texts:
I'm working on a cryptosystem based on ECC (elliptic curve cryptography). I need to choose several (~10) curve points which should be used as generators, and it's important that their relation is unknown, i.e. no one should be able to obtain one generator by multiplying another one by some scalar.

So that just choosing all the generators in a random manner isn't good idea, because some may suspect that they're not actually random, and their relation is known.

Natural solution is to create all the generators by using hashing scheme, i.e. pick several strings and create all the generators by hashing them (or hash each generator in order to create the next). This should convince everyone that their relation is unknown.

However it's also important that the obtained curve points are indeed generators, i.e. each one forms a cyclic group which spans all the curve points.

Now, this is where I'm confused. I've read once that selecting right points isn't a trivial task, there exists an algorithm to test the rank of a point, but it's somewhat complex to implement.
However I've also heard that most of the points on an elliptic curve are generators, and when selected in a pseudo-random manner it's very unlikely to fall onto a bad point.

So, what is right to do? Is it ok just to pick random points and hope for the best?

Is there an "online resouce" which can test the selected points? I mean, I can define the problem (curve formula, the prime for the underlying field order), give the point, and get its rank?


texts: Choosing good entropy $g$ and $p$ for a classic Diffie-Hellman Key exchange

texts:
When selecting $g$ and $p$ for the Diffie-Hellman modular exponentiation:

  $ s= g^x \bmod p $

Which pairs of $g$ and $p$ are considered good nowadays, are recommended by bibliography?

What I try to do is to write a simple Python script that chain calculates Diffie-Hellman Modular exponentiation:

def dh_public(secret):
    g=5;p=23 //@todo select better values

    return g**secret % p

For now, I have REALLY POORLY selected values but I want standardized and tested values for calculating a Diffie Hellman key exchange. As far as I know, both $g$ and $p$ should be primes.


texts: What's efficient MPC protocol for determining if sum's bigger than y?

texts:
My secure multi-party computation (MPC) in need is simply to determine if a sum of two private variable is bigger than a given value $y$, as

$f(x_0, x_1) = [(x_0 + x_1) > y]$

in which the value of sum itself (i.e., $x_0+x_1$) is deemed private and $y$ is publicly known. The output of this function is yes or no.

I am aware of many MPC protocols out there, mostly based on boolean circuit (as in Yao's protocol) or arithmetic circuit. But I have no experiences of benchmarking these protocols, and I want to ask which (existing) protocols are more suitable for my computation?

Update: based on the answer from @mikeazo, arithmetic circuit is good at addition and boolean at comparison. Since my function $f(\cdot)$ involves with both, so the question is really which out of these two circuits can do both (comparison and addition) better?

Update2: I am also thinking if possible to decompose $f(\cdot)$ into separate parts, one for comparison and one for addition. And use different/corresponding circuits for each part. Is it such adaptive framework out there that can do this?... maybe this way, it can be even more efficient.


texts: One-time pad encryption of ASCII characters

texts:
I can't understand a question I came across in a course.

  You observe three ciphertexts all resulting from encryption of ASCII
  plaintexts containing English letters and spaces only, using the
  one-time pad and the same key. The 10th byte of the first ciphertext
  is 0xA8, the 10th byte of the second ciphertext is 0xED, and the 10th
  byte of the third ciphertext is 0xBD. What is the 10th ASCII character
  of the third plaintext?

I XORed 0xA8 and 0xBD and got 00010101
I XORed 0xED and OxBD and got 01010000
so clearly 0xED is a space and 0xBD is a character.

What I don't understand is why it is the letter 'p'.

Thank you in advance.


texts: What is the maths behind Bitcoin's BIP32?

texts:
I've read about BIP32 key derivation functions.
I'm trying to understand how, given a secp256k1 key pair, that "child" public keys may be generated from just the public key, and the corresponding child private keys can be generated from the private key.
It seems to me (and I'm probably mistaken) that the HMAC-SHA512 and concatenation is not important, and that there is a simpler way of making child keys from just the appropriate type of parent key.
Is BIP32 as simple as it can be for the case of non-hardened child keys?
Or are there functions which just depend on a child-number, i, and the parent key of the appropriate type, to generate child keys?


texts:
In point 4 of the Algorithm 4.2 (Classic Merkle Tree Traversal) of *"Post_Quantum_Cryptography.pdf"* shows *"Stack_h.update(2)"* each stack receives two updates. I am trying understand to understand why there are "two updates" but I don't. There is an example on page 19 of *"Boris_Ederov.bachelor.Merkle-Tree-Traversal-Techniques.pdf"*. In that thesis, it only updates one time. For example in the step 1. Why update stack one time?

Step 1: leaf=0
"For h=0 we run 0 Stack_0.update  , which only computes P_n(3), puts it onto the stack and stops."


texts: Is it fair to say that MACs use a signing algorithm?

texts:
The Wikipedia page on MAC calls the algorithm that is used to generate the MAC as a signing algorithm. Is that a fair use of that term? Can we then say that HMAC-SHA-1 uses SHA-1 as the signing algorithm?
Since the term signing algorithms is usually used in digital signatures that use asymmetric cryptography, won't this create confusion?


texts: Is the warning given by chrome warranted?

texts:
I went to a payment page on a site recently, and chrome was warning me that the page is possibly not secure, I have a very basic understanding of crypto but not enough to fully understand why this page is possibly not secure.

The cert comes from Thawte, which from what I found on google is a well trusted CA, however the cert's signature algorithm and hash algorithm are sha1RSA  and sha1 respectively. I was under the impression that these were obsolete and have been for quite some time ?

The page uses AES-128-CBC which I understand to be relatively insecure by it's self but the messages are authenticated with HMAC-SHA1. And after reading
this I understand this to be secure given that the private key is secure which it should be given that the key exchange is RSA. So as far as I understand this makes the whole thing secure? Is that correct?

To summarize :

Is my understanding correct?
If not, why not ?
Is this page secure and why/why not?


texts: How AES-CTR is used in AES-GCM to generate cipherText and a authTag to authenticate the cipherText and authData?

texts:
Let,

Inputs:

key = key used to encrypt the plaintext.
IV = initialization vector.
plainText = plaintext need to be encrypted.
authData = addition data need to be authenticated which is not encrypted.

Outputs:

cipherText = encrypted plain text.
authTag = Authentication tag required to verify authenticity of cipherText and authData

Then,

cipherText = aes-ctr(key, IV+1, plainText);
authTag = AES-CTR(key, IV, keyDependentPoint-H(key, (cipherText-aes-ctr + authdata)));

Note: IV+1 is used for generating cipherText and the first IV is saved for encrypting the generated hash at later point of time when cipherText is generated.

Ref: GCM-Galois Counter Mode with IV & Cipher

Ref: Galois/Counter Mode

am I doing any mistake?

This question is asked to ensure the above relation of AES-GCM with AES-CTR is correct and help others to understand AES-GCM in a simple and convincing way.

This question is derived from this question.


texts: Ciphertext length in TLS 1.3 additional data

texts:
RFC8846 says:
..and the additional data input is the record header.

   I.e.,

      additional_data = TLSCiphertext.opaque_type ||
                        TLSCiphertext.legacy_record_version ||
                        TLSCiphertext.length

But the length of the encrypted text (which is the length field in the record header) is not known until the encryption is done. It looks to me like a chicken and egg situation.
Question is, what I am missing here ?
Thanks.


texts: Create a CR hash function where truncating one bit leads to collisions

texts:
I was reading Boneh and Shoups's A Graduate Course in Applied Cryptography, when I stumbled upon the following exercise (I have changed the array indices to start at 1 instead of 0):

  8.1 (Truncating a CRHF is dangerous). Let $H$ be a collision resistant hash function defined over $(\mathcal M,\{0,1\}^n )$. Use $H$ to construct a hash function $H'$ over $(\mathcal M,\{0,1\}^n )$ that is also collision resistant, but if one truncates the output of $H'$ by one bit then $H'$ is no longer collision resistant. That is, $H'$ is collision resistant, but $H''(x) := H' (x)[1 \ldots n - 1]$ is not.

I've tried many different approaches, but I have not been able to come up with an $H'$ that satisfies both requirements, namely that (1) $H'$ is a CRHF over its full range, and (2) is insecure over its truncated range (by one bit).

Note that if $H'$ was instead defined over $(\mathcal M , \{0,1\}^{n+1})$, then solving the exercise would be easy. Simply define:

$$
H'(x) = H(x[1 \ldots m - 1]) || x[m] \tag 1
$$

It is easy to see that this $H'$ is a CRHF over its full range $\{0,1\}^{n+1}$ by a reduction to $H$, while insecure if we truncate its last bit.

However, if we try to adapt this idea to the range $\{0,1\}^n$, for example as follows

$$
H'(x) = H(x[1 \ldots m - 1])[1 \ldots n-1] || x[m] \tag 2,
$$

then the reduction to $H$ doesn't work anymore. Specifically, suppose we found a collision $H'(x) = H'(y)$, where $x = \tilde x || b_x \neq y = \tilde y || b_y$.
Since this is a collision for $H'$, we must have $b_x = b_y$, so $\tilde x \neq \tilde y$. But notice that $\tilde x$ and $\tilde y$ is not necessarily a collision for $H$. Rather, it is a near-collision in the first $n-1$ output bits, i.e., $H(\tilde x)[1 \ldots n -1] = H(\tilde y)[1 \ldots n -1]$. But that doesn't imply $H(\tilde x) = H(\tilde y)$.

  Thus my question: how do you actually solve this exercise as stated?

Note that one could try other constructions similar to (2). For instance $H'(x) = H(\tilde x) \oplus b_x$,  where we take the full output of $H$ on the substring $\tilde x$ and XOR the last bit of that hash with the last bit of $x$. But again, one can at most show that this leads to a near-collision for $H$, but not a full collision.

The only reference I could find in the literature regarding this problem, is the following statement from Boneh and Boyen:

  Kelsey [13] observed that truncating a collision resistant hash function need
  not be collision resistant.

And Kelsey [13] is this (.mov video) 2005 Crypto Rump session presentation by Kelsey, using more or less the same slides as in this presentation: https://csrc.nist.gov/CSRC/media/Events/First-Cryptographic-Hash-Workshop/documents/Kelsey_Truncation.pdf.
However, what he shows is that truncating can lead to problems if your hash has near-collisions. But he doesn't actually exhibit an explicit collision resistant hash function  with near-collisions --- which is essentially what this exercise is asking us to provide!


texts: Upper bounds on difference of RSA primes

texts: I was wondering whether given a concrete $N = p \cdot q$ whether we can find a upper bound  on $\Delta = | p - q|$ as function of $N$ e.g, $N^\delta$, and thus test whether a given $N$ is vulnerable to Fermat-Factoring?


texts: Correcting Improperly Formatted EC Private Keys

texts:
We are currently generating a secp521r1 key as follows using cryptography for Python:

private_key = ec.generate_private_key(ec.SECP521R1(), default_backend())
serialized_private = private_key.private_bytes(
    encoding=DER,
    format=TraditionalOpenSSL,
    encryption_algorithm=NoEncryption()
)

This turns up the following DER file:

3081DB02 01010441 1343B3C8 94ABD7D3 B2CD80C9 872667BB 45406FC4 E342CDAC
543C99AE 51382765 990DF5EF 1A0436BD 771E8F45 9B8DAE82 EBC101A7 DA084666
F1E718D2 F3F5722F A1A00706 052B8104 0023A181 89038186 000401B9 CB8E7F9F
C698CCAF 5E37A0A3 FF418566 6ABD9F9B ACF2B7F5 5F8785AD C3EA9848 FE29FD33
BC1DB969 158BC3AA 0F684AED BF542D19 B3BCB040 7EAAAD04 2ECA9B50 0109AC9E
F94383C3 CE2CCAFB 1F85289C C2C3153F 76018012 EC7B0E0E 8F29A375 01A3557B
EF5E77E0 24CC2A64 31506CAB E215A833 2E437348 64380564 98A8444A C5B6

From this, we get the following ASN.1 tree:

SEQUENCE (4 elem)
    INTEGER 1
    OCTET STRING (65 byte) 13 43 B3 C8 94 AB D7 D3… (PRIVATE KEY)
    [0] (1 elem)
        OBJECT IDENTIFIER 1.3.132.0.35
    [1] (1 elem)
        BIT STRING (1064 bit) 00 04 01 B9 CB 8E 7F 9F... (PUBLIC KEY)

The problem begins when I extract these two octet strings and present them to the Security APIs on OS X and iOS. These APIs expect the raw octet strings as a concatenation of the public, then the private key, with no extraneous markers. However, it seems like these public and private keys I'm getting from what I assume is OpenSSL under the hood  are slightly malformed; the public key is prefixed with an extraneous 0x00, while the private key is missing a byte (every one I've generated so far that has the missing byte has that byte set to 0x01, but I can only guess what this value should be when the byte is missing… See (page 12 of SEC2)[http://www.secg.org/sec2-v2.pdf] for why I (probably incorrectly) assume the leading digit might be a 0x01).

From my (very limited) understanding of how SEC1 private keys are expected to be encoded, I would imagine that the private key must be 66 bytes long for 521-bit keys (521 bits == 65.125 bytes), while the public key must be 133 bytes long for 521-bit keys (same 66 bytes for x and y, plus a leading 0x04).

Assuming these keys are properly generated, is it safe to assume the leading 0x00 on the public key can be stripped, and the private key padded with a leading 0x01?

Ps. Maybe this is related? https://www.mail-archive.com/openssl-dev@openssl.org/msg37790.html


texts:
Alice and Bob publicly choose the messages $M_A$ and $M_B$ and independently sign them (Alice privately signs $M_A$, Bob signs $M_B$).

Now Alice and Bob are looking for a protocol that allows them to:

Make sure the other party's signature is valid (in a malicious adversary model)
Only reveal their own signature if they're guaranteed by the protocol to learn the other party's signature as well (atomic reveal)
Not rely on a trusted dealer

Is there such a protocol possible to construct? Can it be extended to N parties instead of 2? Can it work with an ECDSA signature scheme?

Edit: After researching the topic more and thanks to the answers below, I found out this is commonly known as a (strong) fair-exchange protocol and it's impossible in the two-party setup without a trusted third party. However, optimistic fair exchange protocols are possible and they only rely on a trusted party if one of the participants attempts to cheat.


texts: Is it necessary to prove EUF-CMA security of blind signature based on one-more type assumption？

texts: One more type means one-more DL, one-more DHP, etc. I find many papers do the EUF-CMA security proof in this way. Is it necessary? What is the difference between proof based on one-more type assumption and one based on non-one-more type assumption? Is the one based on one-more type assumption stronger?


texts: Generating PGP key *without* random generator? (using fixed input only)

texts:
I understand why in general, a strong random generator or source of entropy is used when generating PGP keys.

However, I have a use case where I want to generate PGP keys deterministically, i.e. based on certain fixed input, so that the same input will always result in the same PGP key.

Basically what I want is: instead of using 'real' random data, I want to generate the key from hash(passphrase), which can be considered pseudorandom data. Which will suit the purpose just as well, except this way I can regenerate the PGP key from just a passphrase.

Is there a solution that does this already, or would that involve messing with existing PGP software, and replacing their use of RNGs with my own source of entropy?


texts: How does MD5 process text which is shorter than 512 bits

texts:
MD5 processes a 512-bit block and produces a 128-bit (16 byte) message digest often expressed as 32-digit hexadecimal value

For example if I hash the word "how" using MD5 , I get the following hash value

db88a0257c220dbfdd2e40f6152d6a8d

The word "how" is represented in 3 bytes which is 24 bits. How does MD5 process a 24 bit into a 512 bit block???


texts: Signing/verification between Java and the OpenSSL

texts:
I'm trying to sign/verify data between a C application and a Java application.

In java for now I was using the built-in JCE provider with SHA256withRSA as algorithm. On the C part I'm using OpenSSL RSA_sign/RSA_verify methods with NID_sha256 as type.

With this configuration I can't verify in my java application data signed from the C one and vice versa. It seems that SHA256withRSA is using PKCS#1 v1.5 and openssl state that they use PKCS# 2.0 as padding (source).

This is why I think that the problem could come from this padding difference, but I can't find any JCE provider that support the v2.0 padding.

Is this correct? What is the difference between these paddings?


texts: Traitor tracing - determining a set of codewords

texts:
I am reading some notes and having trouble understanding the following example:

Let $F$ be a finite set of size $q$, where $q ≥ 2$. Let $n$ be an integer, where $n ≥ 2$.
For a subset $X ⊆ F^n$ of words over $F$ of length $n$, and for $k ∈ \{1, 2, . . . , n\}$,
we define $X(k)$ to be the set of $k$th components of words in $X$, and we define
the set desc$(X)$ of descendants of $X$ by
desc$(X) = X(1) × X(2) × · · · × X(n).$

For example, if $X = \{0000, 0111, 0012\}$ then $X(1) = \{0\}, X(2) = X(3) =
\{0, 1\}, X(4) = \{0, 1, 2\}$ and desc($X$) is the following set of words:
$\{0000, 0100, 0010, 0110, 0001, 0101, 0011, 0111, 0002, 0102, 0012, 0112\}$.

I know that the descendants of $X$ is also defined as the set of new words that could be produced by a coalition of pirates who posses all the words in $X$. In the example above I can't see how we know $X(1) = \{0\}$ etc? Or then how we desc($X$) is the following set of words:
$\{0000, 0100, 0010, 0110, 0001, 0101, 0011, 0111, 0002, 0102, 0012, 0112\}$? For example, how is it that we know that $0111$ is in the set but $1111$ is not?


texts:
I posted a similar question but I see that I did it incorrectly. For this reason I post it again hoping not to cause any problem.

I have the following situation:
Alice often sends funny jokes to Bob. She does not care about the confidentiality of these messages but wants to get credit for the jokes to prevent Bob from claiming authorship of or modifying them. How can public-key cryptography achieve this?

I have provided the following answer but I need feedback from an expert:
It is clear that we are talking about an ideal situation because Bob can create a new message and type each joke entirely. However, we can do the following taking in consideration some restrictions for Bob.

If confidentiality is not important then it is not necessary to encrypt the messages. What Alice can do is to include a text at the end of each joke stating she is the author, for example, “Alice is the author of this joke”. After that, Alice digitally signs each message with her private key producing a hash of the message and sends it to Bob along with her public key. When Bob sends a joke to Carol, he sends Alice’s original message including Alice's signature and Alice's public key. This way, if Bob modifies the message, the digital signature will not be successfully validated by Carol because there will be a different result of the hash meaning that the original message suffered a change in some way.

I will very much appreciate your comments.


texts: Is one time pad cipher reuse and random key secure?

texts:
The sender and receiver share two different secret keys:  s1 and s2 both y bit values. 'x' is a randomly generated y bit value. The reader sends to the tag a challenge y =  x ⊕ s1, and the receiver  responds with z = x ⊕ s2 after recovering x = y ⊕ s1.

s1 and s2 never change, x is randomly generated each complete transaction.
Can you determine s1 and s2 through a single transaction? After multiple?


texts:
I am working on a web application enabling users to communicate over private messages which is just one part of the whole system. The main focus during my development process is to protect the privacy of my users, I think this should be one of the main responsibilities for every software developer. Especially when you think about the harmful data leaks over the last years.

I've read a lot of articles about end-to-end encryption and that famous messaging apps like Whatsapp use end-to-end encryption to protect their users privacy. I want to achieve that my server and my application have zero knowledge about the contents of messages being transmitted.

When you have applications which are installed on the users device I know theoretically how to store and protect the private keys on the users device. But in my special case, there is going to be no executable installed on the users device. They are accessing the web application over their browsers and a secured https connection. This fact causes me quite a headache. I can't even imagine how to store the private key permanent and secure in this client side environment. So I thought about storing the keys in a secure way on the server, but this is a contradiction to my mind, when thinking about that I have to assume that a potential adversary takes over the control of my server, database, ... the whole machine while everything is running and the "key vault unsealed".

I opened a question on StackOverflow a couple of days before if you want to read more about my way to desperation. Protecting application secrets like encryption keys and other sensitive data. After a long discussion I was referred to this Cryptography Forum of StackExchange.

So I want to ask you without focusing on any special programming language: "Where and how to store private keys in web applications for private messaging with web browsers?". Thanks in advance!


texts: Describing Discrete Logarithm Assumption

texts:
I'd like to work out how exactly we should describe the discrete logarithm assumption (say, if we are writing a paper).

Consider this:

Let Gen be a group-generation algorithm on input $1^n$, which outputs a group description $(G, g, p)$ where $G$ is a group, $g$ is a generator of $G$, and $p$ is the order of the group.

Let $(G, g, p)$ be outputted by $Gen(1^n)$.  Select $a \in_R \mathbb{Z}^*_p$. We say the discrete logarithm problem is hard with respect to $Gen$ if for every probabilistic polynomial time algorithm, $A$,  there exists a negligible function $negl$ such that $Pr[A(g, g^a)= a] = negl(n)$.

My main confusion is about $a \in_R \mathbb{Z}^*_p$.

Should $a$ be chosen from $\mathbb{Z}_p$ not $\mathbb{Z}^*_p$ ? After all, $p$ is the order of $G$, so we should be able to pick any element from $G$?
Is $\in_R$ a common notation? I've also seen $\leftarrow_R$. Does it make sense as something that says we are picking $a$ uniformly at random?
Instead of $a$, should I say that we choose $h \in_R G$? That is, choose a random group element rather than a random exponent?
Should the probability be equal to $negl(n)$ or $\leq negl(n)$? Does it matter, and why?


texts:
I know that for encryption we require non-linearity because it impedes the ability to attack the cipher by solving for the key with linear equations.

Does hashing require non-linear components as well? I presume it does, but I do not know why.

How would a hash built from a linear psuedo-random permutation be vulnerable to collision/preimage search?

I would like to work with the assumption that the linear permutation has appropriate diffusion and is sufficiently complicated/iterated enough to preclude trivial attacks.


texts:
I read that to break repeating-key xor you can do the following: try a keysize $n$ and compute the hamming distance between the first $n$ bits of the encrypted string and the bits $n+1$ to $2n$ of the encrypted string and normalize by keysize.

The true keysize probably minimizes this. Why?

It also suggests to average a couple of the near minimal values computed in this way. But why should keysizes that are not correct help compute the true keysize?


texts:
In the paper Multi-Signatures in the Plain Public-Key Model and a General Forking Lemma, the authors Bellare and Neven use notation which looks like left arrow with dollar sign above it.

Authors provide an explanation for one variable:

  $s \overset{{\scriptstyle \$}}{\longleftarrow S}$ denotes the
  operation of assigning to $s$ an element of $S$ chosen at random

However, in this paper they use it with multiple variables like this:

  $s_1, \ldots, s_N \overset{{\scriptstyle \$}}{\longleftarrow S}$

What is the definition of this notation? Can we chose dependent random variables for $s_i$? Do we must choose all variables $(s_1, \ldots, s_N)$ at once from the set $S^N$ with uniform distribution?


texts:
One potential client is assessing our system by asking some questions to decide if they eventually will choose our service or not.

One of the question is

  All multi-stage cryptographic computations are computed within the secure boundary of the HSM.

I Googled the phrase but I could not find any relevant topics to help me to understand the meaning of the question.

Could any of you give me some example of multi-stage cryptographic computations? Is it same as multi-party computation?


texts:
Currently I am designing an RSA based application, and I am thinking of how long should the key be in order to be secure against attacks. I know that RSA 4096 bit key can be recovered using Sound Pattern attack yet it is not practical. Brute Force is impossible unless if a quantum computer is available with the claimed computation power.  How long shall the RSA key be in order to be secure against practical attacks?

Update: There exist many techniques which are much faster than brute force attack. Actually we can assume that no one can break RSA cryptosystem with brute force attack. number field sieve was used by Aoki and others in Factorization of a 768-bit RSA modulus to factor 768 bit RSA key. In addition, they predict that RSA 1024 will be factorised by 2019.

Also, if a bad random number generator is used two parties might have the same keys! as described in Mining Your Ps and Qs: Detection of
Widespread Weak Keys in Network Devices

What is your recommendation?
Is there any new advancement in factorization? so the key size should always be longer than the factorable key length.
Can I use Microsoft RSA Implementation?

Thank you.


texts: Why is the vector sampled from Gaussian or Subgaussian distribution in lattice-based cryptography?

texts:
I have known that the vector is sampled from Gaussian distribution in lattice-based cryptography because the distribution of the vector $\mod{\mathcal{P}(\mathbf{B})}$ approximates to uniform distribution.

It is proved by below lemma.

  For any $s > 0$, $\mathbf{c} \in \mathbb{R}^n$, and lattice $\Lambda(\mathbf{B})$, the statistical distance between $\mathcal{D}_{s,\mathbf{c}} \mod{\mathcal{P}(\mathbf{B})}$ and the uniform distribution over $\mathcal{P}(\mathbf{B})$ is at most $\frac{1}{2} \rho_{1/s}(\Lambda(\mathbf{B})^*\backslash\{\mathbf{0}\})$. In particular, for any $\epsilon >0$ and any $s \geq \eta_{\epsilon}(\mathbf{B})$, the statistical distance is at most $\Delta(\mathcal{D}_{s,\mathbf{c}} \mod{\mathcal{P}(\mathbf{B})},\mathcal{U}(\mathcal{P}(\mathbf{B}))) \leq \epsilon/2$.

But if the vector is sampled from uniform distribution at first, the distribution of the vector $\mod{\mathcal{P}(\mathbf{B})}$ is uniform. So, I thought that Gaussian sampling is not needed for above reason, because Gaussian sampling requires large costs.

Another reason I think is that the smaller vector is preferred because almost lattice problem is about finding short vector and Gaussian variable has higher probability as closer to the center. Is it right?

If my thought is not correct, let me know the reason using Gaussian distribution in lattice-based cryptography.


texts:
I'm looking for a slow one-way pseudo-random permutation; or in other words a block cipher $E_K: P\in\{0,1\}^b\mapsto C\in\{0,1\}^b$ with moderate block size $b\approx 64$ bits, wide key $K$, indistinguishable from a random permutation for one not knowing $K$, and additional characteristics:

encryption $E_K$ is controllably slow according to a parameter $c$, similar to the iteration count parameter in PBKDF2; an additional memory size parameter $m$ as in Scrypt would be nice;
there is no efficient decryption method even knowing $K$, ideally so that the least costly method to decipher ciphertext blocks $C_j$ would be to try and (slowly) encipher candidate plaintext until finding a match. Update: Otherwise said, there should be a security gap as wide as possible between decryption and encryption, expressed as a ratio of work; and that should remain sizable when the cost of encryption is raised using parameter $c$.

Is there some established (or arguably secure) construct for that? One idea is outlined in this interesting answer to a related question (but unfortunately, the one-wayness obtained using a permutation polynomial seems dubious).

Update: I'd also be satisfied with a slightly expanding injective function, e.g. $E_K: P\in\{0,1\}^b\mapsto C\in\{0,1\}^{b+1}$.

Updated example application: 2-D barcode cards (or other kind of write-once memory cards) are issued to individuals with data including a unique serial number $S$ of $s=32$ bits (sequentially assigned, thus largely guessable from another $S$), and other data $Q_S$ (which we assume has sizable entropy). The serial number is used for some initial purpose, and (interpretations of) regulatory requirements protecting individual's privacy prevent from storing that identifier for purposes unrelated to the initial purpose. Nevertheless, merchants would like to lawfully reuse the same cards in an existing loyalty application, identifying cards with an identifier of small size, and able to work off-line (at least, as a backup). We thus want to transform $S$ and $Q_S$ into a short digest (practically public), computable from $S$, $Q_S$, and a key $K$, that remains unique to a given card (as $S$ is); the digest should leak no information about $S$ and $Q_S$ without access to $K$; and, inasmuch as possible, the confidentiality of $S$ and $Q_S$ should be preserved from an attacker knowing digest and key (thus easing the requirements on secure storage and use of the key). Notice that a truncated MAC would not match the "remains unique to a given card" requirement.

With a function as in the question, we could use as digest $E_K(S||R_S)$ where $R_S$ has $b-s$ bits, and is obtained, say using Scrypt, from $Q_S$, $S$, and $K$. Notice that encryption slowness in the forward/encryption direction is necessary to prevent checking guesses of $S$ and enumerated $R_S$; and even more slowness (ideally, next to $2^b$ times as much slowness) is required in the backward/decryption direction, in order to prevent deciphering of the digest. Notice that either attack would reveal $S$, and also allow forged cards misappropriating the same $S$ and digest as the original, if not the same $Q_S$.


texts: Is One Time Pad considered Chosen-Plaintext Attack Secure?

texts:
If we're considering Chosen-Plaintext Attack setting, then the adversary has access to the Encryption Oracle right, and we know that OTP is only considered secure if we use the key only once. How would we ensure that the adversary uses the key only once?

Or would it not matter how the adversary uses the encryption oracle since in the end they will be presented with a ciphertext corresponding to a plaintext not queried and the adversary would not be able to decrypt it because they don't know the key. Making it CPA-Secure. Is this second train of thought the correct way to think about OTP in CPA setting?

Thank you!


texts:
Is there any pair of 128-bit strings M and K such that AES$_K$(M) = M?

If yes, how do I go about (efficiently) finding such a pair?


texts:
As everyone is now aware, Mt Gox has declared bankruptcy. As what appears to be the very last thing they did, Mt Gox accepted my $35 and fulfilled my special Mt Gox Yubikey. Having just arrived in the mail, I can now rest assured that my Mt Gox account, if it still existed, and all those bitcoins, if they weren't already stolen, would be safe and sound!

Unlike regular Yubikeys, Mt Gox ones are specially hardened. They are write-only and protected by a secret 48-bit access code (known only to Mt Gox). So, outside of making an interesting keychain, or framing it as a constant reminder to watch where I put my money, does anyone know of any interesting things I can do with the Yubikey? Reprogramming, because of the access code, seems to be out of the question, but maybe I can use it for some sort of cool non-cryptographically-secure authentication token?


texts: Is it possible to get my x,y coordinates from my "secret exponent"?

texts:
...or is that possible?

I am very new to cryptography! But, I think it's very interesting!! I have autism and numbers "are my thing" :)

I already understand a couple of things. For example I know you can get the $x/y$ or $x$ or $y$ from your public hexadecimal address, but can you get anything like that from the secret exponent? Is the secret exponent the non-hexadecimal representation of your private key or is it the secret exponent in hexadecimal? I know it's a random number, but are numbers always converted to hex in this situation? Because I can't imagine graphing a hex number! So, the $(x,y)$ coordinates are on the curve $y^2=x^3+7$, right?

How can you graph that? Like, is there a program that can generate a curve and then I can actually "see" where my $(x,y)$ coordinates are? I just got a free trial of matlab this morning, but I haven't figured out exactly how to replicate that curve on there. Basically, I'm just curious to know what point I am on that curve? How do I figure that out, and how can I draw it? I am a very visual person, so I would like anything that could help to be a gui version. I'm not very good with terminal commands...unless it's very specific.
Like: 1) type this exactly, press enter 2) type this exactly, press enter....etc...

Also, if anyone can recommend a program to help me learn some modular math, how to figure out inverses and multiplicatives of primes, and all that other fun stuff? Thank you! :)

Edit: It is possible I did not phrase this question correctly or put it in the right place. (is that what the -1 means?) Feel free to correct me or move this if need be, but do help please.


texts: Is it possible to use bitslicing for GCM?  This seems like a way to allow for a way to avoid cache-timing attacks without PCLMUL instructions and with good performance.


texts: What is the notion of an interactive assumption?

texts: In this paper: Sequential Aggregate Signatures with Short Public Keys: Design, Analysis and Implementation Studies the authors sell the paper as the first who propose Aggregate signatures without interactive assumptions as LRSW but with static ones. What renders an assumption interactive? The fact that is not a standard: DDH, CDH, DL, QR, RSA ,etc well known assumption?


texts: Double spending on a given Blind Signature over ECC protocol

texts:
Here's a blind signature protocol based on ECC. The question is if it has the double spending problem?

As I investigated, if we can change the c without changing the r and subsequently no change on m^, then there would be two different (F, s) for a single m.
And this can be achieved if considering F as (x, y), one can find another point on the curve with (x, -y) coordinates.


texts: No freshness protection for single messages, but for the overall protocol

texts:
I am given a key exchange protocol between a component $C$ and a key master $K$. During the overall execution 4 messages are transferred between $C$ and $K$. DH keypairs are always chosen randomly for each execution.

Message (1) just contains the ID of the component. Message (2) contains the public-key of $K$ and a signature over the key that can be verified by $C$.

This message (2) can be easily replayed by an adversary. On the other hand a replay of (2) will be visible for $C$ after receiving message (4) from $K$ since message (4) contains a MAC whose key is derived from the freshly chosen private part of the DH-key pair (whose public part is contained in (2)).

I am asking myself whether it is a problem from the cryptographic / security point of view that (2) has not freshness protection but any replay will be noticed by $C$ at the end of the protocol execution.


texts:
I have seen numerous references on the internet of people describing SHA-256 as generating an "almost unique" hash.

Exhibit A. there are more.

Is there some mathematical basis to the almost uniqueness? I would have thought that as SHA-256 is an evenly-distibuted (?) hash algorithm which can accept any message (infinitely many) as an input and produces a fixed length (finite) hash - then there will in fact be an infinite number of each possible output - which I would think hardly qualifies as "almost unique".

Is there a basis for this statement?


texts: How is PBKDF2 so much better than normal Hashing or even using HMAC

texts:
I do not know how the Key Length extension attack works. So if we leave that aside for once, and say just about usual brute-force attack on the hash, I don't really know how is PBKDF2 so much better than usual hashing.

Mathematically I know that PBKDF2 is so better against rainbow table attacks and also slow to recreate, but as computing power is moving up in the world, how it's still keeping its integrity?

For an HMAC we use a salt, also we can do the same for an usual hash.

So, SHA256('Hello'), is easily rainbow tabled. So if I prepend a salt, it's a little bit better, like SHA256(salt+msg), but Salts are usually kept in DB as clear text, so if some hacker is able to crack that salt, he can manually append the salt and perform the same operation.

Now in HMAC, -> H(key(opad) + h(salt + key(ipad))) is mathematically secure, but one can easily brute-force all possible password by running it through an HMAC operation (if he knows the salt), and he gets the key. A bit slower, but possible, and in pbkdf2, this whole process is looped maybe a million times even, with that much mathematical complexity, yet, if one gets the salt. He could simply run a big list of passwords with through another pbkdf2 function, and maybe very slow, but still possible, right?

So what's the use of this much complex algorithms by hashing and hashing with previous results of HMAC and so on, if it's still very much prone to a slower bruteforce?


texts: Design flaw in IND-CKA definition of Searchable Symmetric Encryption?

texts:
I am a graduate student interested in searchable encryption research. I carefully read the Secure Indexes paper published in 2004, and I was confused about the IND-CKA, the game-based security definition.

Paper Link:

https://crypto.stanford.edu/~eujin/papers/secureindex/secureindex.pdf

In setup phase, the definition lets the adversary $A$ to send the collection of subsets $S^*$ to the challenger $C$, and the challenger will return all the indexes with their associated subsets. And in the challenge phase, the adversary will pick a subset $V_0$ which belongs to $S^*$ and generate another subset $V_1$ from the original word set $S$, and give both $V_0$ and $V_1$ to the challenger. The challenger then randomly picks one subset and generates the index and send the index to adversary.

What confused me is that, since the index of $V_0$ was already known to the adversary (in setup phase), the adversary can learn which subset ($V_0$ or $V_1$) was picked by $C$ in challenge phase as long as the BuildIndex() function is deterministic. (If the index given from $C$ is same as the associate index of $V_0$ given in setup phase, the adversary will guess $0$, otherwise guess $1$)

Of course, the BuildIndex() of Z-Index involves random inserting, but it dose not prevent the adversary winning the guess with the probability greater than
$1 \over 2$ + epsilon.

I might have some misunderstanding, and I have stacked here for several days. Thanks a lot!!


texts: How to reduce factorization into Independent Set Problem?

texts:
Is it possible to reduce RSA (basically factorization) into a NP-Complete problem, concretely the ISP (Independent Set Problem)?

If so, which as far as I know is possible, how is it done?

I can't imagine how a problem like factorization could be interpreted as a binary symmetric matrix.


texts: RSA Attack, known public key and ciphertext. Can decrypt the message m?

texts: I'm stuck with this problem: Assume Alice and Bob are using RSA to communicate each other. Given Bob's public key $(217,7)$, Alice send the ciphertext $c=53$ to Bob through RSA encryption. Now, Eve can read the ciphertext $c$, how can Eve decrypt the ciphertext and read plaintext $m$?


texts: Can anybody please explain why is the probabilty of finding a desired message for random chaining values equal $2^{-224}$?

texts:
Can someone explain why does probability is equal $2^{-224}$ in the following piece of paper?
The length of messages blocks in Hamsi is equal 32 and the length of chaining values is equal 256.


texts: Would the Secure Enclaves such as Keystone or Intel SGX obviate the need for cryptography

texts: Would the use of Secure Enclaves such as Keystone or Intel SGX obviate the need for cryptography? Rendering cryptography irrelevant in the decades ahead?


texts: RSA: security of LSB in The Generic Model of Computation

texts: In this paper Maurer and Aggarwal showed that in generic model of computation breaking RSA is equivalent to factoring. It is also known that the LSB of an encrypted message is as hard as breaking RSA.(i.e If there is an algorithm that find the lsb of the message m from the ciphertext c, then we can recover m). So I was wondering, does it follow that the LSB of RSA is a hard as factoring in the generic model of computation?


texts: Can we use Bitcoin miner to break 2Key 3DES, if yes how long it takes?

texts: As ASICs are specifically designed to generate the hash for a block of a block chain. which is much faster than other GPUs which are used to break 2key-3DES. can we use Array of ASICs to break 2key-3DES in practical time?


texts: how to decrypt hidden text under numbers?

texts:
got a question as follows -
how to decrypt below in to letters knowing that crypting language is 469 and it base ofcourse on mathematic.

46781! 9063376290 3222011 677 80322429 67538 14805394, 6880326 677 63378129 337011 72683 149630 4378! 453 639 578300 986372 2953639! I know it’s rather short, but still, this poem I like best."

im strugling to find code for that for a long time.
or where should i look for any possible methods to decript this ?


texts: Can I use steganography to detect data loss that occurs due to gradual degradation in quality in sequential printing of black and white noise texture?

texts: I want to detect original print and a reproduced print. So if I embed some information in this kind of noise texture, after reproducing the original print there might be some loss in information due to degradation in quality in printing. So my question is, Can I use steganography to measure information loss? So I can distinguish between original print and a reproduced print.


texts: Calculating CP-ABE random secret $s$ initialized by the data owner

texts:
I am analyzing the Bethencourt CP-ABE model to understand the math behind it. If a data user is able to satisfy the access policy attached to the ciphertext, that user is able to decrypt the encrypted message.

This is made possible because the data user can calculate:

$$e(g,g)^{rq_{x}(0)}$$

We know that:

$$q_{x}(0) = s$$

Where:

$$s \in Z_P$$

Is it in any way possible for the data user to calculate the value of this secret $s$ if he/she can satisfy the access policy or is it made so that the data user can never be able to obtain this value?


texts: Can multiple public keys lead to the same shared secret in X25519?

texts:
I have no mathematical knowledge about this, but I just read in RFC 7748 the following:

  Designers using these curves should be aware that for each public key,
  there are several publicly computable public keys that are equivalent
  to it, i.e., they produce the same shared secrets.  Thus using a
  public key as an identifier and knowledge of a shared secret as proof
  of ownership (without including the public keys in the key derivation)
  might lead to subtle vulnerabilities

Does that mean that multiple Curve25519 public keys can produce the same shared key produced by X25519? I just don't understand.

Does this mean that key servers (let's say that such key servers even verify the ownership of these public key using sending an encrypted challenge to the claimant) using Curve25519 are not a good idea?


texts: Does it exist? Specifically using Shamir secret sharing based MPC and looking for a (non-)interactive way to prove that the secret value is valid. A value is valid if it is part of a set for example $[0,1] \in \mathbb Z $ or non-negative, or at least that it is the secret key of some other value. For example if $s$ is the secret and $h=a^s \bmod p$ is the encrypted message and I distribute $s$ using secret sharing, can I prove to the receivers that the shared value is indeed the $s$ value used in $h$?


texts: Is there an asymmetric encryption that works in a reverse way of RSA (encrypt using private key and decrypt using public key)?

texts:
I'm writing a program that needs to receive an encrypted message from the server and decrypt it on the client.

The problem in this case, is to prevent the client from being able to re-transmit messages encrypted with same key. RSA is designed to use the public key for encryption and private key for decryption. So if a client can decrypt a message (using private key), the client is also able to encrypt another message using it.

I know that it is possible to sign a hashed message using private key and then verify it using public key. But my scenario is not a digital signature problem. I just need a "read only" encryption.

Is it possible to do this using RSA or any other asymmetric encryption algorithm?

UPDATE:

I know that RSA cannot encrypt data longer than it's key size and this is the reason for hashing data to a fixed length data. My supplemental question is: Can we convert a long message to a few small and fixed length blocks and use the same algorithm used in signing and verification to do encryption and decryption?


texts: Strategies to address an immutable key in a symmetric cryptosystem

texts:
I have a power constrained environment where I do not have enough power to update an encryption key.  For this reason, the symmetric key will be programmed before the devices are distributed, and this key is used to encrypt a payload.  I have two different things that I could possibly change, one is a nonce, and the other is a modification to the base key.  I don't have a way to generate a nonce locally; however, in the system, you have a "host" and a "client" and the host polls the client. The encrypted packed goes from the client to host.  For the sake of scope, let's assume AES-128.  I have a very small, non-volatile memory of 128 bytes.  Here is a list of things that I could possibly do within the current framework:

I could send a random number and XOR that with key that is already stored in the "client".  The problem there is that I have 128-bit key but only the ability to send a 32-bit value to the device (currently that is, I possibly could get 128-bits, but I need to look into the channel bandwidth)
The device creates a 16-bit pseudorandom number that is generated by the client is known by both the host and client, and I could use that a nonce in some way.  This approach is easiest because it becomes a host-side software issue because the key is not modified.

Above is basically a nuance to the problem, so the question is:
Is there a standard method to deal with the problem of an immutable key structure in a system which uses a symmetric cipher?


texts:
In type 3 pairing ($e:G_1 \times G_2\rightarrow G_\tau$ where $G_1\ne G_2$ and no isomorphism from $G_2$ to $G_1$ is known) we have co-DHP* problem:

  Given $H, aP \in G_1$ and $aQ\in G_2$ calculate $aH$

It looks like there should be equivalent problem in $G_2$:

  Given $aP \in G_1$ and $H, aQ\in G_2$ calculate $aH$

yet I haven't found it anywhere in literature. Is such problem mentioned in any paper? Or maybe it's proven to be easy?


texts: Subexponential algorithms for DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$

texts:
Consider the accepted answer to the question: Why are elliptic curves better than cyclic groups?

It seems to suggest there are subexponential algorithms (i.e., algorithms with running time
$$
L_n[\alpha,c]=e^{(c+o(1))(\ln n)^\alpha(\ln\ln n)^{1-\alpha}},
$$
where $\ln n$ is the input size, $c > 0$, and $0 < \alpha < 1$) for solving DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$ in general.

Are there such algorithms?

If not, perhaps someone could explain the following sentence that appears in the answer:

"And working only with the representation $\mathbb{Z}_s \times \mathbb{Z}_t$ will weaken the discrete logarithm so useful for cryptographic purposes."


texts: AES-128 (cbc mode), is it possible to deduce the IV if the plaintext, ciphertext and key are known?

texts: I have the plain text, key and the ciphertext stored in DB. Can I deduce the IV based on this information?


texts:
Recently I heard that the content of an Iphone is stored in encrypted form meaning that if I were to take apart the Iphone and managed to extract the memory and read it, I wouldn't be able to get any information out of it.

I find this hard to believe because an Iphone can be unlocked and opened in a mater of seconds, the decryption of 16 gigabytes of data in that short a time seems too fast to me. I would like to know what is happening exactly.

Is the memory not actually encrypted, is decryption actually just that fast or is there something else happening.

Just to be clear, my impression was that when you unlock the phone (not just when you turn it on initially) everything is decrypted. obviously turning on the phone provides more than just a few seconds of time to decrypt the phones content.

Additionally, I would be interested not only in Iphone encryption but also the encryption of Androids and other smart phones.


texts: AES - MixColumn transformation using the identity matrix

texts: I'm analysing how different components of AES influence its security. However, I cannot find a good explanation to what happens if the MixColumn step would use the identity matrix. Intuition tells me, that then AES won't be secure, but why?


texts: HKDF on output key material of previous HKDF

texts:
I understand the typical way to use HKDF is to make one call to HKDF to obtain multiple keys. Is it safe to use HKDF the following way to generate different keys ? If not, why?

key0 = HKDF-extract-and-expand(0 salt, Z(DH key exchange), x co-ordinates of public points as info).

key1 = HKDF-expand(key0, info1)
key2 = HKDF-expand(key1, info2)

Also, is it safe to replace HKDF-expand for key1 and key2 with sp800-108 or HMAC_SHA256(key0, counter)? i'm curious if there are any subtle differences between them that make them not interchangeable ?


texts: Zero-knowledge proof of knowledge without replay

texts:
Given a hash function:

$H(x)$ = y

$y$ is publicly known.

Alice wants to prove to Bob that she knows $x$. Alice could create a non-interactive zero-knowledge proof, and share it with Bob. Then Bob could verify that Alice has a valid $x$.

The protocol is describe here:
https://media.consensys.net/introduction-to-zksnarks-with-examples-3283b554fc3b

Now suppose that Bob wants to prove to Carol that he knows $x$. Bob could re-send the same proof that Alice sent to him, even though he doesn't know $x$.

Is there any way to create a proof that cannot be replayed by a malicious verifier?


texts: How to calculate $v_k(s)$ in Quadratic Arithmetic Program?

texts:
In the paper Pinocchio: Nearly Practical Verifiable Computation, there are some polynomials $v_k(x)$, $w_k(x)$ and $y_k(x)$ representing the structure of there circuit. However, as in the "concrete example" in page 3, the description of $v_k(x)$ are table items like $v_1(r_5) = 0$ and $v_1(r_6) = 1$, where $r_5$ and $r_6$ are roots of the constructed target polynomial $t(n)$.

But what is the textbook form of $v_1(x)$ like $a_0 + a_1x + a_2x^2 + \dots$? How to calculate $v_1(s)$ and $g^{v_1(s)}$, if $s$ is not a root of the target polynomial $t(x)$?


texts:
As you know there occured some successful attacks again mifare classic tags (manufactured by NXP) and therefore NXP recommends to replace these tags with some newer products like mifare pro desfire and others.

My question is why don't we encrypt data (with AES, ...) and then translate and store this data to the mifare classic's block, with present 32bit micro controllers it doesn't need so calculation time and there will be a good saving in cost . Why don't companies implement this approach ?

EDIT

tnx all answers.
at first my mind from 32 bit mcu was not tag's built in processor,i mean first we separately encrypt plaintext  to ciphertext in the mcu based on AES.
I have an extra scenario, lets find it's bugs:

as you know each tag has a Unique ID(UID) & we define a key for transacting data between tag & reader/writer chip that controlled by the mcu( PCD chip).
when tag entered to PCD's operation field,pcd read tag's UID
mcu make ENC_KEY with irregular combination of AES_INIT_KEY & uid (each tag will has seprate ENC_KEY)
mcu calculate plaintext'hash with its hash function(TEXT_HASH).
mcu encrypt plaintext based on AES with ENC_KEY(it makes CIPH_TEXT).
mcu transfer & stored CIPH_TEXT & TEXT_HASH to the tag's (mifare classic) via mifare algorithm .

then there are not problems mentioned in answer1, each tag's has unique key & same credit in different has not same CIPH_TEXT

in the second part:

mcu read tag's uid,make ENC_KEY with tag's uid & AES_INIT_KEY ,read CIPH_TEXT & TEXT_HASH with crypto1 & its key from tag,decrypt CIPH_TEXT & TEXT_HASH with ENC_KEY & checked plaintext integrity with its hash value.

i accepted  Maarten Bodewes's answer about price case .(tnx a lot)
I'm really concerned to read this approach's baugs
WBR


texts: Is there a KDF that can be computed in an untrusted environment?

texts:
I'm looking for a Key Derivation Function, kind of like PBKDF2 or Scrypt, but which can be computed by a machine you don't trust.  Some way to give it a derivative of the source password, such that the key can be computed from the derivative but the derivative is opaque and otherwise useless to the untrusted machine.  Also, I should be able to verify that machine actually performed the KDF and didn't just throw back a random key.

For the first part, protecting the password, I imagined the system would have to be something like:

s = random()
P = F(s,password)
I = KDF(P)
K = G(s,I)

Where s is some random number, and F and G are some kind of functions such that K is always the same given the same password, regardless of s.

Basically, some way to "encrypt" the password into an opaque value that the KDF can generate an incomplete key from, and then we can use the secret from that encryption to get the real key.  We then throw away s. Later, to regenerate K from just the password, we can just pick another random s.

I don't know if any such combination of F, KDF, and G exist.  I also don't know how to approach the proof requirement; that we can prove the KDF was executed correctly.

And of course this needs to be practical. I'm sure you could accomplish all of this using general homomorphic encryption to implement scrypt, but that would be intolerably slow.


texts: What might be the intuition for this scheme to be AEAD and what is the problem with this?

texts:
There is a plaintext message $M$, and a key $K \:\stackrel{{\scriptscriptstyle \hspace{0.2em}\$}} {\leftarrow}\ \{0,1\}^{128}$ which we will use for AES, we can extract a ciphertext $C \gets \mathrm{CBC}[\mathrm{AES}_K](0^n,M)$, i.e., CBC
mode encryption under IV $0^n$ of the message.

The master keys $L1,L2$ are shared between the sender and receiver.
Sender creates a header (associated data) $H$ that contains various
things including a ciphertext $W \gets \mathrm{AES}_{L1}(K)$, the
enciphering of the per-message key $K$ under master key $L1$. Sender also computes a tag $T \gets F_{L2}(H)$ for some function family $F$ that
we assume is a good PRF. Then the sender transmits $(H,T,C)$ to the
receiver.


texts:
Hi I'm running the dieharder test suite (this) to test an algorithm, but I've found somethings that I don't understand.

This is the command that I run to test my binary file

dieharder -f test -a -g 201

I've tested my algorithm on file of different size: 30Mb, 300Mb, 3Gb
and the result are that I fail a lot of test on the 30Mb file, less in the 300 Mb (still a lot), and in the 3Gb I pass all the tests.

Isn't it strange? Shouldn't the tests produce wrost results if the file is larger? (or the weakness become less visible)
If it's normal, can this be considered a weakness in the algorithm?

Also shouln't the tests consider the file length? and so "adapt" to it

EDIT: If statistical anomalies also go down if a larger test file is used what is the optimal size that I should use to do the tests?

PS when I talk about weakness I mean that it's weak statistically speaking


texts: In Elgamal, the generator g is always quadratic non-residue modulo p where p is a safe prime and inverse of g can be also generator?

texts:
In Elgamal, the generator $g$ is always quadratic non-residue modulo $p$, where $p$ is a safe prime and the inverse of $g$ can also be generator?

Can I prove it? I can't come up with it at all.


texts: ECDH/ECDSA key exchange on embedded devices

texts:
Two devices are communicating only with each other and shall do this with AES encryption. Both devices are offline, have very limited storage and use a small cryptographic coprocessor which is able to perform AES/ECDH/ECDSA/RNG. Also keys and certificates can be stored in it. Any device must work with any other device, as they are not coupled in any way per default.
I planned on doing an ECDH key exchange to create random keys for the AES communication. Then I encountered the MITM problem, which makes ECDH alone invalid for creating random keys out of thin air without further validation.
If I wanted to use ECDSA I would need to store a certificate, which would be static for the entire life of the product, as I can't update it. It would also be the same for every device, as every device must be able to communicate with every other device. If the private key is compromised, so are all the devices.
I could also store a factory key in the devices and use that to transfer a randomly generated keys. For that I could directly use AES and ditch ECDH completely. The problem here is, that the factory key might get compromised, exposing all the other devices using the same key. As mentioned I could use a fixed public/private key pair, but I see no advantage in this case over simply using AES.
Then another problem: One device might stop working, which then needs a replacement. The new device would then have to exchange a new key with the old device. A function would be necessary, that makes the old device ditch its key and accept a new one. If an adversary knows the factory key, he could intercept the new key and listen to the communication.
I am looking for suggestions on how to approach this key exchange problem and make the system as secure as possible. Thanks in advance and BR.


texts: Is a Feistel structure based cipher IND-CPA?

texts:
Using the format of the "game" to establish if a cipher is IND-CPA secure:

The adversary submits two distinct $M_0$, $M_1$ plain-texts to the challenger.
The challenger selects one of them at random and encrypts it with the symmetric key and gives cipher-text C.
The adversary has to guess which message was encrypted based on C with a probability greater than 1/2 for the cipher-text to be distinguishable.

If the challenger is using an encryption algorithm only based on Feistel structures, would it be possible to always correctly identify, which of the messages the challenger encrypted?


texts: How does the frequency work with Vigenère Cipher?

texts:
So I have an unknown key but with the length of 6. I understand that I calculate my own English letter frequency of my letters. I then compare it with the standard English letter frequency and identify a pattern shape similarity (in regards to a bar chart). I get my first letter for the key, however, how do I proceed with  getting the second letter?
What do I change/do to get my second English letter frequency to compare to the standard English letter frequency?
thanks


texts: Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

texts:
I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part.

What is the difference between ”ECDH with a co-factor key” and ”ECDH without a co-factor key”?

Also, it would be great if you could point me to information related to the implementation itself.


texts: Distributional Virtual Black Box security

texts:
Can anyone clearly explain the difference between these two notions of obfuscation security: VBB security and D-VBB Security.
VBB Security: An obfuscated program is no better than just a black box access to the program
D-VBB Security : Let $D = \{D_n\}_{n\in N}$ be a sequence of distributions on F, and O an obfuscator for the F functionality. Then O is said
to be D-DVBB secure if for any adversary A and any sequence of predicates
$P = \{P_n : F_n \rightarrow \{0, 1\}\}$ there exists a PPT Simulator S such that
$$ Pr_{f \leftarrow D_n,A, O}[A(O(f))= P_n(f)] \approx Pr_{f \leftarrow D_n,S}[S^f(1^n) = P_n(f)]$$
Why are we using predicates in this definition?


texts: Breaking Vigenere via Kasiski/Babbage method? (non-programmatic)

texts:
I'm really hoping someone can explain to me what is going on in the second major component of this form of analysis.

If you wish, for convenience, here's a page that already has some ciphered text and a known codeword: http://www.martani.net/2011/04/cracking-vigenere.html

Anyhow, I think I understand how to get the keyword length just fine (shift same-text and highest collision is likely key length) with the factor+collision method.

However, once the step of dividing up the text comes about, I'm lost as to how to use it to obtain the key. I understand using frequency analysis, but thus far all I've managed on my own samples is a gibberish key...

If someone could explain this step of the decipherment in simple terms, I would be very grateful as I have a test on it this week and I know my instructor will try and throw this my way...


texts: AES-CTR-256 Sub Keys With Encrypted Sub Key Index

texts:
I was working with some encryption and I decided to put a spin. To preface this would be used to encrypt multiple files.

You start with a key file generated from random data. For example you could generate a 288 byte key file. This file contains 9 sub-keys each 256-bits.

For each file to encrypt you securely randomly select a sub-key from the file. Then you create the header by append 28 bytes of random garbage bytes onto 4 bytes which is the index of the sub-key in the key file. You then use the first sub-key to encrypt this 32 byte header block.

The remainder of the file is encrypted using the sub-key and is placed after the header.

I was wondering if there are any obvious flaws to this approach. My nuonce is going to start at zero.

Would it also be even better to start the nouce using the first byte of the key?


texts: Ensuring a salesman gets his commission without revealing total sales

texts:
I (ACME Corp) run a SaaS website that charges a USD amount (lets say $1) per file processed.
I directly employed a sales rep. (Alice) at 8% commission i.e. she makes 8% of $1 for every file uploaded by customers and processed.
Alice in turn sub-employed a sales rep. (Bob) at 3% commission (making Alice's actual profit from ACME 5%) who is now asking what Alice's % is so that he knows if he's really receiving 3% of the commission of the files processed. Bob is worried that Alice under-reports the number of files processed and he is getting short-changed.
Is there a way to prove to Bob that he is getting his correct commission without revealing

The total number of files (and thus $ value) processed by ACME Corp, and

Not revealing Alice's commission percentage of 8% from ACME?


texts: How is block cipher padding verified for consistancy?

texts: Under what circumstances is a decryption routine able to tell that the padding of a message is invalid?  If a cipher text block where to be randomly modified,  what is the probability that the padding would be correct?  How does the type of padding influence the detectability of cipher text that has been tampered with?


texts:
Currently in college I'm learning about DES, and everywhere I look the table S-boxes are represented as follows:

S1  x0000x  x0001x  x0010x  x0011x  x0100x  x0101x  x0110x  x0111x  x1000x  x1001x  x1010x  x1011x  x1100x  x1101x  x1110x  x1111x
0yyyy0  14  4   13  1   2   15  11  8   3   10  6   12  5   9   0   7
0yyyy1  0   15  7   4   14  2   13  1   10  6   12  11  9   5   3   8
1yyyy0  4   1   14  8   13  6   2   11  15  12  9   7   3   10  5   0
1yyyy1  15  12  8   2   4   9   1   7   5   11  3   14  10  0   6   13

Is there any reason at all why this table is set up like this? Why not with the last two bits as row and the first 4 as column? Or even as a single row with the number as identifier, as I seem to have managed to do in a spreadsheet here (see A39:D103 for a single-index list)?


texts: Where are the DH parameters in a Server Exchange Message?

texts: In a Server Key Exchange message, isn't it supposed to send both the public key's parameters which are for DH: the g(generator) and p(modulus), but the message only contains one public key called Pubkey: so is that the g, p or both, or is there a fixed variable like there is for the RSA public exponent which is 2^16+1? And where is g^e mod p?


texts: Can the McEliece cryptosystem be used as an additively homomorphic encryption scheme?

texts: Since the McEliece cryptosystem is linear, if matrix G is kept constant for different plaintexts, it can be used for linearly combining the corresponding ciphertexts. In that case, what are the advantages of McEliece over Paillier encryption?


texts:
I'm searching for a simple description that tells me in a schematic way how hmac and cmac is calculated.
So far I found the following:
cmac = aes_encryption(hash(message), key)
hmac = hash(key, message)

The difference seems to be that cmacs are using a symmetric encryption additional to the hash-function while hmacs process the key within the hash-function itself. Is that correct?
Are there some situations when a cmac shall rather be used than a hmac?


texts: How does Kerckhoffs's principle apply to Adversarial Neural Cryptography?

texts:
Martın Abadi and David G. Andersen recently published a paper on arxiv titled: "LEARNING TO PROTECT COMMUNICATIONS WITH ADVERSARIAL NEURAL CRYPTOGRAPHY" (https://arxiv.org/pdf/1610.06918v1.pdf).

I was wondering why Eve neural network $E$ does not get as input the learned parameters $\theta_A$ and $\theta_B$?

If really $K$ is supposed to be the only value that comprises the symmetric key, then in order to adhere to Kerckhoff's principle, one should view the training output (namely, the final values for $\theta_A$ and $\theta_B$) as public information. So, upon "alternating" the training phase to $E$, I supposed $E$ should receive as input $\theta_A$ and $\theta_B$ as well as $C$.

An alternative view would be that the training phase is regarded as a key generation algorithm. In such a view, the only challenge remaining is to really make training very efficient. But I do not think that this view was the intention of the authors because they explicitly contrasted their work to prior work that aims at generating cryptographic keys.

So my initial question still holds. Why is Kerckhoffs's principle (https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle) apparently totally overlooked in this notion of neural cryptography? What am I getting wrong?


texts:
I'm familiar with client puzzles, where the client performs some work and there is a way to prove to the server that the client has done so.

Is there a way to do this, but where the client's resource is memory (storage) rather than computation (CPU)?  In other words, the client ties up some storage for some duration, and there is a way to prove to the server that it has done so.  I would like it to be much cheaper for the server to verify than it is for the client to do this work.

The motivation is that this might serve some similar benefits as client puzzles, deterring Sybil attacks with mass denial-of-service, in cases where the clients have a relationship with the server over a period of time -- in a way that hopefully can't be sped up by GPUs, FPGAs, and similar tricks.

I know that we could have the client generate a certain amount of random data and then use schemes for proof-of-retrievability/proof-of-data-possession to let the client prove that it is storing this data for the duration.  However, I'm wondering if we can do better in this setting, given that the exact data is not important, we just need a way to show that the client has tied up its memory (the equivalent of conspicuously burning a $1 bill, to prove that you are wealthy).


texts: Is murmur3 (128) a good hash function to use as a proof (hash) of a document in a smart contract?

texts:
I want to store document hashes in a smart contract as a prove of a document (eg pdf contract - could be large, dozones of MB) related to a blockchain transaction.

Is murmur3 128 hash functions a good choice for this?

murmur3 is not a cryptographic hash function, but it as difficult as with cryptographic functions to construct a document with same function which will make sense.


texts: GPG encrypt performance degradence for thousands receipients

texts:
I plan to use GPG to encrypt a small file (32KB) for very many recipient public keys (few thousands).

I tested GPG with RSA and then ECDH public key encryptions. If RSA is very slow, with ECDH (nist 256 curve) I get (still bad -but) better results:

1K destinataries encrypt: 14sec
5K destinataries encrypt: 5m42sec

Now, my understanding was that all GPG does is to encrypt the file with a symmetric (session) key, and then encrypt the symmetric key with the public key of each recipient. Thinking that the ECDH is the bottleneck, I did an openssl speed ecdh on the machine and got:

256 bit ecdh (nistp256)   op=0.0001s  op/s=18934.7

My question is what can cause such a bad performance for 5K recipients if ECDH seems to be so quick with openssl? Is there anything else that GPG does (besides the symmetric and asymmetric encryptions) that can explain the 5m42s time?


texts: From Factorisation of semiprimes to breaching confidentiality

texts: If someone or some group found an efficient way to factor large composites with two distinct prime divisors, would this make it easier to decode any messages?


texts: Hashing Public Key of Lamport or Winternitz OTS

texts:
For the Lamport or Winternitz public keys, couldn't one just hash down the large public key to 256 bits in order to greatly reduce the public key size while still having basically the same security? Why isn't this done?
Thanks for your help. If you have any further readings, they are always welcome.


texts:
Hope you're having a nice day.

I need to implement an authentication system between a "document" (it's not exactly a document, but an object without any computing capacity, only able to store information) and a computer. The document will have some sort of information stored there by the computer, and then it will be given to an user and kept away from the computer. When the computer detects the document again, it will identify its possessor as the user to whom it was given to and authenticate it.

However, the computer isn't assumed secure, so I need the information stored there to don't be enough to replicate the document and to let us know if the computer has been modified.

On the one hand, I would like to know if the implementation I was thinking to use would be insecure: I was thinking of using RSA; I'll store the private key in the document and the public in the computer. Then, for authenticating, I'll encrypt and decrypt a random number less than N (the modulo) and see if it results the original one. This will be right, wouldn't it?

On the other hand, I would like to know if there is some research done about this topic and if there are any papers developing it. I've tried to search it by myself, but I don't know how to describe precisely without needing quite a long text. Is there any term for this type of security?

Please, don't hesitate to ask me more details in case I haven't explained myself very well. Thank you so much in advance for your help.


texts: How to see Diffie Hellman private key used during negotiation?

texts:
I used OpenSSL s_client to connect to a test server.

Because OpenSSL generated client side private DH key, I think there will be a way to show the private key or enforce a specific private key to be used in negotiation for test purposes.

How can I do this?


texts: Is modulus switching feasible for plaintext space larger than $\{ 0, 1 \}$?

texts:
I read the proof of modulus switching and realised that it can be extended to integers, but do we actually use it for integer encryption in practice?
Consider that we are doing additive and multiplicative operations modulo $t$. So, we'll have to find $p$ s.t. $p$ mod $t \equiv q$ mod $t$ and we'll have to round $c' = (p/q) \cdotp c$ s.t $c' \equiv c$ mod $t$.
So, is it feasible to do modulus switching in such a setup?


texts: Why are modes of operation used, what attacks do they prevent?

texts:
I know you always need to use a mode of operation when using a block cipher, AES for example, and Wikipedia has a good explanation for what modes of operation are
Now I know if i do not use a mode of operation every time i encrypt the same plain text (abc) with the same key (klm) i get the same cipher text (zyx). the IV in a mode of operation prevents this from happening. But since abc always maps to zyx with the key klm there are some attacks to figure out what key is used.

What attacks can be used against only block ciphers?
What credible sources explain this?


texts: Symmetric encryption mode where ciphertext size is plain text size

texts:
I've had many questions on Stackoverflow on how to minimize the output of a cipher - during encryption of course - to the same size as the input. Obviously this is possible for a single block of plaintext, but it gets harder when the plaintext size is larger than one block. Using a stream cipher is possible, but you would need some kind of IV, and some place to store or derive the input data for the IV.

For now I am just looking for answers regarding confidentiality (authentication/integrity may be disregarded). Furthermore, I would like to focus on input that is bit or byte aligned and cannot be compressed. Obviously it would be nice to have obviously distinct results when using a different plaintext, even if it starts or ends with blocks of identical data. The key size should be manageable, say a maximum of 64 bytes.

Currently I presume that the best result can be achieved using a stream cipher and a nonce encoded to the minimum of required bytes. So then the encoded nonce would be the only overhead.

Note that I am very much aware that the solution space may be empty. In that case I very much would like to have this confirmed.


texts: RSA Accumulator construction - how to pick the initial state?

texts:
I read about RSA Accumulators and I wish to construct one using a programming language of my choice. For selecting modulus N, I see various implementations picking the RSA-2048 number. Also, as the article suggests:

  "The initial state of the RSA Accumulator is the generator sampled
  from the group of unknown order $g$".

However I'm not sure the best concrete value I should put into my code for the initial state of the accumulator. I saw this implementation using 65537, while here I see tests with 3 and 4096 (I'm not sure however since I'm not programming in Rust). So what's the best concrete value to use for the accumulator's initial state?


texts:
The Goldreich-Goldwasser-Micali construction allows to build a (cryptographically secure) pseudo-random function from of a (cryptographically secure) pseudo-random generator.

More formally, let $G: \{0, 1\}^s \rightarrow \{0, 1\}^{2s}$ be a length-doubling PRNG. Given a seed $s$, $G(s)$ returns a $2s$-bit string $G(s) = G_1(s)||G_0(s)$, where $||$ denotes the concatenation. Then, the GGM construction works as follows: given a key $k\in\{0, 1\}^s$ and an input $x=x_{n-1}||\dots||x_{0}\in\{0, 1\}^n$, the output $y \in \{0, 1\}^s$ is computed as $y = F_k(x) = G_{x_{n-1}}(G_{x_{n-2}}(\dots(G_{x_0}(k))\dots))$.

In terms of efficiency, the GGM construction needs $n$ calls to the PRNG for an $n$-bit input. Is there a more efficient, but still provably secure construction, i.e., a construction making less calls to the PRNG? Any pointer on a paper is welcome!


texts: Isn't code signing just digital signature on code?

texts:
I have been trying to understand why code signing is treated or discussed differently from digital signature.

Digital signature is signing a hashed BLOB with a private key. When the BLOB is code/software, it is code signing.

So, isn't code signing just digital signature in the true sense? Why is it carved out based on the BLOB?


texts: What is an advantage of MDS matrices in block ciphers?

texts:
I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is:

For example in the case of linear attack, is constructing the bias table of MDS matrices behavior impossible? Or the values of biases are such a way that linear attack is not applicable and its complexity is higher that brute force attack?


texts: Multiparty millionaire problem where members only know if they are the richest one

texts:
I'm looking for a generalisation of Yao's millionaire problem: $N$ parties want to know whether they are the richest one. If they are not, then they just know they are not the richest party - but do not know the identity of the richest one.

Ideally, in case of equality, all richest members would know they are the richest, but would not know if others are as rich.

Does such a protocol already exist?

Edit: obviously when there are only two users, then everyone knows who is the richest. I guess a formalization would be that not-richest people cannot guess who, amongst remaining users, is richest, with probability better than random.

There exist such constructions, for instance assume a FHE scheme which takes the encrypted values as input, and output for each party $p_i$ their result, encrypted with $p_i$'s key. While this should work (it may need some work for the encryption of the inputs but anyway), it is also extremely tedious.


texts: Converting a plaintext to hex for AES encryption

texts: Looking through AES process I see it uses a substitution table which need the input in the form of hex. Im wondering if i have a plaintext of 16 bytes such as 'j±…<Ãà!DÈ¶;5˜‰*', how can I convert each of these bytes into hex so they can be used with the subsitution table?


texts:
I try to reproduce the analysis conducted in this presentation by R. Lifchitz.
Namely, data signed by an 1024-bit key $n$ (Rabin scheme) and following ISO/IEC 9796-2.
From what I understand, for a message $m$ that went through an encoding function $\mu$, the signature $s$ is produced as $s=(\mu(m))^d \pmod{n}$, or maybe using a hash function $h$:  $s=(h(\mu(m)))^d \pmod{n}$.

Assume that we know the public key $n$ (given in the presentation):

n = 0xAB9953CBFCCD9375B6C028ADBAB7584BED15B9CA037FADED9765996F9EA1AB983F3041C90DA3A198804FF90D5D872A96A4988F91F2243B821E01C5021E3ED4E1BA83B7CFECAB0E766D8563164DE0B2412AE4E6EA63804DF5C19C7AA78DC14F608294D732D7C8C67A88C6F84C0F2E3FAFAE34084349E11AB5953AC68729D07715

The signature taken as example in the presentation is as follows:

s = 0x01ccc173930a67cfa5623f4921c1eb63116a658c2604d90a5567e5a3db2ec2bd0041c22898f912f70c4ce91f173b735472183d4314eb1ff543f603800f371a40e891b94e452639c5975bc6a47028e57e34e143a9fec48b92354616c5ed5453d2fea03f2301de468ab465b919fc79b8da94df3e8828c96ed5e5b973fd88e4fd2f

Verifying it with $w=s^e \pmod{n}$ yields $v=2(n-w)$ since $w=7\pmod{n}$. The value for $v$ shown in hexadecimal below is highly structured.

 00000000: dc 00 13 09 00 71 dc 01 c4 0c 72 29 d2 09 fc e1  .....q....r)....
 00000010: c6 03 ca 05 dc 01 dc 01 de 0f 77 54 a8 4a ef 99  ..........wT.J..
 00000020: ce 18 ef 99 dc 01 dc 01 dc 01 dc 01 dc 01 dc 01  ................
 00000030: dc 01 dc 00 13 09 00 71 dc 01 c4 0c 72 29 d2 09  .......q....r)..
 00000040: fc e1 c6 03 ca 05 dc 01 dc 01 de 0f 77 54 aa 4a  ............wT.J
 00000050: ef 99 ce 18 ef 99 dc 01 dc 01 dc 01 dc 01 dc 01  ................
 00000060: dc 01 dc 01 dc 00 13 09 00 71 dc 01 c4 0c 72 29  .........q....r)
 00000070: d2 09 fc e1 c6 03 ca 05 dc 01 dc 01 de 0f 77 4c  ..............wL

From this, and seeing the data actually signed given in the presentation (Slide #30), I cannot figure out the encoding function (there does not seem to have a hash function $h$). I have read in https://eprint.iacr.org/2009/203.pdf that that ISO standard should used 0x6A header and 0xBC trailer values, but I cannot find them here. (I add that for a second signature using the same public key, I have the same structured $v$.)

Is there a public description of the encoding function that was used here? A public code implementing the signing algorithm?
Any other indication would be helpful.


texts:
I have thought of a system for generating passwords which works as follows:

Take the following items:

A password, such as williamwallace.
A secret 1000 digit number which is stored on my computer.
The name of a website.

Create a password like this:

hex(sha512(site + password + number))

For example:

hex(sha512('google' + 'williamwallace' + '1456 … 3889'))

The generated hash can then be used as your password. How secure is this system?


texts: What does libsignal use the registrationId for?

texts:
I am playing around with the libsignal at the moment and i was noticing that in the different documentation for libsignal-js or libsignal-java one of the first steps is always to generate a so called "RegistrationId" which is basically a (nearly) random 16bit int:

var registrationId = new Uint16Array(Internal.crypto.getRandomBytes(2))[0];

return registrationId & 0x3fff;

In the rest of the examples this registration id is never used again so my question is:

Do I have to generate this id and if yes what is it for?

I am aware that every user needs an index to find the keys afterward, but I don't get why to generate a random number of this length which could lead to collisions quite fasten (with 14 bits effective entropy).


texts: Is the prime P is fixed for an elliptic curve defined over a particular prime field F_p?

texts: I have seen the NIST, SEC and Brainpool standards. They have used same prime for a particular bit curve (128,192,256,521). Is the prime value fixed for a particular security (field size)?


texts:
When it comes to MAC algorithms one can have many choices. CBC-MAC, CMAC, PMAC etc are some MAC algorithms that rely on block ciphers (ex AES) to generate a MAC. On the other hand HMAC is very popular on the Internet and relies on compression functions (ex SHA-1, MD5).

What are the drawbacks of each from a security perspective and how do you make a choice if you need to include MAC in your protocol?


texts: Ciphertext packing for bandwidth optimization

texts:
Let's say $Alice$ needs to send ciphertext $c_b = enc(m_b,k_b)$ to $Bob$ and ciphertext $c_c = enc(m_c,k_c)$ to $Carol$. For both the ciphertexts notice that underlying plaintexts are different (i.e. $m_b, m_c$).

Now imagine a single envelope needs to be sent to both $Bob$ and $Carol$ where both can decrypt and get their respective plaintexts $m_b,m_c$.

The trivial way is ($c_b | c_c$) (i.e concatenation) and use some delimiter for Bob and Carol to extract bits and decrypt respectively. But this needs bandwidth $|c_b| + |c_c|$.

Can we optimize this to use lesser bandwidth? Can such a thing exist at all?


texts: Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

texts:
Reading about typical cache timing attacks, they seem to be based on intentional eviction of cache lines and timing how long an operation takes.  It seems as if those attacks rely upon these tables being hardcoded constants in read-only sections of an executable, and are therefore subject to sharing memory pages.

If you ensure that your AES tables are on physical pages that are private to your process, is that enough to thwart timing-based attacks?  In this situation, an attacker running as a normal-privileged process on the same machine would not be able to perform such tricks as clflushing the cache lines containing the table.

Note that this technique also requires that the contents of the pages are also unique, not just private: some operating systems might notice memory pages with identical contents and coalesce them to a single physical page as copy-on-write.


texts: Why are inputs to boolean functions usually modelled as random variables?

texts:
I ask this because it might one of those things that "everybody knows/does", but never gets written or explained anywhere... Is it just a matter of aesthetics (in the mathematical sense of the word), or is there a more specific (read: practical) reason for doing this? (as opposed to say, talking about a priori and a posteriori probabilities, as Claude Shannon did in his Communication Theory of Secrecy Systems?)

PS: This question might be relevant in the broader field of study of Boolean functions, but I am interested in the case of crypto applications.

PS2: I couldn't find a more suitable tag than "randomness", as "boolean-functions" or "random-variable" do not exist...


texts: Can tweaking a cipher have the same or similar effect as changing the key?

texts:
If we encrypt a message $m$ with (say) $AES$ and key $k$ we get ciphertext $c$.
And if we encrypt the same message $m$ but with $k^*$ we get ciphertext $c^*$:

1) $AES[E_k(m)] = c$ and $AES[E_{k^*}(m)] = c^*$

But what if we were to tweak $AES$ insted of changing the key? For example, a simple tweak might be to change the ShiftRow from right shifts of $0,1,2,3$ to (say) right shifts of $1,3,0,2$. And perhaps unique shifts for each round of the $10$ rounds.

Then, if we encrypt a message $m$ with (say) $AES_{tweak1}$ and key $k$ we get ciphertext $C$. And if we encrypt the same message $m$ with $AES_{tweak2}$ and with the same key $k$, we get ciphertext $C^*$:

2)  $AES_{tweak1}[E_k(m)] = C$ and $AES_{tweak2}[E_{k}(m)] = C^*$

Since these ciphertexts in (2) are distinct is this the same or similar to changing the key, as in case (1)?

Let's assume sender and receiver can secretly exchange the tweaks.


texts:
I've been thinking about a geometric picture for El-Gamal. The idea is to understand the set $\{(my^{x},g^x) \mid x \in Z_p\}$ (the set of encryption of $m$ for fixed $g$ and $y$) by taking the $\log_g$ and getting $\{(\log m + x\log y, x) \mid x \in Z_p\}$, which is a line on a plane. Decryption corresponds to finding the $y$-intercept; this is possible if you know $\log y$. Re-encryption corresponds to moving a point on the line to another random point on the same line; this is possible if you know a point on the line (a ciphertext) and a vector parallel to the line (or simply another point on the line). Notice that since El-Gamal is IND-CPA, knowing two points on the line is not sufficient to determine the $y$-intercept.

Of course, one needs to determine what geometric operations are efficiently computable. Vector scaling by $\lambda$ is efficiently computable. Vector addition is efficiently computable. Vector difference is efficiently computable.

The main benefit is that it makes some sense, to me, of the homomorphic properties of El-Gamal.

Any references for this point of view? Further thought seems to show that the Computational Diffie-Hellman and Decisional Diffie-Hellman assumptions have a very elegant formulation. The Decisional Diffie-Hellman assumption is that you can't tell whether two vectors are parallel.

[edit]
This looks relevant: https://eprint.iacr.org/2013/377.pdf


texts: Why is Diffie Hellman used alongside public keys?

texts:
I just read this post here: Why do we need asymmetric algorithms for key exchange? that asserts that in public key cryptography when asymmetric keys are used to secure communications, for parties to agree on a common shared secret, the following method is used:

  So, say you want to send me a very long message, using asymmetric
  encryption. Here's what you'd actually do:

  (1) Pick a random key for use with a symmetric (fast) cipher. Encrypt
  your message using that (fast) cipher and key. Send me that encrypted
  message.

  (2) Then use asymmetric (slow) encryption to encrypt the following
  message and send it to me

  "Hi, I just sent you a message encrypted using the BLAH   symmetric
  cipher with key ABCDE123456."

So, you use your peer's public key to encrypt a shared secret, send the peer the encrypted secret, and then the peer decrypts the secret with his or her private key. In this way, you can use the big certificates to authenticate parties as well as use them to establish a shared secret.

This makes sense, but i have to be missing something. Why/how would DH be used here as well? I see that there are plenty of schemes like RSA2048 that have large keys, which i assume would be used in this way above, but also incorporate DH in their cipher suite:RSA_DHE, ECDHE.

What benefit does the DH component add? What can it do, now that we can establish a shared secret with the public keys in the certificates?


texts: Line by line encrypted logging stored with iv/salt/iterations. How safe is it?

texts:
I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2.
The application must support log rotation, and I would like to make each log entry "self sufficient". This would allow me to discard previous logs that have already been processed/are too old.

By self-sufficient, I mean that having the log entry and the password is sufficient to decrypt the payload. I do not wish to maintain a separate file/record with information about the key or its derivation.

That means I have to store a whole bunch of information with my each log entry:

pbkdf2 salt
pbkdf2 iterations
iv
gcm tag
encrypted payload

The PBKDF2 salt and iterations are not likely to change often, if ever.
The IV will be randomly generated for each log entry.
The payload is user-provided content
The tag is the verification tag for the GCM encryption.

Here's an example of such a log file:

timestamp  pbkdf2 salt              iter   iv               tag                      encrypted payload
1584815488,IqdD09R5kbtA4recw5LQeg==,100000,IxsZwVEjYvO0vgjl,w4EdRjRJQNCK/sOYKYyXYA==,DCqFFCGQbpYhWEy3u3OlKMN2iMn9JF2vFZFY
1584815488,IqdD09R5kbtA4recw5LQeg==,100000,n1PscNktuug1Os7b,e1oZAg31XCZOZUC4ZrKjzg==,cLhr1baGonaTt/k/PJZ2s5hboTBjNCmqFu281w==
1584815488,IqdD09R5kbtA4recw5LQeg==,100000,RqKtky2ICMORWqGZ,G5VHGDkhWuUch7ZN0AiRBg==,mjexQ9aUHCZGomrlrnQrk6K9ULBEYHPSsjeAxw==
1584815488,IqdD09R5kbtA4recw5LQeg==,100000,JY3h/TQSlk+yP/5W,bXL8xK5QVC9uPi2vJ+IDQw==,xu5e/UKPyeEnghFVJL+JLmV2yXYlN2cKBmGGZw==
1584815488,IqdD09R5kbtA4recw5LQeg==,100000,W/3uKytKkGmPezdP,HuGNKT6L+Bh/bEvwnlkI5A==,rwVB3ssIKNaz0ZldNRR608JKOIjlimnuu5ZAyQ==
1584815488,IqdD09R5kbtA4recw5LQeg==,100000,l7RSko8EvTydWWgt,Ahwjm63IR/8MK03gn//uQQ==,cVS+O0nP7BrhuFCheXn1EDSdGSXumzu8PL1cUQ==
1584815488,IqdD09R5kbtA4recw5LQeg==,100000,H+5ywMwpalZVPwLj,nzVSRSz08gJ+OxcktniAOQ==,4WbpNcfcIEcx0wDyzH7s40u+Utx+xzlIFfosuA==
1584815488,IqdD09R5kbtA4recw5LQeg==,100000,hF5i+nCT3lFFxHJh,w9MYSR4j3tlebur+ZkUyVg==,9ZIlK8ooUhV0AVAJso6DIstAZ3IdxXCbNhpG4A==
1584815488,IqdD09R5kbtA4recw5LQeg==,100000,RAqAaY4cXsAMXZ3m,JzS4uU4QuMeenWqOMnCoRA==,phjLHaBeETJ+H5mRq0i1EUIe/MIbNmxEnNhLcA==
1584815488,IqdD09R5kbtA4recw5LQeg==,100000,iGXfpm7FZ7Rmj0F1,TRi0/ElsdCbdUUGBrhxqhQ==,P2yMW+1pn9F7kTTU7bWOm19xrjWQU+0UuhJGKw==
1584815488,IqdD09R5kbtA4recw5LQeg==,100000,IXNxT6RwDu3BnoFB,7khAMRKSLcE6nAcxdUsQbQ==,FMv3gUuO5Q2HVwetr/uo73ph4UOuA+Z3IOiXEg==

Is it safe to store all of that information at the same place?
A log file will typically contain hundreds/thousands of such entries. Does the encryption get significantly weaker as entry count increases?
The timestamp has to be stored in cleartext, for practical reasons. However, I would like to validate that it hasn't been tampered with. What's the best approach for this?


texts: Can deterministic ECDSA be protected against fault attacks?

texts:
In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin

  Deterministic (EC)DSA. The purpose of the attacker in this case is to recover the value of the secret key $d$, from the values of the correct signature $(r, s)$ and the erroneous one $(\tilde r, \tilde s)$. The attacker is able to build the following simultaneous equation set on $\mathbb{Z}^*_q$ in the unknowns $d$ and $k$:

  $$ \left\{ \begin{align} s &\equiv_q (\texttt{H}(\texttt{msg})+d \cdot r) \cdot k^{-1} \\ \tilde s &\equiv_q (\texttt{H}(\texttt{msg})+d \cdot \tilde r) \cdot k^{-1} \end{align} \right. $$

  and solve it for

  $$ \left\{ \begin{align} d &\equiv_q \textstyle \frac{(s - \tilde s) \cdot \texttt{H}(\texttt{msg})}{r \cdot \tilde s - \tilde r \cdot s} \\ k &\equiv_q s^{-1} \cdot (\texttt{H}(\texttt{msg})+d \cdot r) \end{align} \right. $$

  The amount of computation required to derive the secret key is negligible, and it is possible, in case an unreliable fault injection technique is being used, to confirm whether the correct values of $d$ and $k$ have been extracted deriving the deterministic $k$ corresponding to the $d$ via the procedure specified in [9], and checking it against the one obtained from the simultaneous equations.

Can deterministic ECDSA be protected against such fault attacks?


texts: Does Lamport's authentication scheme still work if the hash function is not collision-resistant?

texts:
Geology professor Peter McMenteur gets interested in Lamport’s authentication
  scheme. After a brief study, he claims that the scheme works even if the hash
  function is substituted by a function that is only easy to compute and hard to invert
  (i.e., a hash function without the property of collision resistance

Can anyone point me in the right direction with this ?


texts: CBC key lifetime, or, "how big is too big?"

texts:
IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB.

My case isn't using IPSec, the above is just for comparison.

Assuming a plaintext is encrypted and stored to disk using AES-256 in CBC mode, is there a maximum 'safe' size? Fear not, each plaintext gets its own randomly generated IV. I'm just having a hard time finding what the upper bound is for practicing safe encryption.


texts: Need help understanding math behind Rijndael S-Box

texts:
in Rijndael SubBytes() step all bytes of input block are substituted based on a lookup table S-Box. S-Box is initialized by taking all elements of $GF(2^8)$, calculating their multiplicative inverse and then calculating their affine transform.
Here is C code which does that as found on wikipedia page.
#include <stdint.h>

#define ROTL8(x,shift) ((uint8_t) ((x) << (shift)) | ((x) >> (8 - (shift))))

void initialize_aes_sbox(uint8_t sbox[256]) {
    uint8_t p = 1, q = 1;

    /* loop invariant: p * q == 1 in the Galois field */
    do {
        /* multiply p by 3 */
        p = p ^ (p << 1) ^ (p & 0x80 ? 0x1B : 0);

        /* divide q by 3 (equals multiplication by 0xf6) */
        q ^= q << 1;
        q ^= q << 2;
        q ^= q << 4;
        q ^= q & 0x80 ? 0x09 : 0;

        /* compute the affine transformation */
        uint8_t xformed = q ^ ROTL8(q, 1) ^ ROTL8(q, 2) ^ ROTL8(q, 3) ^ ROTL8(q, 4);

        sbox[p] = xformed ^ 0x63;
    } while (p != 1);

    /* 0 is a special case since it has no inverse */
    sbox[0] = 0x63;
}

I cant wrap my head around how multiplicative inverse is being calculated here. I assume p here acts as input while q is its inverse. Hence $p*q = 1$.
I want to understand how exactly this works because I am trying to implement a function that initializes Rijndael inverse S-Box, where first the inverse affine transform is calculated and then the multiplicative inverse.


texts: Examples of applications that use the Schnorr digital signature?

texts:
I have made a study on digital signatures, especially on the Schnorr digital signature, and I was just wondering if there is some way I can find names of actual (known) applications that have applied and used this kind of digital signature.

I haven't been able to find anything by myself, so any help is appreciated.


texts: Is $f(g)$ a PRG if $f$ is a OWF and $g$ a PRG?

texts:
If we have a PRG $g$ and a OWF $f$, can we say that $g' = f(g)$ is a PRG?
And what if $g$ stretches its input by a factor of 2?