texts: What are the rules for using AES-GCM correctly?

texts:
When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM correctly?
I am looking for a bullet point checklist with advice that I can follow as a  developer, and the consequence of ignoring the advice.
I am using the Java implementation of AES-GCM.


texts: Prove that (m1 ⊕ m2) = ek(m1) ⊕ ek(m2) for a 8-bit blocks i/p encryption system

texts:
I tried to work this out but I'm stuck at finding a relation between $c$ and $e(k)$:

An encryption system accepts 8 bit-blocks as input.
The encryption is done by XOR'ing the bits with an 8-bit key.
Prove that:

$(m_1 ⊕ m_2) = e_k(m_1) ⊕ e_k(m_2)$

There does not exist a message $m$, such that $e_k(m) = m$, except when $k$ is all 0's.


texts: Compute euclidian distance on encrypted data

texts:
The scenario is described as following: Let $A$ an user that is transmitting an encrypted (with its own public key $PK_A$) data vector containing its position as $p = Enc(PK_A, [x,y])$ towards a group of users $U = [u_1, u_2, \dots, u_n]$.

Is it possible that each of these users belonged to the group $U$ positioned at different distances from $A$ can compute respective the euclidian distance on it (on the encrypted data that they received I mean)?


texts: Authentication protocols for authenticating devices to a server

texts:
The requirement is to authenticate 1000s of devices to a server when the devices try to contact the server. The problem I face is that all authentication protocols require some kind of shared secret between the devices and the server. And for devices to know this shared secret, some reliable user has to manually enter the shared secret into the device. This manual step is undesirable. The goal is to have the devices start contacting and authenticate with the server with as little manual intervention as possible.

To elaborate a bit, two options I could think of are:

Inject a shared secret that only the server can the generate and verify(eg: a digital signature of a random string by the server) into the devices. The server and device use some standard authentication protocol using this shared secret.  But for bootstrapping this setup, a shared secret needs to be injected for each device manually by an user. I am wondering if there is a way to avoid this step.
The device and server agree on some obscure algorithm. The device would apply this obscure algorithm on some common entity that both the device and server know (like the Serial Number) and send to the server. The server will also apply the same algorithm and verify that it could generate the same secret. Here the shared secret is the algorithm. Although this option doesn't require someone to manually enter a shared secret, this option doesn't sound secure or convincing to me.

In general, are there standard protocols that solve this problem?


texts: Security difference between $\mathrm{Keccak}(k\mathbin\|x)$ and $\mathrm{Keccak}(x\mathbin\|k)$

texts:
$\require{begingroup}\begingroup
\DeclareMathOperator{\keccak}{\mathrm{Keccak}}
\DeclareMathOperator{\concat}{\|}
$According to Keccak's website, $\keccak(k \concat x)$ is safe:

  Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be performed by simply prepending the message with the key.

My question is, is $\keccak(x \concat k)$ safe?

I read Why is $H(k\mathbin\Vert x)$ not a secure MAC construction? but I guess it doesn't apply to Keccak.
$\endgroup$


texts: Can I change the S-box and P-box in DES?

texts:
I am a newbie to crypto and just one quick question on the s-box and p-box of DES. I understood that the s-box is where the security comes from and NSA has somehow decided how it should be filled in.

But my question is that, can we really change the content of the s-box or p-box? Would that break the security somehow? Why or why not?


texts: A key-generator outputs an encrypted string that only changes the second half - what weaknesses could that expose?

texts:
The company I work for provides a software solution. The software is licensed and I have access to the license generator.

We have a company culture of challenging our perceived security but I am a very basic cryptanalyst. I would like to ask for some leads to see if I can prove our license generator needs to be fixed.

Example (not real licenses):

License #1: abc111
License #2: abc222

Real licenses are about 600 chars and look very much like an ssh-rsa public key.
(I can't explain it, they just look like one! If I could show you a real one, I am sure you would agree there is something in common)


texts: How to do unmasked addition on SSS masked shares?

texts:
I'm trying to understand how Shamir's Secret Sharing algorithm is applied to AES when doing threshold masking.
I understand how the secrets are created  and the secret is calculated and I'm now trying to figure out how the math operations (that are  needed for AES) work when you have the shares. To do that I'm reading this source: Goubin et al, Protecting AES with Shamir's Secret Sharing Scheme. (pages 79-94 in isbn 978-3-642-23951-9)
It says: addition of shares with an unmasked value: $$\{(x_i', y_i') \leftarrow (x_i,y_i \oplus u) | \forall (x_i, y_i) \in shares\}$$
Where $u$ is the to be added value and $(x_i, y_i)$ is an original share. Addition results in a new $(x_i', y_i')$ share.
I've implemented this in python (not in a finite field) in this way:
def add_unmasked(self, shares, value):
    return [{'x': share['x'], 'y': share['y'] ^ value} for share in shares]

However I don't see the correct results, if I have a secret of 20 being shared and unshared results it in 20, but if I add 1, I get the wrong result 80% of the time.
For completeness sake my code:
def create_shares(self, to_create):
    if to_create < self.degree + 1:
        raise Exception('shares don\'t cover the order')

    coefficients = self.generate_polynomial(self.degree, self.secret)

    points = random.sample(range(self.finite_field), to_create)
    shares = [{'x': point, 'y': sum(coefficient * point ** n for n, coefficient in enumerate(coefficients))} for
              point in points]

    return shares

def tell_secret(self, shares):
    # doing a polynomial interpolation using the basic definition. sum y * l where l is the product of x - xi / xm - xi. x is 0 in our case
    xs = [share['x'] for share in shares]

    y = 0
    for share in shares:
        l = 1
        for x in xs:
            if x != share['x']:
                l *= (- x) / (share['x'] - x)
        y += share['y'] * l
    return int(round(y))

edit:
Reading wikipedia about the definitions of operators in a finite field, I've found this:

A particular case is GF(2), where addition is exclusive OR (XOR) and multiplication is AND.

AES uses a $GF(2)$ finite field, the Galois field $GF(2^8)$
So when my paper says: $\oplus$ they mean the addition operator for the finite field GF(2). This is confirmed by my test when doing an addition in my non finite field program.

edit 2:

As such I read this as doing a $GF(2^8)$ addition to all the shares. It is using the word XOR and I've read that it should be XOR in the finite field but when I do this in my testing program, I don't get the correct result. This seems to be because of at least one share having an y value which overflows with the addition.

edit 3:
So I've found the following lines in the referenced paper:

Our scheme maintains the same compatibility as Boolean masking with the linear transformations of the algorithm

So it seems that the paper proposes some kind of SSS mixed with boolean masking on an AES implementation. I still don't get it completely but I'm moving on and maybe if I come back to it later my understanding will have improved.


texts: Lsb as hard core predicate in a sign-hash scheme

texts:
Given a random oracle and a deterministic signature scheme.

Is the following $hc(x)$ an hardcore predicate of $H(SIG_k(x))$ ?

$$hc(x)=lsb(H(SIG_k(x)))$$

How would I get to think about this? I saw a few academic papers that mention this strategy. I don't understand why that can be a valid hard-core predicate.

Thank you for your time!


texts: How can we generate a shared key from two key pairs for an ECC implementation?

texts: This is the diagram of an ecc implementation here that needs to generate the shared key, how can it be done?


texts:
Are there any guidelines or justification for converting a stream cipher algorithm for use as a CSPRNG?

For instance, lets say I wanted to convert one of the eStream portfolio Profile 1 (software) selections for use as a CSPRNG. What I could do is generate a really unique hash from some other algorithm and use it as the key. Then I could generate another really unique, lets say 64-bits, and use it as the initialization variable. Now, what are my options? I could continue regenerating output blocks based on the cipher's internal variables. I could try to encode an incrementing counter into the block stream and then get the output. I could regenerate a key and (iv) and get the output again (seems costly).

I read that it's generally not smart to re-use the key on multiple encodings, so that makes me think I should just keep regenerating the first output block. Is the original output block by definition an unending random stream?


texts: Non-repudiation isn't a part of cryptography?

texts:
According to the "Handbook of Applied Cryptography" by Alfred J. Menezes, Paul C. van Oorschot, and Scott A. Vanstone (CRC Press, 1997; p.4):

Cryptography is the study of mathematical techniques related to
aspects of information security such as confidentiality, data
integrity, entity authentication, and data origin authentication.

My questions are: Why doesn't non-repudiation appear in that definition? Is it less important? Isn't non-repudiation one of the aspects of information security?


texts:
I've seen the term "witness" tossed around when talking about knowledge extractors, but I have no idea what it means. I can't find a definition.

What is a “witness” in zero knowledge proof?


texts: Any efficient text-based steganographic schemes?

texts:
While there are sophisticated and efficient steganographic schemes with images as cover available, I am yet ignorant of the existence of any fairly efficient and secure schemes with texts as cover. This state of affairs is IMHO unsatisfying, since the communication channel may under circumstances only be able to transfer printable natural language texts, and that in rather small volume, due to constraints posed by the warden.

To be concrete on the efficiency issue, I would desire that the ratio of stego bits to covertext bits be no less than, say, 1/50. For references to existing schemes, if any, or else novel basic ideas that could lead to the development of such a scheme (if possible  user-friendly and not too hard to implement), I should be very grateful.

[Addendum 1, edited] I have in the meantime a scheme named WORDLISTTEXTSTEGANOGRAPHY that should achieve a not large but IMHO practically nonetheless useful efficiency in the range of [0.5, 1.0] bit per word of natural language texts, requiring though that the user does some amount of trial and error work under the guidance of the software. (Use e.g. of an appropriate codebook could highly compress the input stegobit sequence.) The latest Version 2.1 of it, running on Python V.3.6.1, is available at my new home page: http://mok-kong-shen.de. See update notes in it for the differences to the earlier versions. (I regret in particular that in the earlier versions a sentence is missing in the explanation of how to do the examples, with the very unfavourable consequence that new users may fail to do the examples.)


texts: According to NIST SP800-108, there are three modes that can build KDF from PRF: counter mode, feedback mode and double-pipeline iteration mode. Assume that the same PRF and input distribution are used, will the three different modes make any difference on security strength of the resulting KDF? Here the security strength aims at the unpredictability of the output and the threat model includes side-channel attacks. Thanks.


texts: Given current technology such as GPUs and GPU cracking software I was wondering if anyone has an idea on how long it would take to brute force the key used to derive an HMAC?


texts: One-Time-Pad with key-reuse: Faster way of decrypting?

texts:
I know there are already of few questions about this and I'm working with the advices that were given but I still doubt my approach is the fastest, so I'd really appreciate if you helped me find a faster way.

What I want to do:
I have 2 encrypted messages (about 200 characters each in HEX) and I want to decrypt them. I know that the same key was used on both of them and that the original message is written in English (should be something about a book), so I attempted to crack it with crib-words (" the ", "the  ", "he  t" ..., same with " and ", " book " and " novel ") but I was only able to find two words so far ("guess" in one text, "the" in the other) which is kinda sad.

I made a little Java program (just in Eclipse) that's doing the following:

Get 3 Strings with the same length as input (text A, text B and the crib repeated over and over again)
Take 2 int, do A XOR B, take the next 2,... repeat until the end of the String is reached
Do the same thing with the result of A XOR B and the crib (in the same "for")
Output it as Hex

I'm then using a little applet to convert the Hex to ASCII.

I read that there's a way to get the positions of blanks which would be at least a little big helpful, but I didn't quite get how it works. Is there another method of getting a result faster?


texts:
Let $n$ be the modular arithmetic, $p$ and $q$ the two large primes such that $n=p*q$ and $e$ the public exponent. Here they are two "simple" numerical questions:

If $p = 13$ and $q = 17$, what is the range for exponent e?
Let be $p = 7$, $q = 11$ and $e = 3$. What is the max integer that can be encrypted?

About 1), I know that $e$ needs to be relatively prime to $φ(n)=(p-1)*(q-1)$, but how can I determine the range?

About 2), is there really a threshold on the maximum integer I can encrypt with RSA?


texts:
I am looking into an article about 32bit CPU/MCU software implementation of AES and there are some weird changes over there.
Like shift-rows.
It seems that the shift-rows in the 32bit implementation is shift columns instead.

So my guess is that the 32bit implementation returns different output than the 8bit implementation (the original).

Can you correct me ? or at least explain why it is still equal ?

The article : "Efficient Software Implementation of AES on
32-Bit Platforms"


texts: Mitigating the damage when a signing key is stolen

texts:
Let's say we have a server whose job is to sign documents using a private key. Let's say that there's a bug in the software and the private key gets stolen. I'm interested in mechanisms to mitigate the damage.

One thing you could do is have the server throw out keys as it goes.  Instead of giving a the server a single private key, you'd give it a sequence of private keys. The node signs doc1 with key1, doc2 with key2, etc. When it's done with a key, it throws out the key completely, so that key can't be stolen any more. There must be some mechanism to procedurally generate the sequence of keys, but I don't know the name of the technique to google it. Anybody know what this is called?

Are there any other cool techniques that can be used to protect the private keys?

I found a paper called "A Forward-Secure Digital Signature Scheme." I think I'm on the right track.

I'm still interested in the second part of my question, though: is there anything I can do besides forward secure digital signatures?


texts: Re-using parts of a one time pad to encrypt a new one?

texts:
The main problem with OTP's is the fact that they can only be used once.

Would it be possible to use a random number that's, say, 512 digits, then use 256 of those for the (non-random) message, the 256 remaining ones to send half of the new pad (to be able to send a message back), then re-use those last 256 to send the second half?

As far as I can see, the clear text is obviously obscured (exactly the same as a standard OTP), and the re-used part is also secure because of the fact that the encrypted information is random as well.

The big difference from a two / many time pad is that the re-used part never comes into contact with any predictable data; it's an entirely different part of the message. So, as far as I can see, you could say the OTP encrypts the 256 digits, just as well as the 256 digits encrypt the OTP (both are completely random). Therefore, there should be no difference between the security of this and the regular way of using OTP's. If you were to re-use the part of the pad that encrypted the plain text, you would be vulnerable with regards to a known plain text attack.

Of course, it's not that efficient, because if the random number that encrypted the first message is discovered, all future numbers can be discovered. But other than that it could be pretty fun.


texts: Hardness of LPN problem with small secret

texts:
The Learning Parity with Noise (LPN) assumption states that, for a fixed secret $s$ chosen uniformly from $\{0,1\}^n$, then the distribution that outputs $(a,a\cdot s+e)$, where $a$ is uniform in $\{0,1\}^n$ and $e$ is sampled according to a Bernoulli distribution $\mathsf{Ber}_\tau$ (with parameter $\tau\in[0,1/2]$), is pseudorandom.

My question is: Does the LPN assumption holds even if $s$ is chosen according to the same distribution as the error, that is, $\mathsf{Ber}_\tau^n$?

In other words, given $s$ from $\mathsf{Ber}^n_\tau$, is the distribution $(a,a\cdot s+e)$ pseudorandom?


texts: What exactly is a negligible (and non-negligible) function?

texts: The mathematical definition of neglible and non-neglible functions is fairly clear-cut, but  why they are important and how they are used in cryptography?


texts: Threshold Encryption Scheme for Multiple Messages

texts:
In a threshold encryption scheme, a dealer generates $(PK,SK1,…,SKn)$ and distributes the secret keys to users indexed by $1,…,n$, and if a combiner obtains $t+1$ partially-decrypted ciphertexts, it can retrieve a plaintext.
When only for one message $M$, we can first use public key $PK$ to encrypt $m$ and get $C$, then use $t$ private key fragments $Ski$, $i∈[0,…,t]$,  to partially decrypt the $C$, which named $SKi(C)$($i∈[0,…,t]$), and then perform some operations on the $t$ results to restore the original Message $M$. For this situation, $(t,n)$-threshold Paillier scheme is feasible.
But when we have multiple messages $Mi$, $i∈[0,…,t]$, we also use the $PK$ to encrypt them separately, which named $PK(Mi)=Ci$, $i∈[0,…,t]$, and we define that each message can only be partially decrypted using the corresponding private key fragment, like $SKi(Ci)$, $i∈[0,…,t]$. In this case, can we use these decrypted results to restore each original message $Mi$($i∈[0,…,t]$) or get the sum of all messages $∑M_i $ ?


texts:
Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which results in the same hash value. What I need is an explanation of a successful attack on a real hash function.

I have read lots of articles (from journals - especially Lecture Notes in Computer Science) on successful second-preimage attacks on some cryptographic hash functions but my mind can't get to grasp it properly.

What I need is a practical example (with explanation please) of a second preimage on MD4 using the attack developed by Wang et al in their paper "The Second Preimage Attack on MD4" (alternate link)

Edit(1): Or, better still, can I have an explained example of a second preimage attack using the attack presented by F. Mendel et al. in the paper A (Second) Preimage Attack on the GOST Hash Function
I'm desperately in need of some kind of simple step-by-step practical example of a successful attack.

Edit(2): Going back to the second preimage attack on MD4 based on the paper above, a working example is given (Table 2 on page 9 in the paper). I can leave out trying to understand the transformation from the target message M_0 to the weak message M, what I really need is some kind of step-by-step explanation of how the second-preimage M' was discovered using the method given.
Please, I am new to cryptography, so an explanation of this example (or any other for that matter) is what can enable me understand this faster and better.

Thanks in advance.


texts: Why does GPG ciphertext length differ with fixed plaintext length?

texts:
Thank you for your reply.
Based on your inputs. I was investigated further, find details below

Step 1) Input string for encryption is UUID format
Input data = c0c6f311-a793-4d65-9374-1c0e45f5382c
Length  = 36 bytes
Step 2) encrypt UUID with gpg command
    gpg --encrypt -r  PublicKey c0c6f311-a793-4d65-9374-1c0e45f5382c
Step3) encrypt gpg output using base64 command
    /usr/bin/base64 -w 0  gpg-encrypted-data(step2 output)

I had been ran same 36 bytes input data (c0c6f311-a793-4d65-9374-1c0e45f5382c) continuously(90000 times)  using step2 and step3, observed below possible outputs

1)gpg encrypted 36 bytes input data to 389 bytes  and base64 encrypted 389 bytes input data to 520 bytes   --  89996 times out of 90000
2)gpg encrypted 36 bytes input data to 387 bytes  and base64 encrypted 387 bytes input data to 516 bytes   -- 4 times  out of 90000
3)Able to decrypt the 516 0r 520 bytes encrypted data with orginal Input text(c0c6f311-a793-4d65-9374-1c0e45f5382c)

Please find some of the base64 command outputs gathered from above execution.
    520 bytes output last few characters
1)  LG1bEwdUt3Sh6ea6cUrDk=
2)  Gwpr0kClWzllff6KgNo=
3)  FLyCFDlMDQD6GiKJITBIjg=
4)  NbJ6y3mayCiWN8yZ9HQsJV+KQ=

516 Bytes Output
1)  JpTKn/7yS/0JBhH9TVTRxRNwhmh
2)  Vzlo7c2zH2y3kB3PK+ihAyBfA
3)  ZlvAgKJQFe39+IT6giO1nQxZcwkX

I have few more questions above execution

Q1)  padding is happenings both encryption level(i.e  gpg, base64)
Q2) is there any way to handle fixed length encryption?
Q3) is there any way to remove padding encryption in both levels(i.e gpg, base64)?
Q4)Actually we are assuming that base64 encryption happening with 520 bytes, even above execution also 99% encrypted with 520 bytes. Is there any way to padding 516 bytes encrypt to 520 bytes encryption?


texts:
El Gamal encryption involves picking $(p,g,b)$ which is our public key. We compute $b=a^x$ $mod$ $p$. Here, $x$ is the private key which we don't know.

What are some efficient and strong algorithms today used to finding this $x$?

I am currently dealing with numbers such as $b=42-60$ digits long and $p=30-50$. So $b$ is anywhere between 42 and 60 digits.

Does anyone know of any program and some attacks to finding this $x$ using our given information?


texts:
Given a set of pseudorandom functions $F=\{f_s^i\}_i$ for each $s\leftarrow\{0,1\}^n$ generated at random; moreover each $f_s^i$ uses a specific PRG $G^i:\{0,1\}^n\to\{0,1\}^{2n}$, where:

$G^i(s)=x_1\dots x_nx_{n+1}\dots x_{2n}$ and $G_0^i(s)=x_1\dots x_n$ and $G_1^i(s)=x_{n+1}\dots x_{2n}$
$f_s^i(1)=G_1^i(s)$
$f_s^i(0)=G_0^i(s)$

Given $f_s$ from $F$, let us define some new $f_s'$ and $f_s''$ respectively for a PRF $F'=\{{f_s^i}'\}_i$ and $F''=\{{f_s^i}''\}_i$ as follows:

${f_s^i}'(x)=f_s^i(0x)f_s^i(1x)$
${f_s^i}''(x)=f_s^i(0x)f_s^i(x1)$

I want to check if ${f_s^i}'$ and ${f_s^i}''$ are pseudorandom. So, since  a PRF is defined as $f_s^i(x_1,\dots,x_n)=G_{x_0}^i(\dots G_{x_n}^i(s)\dots)$, then in the first case I would have that:

$${f_s^i}'(x)=f_s^i(0x)f_s^i(1x)=G_0(G_x(s))G_1(G_x(s))=G(G_x(s))$$

so, given $s$ random $G_x(s)$ is random, then ${f_s^i}'$ is a pseudorandom function. So, is the first proof correct? Could I apply the same reasoning even in the second case? Thanks in advance.


texts: RNG failing Restart Tests by NIST SP800-22?

texts:
I have data sample of 1,000,000 bytes generated by a hardware RNG. The device is certified by ENT test suite, NIST SP800-22, DIE HARDER and TestU01.

I have tested my sample by SP800-90B_EntropyAssessment (github.com/usnistgov/SP800-90B_EntropyAssessment). Minimum Entropy Estimate is 7.88237 after which I run Restart Tests.

My sample fails at Restart Testing and the program displays

  Validation Failed, No Entropy Estimate Awarded.

“Analysis and Improvement of Entropy Estimators in NIST SP 800-90B“ (PDF) says

  Randomness has three features: unpredictability, unbiasedness and non-repeatability and and the non-repeatability is validated by restart tests.

I want to know if my RNG is failing Restart Tests, does it mean it offers no entropy at all?


texts: How to map output of hash algorithm to a finite field

texts:
I would like to know an algorithm hash to a finite field.
I have an $l$ bit prime number $q$. I want setup a hash function $H: \{0,1\}^* \to \mathbb F_q$ but I do not know how I can do it.
I use a library for a hash with C++, this is cryptopp.
I find an answer at  Right way to hash elliptic curve points into finite field but I don't understand.
Does anyone help me know what to do?


texts: How can I calculate the SHA-256 "midstate"?

texts:
Recently I've been trying to implement some Bitcoin-related code, and I've stumbled upon a weird concept, a SHA-256 "midstate". Some explanation is given here.

The general concept is that Bitcoin relies on performing SHA hashing of a 128 byte data chunk many times, but only the second half of that chunk changes. This is why the concept of "midstate" is used. As I understand it, in order to perform SHA on 128 bytes of data, one needs to divide the hashing into operations on first and second 64 bytes of the data. As results of first hashing are constant, one would save them as this "midstate", and before hashing the changed second half of bytes, one would restore the "midstate" instead of calculating it again.

Can anyone explain how would I calculate this "midstate" having a library that calculates a whole SHA-256 hash, or alternatively which libraries support calculating of something like that?


texts: Parallel Pollard's Rho: Number of distinguished points

texts:
When using the parallel version of Pollard's Rho algorithm for discrete logs, each processor performs its own random walk to find distinguished points, and reports the starting point and the distinguished point to the server. If two processors report the same distinguished point, then the server can re-do the random walk and find where the collision occurred and solve the discrete logarithm.

The average number of steps each processor must perform before finding a distinguished point depends on the number of distinguished bits. On average it is $2^d$ where $d$ is the number of distinguished bits.

If the attack is being run on systems with lots of slow processors (e.g. 100,000 GPUs each with thousands of threads), then its possible to come up with the required number of distinguished points without each processor coming close to $2^d$ iterations.

Suppose we have a 128-bit discrete log problem. We need ~$2^{64}$ group elements to solve it. We can do this with $2^{32}$ distinguished points with $32$ distinguished bits.

Suppose we are using a 50 billion processors that each do 20 steps per second (generate a trillion points per second).

So that is ~$2^{40} (\dfrac{1}{2^{32}})$ = $256$ distinguished points per second.

It will take about 194 days to find $2^{32}$ distinguished points.

But if each processor only walks $20$ steps per second, then each processor could only have walked at most $335,232,000$ steps, far less than the expected $2^{32}$.

That means each distinguished point reported to the server represents at most $369,782,000$ steps taken. So the total number of points between the starting points and distinguished points is far less than $2^{64}$

Question:

Does this mean it will require far more than $2^{32}$ distinguished points?

I think it will because the total number of points reported isn't enough to make a collision probable. We could say that each distinguished point represents $2^{32}$ points, but since the walks were so short, its more likely that any collision was the result of one random walk stepping into the starting point of another random walk, in which case the collision is useless (they call this a "Robin Hood" in the literature).

I think Parallel Pollards Rho favors a few very fast processors over many slow processors. Or many slow processors with short walks (fewer distinguished bits, more distinguished points) and lots of storage.


texts: Proof that perfect privacy implies that the number of keys is at least the number of messages

texts:
I was reading a proof to the statement:

  Perfect privacy implies that $|K| = |M|$

where I am pretty sure that $K$ is the set of keys and $M$ is the set of messages.

The proof is the following, but I don't understand it (maybe because of the notation).

  Assume not, i.e., assume we have fewer keys than messages.
  Given a ciphertext $c$, there is a message $m$ and a key $k$ such that:

  $e(k, m) = c$, and $p_{k \in K}[e(k, m) = c] > 0$

  Let $P_c = \{ m \in M$ such that $e(k, m) = c$ for some $k \}$

  Since every $k$ maps exactly one message $m$ to $c$, and since we have fewer keys than messages, then there is an $m'$ not in $P_c$ such that no key $k$ maps $m'$ to $c$.

  Therefore $P_{k \in K}[e(k, m') = c] = 0$, which violates the perfect-secrecy condition that for all m and $m'$, $P_{k \in K}[e(k, m) = c] = P_{k \in K}[e_k(k, m'). = c]$.

where $k \in K$ means that $k$ is a key in the set $K$.

The first thing that I don't understand is the following notation: $p_{k \in K}[e(k, m) = c] > 0$. What exactly does this mean? Does $p$ refer to the probability?

I understood the following statement:

  Since every $k$ maps exactly one message $m$ to $c$

It makes sense that a function should just output one result for the same inputs.

  Therefore $P_{k \in K}[e(k, m') = c] = 0$

Does this mean that the probability that we encrypt $m'$ using $k$ results in the cipher $c$ is equal to $0$ because, as said before in the proof, $m'$ is a message that has no key $k$ that transforms it into $c$? If yes, I am still not 100% convinced.

  which violates the perfect-secrecy condition that for all m and $m'$, $P_{k \in K}[e(k, m) = c] = P_{k \in K}[e_k(k, m'). = c]$

If we assumed at the beginning that $p_{k \in K}[e(k, m) = c] > 0$, that the statement above makes also sense.

Again, I don't get the part of assuming $p_{k \in K}[e(k, m) = c] > 0$ (apart from the fact that I am not sure if $p$ should be $P$, i.e. if it is just a typo, and if $P$ (or $p$) refer to probabilities, as I was wondering above).

Moreover, I think the proof is not showing the case when the number of keys is greater than those of the messages.


texts: Can anyone explain to me the difference between the OTP (one-time pad) and Vernam Cipher?

texts: I heard they are very similar, although there are subtle differences between the two.


texts: Are there any noisy homomorphic encryption schemes?

texts:
Are there any Homomorphic Encryption(HE) schemes that result in noisy answers ? By noisy i mean , the answers could be approximately near the actual answers by noise factor $\epsilon$.

For example , we could get $dec_{sk}(eval_{pk}({enc_{pk}(5) + enc_{pk}(10))) = 16}$ where as the real answer is 15. Here $enc,eval,dec$ are functions of an HE scheme and $sk,pk$ are private and public keys. The scheme could be Fully HE or Semi HE or Partial HE


texts:
Recently I've been delving into security algorithms, I already knew some of the (easy) math behind AES and RSA and how to and not to implement it. But well, i got a bit bored so i thought I'd just do something fun and i wrote a small bit of code for the OTP (not so difficult)

then i thought, and this concerns my question: If you give someone a OTP key and you tell him that the (say SHA 256) hash of the previous plaintext will be the new key, how secure is this? Obviously you start with a perfectly random key an will never make your plain text longer than your key. (so a proper one time pad function)

So you have a key, you decrypt the cyphertext you get, then you hash the retrieved plaintext and this has will be the key for your next message. In my mind this would be as secure as the OTP when starting with a proper key. But then again my mind isn't really suited for simulating real applications, haha.

So does anyone have an idea on how secure this would be?

EDIT i might want to clarify your next plain text will of course be as long as the generated  hash, if you need to write a longer message you will use the hash of your newly typed plain text, and so on.


texts:
I need to encrypt an ASCII string [a-zA-Z0-9:] to an ASCII [a-zA-Z0-9] string of the same length. It doesn't have to be unbreakable, it's sufficient that it won't be readable at the first sight.
The purpose is to encrypt my WiFi hotspot name with a key so that only my friends holding the key can decrypt a message from the hotspot name.

I might need XOR encryption that will guarantee that the output will be ASCII.
Or I can simply have a numeric key and add the corresponding key number to each ASCII code of the char of the hotspot name.

What would you suggest?


texts: Recovering a secret that has been blinded several times

texts:
I'm analyzing a protocol that, during one of the steps, sends a blinded secret. Let's denote the secret $x \in \mathbb Z_p^*$ (for $p$ prime) and the blinded secret $y$, so that $y = r\cdot x \bmod p$, where $r$ is a blinding factor randomly sampled from $\mathbb Z_p^*$. We can assume that the blinding factors won't repeat.

Several runs of the protocol would produce several $y_i$ values, with the same fixed secret $x$:

$$y_1 = r_1 \cdot x  \bmod p$$
$$y_2 = r_2 \cdot x  \bmod p$$
$$...$$
$$y_n = r_n \cdot x  \bmod p$$

Knowing only the $y_i$ values, what would be the best algorithm to retrieve $x$?


texts: Is signing a message just encrypting it with private key?

texts:
I have a simple question,

When I sign a message (in RSA) does the program encrypt the text with my private key?

Because I can decrypt it with my public key.

Yes or no.
Is signing a message just encrypting with private key?


texts:
Question: How to determine the RSA Private key size from the Public.key file? Just roughly, how big it could be?

$ ls -la Public.key
    -rw-r--r--. 1 user user 498 Sep  4 15:31 Public.key
    $

The Public.key was generated using the Java API (which defaults to the X509 SubjectPublicKeyInfo structure with embedded PKCS#1 public key in a BIT STRING).


texts: In ARX construction like Salsa 20, why xor operation is required? That is why AR is not sufficient? Note that xor is a linear operation.


texts: Diffie-Hellman: Calculating the private key from the public key with Java

texts:
I have the task to calculate the private key from the given public key and have the hint that the secret exponent lies in the range from $-2^{31} < e < 2^{31}$.

To find the exponent I calculate a public key and compare it to the given key.
$$k_{pub} = 2^{e} \bmod {prime}$$ I start with $e = -2^{31}$ and then iterate my way up until I should find the $e$ where my calculated key equals the given public key. The problem is that it takes really long (about 20 days, if I calculated correctly).
Is there a way to make it faster?

import java.math.BigInteger;

public class task {

        public static void main (String[] args) throws java.lang.Exception
        {

            BigInteger prime                = new BigInteger("FFF....FFF", 16);
            BigInteger BobPublicKey         = new BigInteger("b54.....da6", 16);

             BigInteger tmp = new BigInteger("0");

             BigInteger j = new BigInteger(new Integer(Integer.MIN_VALUE).toString());
             System.out.print("Starting to guess Bobs secret: \n" + j + "\n");

             while ( !(tmp.compareTo(BobPublicKey) == 0)){
                 tmp = BigInteger.valueOf(2).modPow(j, prime);
                 j = j.add(BigInteger.valueOf(1));
                 System.out.print(j + "\n");
             }

             //correct for counting 1 too far in while loop after the actual e was found
             j = j.add(BigInteger.valueOf(-1));

             System.out.print("Bobs secret was: " + j + "\n");

        }
 }


texts: What adequate tools are available for estimating entropy?

texts:
This question seems to touch on the apparent fact that NIST SP 800-90B is not suitable for estimating entropy produced by sources that are not uniform, despite being IID or non-IID.  It also seems that most phenomena for producing entropy are not uniform.  If that's indeed right, then naturally one wonders what adequate tools are available for estimating entropy?
Clarification.  The question is asking for tools like NIST SP 800-90B.  What programs are out there that are ready to use, hopefully with a publication to introduce it?  It seems only NIST SP 800-90B is available.


texts: How different is SHA-512/224 when compared to SHA-512?

texts:
I understood from the NIST SHS specifications (FIPS 140-4) that the difference between SHA-512 and SHA-512/224 the two differences are the initial hash value and the final result truncation
I changed the initial hash value of SHA-512 to that one of SHA-512/224 as specified in the SHS specifications and then built the CAVS tests. Then I started testing against the copied CAVP test vector.
Lets consider the first case:
Len = 0
Msg = 00
MD = d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f

But the result I am obtaining for the above input is:
SHA512/224 digest
     6ed0dd02806fa89e25de060c19d3ac86cabb87d6a0ddd05c333b84f4

Lets consider the second case:
Len = 8
Msg = 84
MD = 3cd36921df5d6963e73739cf4d20211e2d8877c19cff087ade9d0e3a

But the result I am obtaining for the above input is:
SHA512/224 digest
     8f8fdcb3f617a2d809b3132860b02fee00bdd927d541d42073dd12e7

What am I doing wrong?


texts: Is it better to maximize memory usage or number of passes with Argon2i 1.3?

texts:
I wrote a small application that uses Argon2i for deriving symmetric  keys for encryption of local files and secret Curve25519 keys. Argon2i v1.3 is susceptible to TMTO attacks if the number of passes is below 10, according to the most recent paper  I could find: https://eprint.iacr.org/2016/759.pdf

Ideally, of course, I would increase both. However, I am trying to find parameters that maximize security on a variety of machines, some of which are limited by CPU much more so than by RAM, such as old laptops. Let's say  I am aiming for a computation time of around 10 seconds. I can use much more RAM if the number of passes is 3, which is the minimum recommended for Argon2i. However, this appears to allow a TMTO attack that reduces that RAM usage according to the paper above. If  I increase the number of passes to > 10, I must use much less RAM to achieve the same computation time, however, the TMTO attack above does not apply.

On fast CPUs, increasing the number of passes is not a big problem because I can still use a lot of RAM. On slow CPUs, it can be much more significant. As a practical example, I tried this on a T23 ThinkPad. The results are below.

Tcost=3 Mcost=128 MiB Parallelism=1
Computation time: 10 seconds

Tcost=11 Mcost=40 MiB Parallelism=1
Computation time: 10 seconds

Given the most recent TMTO attacks in the Alwen-Blocki paper above, does an attacker with a GPU gain more of an advantage attacking the first example or the second? What about an ASIC?

For reference, here's Argon2d with only 1 pass and a target of 10 seconds

Tcost=1 Mcost=448 MiB Parallelism=1
Computation time: 10 seconds

(I am strongly considering going to Argon2d)


texts: Is there a CSPRNG capable of generating a large sequence of numbers from a single seed?

texts:
In my CS course i am in dire need of a CSPRNG that can create N numbers starting from a single key.
Something like this:

CSPRNG(x):
Input 64 bit int;
Output Array of CSR 64 bit Ints;

Does something like this exists? Which ones?
Or is almost every CSPRNG like this?


texts: Is there any way to decrypt RSA ciphertext $c = m^e \bmod n$ when $\gcd(p-1,e) > 1$?


texts:
I received a representation of a point on an elliptic curve $GF(2^m)$ (with curve coefficient A, B) in specific format and some description how to decode it but not all is clear to me. I would be appreciate to someone to explain some issues to me.
So I have an array of the bytes $\tilde{P}$ (array's size equal to m) and to get a point $P= (x_p, y_p)$ from it I need to do the following:

If  $\tilde{P} = 0$, we set $x_p=0, y_p=\sqrt{B}$, and then go to step 7
We take the right byte $k$ of the $\tilde{P} = (\tilde{P}_{m-1},..., \tilde{P}_0)$, i.e $k = \tilde{P}_0$
We set the the coordinate $x_p$ of the $P$ point as $x_p = (x_{p, m-1}, ... , x_{p,1}, x_{p,0}) = \tilde{P}$ and then make $x_{p,0} = 0$. But if trace $tr(x_p)\neq A$ we set $x_{p,0} = 1$
Calculate $w=x_p^3 + A x_p^2 + B$
Solve the equation $ z_2 + z = v, v = w x_p^{-2}$
If trace $tr(z)$ of the solution $z = (z_{m-1},...,z_0)$ is equal to $k$ then we take $y_p = zx_p$,  otherwise $y = (z+1) x_p$
The result of the calculation is a point $P = (x_p, y_p)$

So the first (1) item above is clear absolutely :)

Second (2) item is clear and the trouble begins from (3) item because i need calculate $tr(x_p)$ operation to determine $x_{p,0}$: it can be 0 or 1 here.
How could i calculate the $tr$ ? Can i use any simplifications?

(4), (5) are clear as well

In (6) we need to calculate $tr$ again, but in my case the right byte $k$ from  $\tilde{P}$ equal to 40 !!! (not to 0 or 1)

So my question is whether can i utilize mentioned instructions to restore point or maybe it has mistakes in description??


texts: Algorithm for factoring a number $n$ of a specific form given $n$ and $\varphi(n)$

texts:
Given the natural number $n$, which is in the form $p^2 \cdot q^2$ with $p$,$q$ prime numbers. Also $\varphi(n)$ is given. Describe a fast algorithm (polynomial time) that calculates $p$ and $q$. Apply your algorithm to calculate $p$ and $q$ when $n=34969$ and $\varphi(n)=29920$.

I found this problem on a mathematical competition on cryptography. I  tried to find a solution alone and on the internet and I didn't succeed anywhere, can we find a solution?


texts: Security of non-standard use for AES-256-CTR?

texts:
I have a string secret that I would like to encrypt for storage in a Yubikey's second slot. These slots can be configured to store up to 38 characters that are later "typed" by the USB device acting as a keyboard. This means it can't store raw bytes, but fortunately it's sufficient for my use case for my secret to consist of 38 base64 characters.

Using a strong password, I'd like to use OpenSSL v1.0.1+'s implementation of aes-256-ctr to encrypt the secret for storage on the Yubikey. I am asking about using a counter cipher rather than an alternative because I need for the output to have the same number of bytes as the input. I also need to decode the input from base64 first so that it's using the bytes efficiently, and then encode it as base64 again after the encryption so that the result can be "typed".

echo -n "secret+that+is+exactly+38+base64+chars" | \
openssl enc -base64 -A -d | \
openssl enc -base64 -aes-256-ctr -nosalt -k "this will be a strong password"

Is this a secure way to store my secret? Would it be safe to, say, post the encrypted secret on the public Internet? I'm not planning to, but I also don't want to have to be constantly vigilant about the physical security of the Yubikey itself.

Edit: Thanks for the answers and comments! I apologize for having left some things ambiguous initially, but my lack of domain knowledge made it difficult to know what's relevant. Here are some clarifications:

The Yubikey functionality I'm using is called Static Password mode. While the Advanced configuration for this mode can contain 64 modhex characters, the user cannot choose the password so this does not match my use case. The alternative is the Scan Code configuration which can store up to 38 ASCII 256 characters. I can select either US or DE keyboards in the Yubikey Personalization Tool that I'm using to configure the device; as I understand it, this determines the scan codes that are emitted to correspond to my saved password, and a US keyboard will work for me. I realize this is 4x the different characters I get from base64, but since I was able to get something that seemed to work as-is, I didn't try to convert the encrypted bytes to ASCII 256 for more efficient storage. Links: Yubico knowledge base, PDF documentation (see page 25), scan code explanation.
The secret I'm planning to encrypt and store is a 1Password Secret Key, so it will have 128 bits of entropy. (I removed some dashes to make it fit the 38 characters, and converted the remaining dashes to pluses.) I'm trying to set up a recovery plan that is more accessible than a piece of paper in a safety deposit box, and more secure and durable than a piece of paper in my wallet. I omitted this detail from my original question because it seemed like a distraction, but I see now it's relevant to certain types of attacks.
I was planning to use a proper diceware password with at least seven words. If I use ten for 128 bits, is my original proposal sufficient?
I'd love to find a way to make this work securely with the standard tools in OpenSSL. Part of the reason for this is that other tools (such as argon2) seem a bit over my head / beyond what I can trust myself to use properly. Most of the reason, however, is that I want to use tools that are at least somewhat universally accessible so that I'm able to decrypt my 1Password Account Key and recover from hardware loss in the widest variety of possible circumstances (i.e. if I'm abroad without my laptop). One appealing thing about OpenSSL ciphers is that there are Javascript implementations that I could use on a trusted iPhone to do the decryption, obviating the need to install and use OpenSSL on some unknown machine. I was able to get the above encryption/decryption to work using Forge, for example.


texts: What should I think about these unique certificate serial numbers

texts:
I  was looking at the serial numbers of the certificates for www.google.com and wordpress.com.  Wordpress was listed by openssl as:

04:0B:D4:F8:25:88:C5

This serial is listed as the serial for both my specific wordpress.com domain and for www.wordpress.com.  A google search using the serial number as a keyword shows only my wordpress.com domain (because I pasted the serial number into one of my pages) in the results.  I would expect to find  other hits on Google.

The site www.google.com was listed by openssl as:

5F:BB:FC:7C:4C:6E:FF:92

That serial number, in a google search, showed up with only two listings, mine (Because I again pasted the serial number into a page) and cryptostorm.org.

I would think these numbers would have been put on the google search engine, and yield (probably) many hits.

@cpast:  I'm not downvoting your answer, but I need a better one.  I can see that google indexes the serial numbers and that is obvious if you type or copy the serials I've provided (above) into the google search bar. Using fingerprints as a search term, I can normally see many items in a search result.

And - I know people often cut and paste whole certificate info pages from Firefox, and put them into forum posts, where they ask "What's this?" or "Why's this?"

Additionally, the statement that nobody cares seems silly. One of the first items in the certificate is the serial, and certificate revocation lists are indexed by certificate serial numbers. Those serial numbers are very important.  Your answer seems trollish.  Anyone else?

@SOJPM: Serial numbers are unique within a CA.  This serial number (e.g. Wordpress) - is supposedly used by hundreds of thousands of Wordpress associated domains.  It should have google indexed data associated with it. Unless I have a "special" one.

@cygnusv: No offense taken.

@all: Why can I edit cpast's comment? I'm new to stackexchange.  Seems odd.

@SOJPM: Thanks, and yes that's what I meant.

@truthserum:  Here's the expiry:

issued  on            : 2014-04-14 18:09:05
  expires on            : 2015-10-14 11:29:26

So, it's been around awhile (if what I see is valid) and should have been the cert for a lot (millions?) of users.  I'm not sure how many users WP has.

Maybe someone else can dump the cert or look at the Firefox Cert GUI - and see if the serials match what I have?


texts: Hash algorithm for converting n-bit number into another n-bit number

texts:
So I'm new to this area of Stack Exchange, and to cryptography in general, but I just wanted to ask this question here to see if I could get any advice. I don't understand a lot of the technical jargon used around here, so go easy on me.

I'm programming something where I need to use a hash algorithm to convert a 96-bit number into another 96-bit number. No, it's not for passwords, and it doesn't really need to be super secure. Actually, it's just for generating a unique UUID for each level a player creates in a game. The original 96-bit number contains the user's MAC address, the timestamp when the level was created, and a pseudorandomly generated number. To me it seems a bit weird to have a level's UUID traceable back to the timestamp and the creator's MAC address (and possibly a minor security risk for the latter, from what I get at), so I decided on using a hash function to obscure that information.

However, most hash functions take an input of indefinite length and return an output of predetermined length, which in most cases is not 96 bits. I need a hash function where I can specify the length of the output. Preferably, the function would require an input of that same length. Why is that? Well, however rare they may be, the possibility of hash collisions is a given for functions that take an input of indefinite length. If my function were to take an input with a length of 96 bits and return an output with a length of 96 bits, a one-to-one mapping could be created between the inputs and outputs. Again, I don't know a huge deal about cryptography, so I have no idea if creating a function like this that is completely immune to hash collisions is even possible, but I would like to try to avoid them as much as I can because of my requirement for uniqueness.

Thanks in advance for the help.


texts: Is it safe to use a random numbers instead of a counter in ChaCha20?

texts:
Besides the IV, ChaCha20 takes a random number and a counter as input.

I couldn't find more precise information about this but it seems to be that the counter is just a safety measure in case of a bad the PRNG.

If the user has a good PRNG, would it be safe to use another random number instead of a counter in ChaCha20?

In some applications, such as P2P networks with a flooding protocol, this can be useful so I would not have to keep all these counters in memory.


texts: Hardness of $SIS$ and its reduction to an NP-complete problem

texts:
Short Integer Solution ($ SIS_\gamma^{(q,n,m,\beta)}$): Given a matrix $A\in Z_{q}^{n×m}$, find $x \in Z^m $, such that $Ax=0\mod q$ and $||x|| \le \beta$

Is $SIS\in NP$ ?

If $SIS \in NP$, then it should be reduced to any NP-complete problem.

Is there any reduction from $SIS$ to a Hamiltonian cycle?


texts:
The following table specifies a cryptosystem based around a very simple encryption algorithm with four different plaintexts A, B, C and D (one corresponding to each row) and four different ciphertexts A, B, C and D. The encryption algorithm has five different keys K1, K2, K3, K4, K5 (one corresponding to each column). By writing EK(P)=C to mean that the encryption of plaintext P using encryption key K is C, the entire cryptosystem is defined as follows:

EK1(A)=B   EK2(A)=B   EK3(A)=D   EK4(A)=A  EK5(A)=C
EK1(B)=C   EK2(B)=C   EK3(B)=B   EK4(B)=B  EK5(B)=D
EK1(C)=D   EK2(C)=A   EK3(C)=A   EK4(C)=D  EK5(C)=A
EK1(D)=A   EK2(D)=D   EK3(D)=C   EK4(D)=C  EK5(D)=B

I am getting conflicted on this question. To me the key space should be 5. But some articles I've read say you do do k^2. If this was the case it would be k^5 = 32. Does it change how you compute this based on the algorithm or? I'm stumped.

This is not school related. I'm just wanting to learn some security and failing lol


texts: Why equation Y^2=X^3 +AX+B can't work with finte field of charateristic 2?

texts: I know that we can't define $dx/dy$ with this equation because $2y = 0$ with finite field of charateristic $2$. But with $GF(2^n)$ (has characteristic by $2$) $2=x$ not $0$. Do I misunderstand here?


texts: What's the utility of the last two messages of Needham Schroeder Symmetric key protocol

texts:
The protocol works like this

But I can't understand what's the utility of message 4 and 5, what do they protect from?
They do not protect from replay attack if Ks gets compromised because B won't be aware anyway of its freshness.
Wikipedia says that Bob sends Alice a nonce to show that he has the key, and Alice sends back a modification of it to show that she has the key too.
Isn't it obvious that she has the key if she sent it to Bob previously?
Or is it just a sort of acknowledge (which kind of surprise me because it would be the first time I see it in these protocols)


texts: Using Viterbi algorithm to decrypt Vernam cipher

texts:
I'm reading a book on cryptography and it mentions the Viterbi algorithm being used to decrypt Vernam cipher if the same key is used multiple times.

According to the book the Viterbi algorithm takes a weighted directed graph whose edges are labelled by letters and the weights correspond to transition probabilities.
Given a starting vertex and a word it returns the highest probability path starting from this vertex and such that the edges passed are labelled by the letters of the word in order.

I have three cipher texts that have been obtained by using the Vernam cipher with the same key.

I'm guessing the edges should represent the cipher text and the vertices should represent the clear text but I cannot figure it out.


texts: Is a large random number cryptographically equivalent to the product of multiple smaller ones?

texts:
Say I create a 256-bit key by taking a random number between $0$ and $2^{256}-1$.

Would it be cryptographically equivalent to generate $8$ numbers $r_1\dots r_8$ between $0$ and $31$, and combining them in the following way?

$$\mathit{rand} = 2^{r_1} \cdot 2^{r_2} \cdot 2^{r_3} \cdot 2^{r_4} \cdot 2^{r_5} \cdot 2^{r_6} \cdot 2^{r_7} \cdot 2^{r_8}$$

It would still add up to 256th power, but would it be secure of generating it this way? If not, then how to do it, how to generate big random number by combining smaller ones?


texts: Does adding a random number to my data make it secure?

texts: Say I have some real valued data that i want to keep secure. Now I have to pass on some modified version of the data to a second party for some computation, but i do not wish to reveal my data to the other party. If I add a value generated by a pseudo-random generating function to my data and then pass it on, does my data stay secure?


texts: NIST LWC finalists (AEAD) vs ChaCha20-Poly1305

texts:
NIST LWC finalists announced. My question is that how finalists are faster or slower than current golden lightweight AEAD standard -- ChaCha20-Poly1305.
Some benchmark among chacha20-poly1305 vs LWC finalists?


texts: Fast Symmetric Encryption Algorithms: My Options

texts:
Basically, the question above...

I'm trying to implement encryption on the server, and I have another webserver that I can share a secret key with via TLS/SSL/HTTPS, so I do not really need asymmetric encryption.

There are many many different algorithms, but I'm looking for one that has balanced encryption and decryption performance since I'm gonna do both on the server...performance-wise, what are my options?

Thank you.


texts:
I have a ciphertext, that is encrypted using 3-DES.
I wondered, why is it possible to decrypt it using 1-DES.
1-DES key is shorter than 3-DES that is used. How does it work like that?


texts: The Probability to Detect or Identify an Unknown Ciphertext

texts:
Let $\it C$ be a ciphertext such that we have no information about the type of symmetric encryption algorithm used to generate $\it C$.
Let $\bf S$ be the source bank of most block and stream ciphers such as AES,DES,RC4 and so on. Let $s \in {\bf S}$.
Question:
Is there an algorithm, software, or method (especially based on deep learning or machine learning) that receives $\it C$  and $s$ as input and the output is the probability that  $\it C$ is encrypted by $s$?
Thanks for any help such as paper or thesis.


texts: Showing that $2^{N-1}\equiv1\pmod N$ when $N=2^p-1$ for prime $p$

texts:
I got this question on a previous exam and I got it wrong. I've gone back through it several times since then, but I can't seem to get it. I would really like to know how to do it, so if someone could give me a step by step walk through (answers included), I would really appreciate it! Thanks! The question is the following:

Let $p$ be an odd prime number and $N=2^{p}-1$. The goal of this problem is to show
   that $2^{N-1}$ is equivalent to $1 \mod N$, namely that $N$ passes the Fermat primality
   test for $a=2$. [Note: This doesn't mean that N is necessarily prime. For example,
    if $p=11$, $N=2047=23*89$ and if $p=23$, then $N=8388607=47*178481$.] Then, do the following:

a) Explain why $2^p$ is equivalent to $1 \mod N$ is true

b) Show that $N-1$ is equivalent to $0 \mod p$

c) Use parts a and b to show that $2^{N-1}$ is equivalent to $1 \mod N$


texts: Nonce for AES GCM to prevent replay attacks

texts:
I am wanting to encrypt a message with a pre shared key that uses AES GCM from the OpenSSL library to do so.

I generate my key for the AES crypto via hashing my pre shared key with a salt using the PKCS5_PBKDF2_HMAC_SHA1 function which gives me a key of 32 bytes.

Once this is done I generate a crypto secure pseudo random byte sequence using RAND_bytes to generate 12 bytes to use as my IV.

Then I proceed with my crypto of the message, generation of the MAC, and packaging of my encrypted message in the form of [Length (Message + IV + MAC)][MAC][IV][Encrypted Message]

Now my question is, how can I implement protection against replay attacks. Or is there already protection built in?

From what I understand is that AES GCM only authenticates (preventing modification to the encrypted data) and encrypts data. It does not actually have a mechanism to recognize if a message has been received already, or at least in the OpenSSL implementation.

So for me to add replay protection to this message encryption, how should I add a nonce to the crypto scheme.

Should I simply keep track of each random IV for the given communication session and comparing any incoming message IV against the list of already received IVs?
Should I subtract 4 bytes from my 12 byte IV to use the free 4 bytes as a counter? ([Random Bytes X 8][00 00 00 01]) Incrementing it per message and when a message is received see if the message comes from the past until the session is over.
Prefix or Suffix a nonce counter to the message being encrypted, using a fully random IV and use the same detection mechanism as #2 except checking the decrypted message for the nonce rather than the IV?

A session usually only lasts for less than 50 messages, and there is no way to implement a stream cipher (SSL,TLS) encryption.

I feel that #1 may be resource consuming since I have to iterate an entire list of IVs in search for a duplicate and if the sessions ever grew in size this could be costly. #3 is alright besides the fact that the nonce is joined with the message, although since it is known in size (4 bytes) this can easily be extracted from the message. #2 seems like the best option, since all you need to keep track of is the previous messages counter and the message is left unmodified.

Is there a proper and safe way to implement a nonce to prevent replay attacks?

Thanks for your time.


texts: Minimum number of active s box to be resistance to differential cryptanalysis

texts:
I am calculating the minimum number of active s_boxes for block cipher using mixed integer programming, when can we say that block cipher is resistance to differential cryptanalysis after which round?
For example AES algorithm or LED


texts: Can homomorphic decryption of DES be practical?

texts: I was reading this paper Homomorphic evaluation of the AES Circuit by Gentry et al. when I thought if something similar can be done with DES or 3DES, e.g. it is plausible to decrypt DES homomorphically ?


texts: What's the point of hiding the key in white box cryptography if the attacker already has full access to the encryption (or decryption) implementation?

texts:
The attacker doesn't need the key in order to decrypt ciphertexts or encrypt plaintexts since he/she already has the full implementation.

So what's the point of hiding the key?
What advantage would the attacker even have by knowing the key?

Update:
ddddavidee's answer below, in the second paragraph, raises an interesting point: a white-box implementation of a symmetric cipher that exhibits the "one-wayness" property - i.e. it is infeasible to derive the decryption circuit from the encryption circuit, or vice versa - can be used to create an assymetric cipher. That would indeed be useful. Note that key-extraction security - i.e. it is infeasible to derive the key from the encryption (or decryption) circuit - is a necessary but not sufficient condition for achieving one-wayness.

However, I'm still stumped by the tenor of the first paragraph of ddddavidee's answer, which is why I asked this question to begin with. The model for an attacker of a white-box implementation assumes that they have full access to the encryption (or decryption) circuit. In that case (aside from the scenario in the previous paragraph), what is the point of the notion of key-extraction security, or key-extraction itself, for that matter, since the attacker can accomplish any encryption without using the key? Either I am missing something or there is something missing or flawed in the definition of white-box cryptography itself.


texts: Are there any methods for constructing a password that can be reconstructed if forgotten and is as secure as randomly generated ones?

texts:
Is there a formal name for such a thing, so I know what to google? Is it possible to make them as secure as randomly generated passwords?
An illustrative example would be something like picking a random book and then picking the words inside it using some process that can be recreated to generate a passphrase.


texts: Would hashing a password twice prevent naive attacks?

texts:
A common way of using MD5 or any other hashing algorithms to store passwords is to hash the password with a salt $$\text{hash}(\text{password} \mathbin\| \text{salt}).$$ This way, if an attacker wants to brute force the passwords, they have to do this for each password since each password has a different salt. With this setup, a determined attacker could still brute force a password since they have the salt and they know the hashed password was generated with $\text{hash}(\text{password} \mathbin\| \text{salt}).$
Would storing the hashed password as $$\text{hash}(\text{hash}(\text{password} \mathbin\| \text{salt}))$$ be a way of deterring the attacker? The idea with this approach is that the attacker doesn't know the password is being hashed twice. This means that if they try to brute force the password with the assumption that the hashed password is of the form $\text{hash}(\text{password} \mathbin\| \text{salt})$, they will never be able to crack it.


texts: Is there any difference in security between S2K and PBKDF2?

texts:
S2K is a KDF designed for the OpenPGP standard which concatenates a password and salt and feeds this, repeating, into a hash function for a configurable number of bytes. PBKDF2 is a KDF which uses a hash function in HMAC mode and iterates it a configurable number of times over previous output.

Assuming optimizations for PBKDF2 are used (precomputing the hash state for the inner and outer key), is there any difference in security between S2K and PBKDF2 if they both are made to require the same number of hash compressions? For example, does one of the schemes rely on stronger assumptions about the underlying hash, or is one slower than the other even for the same number of compressions?


texts: Zero knowledge proof for sign of message value

texts:
I am using ElGamal encryption to encrypt an integer message $m$ as,

$E[m]$ = ($g^x$, $g^m.h^x$)

Can I write a zero-knowledge proof to prove to a verifier that $m > 0$ ?

I can create the bit representation of $m$ and encrypt each bit to prove this, but I have a lot of integers and am trying to avoid this approach.


texts: Simulation of Chosen Plaintext Attack on CBC, Predictable IV with OpenSSL

texts:
I would like to simulate the CBC IV attack where the IV is predictable.
It's described in the answer to this question:
chosen plaintext attack on CBC, predictable iv

(Only "Yes" and "No" are valid messages and the attacker knows this)

I am using 128-bit AES, CBC mode. Everything is in hex

Key: 00112233445566778899aabbccddeeff
IV1: 12121212121212121212121212121212
Msg: Yes
Ciphertext: 030a 6eac 2641 e072 bd51 0d84 fb87 08da

I have encrypted the message like this:

printf "Yes" > yes
openssl enc -aes-128-cbc -e -in yes -out yes.aes -K 00112233445566778899aabbccddeeff -iv 12121212121212121212121212121212

The next IV (IV2) is going to be:

12121212121212121212121212121213

When an attacker knows this, it can calculate

IV1 XOR IV2 XOR "Yes"

and submit it to be encrypted with the next IV. If the ciphertexts match, then the attacker knows that the first message was in fact "Yes"

In my example the XOR calculation results to 59 65 72 which is in ASCII:

Yer

(calculated with http://xor.pw)

Now let's encrypt this and check if the ciphertexts match:

printf "Yer" > yer
openssl enc -aes-128-cbc -e -in yer -out yer.aes -K 00112233445566778899aabbccddeeff -iv 12121212121212121212121212121213

But now I get this as the ciphertext:

4378 8d70 de54 d287 8f64 1c8d ec40 de91

I was expecting it to be the same ciphertext as the one for the original "Yes"

I can't find my error. The attack should be correct, so I guess I am using OpenSSL incorrectly?


texts: Using encryption schemes for identification

texts:
I've been researching how to implement a post-quantum SSL-like connection authentication, especially correct identification&authentization of the server/client. Because good post-quantum digital signature algorithms are generally unavailable (McEliece-based CFS is slow, NTRUsign is impractical, MQ schemes are generally broken and hash-based schemes have limited number of signatures which doesn't go very well with automated on-demand signing), I've been trying to find a good scheme that would not produce signatures, but would just verify whether there really is the holder of the given private key on the other side of connection.

There are several approaches to such identification (Stern's scheme etc.), but because we already have good post-quantum encryption schemes, I've been wondering whether one could use them like in following scheme:

A has some kind of data connection to B. A wants to know if B is really the guy identified by public key PubB, therefore A wants to determine whether B can do operations that depend on key PrivB. (PubB and PrivB is the keypair of some asymmetric encryption scheme)
A generates a random string S, encrypts it with PubB, and sends it to B.
B decrypts the message to S', and sends it back to A
A compares received S' with S, if they are equal, B was able to use PrivB and therefore it is (cryptographically) indeed B.

Questions:

Is there any good reason why this would not work? (consider the connection somehow secured against MITM-like disruption, as this is not the purpose of the question and the solution is relatively simple)
Is there any problem with sending decrypted plaintext S' back? Especially for fighting the fact that in this case B would simply act as a decryption oracle for PrivB for anyone connected, would it help if B was sending back only H(S'), where H is some cryptographic one-way (possibly hash) function?

Thanks for any thoughts&suggestions,

-exa


texts: All Curve25519 Parameters with Explanation

texts:
I'm trying to sum up all Curve25519 parameter and specification reasons. Can you tell me if I missed some important reasons or parameters in the following list?:

Curve: Montgomery Curve. $M_{A,B}: By^2 = x^3 + Ax^2 + x$
Reason: The projective arithmetic for scalar multiplication (Montgomery ladder) is very fast.

Parameter $A = 486662$.
Reason: $A$ should be as small as possible but still provides an order for the elliptic curve, which is bigger than every private key ($256$ bit length). The order should be $ n \cdot p$ with $p$ being a big prime and $n \in {4,8}$ (the reasons for this is the order of Montgomery curves in general). The order of the twisted curve should have an equal form (security reasons).

Parameter  $p = 2^{255} \text{- } 19$.
Reason: The curve is defined over a prime field with the prime $p$. $p$ should be close to the power of $2$ to make use of a fast modulo computation. See this post.

Public keys $ q\in \{ 0,1,2,\ldots,2^{256} - 1\}$.
Reason: Every $32$ byte shall be possible, so you don't need to validate the public keys (faster). Theorem 2.1. states, that this is possible (Using extension fields).

Private keys $ n\in 2^{254} + 8 \cdot \{ 0,1,2,...,2^{251} - 1\}$.
Reason: Not every $32$ byte is a good key. For security reasons, the last $3$ bits should be $0$ (this prevents subgroup attacks). To prevent side-channel attacks using other scalar multiplication than Montgomery ladder, the first bit should be $1$.

Base point $P = (9, y)$.
Reason: To prevent small subgroup attacks, the base point has to have a big prime order. Also, for nothing-up-my-sleeve number the first $x$ satisfying the curve equation that is in the large prime order is chosen.


texts:
I tried to solve SBox as given in this link
I am trying to understand this paper SBox. In this on page no.4 the correct equation of given SBox is mentioned. I am not getting how to design ANF equation as given in paper.


texts: Modification of vigenere cipher cryptographically secure?

texts:
After looking for ages online for a python implementation of the Vigenere cipher, and finding few, I decided to implement it myself. After ironing out all of the flaws, it's now a working (and secure) implementation of the Vigenere cipher. But I had an idea.

What if you increase the size of the alphabet that it's using? eg:

With the size of the alphabet being 1114111 , and all letters of the alphabet having been converted into their ASCII representations (a  = 97):

Encryption:

$c^i = (m^i + k^i) \bmod 1114111$

Decryption:

$m^i = (c^i + k^i + 1114111) \bmod 1114111$

Would this be cryptographically secure? And I'm assuming that it would be more secure than traditional Vigenere?


texts: What is the verification algorithm for verifying RSA signatures?

texts:
I am not able to find much information how how to verify RSA signatures.

I have three values.

Message = "Launch a missile."

public key:

e = 010001 (this hex value equals to decimal 65537)
n = AE1CD4DC432798D933779FBD46C6E1247F0CF1233595113AA51B450F18116115

I want to verify if the signature below is the correct signature.

S = 643D6F34902D9C7EC90CB0B2BCA36C47FA37165C0005CAB026C0542CBDB6802F

The only formula I was able to find is

$S^e = \operatorname{Pad}(\operatorname{Hash}(M))\pmod N$

Is this the correct verification algorithm? If so, I am unclear about the Pad() and Hash() functions.  How can I calculate the hash and pad functions?


texts: Why is it secure to reuse key and nonce in ChaCha20-Poly1305 AEAD construction?

texts:
While looking at the ChaCha20 and Poly1305 AEAD construction as defined by RFC 8439, more precisely its use of the key and the nonce, I came up with the questions below. Maybe someone with some in-depth knowledge is willing to share it?

The key and the nonce (usually a "number to be used only once") are used twice in this construction: first, to generate the Poly1305 one-time key using the ChaCha20 block function, and second, to encrypt the plaintext using the ChaCha20 function. Why is this reasonable and secure? Especially as both are using a related construction and its stated for ChaCha20 that the nonce "MUST not be repeated for the same key".
In the AEAD construction, the nonce is not explicitly authenticated by the MAC. Is it still secure to include the nonce in the AAD as this could be treated (at least in some way) as a reuse of the nonce with the same key? I guess it is secure, but can someone explain why this is so?


texts: Can Key-Encryption Key (KEK) be symmetric?

texts:
This from Cryptography course from Coursera:

Key wrapping or encapsulation using a KEK can be accomplished using
either symmetric or asymmetric cipher

For my information KEK solves the key distribution issues with symmetric keys, so only the involved party can decrypt the cypher with their private key, but doesn't using symmetric KEK for distributing symmetric session keys raises the same distribution issues?


texts: Combatting traffic shape analysis with spurious packets

texts:
I was reading a question about combatting traffic analysis, and a thought occured. If I send random junk messages periodically, would that defeat traffic analysis?

The messages would contain some form of header to specify "this is junk", and would otherwise be comprised of random data of a random (plausible) length. In fact, the data could just be produced by a CSPRNG, such that the packets would not be decryptable. Someone who knows the key would be able to verify that the decrypted message was invalid, but an attacker wouldn't be able to tell which messages are part of the conversation and which are random, making it difficult to perform cryptanalysis.

Does this idea have merit?


texts: Is it possible to delegate re-encryption key generation?

texts:
In a non-interactive proxy re-encryption scheme, Alice, with the key pair $(pk_a, sk_a)$, needs to issue a re-encryption key $re_{a\rightarrow b}$ once she wants to share her secret message with Bob, with key pair $(pk_b, sk_b)$.

In other words, Alice does:
$re_{a\rightarrow b} = rekey(sk_a, pk_b)$.

Let's say Alice wants to issue re-encryption keys automatically, maye because she has been notified she has received a payment from Bob that entitles him to see the secret message. She would then need a program/server that issues new re-encryption keys when certain conditions are met.

How would she proceed? Without any encryption scheme modifications, she may either:

run her own private server
trust a third party to run that server

Let's say both cases are not feasable: Alice neither has resources to run her own server, nor she wants to reveal her secret key to a third party.

Can Alice delegate re-encryption keys issuance without revealing her secret key?

What really Alice wants to achieve is sharing a secret with an unknown number of Bobs under certain conditions, so any solutions wich may even involve changing encryption scheme will be accepted.


texts: Can you use ECDSA on pairing-friendly curves?

texts:
I'm learning about Elliptic curve cryptography. If I understand right, ECDSA and other algorithms used in ECC are dependent on the curve chosen. So, before you want to use ECDSA, you first have to choose a suitable curve.
Pairing-friendly curves are a special kind of elliptic curves that have properties that allow for different algorithms not available on every elliptic curves such as BLS or Identity-Based Encryption.
In this publication there is written on page 8:

Following the discovery of these attacks in the early 1990s, the consensus was that elliptic curves with low embedding degrees should not be used in discrete log protocols.  In fact many standards for elliptic curve cryptography such as ANSI X9.62 [3] explicitly forbid the use of such curves. However, low-embedding degree elliptic curves are now very much back in vogue since they are crucial for the efficient realization of the pairing-based protocols that were presented in §3.

Let's say I wanted to use ECDSA (which is based on the discrete log problem I believe) over a pairing-friendly curve (like alt_bn128). According to this, the pairing-friendly curve is supposed to have a low-embedding degree and shouldn't be used with ECDSA.
Am I understanding this correctly? Does that mean the cryptographic primitives one can use on pairing-friendly curves should be specifically designed for pairing-friendly curves (like BLS)?


texts:
Is it possible to know if two geographic locations are within a certain distance of each other without revealing the location?

I'm thinking about contact tracing during the COVID-19 outbreak. Assuming users have an app that records their location history, more specifically where the stopped and spend a few minutes. When a user is diagnosed with COVID-19 imagine they could share where and when they've been somewhere but without revealing the actual location and time. Other users could compare their own location history and know if there's a match.

Here's what I'm thinking so far, but I'm not sure if it's secure or not:

Let's say that locations within roughly 7.5 meters and 7.5 minutes of each other are considered a match.

Take your coordinates with enough precision up to 5 meters
Take the 5 meter squares around you, so you have a 3x3 grid
Take the current time rounded to the nearest 5 minutes
Take the 5 minutes before and 5 minutes after
Hash each combination of coordinate squares and 5 minute intervals

Now you have a set of 27 hashes. Other users can hash their own location and time (with the same precision) and see if it matches any of your hashes, but otherwise cannot know where or when that set of hashes corresponds to.

Granted, it's not precise there's a margin of error (is it 2.5?) but that's acceptable IMO.

Would this work?


texts:
I am  always wondering about the seemingly odd syntax $1^n$ which designates the security strength of a cryptographic algorithm.

Who invented this (odd) syntax and what was the reason for inventing it?


texts: Identity-Based Encryption consist of four algorithms. Extract phase is one of them and it is done by PKG or receiver?

texts: The Identity-Based Encryption consist of four randomized algorithms: Setup, Extract, Encrypt, Decryption. The Setup phase is done by Private-key generator, Encrypt by sender and Decryption by receiver. the Extract phase is done by PKG or receiver?


texts: How to recover deleted-recovered windows efs-encrypted files?

texts: I'd some EFS-encrypted files on a HDD which were deleted unintentionally. I used a data recovery software to restore them, but afterward, windows does not recognize those recovered files as encrypted anymore. I've pfx which files were encrypted with, but I'm unable to use it. Is there any way to recover my data?


texts: How to reverse x XOR (x >>> 1) XOR (x >>> 2)

texts:
Short version:

What is the inversion of $f(x) = x \oplus (x \lll 1) \oplus (x \lll 5)$ when the last 4 bits of $x$ are known?

Long version:

Hi,

a friend a mine and I are giving each other crypto challenges to break. This time, he gave me a "one-way" function which is defined as followed:

$R(x)= x \oplus (x \lll 1) \oplus (x \lll (x\ AND\ 15)) \oplus ((x\ AND\ 15) \lll 1)$

Or if you define $i = x\ AND\ 15$:

$R(x) = x \oplus (x \lll 1) \oplus (x \lll i) \oplus (i \lll 1)$

Given you can bruteforce $i$ (since it is ranged from 0 to 15), there are a few things you can do:

For $i = 0$: $R(x)$ can be reduced to $R(x)=x \oplus (x \lll 1) \oplus x \oplus (i \lll 1)=(x \lll 1) \oplus (i \lll 1)$ which can easily be reversed.

The same applies to $i = 1$ which allowes you to reduce $R(x)$ to $x \oplus (i \lll 1)$.

However, things get more complicated for $i \ge 2$ since the xor's no longer negate themselves, but since you "know" the last 4 bits of $x$, you can try to reverse the function by building upon $i$:

Given that $x_{28-31} = i_{0-3}$ and $0 \le i \le 3$

$x_{27} = x_{27} \oplus x_{28} \oplus x_{27 + i}$

$x_{26} = x_{26} \oplus x_{27} \oplus x_{26 + i}$

...

$x_{n} = x_{n} \oplus x_{n + 1} \oplus x_{n + i}$

($x_n$ or $i_n$ are the $n$th bit of $x$ / $i$)

However, i really have no clue when it comes to $i \gt 3$ since you cant access the plain bits anymore.

// EDIT: The $f(x)=x\oplus (x \lll 1)$ can easily be broken by defining that $x_0=0$ and then calculating the rest using $x_{n}=x_{n-1} \oplus x_{n}$ but I wasn't really able to expand this to the problem above.


texts: How use multiple keys to sign the same document?

texts:
I’m thinking about create one software, that will need the user to sign each document, using Ed25519. I need to create something that is secure and simple. Requering use a HSM is not viable and hardware implementation of Ed25519 is closely to nonexistent, and common users not have it.

Considering it, the key will be stored (in the encrypted way) on the computer and the signature operation will occur in the same machine. I don’t think it is safe enough. To create something “more secure”, and still accessible: the user can add more devices, more keys, that need to sign the same document.

One user can have two keys, one it is stored on the computer and another key on the smartphone, for instance. The attacker, in this situation, need to steal two keys, which can increase the difficult, a little bit.

What is the best (the safest and easiest) way to create a multi-signature?

I can use something like S(M, K1), S(M, K2) ... S(M, Kn). I think it will work, because the Message will be Signed by multiple Key, and we only need to append all these signature at the end. To verify, only require to compare all signatures with the same text and check against the public key. I'm not a cryptographer, so I'm a little bit worried if something is wrong.

Have a more elegant solution? Have something that can be wrong in this previous approach?

The main goal is:

Stealing all keys, except one, we still safe. We are safe until the attacker gets access to all the keys.
Signature operation need to occur where the key are stored, we can’t share a private key between the devices, or trust in a single device to perform the operation.
Uncomplicated way to verify the signature. Everyone, including the software, can easily verify that was signed by all these keys.

Note:

Keys, already compromised or not, can't be removed/revoked. All keys will be trusted forever, or until the signature algorithm has been broken.


texts: How to perform the initial permutations 64-Bit DES to derive $K$?

texts:
Perform DES encryption on the first 64-bit plaintext only, what are these 0's and 1's? Do they mean that I need to use this value 111101 to derive $K$?

I want to know how to use initial permutation to derive $K$ using permuted choice 1 and permute choice 2.


texts:
I'm developing an experimental Amateur Radio digital protocol for over-the-air data exchange.  A part of any protocol over fallible transport layers is of course some kind of error control (ECC, FEC, CRC, etc).  My original intention was to use a simple 16 bit CRC to checksum each individual packet.

An additional concern is the potential spoofing of packets.  With a simple CRC this is pretty trivial, as the protocol and implementation will be open-source, it would be easy to construct packets that appear to be from any station.

The protocol may also be used over error-free transport layers as well, in which case the CRC, used purely for error checking, would become redundant.

What I'd like to explore is replacing a simple 16-bit CRC with what amounts to a digital signature.  Thus it would serve the purpose of providing at least 16-bit quality CRC, along with a unique CRC that cannot be trivially generated to spoof packets from a station.

I realize that, cryptographically speaking, a signature as small as 16 bits can be easily brute forced. However, similarly, a 16-bit CRC also has a fairly high probability of collisions.  Unfortunately that is the limitation when dealing with data transfer at rates as potentially low as 300 baud, and typically at 1200 - 9600 baud.  There is no luxury to transmit large signatures and checksums.

For critical information, such as an OTA software update, that data would be properly signed using standard methods with appropriate length bit lengths.  Of course the higher level data can also be signed as well.  My question is pertaining to the lower-levels of data exchange at the individual packet level, and adding at least some level of anti-spoofing that would also serve the same purpose as basic CRC.

The public and private keys can be pretty much any size, as the public keys would only need to be exchanged once for each pair of stations that wish to communicate.  It is the individual packet signing I would like recommendations on.

Note that the entire payload cannot be encrypted, as that would be in violation of FCC regulations for Amateur Radio.

A method such as encrypting just the CRC using an asymmetrical encryption would not suffice, because not all packets are intended for consumption by a single station. Beacons and other broadcast packets are intended to be received by all listening stations. So encrypting the CRC so it can only be decoded by a single receiving station would only solve the issue for direct station-to-station communication and not more generally.


texts: Are there any MGF1 and OS2IP functions available in C?

texts:
I need  MGF1 and OS2IP functions, as defined in the PKCS #1 v2.1: RSA Cryptography Standard.

Is there anything available in OpenSSL, or any other open C library?


texts: Is it possible to determine if data was encrypted by a specific public key?

texts:
If the prover provides a block of data and a public key. The provided data is supposedly ciphertext that was encrypted using the provided public key. Is there a way to prove that the provided data has infact been encrypted using that specific public key?

The verifier does not have access in any way to the plaintext data or the private key. However, the prover does have access to the plaintext data and private key, and can provide additional information to assist in proving, as long as zero knowledge of the plaintext data and private key are exposed to the verifier.

Update:
Based on the current responses, it seems unlikely that the verifier would be able to prove or disprove the claim by the prover using only the provided data and public key. However, the question still remains if this could be accomplished using some form of additional proof data, possibly in conjuction with a zero knowledge based algorithm.


texts: How to decode a Playfair message with a partial key?

texts:
I've been given a Playfair ciphered message and a partial key, where a few key letters are missing:

Corrupted key (? stands for a missing letter): ?ENVGQ?RKBDXACU?LIOW
Ciphertext: LGOXMVYHIMISYSSQWMZX

I tried to solve this myself and got the plaintext WELCHOQLHNLRBHED, which is clearly wrong.

What methods can I use to decode this message?


texts: Is this method for exchanging private key using RSA sound?

texts:
Bob know's Alice's public key, and he wants to make sure he's connecting to the one which has that key. Furthermore, Alice wants to verify when she gets a connection from Bob who'll give his public key that he is indeed the one who has that key.

Bob will send Alice half the AES private key and half the initialization vector which he generated randomly, both encrypted using Alice's public key.

Alice would reply by sending back what Bob sent + the other half of the AES private key and the initialization vector which she generated randomly as well.

Afterwards communication begin using AES crypto stream with a key composed of the two halves both exchanged. If a crypto exception was thrown at either side at any point, the connection will be terminated. No third message will be sent from Bob to Alice to verify that he got her part of the key, the AES stream will begin directly after Alice's message.

Note: I thought about using Diffie-Hellman, but what I didn't like what that the private key agreed upon would be the same for every session assuming the two parties will not change their public keys.

Is this enough for both to verify that each one is the actual owner of the claimed public key, and to exchange the AES symmetric key safely without creating potential security issues ?


texts: What is the shortest fingerprint of a Curve25519 public key that is secure

texts:
My clients have to exchange public keys. To ensure security they are exchanging fingerprints and typing them into the computer by hands.

I want the fingerprints to be as short as possible.

I am using libsodium for encryption, which uses Curve25519. What is the shortest fingerprint I can generate which would still ensure security?


texts:
When using symmetric encryption is it important to compress the data first?

I think that compression will make data look "more random" and therefore be more difficult to crack, but I am not sure if this is a requirement.

Could compression be necessary for some ciphers but not for others?


texts: Why are theoretical hash constructions based on the hardness of the discrete logarithm problem not really used in practice?

texts:
In an old 2010 Q&A at StackOverflow, Pornin states:

  … a good hash function "should not" allow a property such as surjectivity to be actually proven.

This makes sense to me when looking at, for example, the SHA-2 function family.

Yet, in an answer to Has any crypto hash function been proven to be surjective?, Lindell provides an answer with a nice example of a hash function that allows such proof.

Since the widely known, theoretical construction based on the discrete log problem combined with a Merkle-Damgård transform seems pretty solid at first glimpse, it begs for the question why alike hash constructions don't tend to be practically used more often. The surjectivity (and according collision resistance) proof seems to be a plus when comparing it to the somewhat non-provability (more of an assumption) of the surjectivity of SHA et al.

Is this merely based on the fact that discrete log functionalities tend to be computationally expensive and harder to implement on specific hardware (compared to constructions like SHA-2)?

Or are there other implications (maybe related to cryptographic security or specific attack vectors) which could explain why such theoretical hash constructions based on the hardness of the discrete logarithm problem don't tend to be practically used and preferred (due to the more clear proof)?


texts: My question is about black box secret sharing schemes (BBSSS). Do these schemes have any advantages over the better known secret sharing schemes like Shamir’s?


texts: Can I select a large random prime using this procedure?

texts:
Say I want a random 1024-bit prime $p$.  The obviously-correct way to do this is select a random 1024-bit number and test its primality with the usual well-known tests.

But suppose instead that I do this:

select random odd 1024-bit number $n$
if $n$ is prime, return $n$
$n \leftarrow n+2$
goto 2

(This approach allows faster selection of primes via sieving.)

Since primes are not uniformly distributed on the number line, it would seem that this algorithm prefers primes that lie after long runs of composites.  Take a piece of the number line around $2^{1024}$ with x denoting a prime:

  ---x-x----------------------------x------------------------x---x

Clearly our algorithm above is much more likely to find the 3rd prime above than to find the 2nd one.

Question: Is this a problem?


texts: Difficulty deciphering the RSA algorithm

texts:
$d = 27, e = 3, n = 40$

For encryption, I have the letter T converted to 084 by the ASCII table, which encrypts to $24$ by $84^3\bmod 40$, for example.

To decrypt, I believe it would be $24^{27}\bmod40$ however this gives me 4.4342649e+38 which clearly does not fit into my ASCII table.

How does one decrypt using the RSA algorithm in relation to ASCII?

Further question: Is ASCII converter the best way to convert plaintext to numerical value?

EDIT: this is purely for a high school maths project; thank you for all the answers


texts:
I have RTS game, where all players run game and server just relays messages. Game can generate and store text file on player pc. I want to allow some players to be moderators, so I need to sign or encrypt their ids + number representing their permissions.

Problems:

everyone knows permissions and ids of other players.
player can see code that encrypts message (so goodbye symmetric cryptography)

What I have so far:

Textbook RSA 1024 bit + bignum library
I encrypt message with my private key and store in text file on player pc
Game got my public key and can verify if decrypted number is player id + permissions + checksum
Ids are authenticated by server

I read about RSA padding and my conclusion is - if everybody know message after it is decrypted there is no point in padding (because people got multiple copies of various messages, and they know what message will be decrypted to). Am I correct?

Maybe there is other cipher that I could use (preferred solution without need for bitwise  operations).


texts: How are Zero-Knowledge Proof protocols designed?

texts:
There are some classic ZKP examples out there (the alibaba cave, the colored balls, etc. See the Wikipedia page for details)

To me it looks like these protocols were invented "ad-hoc". That is, someone came up with a clever solution for that particular problem, and it's not immediately clear how it applies to other problems.

Is there a more "direct" way of coming up with a protocol? Are there situations where a ZKP is not possible?


texts:
Some time ago I was working in a pet project for a type of database engine. And I thought about securing the data in disk with encryption.. and since the main code was already developed.. I had a few requirements..

a simple stream class that I could hook instead of my file stream had
to support random access (both read/write at random positions)
be able to work at any byte position (since the data might not be aligned)
encrypt/decrypt only the requested data, not the all file,(because the file maybe several MB)
fast encryption/decryption, since this was for a database system

nowhere on the web I found information about this, or implementation of such code.
Normal stream ciphers don't support random access/lookup, and block ciphers require the data to be aligned and in fixed blocks..
So I thought about developing my own. I do know that developing your own encryption is always a bad choice.. but this was kind of theoretical exercise..

So I would like to present you the code.. just to see how far of I am from a security point of view

First the stream is initialized with a password.. but that password is not used for the encryption itself.. it is used as a seed to scramble an array of 256 values in hope of of increasing the key space

public CipherStream(String sKey,Stream oStream)
{
    _oStream = oStream;
    //initialize key space
    _oVector = new byte[256];
    for(int i = 0; i <= 255; i++)
    _oVector[i] = (byte)i;
    //shuffle the keyspace
    for (int i = 0; i <= 255; i++)//shuffle the box
    {
        //shuffle this item with other
        //other is chosen by char(i) of password
        //and the currently shuffling vector(I)
        // this means that even repeating passwords 'aaaaaa' will produce random results
        int j = ((sKey[i % sKey.Length]) + _oVector[i]) % 256;
        byte cTemp = _oVector[i];
        _oVector[i] = _oVector[j];
        _oVector[j] = cTemp;
    }
}

after this all we have to do is choose the cipher byte for the position we are trying to read/write from.. in my implementation I used xor, witch I know is not the most safe.. but that is can be changed and is not the core of the algorithm..

public override void Write(byte[] buffer, int offset, int count)
{
    long nPosition = this.Position;
    for (int i = offset; i < count; i++)
    {
        byte oPlain = buffer[i];
        byte nKey = GetKey(nPosition);
        byte oCypher = (byte)(oPlain ^ nKey);

        buffer[i] = oCypher;

        nPosition++;
    }
    _oStream.Write(buffer, offset, count);
}

the 'key' to the byte is chosen from the key vector dependently from the position we are trying to access.. calculations are done so that there are no repetitions and the chosen value is as random as possible

private byte GetKey(long nPosition)
{
    byte nOffset = _oVector[nPosition % _oVector.Length];
    byte nOffset2 = _oVector[(nPosition / (nOffset + 1)) % _oVector.Length];

    int nDif = nOffset - nOffset2;
    if (nDif < 0)
        nDif += 255;
    byte nKey = (Byte)(nDif % 256);

    return nKey;
}

I did try to render the stream as a bitmap.. just so make sure no patterns where obvious.. and did some fine tunning there.. and it seemed ok..

the best I can describe this algorithm is a 'deterministic predictable pseudo-random generator'
where I can just ask 'give me the nth random number', and the seed is a 2048 bit vector
that is initialized randomly with a password..

how far am I from a solution? Is this completely insecure? or there is not even point of trying because there is no solution for this 'random access stream'  problem?


texts: Semi static ElGamal vulnerability when the secret is not truely random

texts:
Assume Alice wants to communicate with Bob. Bob provides his public parameters $(g,n,y)$ with $y=g^x$ where $x$ is his secret key

Now Alice wants to send $m$ to Bob. She generates a random $r$ and computes $u = g^r$ and $c=my^r$ and sends back to Bob $(u,c)$.

You intercept $(g,n,y)$ and $(u,c)$ and you also know what $m$ is.

As far as I know, it is still not possible to recover $r$ from this.

But what happens if Alice sends a second message $(u',c')$ with $u' = g^{r'} = g^{f(r)}$, in other words $r'$ can be easily computed from $r$.

Can you recover $m'$ and/or even $r$ ?


texts: How can the Diffie-Hellman key exchange be extended to three parties?

texts:
Possible Duplicate:
  Can one generalize the Diffie-Hellman key exchange to three or more parties?

How can Alice, Bob, and Charlie share a common secret key using an extended version of the Diffie-Hellman key exchange protocol?

a=3, b=4, c=5
g=2
p=5


texts: Brute-force attacking One Time Pads feasible?

texts: I have a ciphertext encoded with One Time Pad. I do not know the key. How can I find the possible keys which when decoded, will result in a meaningful plain text?