ is $k$ where $k|lcm(p-1,q-1)$ where p,q are distinct primes.

Something else i think we know is that the elements that have order $lcm(p-1,q-1)$ will generate exactly $\frac{φ(n)}{lcm(p-1,q-1)}$ different subgroups which may have common elements (in order to jointly generate all the elements of the group). Based on that, if the n was prime, we could easily count the elements of each order by doing $φ(order)$. (if it is prime, one element could generate all the others)

Is it possible to count how many elements have a given order?

For example: $n=5*7$

How many elements have order 6? (I know it's 6, but is there a generic way to find it?)

CRT could give an approximation in this case but you should still filter out the elements that may have smaller order that divides in this case 6 (1,2,3).

Here are the subgroups with order 12:

2,4,8,16,32,29,23,11,22,9,18,1
3,9,27,11,33,29,17,16,13,4,12,1
12,4,13,16,17,29,33,11,27,9,3,1
17,9,13,11,12,29,3,16,27,4,33,1
18,9,22,11,23,29,32,16,8,4,2,1
23,4,22,16,18,29,2,11,8,9,32,1
32,9,8,11,2,29,18,16,22,4,23,1
33,4,27,16,3,29,12,11,13,9,17,1

One interesting detail is that the generators for each group are present to exactly three other subgroups. For example, 33 is inside 3,12,17 subgroups. (each contains the other elements in positions m where $gcd(m, 12)=1$ so we have 4 permutations of each of the two subgroups)

With order 6:

4,16,29,11,9,1
9,11,29,16,4,1
19,11(-24),34,16,24,1
24,16(-19),34,11,19,1
26(-9),11,6,16,31,1
31(-4),16,6,11,26,1

Here, each generator is present in another subgroup

EDIT:

My second theorem seems to be little flawed:
I assumed that combining all the subgroups of order $lcm(p-1,q-1)$ would generate all the elements of the multiplicative group n. But as we can see from my example, they do not since they don't generate the elements 6,19,24,26,31,34.

Here are some good resources that could be useful mult. groups mod n and carmichael function.


texts: Does the SHA hash function always generate a fixed length hash?

texts: I'm using the SHA1/2 family of algorithms for a particular project. I was wondering if all the SHA algorithms return a fixed length hash regardless of the length of the data.


texts: What functions allow for practical indistinguishability obfuscation?

texts:
Recently, there has been a major theoretical breakthrough in program obfuscation, in the area of indistinguishability obfuscation.

Background: Indistinguishability obfuscation is a form of program obfuscation, with the following security property: if $C_1,C_2$ are two different circuits that both compute the same function, then $\text{Obf}(C_1)$ should be indistinguishable from $\text{Obf}(C_2)$, where $\text{Obf}(C)$ is the obfuscation of the circuit $C$.  In other words, if there are multiple ways to implement a particular functionality, the obfuscation of an implementation doesn't reveal anything about the implementation choices you made, though it might reveal the input-output function completely.

The recent breakthrough shows how to achieve indistinguishability obfuscation of any circuit in NC1.  This is a huge step forward in the theory and foundations of obfuscation.  Unfortunately, the construction is highly inefficient -- the obfuscated circuit is hugely slower than the original -- so the scheme described in this breakthrough paper is totally impractical.  However, often in cryptography if we focus in on special classes of functions, we can come up with specialized schemes that perform a lot better.

My question: What functions do we know how to obfuscate (in the sense of indistinguishability obfuscation) efficiently?  Are there classes of functions for which we can provide indistinguishability obfuscation, where the obfuscated circuit/program is efficient, and if so, what are they?  I'm fine even if the scheme relies on non-standard hardness assumptions, or even a construction where we have no proof of security but where it seems plausible that it might be secure.


texts: How to run a (provably probably) secure global referendum?

texts:
The following question is extremely broad and speculative, for which I apologize, but it strikes me as exceedingly important, so I will ask it nonetheless.

Suppose an event of global significance took place, like the detection of an Earth-threatening asteroid or an alien invasion, and humanity were to need to decide collectively how to respond to it. Suppose further -- as is quite likely -- that (a) some individual nation states (US, UK, RU, CN etc) would attempt to control the global response, but (b) citizens of other states would be skeptical of whether the "leader" states' proposals were in their own best interest. In such circumstances, existing political arrangements like the United Nations probably might not suffice to achieve a mechanism for arriving at a true "consensus" that would be (approximately) universally recognised as such. Is there a plausible cryptographic mechanism for conducting  a global referendum that would be (approximately) universally recognised as legitimate?

Some of the issues that I am trying to get at:

What sort of cryptographic guarantee, if satisfied to a reasonable degree of certainty, would ensure "legitimacy"? A presumably-unattainable example illustrates what I mean: if a cryptographic protocol could ensure adherence to the principle of "one person one vote", while simultaneously permitting a sufficiently large fraction of the human population to vote, I would venture to guess that the outcome of the election would enjoy a certain degree of "universal" legitimacy.
Although a layman in cryptography, I'm still well aware that when I interact on the internet I "leak" some information that would suffice to identify me uniquely to a high degree of certainty. (My persistent logins, browser cookies, ...) What fraction of the human population could be identified uniquely, with what degree of certainty, using a cryptographic protocol that could ensure anyone can vote once and only once?
Can and should ordinary, run-of-the-mill elections like those held in the United States for selecting our President, be conducted online? If not, why not? In terms of provable (albeit probabilistic) guarantees about how electoral outcomes compare to the preferences of the electorate, are there any valid reasons to prefer paper ballots to electronic ones? If so, what infrastructure changes could be adopted that would allow us to leverage the efficiencies of online voting? Do we need an international public key infrastructure with private key issuance tied to state identities? Something else?


texts: Can the ECDSA still work without present of hashing function?

texts:
According to walkthrough steps for ECDSA topic from wikipedia as shown below, What if the impact if we don't apply the hashing function (highlighted in blue in the image) to the raw messages?
Although this sounds a bit silly, but let's say we have both with or without SHA256 engine test cases like below.
Hex Message (256 bits):
"0123456789012345678901234567890123456789012345678901234567890123"
Hex Message after SHA256 (256 bits):
"9674d9e078535b7cec43284387a6ee39956188e735a85452b0050b55341cda56"
Can anyone explain what is the problems with the first Hex Message if I proceed with this to the subsequent ECDSA signing flow?
Just assume Alice signed the raw message in this case?


texts: XOR & AND equation in quantum computing ... is it correct?

texts:
I'm trying to understand the following equality found in a paper of quantum key distribution Fully device independent quantum key distribution :
$$a \oplus b = x \wedge y$$
As far as I know;

$\oplus$ stands for lofic X-OR
$\wedge$ stands for logic AND

Using integers from a specific set $\{0,1\}$, how the above mentioned equality can be satisfied?
Example:

$a=1, b=1, x=1, y=1$
$1 \oplus 1 = 0, \quad  1 \wedge 1 = 1 \quad 0 \neq 1$, therefore NOT satisfied

$a=1, b=0, x=1, y=1$
$1 \oplus 0 = 1, \quad  1 \wedge 1 = 1 \quad 1 = 1$ therefore satisfied

Is that correct?


texts: How sensitive is Tiny Encryption Algorithm (TEA) to the magic numbers?

texts:
If I needed to implement an encryption algorithm from memory, chances are I would try to implement: TEA
https://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm

How sensitive is it to the magic number? If I replace it with a random value is security expected to be severely diminished?
What about the rotations? Which rotations numbers are safe? Are there clear requirements for them?


texts: Advantage of distinguishing LWE using short vector in dual lattice

texts:
In analyzing the advantage of distinguishing LWE via dual attack, many papers uses the result of [LP11] as follows :

Given an LWE instance parameterized by $n$, $\alpha$, $q$ and a vector
$\mathbf{v}$ of length $||\mathbf{v}||^2$ in the scaled dual lattice
$L = \{\mathbf{v} \in \mathbb{Z}^m_q| \mathbf{w} \mathbf{A} ≡ \mathbf{0} \mod q\}$, the advantage of distinguishing
$\left<\mathbf{v}, \mathbf{e}\right>$ from random is close to
$exp{(−π{({||\mathbf{v}||}_2 \cdot \alpha)}^2)}$.

However, [LP11] does not provide any proof that the above statement is true.
I tried to derive it with Lemma 2.2 in [LP11] but I failed.
Does anyone know how to derive the advantage?


texts: Why not just encrypt the message and the hash of the message to achieve cryptographic integrity?

texts:
I've always seen MACs as a way to provide integrity and authentication. You would just append it to some message in clear.

But this is clearly not the case when you're doing Encrypt Then Mac. When you do that you provide authentication to something that already has authentication (to decrypt we need to know the key). So why use a MAC when we can use a hash instead: $E(m | h(m))$? (i.e., encrypt the message appended to a hash of the message)


texts: Default algorithm for scalar multiplication of elliptic curve points by the MIRACL Library

texts:
What is the default algorithm used by the MIRACL-Library [1] for elliptic curve cryptography systems to perform scalar-point multiplication with curves of Weierstrass form satisfying the equation : $y^2 \equiv x^3 + a\cdot x + b \pmod p$ defined over a prime Field $\mathbb{F}_p$ ?

I can't find any satisfying information about the used method, the point representation and the costs for the formulars.

[1] https://github.com/CertiVox/MIRACL


texts: How to apply two consecutive Paillier encryptions?

texts:
The plaintext space for Paillier encryption is $\mathbb{Z}_n$ and the ciphertext space is $\mathbb{Z}_{n^2}$. How can I apply two consecutive encryptions?

I mean, if $c$ is the ciphertext of $m$, how to encrypt $c$?


texts: Is Common Name encoded in the certificate?

texts:
When I make a certificate like so

cd /etc/openvpn/easy-rsa/2.0/
source ./vars
. /etc/openvpn/easy-rsa/2.0/build-key client1

Then commonName is set to client1.

When I ask the OpenVPN server what the commonName is of the user who is connected, can I then trust, that the user haven't altered his commonName in the certificate?

Update

I have tried to change all the clear text in the crt file on both the client and server, but the certificate still works and the OpenVPN server still replies with the proper commonName and Subject.

This certificate still works, where I have altered all plain text. I have removed the actual certificate for security reasons.

If commonName and Subject isn't extracted from the plain text. Where does OpenVPN then gets them from?

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5 (0x5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=X, ST=X, L=X, O=X, OU=X, CN=X CA/name=X/emailAddress=X@X.X
        Validity
            Not Before: Jan 12 12:53:47 2012 GMT
            Not After : Apr 11 12:53:47 2012 GMT
        Subject: C=X, ST=X, L=X, O=X, OU=X, CN=X/emailAddress=X@X.X
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:a5:40:a0:e4:44:3e:27:4c:13:69:03:a7:c3:38:
                    4f:dc:43:dc:fb:f5:43:c8:5b:50:8b:7f:0d:f4:d8:
                    30:00:e0:e3:f7:75:1c:3b:e2:08:95:8e:31:cf:a7:
                    6f:e2:94:f4:4d:7c:c4:11:a9:a5:84:1b:95:2b:9a:
                    93:da:ad:34:ae:df:5d:9d:0a:18:b3:df:86:c1:f6:
                    fb:fe:d8:16:64:a9:bf:91:51:8a:54:ba:26:5a:b4:
                    6a:88:c3:52:a7:fa:86:39:08:20:c1:53:3d:f3:12:
                    e1:50:37:11:16:db:99:53:02:82:6f:a0:05:9f:23:
                    ff:bf:79:93:1c:ef:1e:4e:31
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                Easy-RSA Generated Certificate
            X509v3 Subject Key Identifier:
                89:E7:7A:9B:1F:72:15:91:BD:D0:F4:67:A8:A1:C3:E0:0D:B1:3A:B3
            X509v3 Authority Key Identifier:
                keyid:75:A6:F1:68:88:53:F5:9B:14:4A:67:00:0B:58:7C:38:1C:A0:A1:F8
                DirName:/C=X/ST=X/L=X/O=X/OU=X/CN=X CA/name=X/emailAddress=X@X.X
                serial:80:D1:56:33:4C:5D:6D:57

            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Key Usage:
                Digital Signature
    Signature Algorithm: sha1WithRSAEncryption
        9c:a5:2b:a8:cf:86:60:90:f3:45:80:78:30:89:6a:56:cc:09:
        e8:a4:75:25:af:04:52:8f:15:7b:cd:87:94:f3:c4:2f:99:3f:
        b5:51:f7:e1:de:96:92:ae:0a:77:9e:1f:fb:8a:c3:de:84:3c:
        bb:4f:7f:f1:67:af:0c:1e:b0:90:2c:de:63:f8:47:89:f5:7b:
        57:fe:e4:8d:1d:1e:62:19:27:99:83:99:9f:4d:08:ef:b6:b4:
        7d:56:5d:ca:39:fd:1c:f3:15:6a:da:bc:51:ca:ad:59:7c:af:
        77:72:3c:ca:e7:dc:74:bc:c0:de:2e:f7:b2:27:1b:a7:ae:02:
        0f:9c
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----


texts: how to compute Bit Independence criterion of SBOX?

texts: I want to compute BIC's of my Sboxes, I found out some theses for that but I could not understand how to do it. Can someone help me?


texts: Exchanging session keys over symmetric-key channel?

texts:
I know session keys are exchanged (in SSL e.g.) over public-key cryptography channels but I was wondering if there are already known algorithms/methods for exchanging session keys over a symmetric-key channel? More specifically, is it possible/feasible to e.g. exchange 128-bit AES keys over a channel already using 128-bit AES keys?

If so, where can I read about them? IF not, why not? Is it not a good idea or can't be secured?

Possibly related: Deriving Keys for Symmetric Encryption and Authentication


texts: I hashed my bag and in it I put... "Is there a hash for unordered items?"

texts:
(By items I mean hashable objects.) As an example (with obviously way too short hashes for readability), say I packed my bag and in it I put

a shovel (hashed to S)
a bucket (hashed to B)
a towel  (hashed to T)
a random number (hashed to R)

Now friends of mine (who packed their bag too) and I agree on a game of multiple rounds, and each round consists of the following steps:

someone to be picked at random suggests something that might happen (e.g. going to the swimming pool, hitchhiking, Alien invasion) and what item(s) we might need then
everyone who doesn't have a mentioned item in their bag has to pay a small prize equally shared among those with the item in their bag; this is done for each mentioned item
additional items may be added to each ones bag

Would the game last only one round, we could simply open our bags and confirm the items' presence, but for multiple rounds the person to pick the next hypothetical event would of course choose something for which they'd probably gain the most due to knowing what everyone had in their bags (and maybe guessing the additions). Therefore, the round actually starts with

we'll tell each other something (a hash) and confirm that

and for confirmation, I propose to use a hash H with the following properties:

H can take an arbitrary amount of inputs such as H(shovel) = S, H(shovel, bucket) = E
H is commutative, i.e. H(A,B) = H(B, A)
H is chainable, i.e. H(H(A,B),C) = H(H(A), H(B), C)

(if calling H a hash is still adequate).

With such a hash, we'd simply share the entire bag's hash, and for a given item I we'd have H(bag) = H(I, bag without I), i.e. by providing the remainder's hash there's proof of the item's presence in a bag without requiring to unpack it (that's also why the random number is added, otherwise everyone could figure out when one's bag is fully revealed).

So, long story short, does such a "hash" exist?

Of course, we could simply alphabetically sort our items and use a hash-chain, but for the question's sake let's assume sorting is beyond our capabilities ;)


texts: Meet-in-the-middle attack (different block cipher modes)

texts:
Does a meet-in-the-middle attack on depend on the used modes for block ciphers?

encryption: $C_i$ = $D_{K2}$($D_{K1}$($E_{K1}$($P_i$ $\oplus$ $C''_{i-1}$))) $\oplus$ $C'_{i-1}$ and $IV_1$ = $C''_0$ = $O^n$

with $C'$ and $C''$ be the intermediate solutions (and $C''$ the first) of each encryption/decryption method.

decryption: $P_i$ = $D_{K1}$($E_{K1}$($E_{K2}$($C_i$ $\oplus$ $C'_{i-1}$)) $\oplus$ $P_{i-1}$)

All the steps are DES and the first encryption on the plaintext is in CBC mode then that is decrypted in ECB mode and finally CBC mode to generate the final cipher.

Does this change anything for the meet-in-the-middle attack?