texts: Breaking RSA with Factor in Range of $\sqrt{N}$

texts:
Suppose on of the RSA prime factors $p$ is the range of $\sqrt{N}$, in particular it holds that $|p-\sqrt{N}|<\sqrt[4]{N}$
I want to show that RSA can be broken in time poly(log N)
Given hint: $N = pq = (\frac{p+q}2)^2 - (\frac{p-q}2)^2 $ , also $\frac{p+q}2 \approx \sqrt{N}$
$\textbf{This is my approach:}$
First of all, we can calculate $\sqrt{N}$
From $|p-\sqrt{N}|<\sqrt[4]{N}$ we know that $p$ can only be $2 \sqrt[4]{N}$ distinct values, namely anything in$ \{\sqrt{N}- \sqrt[4]{N}, ...,\sqrt{N} + \sqrt[4]{N} \}$
Of course $\sqrt{N}$ is usually not a whole number, but we can round up
So now we can test for every element $p$ in this set, if $p | N$ , in which case we could easily calculate the other factor
If i am not mistaken, this reduced bruteforce would cost $\mathcal{O} ( \sqrt{N} )$ , which does not seem to match with what we want to show, e.g. $\mathcal{O} ( \sqrt{N} )$ $\not=$ poly(log N)


texts:
The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database.

But what if I use a keyed hash (like Blake2b) with a server key and then hash the user ID to generate the user key to avoid the need to hold a database of randomly generated keys? Is it secure? If not, why and how can you attack it?


texts:
I would like test vectors for 32-bit or 16-bits elliptic curves like
$[p,
 a,
 b,
 G,
n,
 h]$
, to test the Pohlig-Hellman algorithm in order to attack ECDLP over a finite prime field $F_p$.

Does anybody know a method to generate small $F_p$ parameters or can anybody supply the test vectors?


texts:
I'm trying to understand "Option 2: Using a Client-Side Master Key" from https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html#client-side-encryption-client-side-master-key-intro.

Basically, it seems that the one-use encryption key is generated, and used to encrypt the file, and then the key is encrypted by the master key and attached as metadata.

What is the benefit of using a separate key for each file when having the master key is the only thing needed for decryption either way, be it in one step or two?


texts: Asymptotic Hash Function and Concrete Hash Function

texts:
I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical, and they

say that its formalization is non-asymptotic. Why is the formalization non-asymptotic?

What is an example of hash function with an asymptotic formlization?


texts:
In chapter 2 of Katz's Introduction to Modern Cryptography there is a formal definition of an encryption scheme.
As part of this definition, the decryption algorithm is required to be perfectly correct, and thereafter the book assumes the decryption algorithm is deterministic and never outputs a wrong decryption.

  Throughout the book, we assume that encryption schemes are perfectly
  correct, meaning that for all $k\in\mathcal K$, $m \in M$, and any ciphertext $c$
  output by $Enc_k ( m)$, it holds that $Dec_k (c) = m$ with probability 1.
  This implies that we may assume $Dec$ is deterministic without loss of
  generality (since $Dec_k(c)$ must give the same output every time it is
  run). We will thus write $m := Dec_k(c)$ to denote the process of
  decrypting ciphertext $c$ using key $k$.

My question is: If we allow $\mathrm {Dec}$ to produce a wrong decryption with negligible probability $\epsilon$ (this could be any value < 1, and by repeated application of $Dec$ we could get any level of confidence we want short of 1), would this affect the theory at all?

Would everything be the same, only with this additional chance of error? Or, if we allow these negligible mistakes, could there conceivably be some algorithm, that is 'better' (security or efficiency-wise) than anything possible with deterministic decryption?


texts:
I would like to get some intuition on the security of the sponge construction. I'm referring to this diagram and notation.

Let's consider the case where we have don't apply $f$ in the squeezing phase i.e. we simply take the bits in the r-space ($Z_0$ in the figure) at the end of absorption and call that the hash of our message.

The Wikipedia article says that one could replace the XOR function and simply choose to overwrite the $r$ bits with the message instead of using XOR. The security level is not compromised if this is done and makes it easier for me to understand.

Reading a few other answers, it seems to be the case that the core thing that keeps SHA3 safe is the lack of knowledge about the state of $c$ in the final step. But this seems problematic.

For instance, let's say I have the hash of a known message (and therefore the internal states $c$ corresponding to this message at all stages) and would like to modify the last part i.e the $P_{n-1}$ bits. It seems like I have a very localized problem i.e. I know $(r_1, c_1) \xrightarrow{f} (r_2, c_2)$ and must find $(r_1', c_1) \xrightarrow{f} (r_2, c_2')$ for arbitrary $c_2'$. If I want to do it for any intermediate block, $P_k$, then $(r_1', c_1) \xrightarrow{f} (r_2', c_2)$ is the constraint, where $r_2'$ is arbitrary. This is because the bitrate is overwritten in intermediate blocks so that part of the output can be arbitrary while for the last block the state of the capacity is not used so it can be arbitrary. Moreover $f$ is just a permutation and so this task seems... not too hard?

I want to add, I know that hundreds of very clever people have tried various attacks and failed so this has a good resolution. This isn't some crackpot "I broke SHA3" post - it's more of a "what aspect of SHA3 am I missing" post!


texts: Output a pad (un-keyed, variable length) from an input seed (fixed value for same seed)

texts:
I want a function $y = f(x, len)$:

$x$ is the seed. $y$ is the output. $len \in \mathbb{Z^+}$ is the length (bytes) of $y$
Select a seed string $x$ to generate a string $y$.
For each same pair of $x$ and $len$, the value of $y$ is same.
seed should have a reasonable short length. $y$'s length may support a certain range (*remark)
Every byte value of $y$ should be uniformly (or close to uniformly) distributed

Remark of 4 - please consider two possible functions:

$y$ length is a multiple of $16$ (block length $16$). If I use hash function, the problem is that the length options are limited and not consecutive (e.g., $16 \cdot n$, $n=1, 2, 3,\ldots$).
$y$ can be any length within a range

(No need to protect $f(x)$ as a secret)


texts: Standards for finite-field discrete log cryptography

texts:
The NIST and TLS standards for Diffie-Hellman key exchange over a finite field all work in a subgroup of ${\mathbb Z}_p^*$ having prime order $q$, where $p = 2q+1$. On the other hand, DSA has a larger cofactor, i.e., it works in a subgroup of ${\mathbb Z}_p^*$ having prime order $q$, where $p = rq+1$ and $r \gg 2$. The latter makes sense because it gives better efficiency while still giving the same security against known attacks.

So, why do the NIST/TLS standards not allow for cofactors greater than 2?


texts:
I have the following APP Design

key store (contains 1:n user payload as 1:n key store entries)
key store salt (is used to extend to key store password to 256 bits, stored in clear text)
key store entry (what the user wants to encrypt) with:

own entry IV (payload is encrypted with AES-256 MODE OFB, IV stored in clear text )
own entry SALT (64 bytes random appended to payload before encryption, SALT stored in clear text)

The encrypted entry is stored base64 encoded:

model (a): only passwords are allowed
model (b): additional data is allowed

Here the additional data may be comments / remarks in the users language,  links or email addresses.

The key store SALT is used for apple crypt function CCKeyDerivationPBKDF which extends the user password to 256 bits to be used for AES256.

Is it secure to allow multiple keys on the key store if the key store SALT is shared on all keys?

The number of used passwords is not detectable as the application accepts every entry as valid. You must decide on the decrypted information if the key is valid or not. This is also true for the user who should know the correct password.

Can an attacker use the shared SALT for some attack?
Is there a security risk when I use model (b) which allows the attacker to guess, that there is user language (or links / email addresses) in the encrypted entry?


texts: Hash function and outputs of arbitrary length

texts:
I know that Skein can output a digest of arbitrary size, with a kind of counter mode. Blocks of the resulting digest can be computed in parallel.

What about Keccak ? I know that a sponge function can generate a hash of arbitrary length, but is it possible to generate this output with a parallel algorithm ?


texts: Ways to make a "doomsday" cryptocurrency which becomes untradable

texts:
As a social experiment (not a money-making scheme), I'm interested in developing a crazy cryptocurrency which, by its very design, will become worthless and untradable after a certain point. Ideally, this would be a fixed date like "January 1st 2020," but it could also be after a predictable event occurs, such as after one million trades have been made, or once a super expensive computation completes. I, the designer of the currency, should not have any ability to prevent this "doomsday," postpone it, or even cause it to happen early. Lastly, my users should not have the ability to defy the doomsday by creating their own fork of the code.

The current idea I'm running with is to have there be a "super-key," which works as a universal private key and allows you to break into anyone's account. Since the accounts would cease to be secure, the currency would be worthless. I would generate this key, then encrypt it in such a way that it would take years (but not decades!) to crack, then release it publicly. The superkey could a third party, but this is less fun because it goes against the basic idea of cryptocurrencies. I also do not know if I would be able to guarantee that I myself don't own the super-key in its unencrypted form.

I'm wondering if anyone has any suggestions on how to implement this.


texts: how many iterations of SHA3 (keccak256) hashing would be required to provide reasonable protection for the following data structure?

texts:
((A , B , C) , (D , E , F, G, H))

Where:

A is 0x0-0xF, (1 of 16)

B is 0x00-0xFF (1 of 256)

C is an 8 digit integer

D is a one of a list of one hundred words padded to 12 characters

E is a one of a list of one hundred words padded to 12 characters

F is a one of a list of one hundred words padded to 12 characters

G is a nine-digit numerical value, that could be one of 3 derived from (D,E,F) through research

H is an alphanumeric "secret" of a(hopefully but humans are lazy) secure nature

Where ABC are hashed to a 32-byte value, DEFGH to another, then both resulting values are concatenated and hashed together

These metrics are based an very pessimistic assumptions about the randomness of my inputs.

In my naive understanding that gives me 1.2289e20 permutations assuming that the "secret" can be derived from a 100 word rainbow table lol.

The objective is to make it impractical to derive hash-seed candidates in the foreseeable future.

my equally naive analysis is that at 1,000,000,000 hashes generated per second this would require a median time to match of about 1900 years per hash?


texts:
I have an interesting situation where I have a block cipher and a noisy channel.  The interesting thing is that I happen to know much about the data.  The cipher is a balanced Feistel network, and for the sake of this question, let's just assume that the block size is 32-bits.

What I know:

The key.
The original data has the format of xx000000, where xx is 8 bits of data.

It then gets encrypted.

The issue is that after encryption, I'm losing 2 bits of the 32-bit stream.  I have plenty of computer power, so I guess that I could just do a comparison because I know that xx will be 0-255 and run some sort of algorithm for flipped bits.

My question is: does anyone know if someone has looked into this before?  I feel that something like this would be a nice math project.


texts:
What is a formal definition of strong one-time-secure signatures?

I know the Lamport's scheme is one of them, but what is the global definition of it?


texts:
I'm creating a messaging application that will use an outlook account to send an email. However, I'm unsure about the proper steps to store the e-mail password on the user's computer. Suppose I had the following code:

SmtpClient SmtpServer = new SmtpClient("smtp.example.com");
var mail = new MailMessage();
mail.From = new MailAddress("you@example.com");
mail.To.Add("to@gmail.com");
mail.Subject = "Test Mail - 1";
mail.IsBodyHtml = true;
string htmlBody;
htmlBody = "Write some HTML code here";
mail.Body = htmlBody;
SmtpServer.Port = 587;
SmtpServer.UseDefaultCredentials = false;
SmtpServer.Credentials = new System.Net.NetworkCredential("you@example.com","pass");
SmtpServer.EnableSsl = true;
SmtpServer.Send(mail);

Obviously, I don't want "password" stored as a string inside my application. What would be the ideal/proper solution to storing a password on the user's machine  so I can read it into my application, and pass it to the NetworkCredential constructor?

I've done reading here, and here. The first link suggest storing it in a file or registry, not sure how to store it in a registry. How would I properly store it in a file?

Clarification:
This may have been a bit unclear from the above, but I want to allow some person, for which I set up an Outlook account, to send mails to other persons. So one may interpret this in that way that the created account "belongs" to that person, but I also know the password - for administration purposes and the user may know it.


texts: Can an encrypted nonce be used for authentication?

texts:
Would a scheme like the following work to allow authentication of a sender:

A nonce is appended to data, and the result is encrypted. The encrypted pack is sent to the other party. The sender then contacts the receiver through an authenticated channel (or one that is sufficiently good for the current purposes) and provides them with the nonce. When the receiver gets the encrypted file, they decrypt it. If the nonce matches the one given through the secondary channel, the encrypted pack is known to be from the sender.

Now, I realize no such scheme could provide non-repudiation, but the purpose in this case is simply to ensure that the encrypted pack has not been tampered with in transit. My presumption is that tampering with the encrypted pack without decrypting it has a high probability of creating gibberish, so the main threat of an MITM is the pack being removed and replaced with something else.

Does the approach above sound reasonable?


texts: Exchanging key material between HSMs of different manufacturers

texts:
In the future we may be setting up a system to secure a large number of symmetric (device) keys (a few million) by using HSMs. So, the keys themselves will be stored outside the HSM, but they will be stored encrypted by a key that resides in the HSM.
We will setup two such systems with HSMs potentially from different manufacturers.
One requirement is that it must be possible to exchange the keys from one system to the other.
So, is there a secure and standardized way to exchange key material between HSMs of different manufacturers?
If so, which standards are applicable here, and are they commonly implemented by HSM manufacturers?


texts: Actual RSA encryption & decryption of strings?

texts:
$K_{pub} = (n, e)$
$K_{pvt} = d$
Then
$E_{K_{pub}}(x) \equiv x^e \mod n$
Practically, when RSA is used to encrypt strings, what is the $x$ here? You cannot take it byte by byte because $\mod n$ will result in values larger than a byte. So what is done?


texts: If a message $M$ contains $n$ message blocks and I XOR the message blocks and encrypt the result using AES, can i use the resulting cipher-text as MAC? is it a good design or bad one?


texts:
I am currently reading through Cryptography Engineering and came across this definition of block cipher security:

  Definition 2 An attack on a block cipher is a non-generic method of
  distinguishing the block cipher from an ideal block cipher.

Reading further, I find myself struggling to understand what the authors mean by a "non-generic attack" (and, conversely, a "generic attack"), which may be explained by what they say near the end of the relevant section:

  That's why nobody has been able to formalise a definition of generic
  attacks and block cipher security.

Would anyone like a shot at attempting a definition of a generic attack and of a non-generic attack, particularly with respect to block ciphers?


texts: Tests to distinguish between PRNG and a CSPRNG

texts: What are the tests which a regular PRNG would fail but a CSPRNG would succeed? Is it just the next-bit test or are there multiple other tests which a PRNG which is not a CSPRNG would fail? Would a PRNG which is not a CSPRNG pass the Chi Square tests?


texts: Is the keystream transmitted with the ciphertext when a stream cipher is used?

texts:
When a stream cipher is used and a keystream is generated to be XOR'ed with the plaintext, is the keystream sent with the ciphertext so that the receiver knows how to decrypt it? Or does the receiver(s) need to already know the keystream?

Absolute noobie to cryptography.


texts: Message security and also program copy detection

texts:
Imagine I have client and server running on different machines, each as a separate software.
I want to ensure:

message authenticity, integrity and confidentiality at least of messages coming from client.
and also I want to be able to detect if someone copied my client software on different machine and is trying to make requests there

Now to solve item 1. I will use SSL with both client and server (is mutual authentication needed btw?) authentication. This solves 1, right?

To solve 2, I intend to use following protocol together with SSL:

After client connects to server using SSL, server will send some random number to client. Each client can have some ID of course.
Client must use this number in next iteraction with server. After successful interaction, server sends client different random number which the client has to use in next interaction with server and so on.

Now, idea is if someone copies my client software, her copy of the program will use the random number provided by the server - but this will make my original client go out of sync with the server (because her random number was already used) - and I will be able to detect this. Which means my goal is achieved as I listed initially. Does this achieve my item 2. in the list? If no improvements?


texts: Deterministic symmetric indistinguishable encryption

texts:
Are there any block-cipher modes (or symmetric encryption schemes in general) that are fully-deterministic, meaning same inputs lead to the same outputs (like for all modes with constant IV) and satisfy any notion of security?

ECB would for example accomplish the first but has no security properties at all) And more specifically: are there any schemes as described above that produce indistinguishable blocks in the presence of an eavesdropper? (This is weaker than CPA security)

I know that there exist papers for the public key setting but I could not find anything for the symmetric setting. Also, I don't need anything like 'searchable encryption', I need specifically the described properties above.

I have done research on this topic but could not find anything useful.


texts:
I'm pretty new in crypto, and studying RSA now. I saw few videos and read about it and how it works. So  basically, after we have the modulus N and exponent, we encrypt a message with:
m^e mod N = Cipher

and then decrypt that cipher with d
My question is that, seemingly, we can have multiple values for m that would yield the same cipher C, so how can the original text can be determined? For example:
p = 11
q = 13
n = 143
e = 7
d = 103

Now if we encrypt the message 9
for example:
9^7 mod 143 = 48

We get 48, which is the same if we encrypt 152.
How does it work then?


texts:
I am working on an implementation based on the Disco library, which itself is based on Noise and strobe framework. The goal is to do bilaterally entity-authenticated key agreement with perfect forward secrecy. Disco already implements Noise_NNpsk2 but does not offer Noise_NKpsk2. I at first considered using Noise_NKpsk2, though the more I think about the the more it seems like Noise_NNpsk2 might work too!
Situation:
Consider two entities A, B, where B has a key printed in a spot which we can guarantee is only visible to A. Entity B is computationally much weaker and cannot take any pre-messages. Concretely, A is a local server and B is some IoT device without any possibility of user input.
Assume A wants to initiate a handshake with B. If we consider the differences between the two schemes Noise_NNpsk0, Noise_NKpsk2, the only security-relevant differences are that in Noise_NKpsk2 A has the extra authentication measure of the static public key of B. As we assume that the PSK printed on B can only be seen by A, I reckon that the extra assurance of the static public key of B doesn't add anything!
Hence, my question:
What are motivations to go with Noise_NKpsk2 over Noise_NNpsk0 given the assumptions of the "hidden" PSK only visible to A?


texts: Give a distinguisher to differentiate between PRP and RPO

texts:
I have understood the proof that shows that a PRP is a PRF except for negligible probability $\frac{q(n)^2}{2^{-l(n)}}$. My computations suggest me that the same argument, perhaps with minor mathematical details, can show that a PRF can be treated as a PRP (if we forget about the fact that a PRP needs to be a DPT computable permutation while a PRF needs not).

Now I stumble upon this question:

  Show that there is a PPT-adversary which distinguished a PRP F from  RFO with a negligible, but non-zero advantage.

My problem is to give the code in the distinguisher side. Let me phrase it:

Alice picks $b \stackrel{u}{\in} \{0,1\}$. If $b = 0$ sends to Eve the RFO and if $b = 1$ sends to Eve the PRP $F$.
Here I need to describe what the distinguisher $D$ does.

I guess that I should make $D$ query the oracle he receives a polynomial number of time $q(n)$ defined by its efficiency bound. But what can be the details of the construction?

Glossary

PRP = pseudo random permutation
PRF = pseudo random function
RFO = random function oracle
RPO = random permutation oracle

A RFO is essentially supposed to generate a random function in the sense that when a new input (it has not been seen before) it will assign to this input a random output. The RPO is similar to this construction but ensures that the output have not been used before for other inputs, so that the generated function is injective.


texts: Modes for encrypting small binary blobs?

texts:
Suppose I am building an encrypted document storage system.  Suppose each user has a "user key": a symmetric key.  Suppose each document is encrypted with a "document key".  So, in order to give a user access to a document, we store a tuple of (user_id, document_id, encrypted_doc_key) where the encrypted document key is encrypted using the user key.  In this case, is there an appreciable difference in encryption modes?

The plaintext would be 1-2 blocks long, and random.  Every time data is encrypted or decrypted, the entire thing is needed, so the ability to decrypt arbitrary blocks is not necessary.  Even ECB seems like it should be relatively secure here, but I'm thinking using something with a random IV would be a better option.  Given that the data being decrypted (the wrapped keys) shouldn't be able to be modified by an attacker, I'm not as concerned about authentication.

Is there an existing protocol that does something like this?


texts: Predict with a machine learning model without knowing the actual model values

texts:
Imagine Alice has trained a machine learning model. She wants other people like Bob to be able to use her model for prediction, but she doesn't want them to know the actual model. She wants the model to be private.
Is there anyway to predict with a previously trained model without knowing the model itself?


texts: Is $F_k(x)=H_k(x \oplus H_k(x))||H_k(x)$ a PRF, where $H$ is a PRF?

texts:
Let $H_k(x)$ be known to be a PRF from the family of PRFs defined by

$H_k(x): \{0,1\}^{n} \times \{0,1\}^{n} \rightarrow \{0,1\}^{n}$, and then define
$F_k(x) = H_k(x \oplus H_k(x))||H_k(x)$.

Here, addition is over $n$-bit integers modulo 2.

Question : Is $F_k(x)$ a PRF?

This question was presented at the end of my lecture notes but left as an exercise to the reader, and my intuition leads me to believe that this is not necessarily a PRF as I think there exists a counterexample where if the chosen $k$ yields a bad PRF from the family, then an attacker can choose inputs that will cause it to be obvious if the outputs are from $F_{k}$ versus a random function. However, I'm struggling to think of a way to define this $H_{k}$ for a bad $k$.

Any thoughts are helpful!


texts: Name of the hash algorithms and create an unhash function

texts:
Below is a function to hash a string into a number. I'm curious what would be the name of the below hash function and what would be best approach to create an unhash function to turn the number into a string (ex. 61752 to abc)?
function hash(str){
    const letters = "abcdefghijklmnopqrstuvwxyz"

    let h = 9

    for (let i = 0; i < str.length; i++) {
        let v = letters.indexOf(str[i])
        h = h * 19 + v
    }

    return h
}

console.log(hash("abc")) // will return 61752


texts: Convincing "someone" on the (in)validity of DH tuple without revealing $u,v$

texts:
Is there a way of convincing someone on (in)validity of Diffie Hellman tuple $<g, g^u, g^v, g^{w}>$ without giving away $u,v$.

or at least solve the Decisional Diffie Hellman Problem without revealing $u,v$.

[Considering the prover knows exactly one of $u$ or $v$]?

I would appreciate references to papers (however I am avoiding Interactive Proofs for this)


texts: What is meaning of "Decipher the rest of the message by deducing additional words"?

texts:
I have an assignment in cryptography. I am not asking here answer, but meaning of question.

This is a question :

  2.4 The following ciphertext was generated using a simple substitution algorithm. 53‡‡†305))6*;4826)4‡.)4‡);806*;48†8¶60))85;;]8*;:‡8†83 (88)5†;46(;88*96*?;8)‡(;485);5†2:*‡(;4956*2(5*—4)8¶8* ;4069285);)6†8)4‡‡;1(‡9;48081;8:8‡1;48†85;4)485†528806*81 (‡9;48;(88;4(‡?34;48)4‡;161;:188;‡?;

Decrypt this message.
Hints:
1. As you know, the most frequently occurring letter in English is e. Therefore, the first or second (or perhaps third?) most common character in the message is likely to stand for e. Also,e is often seen in pairs (e.g., meet, fleet, speed, seen, been, agree, etc.). Try to find a character in the ciphertext that decodes to e.

The most common word in English is “the.” Use this fact to guess the characters that stand for t and h.
Decipher the rest of the message by deducing additional words. Warning: The resulting message is in English but may not make much sense on a first reading.

Some how I did answer for 1 and 2, but not able to understand 3rd question.

Does this mean, I should replace t, h and e characters and deleting rest??


texts: How can a fully encrypted homomorphic program resist copying?

texts:
Let's say that we have an original homomorphically encrypted program with any possible code inside. What methods can it use to ensure that it is impossible to create an exact copy of it? Are there such ways?

I understand that a person without a key will not see the internal content of a homomorphically encrypted program, I'm interested in whether it is possible to limit the exact copying of this program entirely


texts: What is an accurate definition for a 'Monoalphabetic substitution cipher' and why does it provide a poor level of security

texts:
From my research online, I am confused about the difference between a 'monoalphabetic cipher' and 'monoalphabetic substitution cipher'. However, I have got my answer from the websites Kifanga and Cornell.edu for reference:

The following is my answer:

A monoalphabetic substitution cipher is a cipher in which each occurrence of a plaintext symbol is replaced by a corresponding ciphertext symbol to generate ciphertext. The key for such a cipher is a table of the correspondence or a function from which the correspondence is computed.

Monalphabetic substitution ciphers are easy to break using a decryption method called letter frequency analysis. This is done by studying the text in the language of the cipher, and the frequency of each letter can be determined. For example, in the English language, the most frequent letter is E followed by T. By substituting the most frequent letter in the ciphertext with the letter E the second most frequent with the letter T and so on I will end up with the original plaintext.

Are my definition and description accurate? If not, what is an accurate description and why does it then provide a poor level of security?


texts: Why is fully homomorphic encryption so slow?

texts:
What are the reasons that FHE is so slow? Is it possible to make the FHE algorithm so fast that it can be used in practice (say, the practical FHE algorithm should be slower no more than 10 times compared to conventional calculations)?

Or there is some fundamental limitation and any FHE implementations will always be millions of times slower than usual calculations?


texts: one-time key, zero IV in stream cipher (e.g. AES-CTR)

texts: Say I am using a random key to construct a stream cipher with, say, AES in CTR mode, which will never be used to encrypt more than one data stream. Is there any advantage, no matter how small, to using a random IV instead of an IV of zero? I repeat, the key will never be used twice.


texts: How many different keystreams can I produce with AES in Counter Mode?

texts: I'm using a 64-bit nonce (incremented between the streams) and a 64-bit counter (incremented within a stream) for AES in CTR mode. How many different key streams can I produce with this setup?


texts: Embedded devices Authentication, Integrity and Confidentiality

texts:
Embedded devices send messages to the server. The server occasionally sends messages to individual devices(Reboot, upgrade firmware etc)

After some research this is my ad-hoc solution:

1) Each devices gets a unique id(like MAC address) and a public/private key pair when first programmed at the factory. The server will have a copy of the unique id and the public key for each device.

2) The server has a public certificate.

3) When the device wants to send a message: If it wants confidentiality it can encrypt the message using symmetric encryption and the key,salt etc will be encrypted with the servers public key. Then it can use it's private key to digitally sign the message which gives the message Authentication and Integrity.

4) The same process could be reversed when the server wants to send a message to the client.

5) Timestamps will be part of the message to resist replay attacks. The time needs to be fairly synchronized (within a minute of each other) for data collection purposes.

Are there any flaws with doing it this way? The devices are fairly resource constrained so have to pick fast public key algorithms.


texts: Are there any one-way operations that could be used for Diffie-Hellman post-quantum? (See criteria)

texts:
With quantum-computers looming, there is a need for Public Key Cryptosystems that can withstand attacks by quantum-computers. Are there any known one-way operations that fit the following criteria?

Is of course, one-way (you can only do f(x)=y and compute y, but not compute x knowing y),
Can run on today's computers efficiently,
Does not rely on the 'Integer Factorization Problem' or 'Discrete Logarithm Problem' (The two problems that almost all modern asymmetric ciphers rely on, could be broken with a quantum-computer running 'Shor's Algorithm')
Is non-dependent on order, eg. satisfies fb(fa(x))=fa(fb(x)).

A one-way operation that follows this criteria could be used in a Diffie-Hellman style key agreement/exchange that is quantum-resistant.


texts: If a permutation $f$ is not one way, what can we say about $f^{p(n)}$?

texts:
Consider a permutation $f:\{0,1\}^*\rightarrow \{0,1\}^*$, which is not a one-way function, i.e. there exists an efficient probabilistic adversary $\mathcal{A}$ and some polynomial $q(n)$ such that for infinitely many $n$

\begin{equation}
\mathrm{Pr}[\mathcal{A}(f(x)) = x] > \frac{1}{q(n)},
\end{equation}
where the probability is over the internal randomness of $\mathcal{A}$ and  $x$ drawn uniformly at random from $\{0,1\}^n$.

I would now like to prove that $f^{p(n)}$ is not a one way function, for any polynomial $p(n)$. Is this true for all permutations $f$ which are not one way?

My intuition was that this would be true, and that one could prove this by showing that $\tilde{\mathcal{A}} = \mathcal{A}^{p(n)}$ is a suitable adversary for $f^{p(n)}$. However, I can't get this to work. Is there a clever way to prove this, or is the statement I am trying to prove actually false?


texts: Why Authenticated Encryption the same message again is not secure?

texts:
It is the Exercise 9.14 (9.1) from the book A graduate course in applied cryptography by Boneh and Shoup.

Let $(E, D)$ be an AE-secure cipher.

a. $E_1(k,m):=(E(k,m), E(k,m));$
  $$D_1(k,(c_1,c_2)):= \begin{cases} D(k,c_1) & &
    \text{ if } D(k,c_1)=D(k,c_2),\\ \text{ reject } & & otherwise \end{cases}$$

b. $E_2(k,m):=\{c \leftarrow  E(k,m),\text{ output } (c,c) \};$
 $$ D_2(k,(c_1,c_2)):= \begin{cases} D(k,c_1) & &
 \text{if }  c_1=c_2,\\ \text{reject} & &otherwise \end{cases}$$

Show that part (b) is AE-secure, but part (a) is not.

--

I know that the different of (a) and (b) is that $E(k,m)$ use again will product different cipher.

I do the follow:

let the algo use XOR,

let R is the random of algo,

$c_1 = E(m)\oplus R_1; c_2 =  E(m)\oplus R_2$

$c_1 \oplus c_2 = R_1 \oplus R_2 = R_3$

let $B=u \oplus v$, where u is the origin header and v is my header.

$c_1 \oplus B \oplus R_3 = E(m) \oplus B \oplus R_2$

then the message is changed by me, so it is not an AE-secure.

But my teacher ask me don't assume the algo, and I don't know how can I do now.

I guess the HMAC use same key twice maybe is point, but I still don't know how can I do now.

Can somebody please help me?

Thanks!


texts: Interpretation of certain results of NIST Test Suite

texts:
I am using NIST Test suite on a PRNG and have a confusion regarding some specific results. Following is the part of the results:

RESULTS FOR THE UNIFORMITY OF P-VALUES AND THE PROPORTION OF PASSING SEQUENCES

 C1  C2  C3  C4  C5  C6  C7  C8  C9 C10  P-VALUE  PROPORTION  STATISTICAL TEST
  0   0   0   0   1   2   3   3  15  76  0.000000 *  100/100     BlockFrequency

My question is what is the significance of above result when p-value is 0.0 for Block Frequency Test but proportion is showing 100/100 test sequences passed the test and should I consider this test to be passed of failed? I have checked other questions regarding the NIST Test Suite but they don't answer this specific query.


texts: Detecting steganography by analysing non-significant data entropy?

texts:
I am not thinking only steganography in images, I think it is also possible to encode data for example into the length of spaces of a clear html text.

I suspect, the steganography changes (elevates) the entropy of the non-significant part of the messages.

But:

How to detect in the general case, what is "non-significant"?
Sometimes the hidden content has also a low entropy, while "clean" content can have also high.

For (1): Afaik, it is impossible, the only possibility would be to use some application-level decoding and interpretation.

For (2): I think, there is (should be) some type of correlation between the entropy (complexity) of non-significant part and the significant part of the carrier content, too. Some type of uncommon deviation could be maybe detected.

Does such technique, algorithm already exist?


texts:
What is the ideal cipher model?
What assumptions does it make about a block cipher?
How does it relate to assuming that my block cipher is a pseudo-random permutation (PRP)?
When is the ideal cipher model appropriate to use?
How do I tell whether a particular block cipher can reasonably be modelled using the ideal cipher model?


texts: Can one hide a text in an image and then hide that image in another image?

texts: Using a steganographic algorithm like least significant bit, can one hide a text in an image and then hide that image in another image?


texts: Symmetric key crypto secure communication infrastructure

texts:
Imagine that public-key crypto stops working.

Are there any academic proposals out there that would explain how we could implement commercially viable secure communication based on the current infrastructure and symmetric key crypto?

Inspired by this post.


texts: Encrypt/Decrypt cloud passwords with master password

texts:
I know it's generally bad to store password in the clouds, and that I should be using salted-hashed password only.

I'm making an application that will authenticate a user (with salted-hash), and then needs to return the credential of all their ip-cameras from the cloud database. For obvious reasons the camera password should not be hashed, neither saved as plain text as they are right now during development.

Of course, I will use HTTPS. But I'm concerned about the server-side, in case its security will be compromised, and I don't want all the password in plain text, naturally.

As I'm not an expert in cryptography (and information security in general) I am having a bad time trying to solve this.

What is the best cryptographic algorithm for this case? I've searched for password-based-encryption and authenticated-encryption but I don't like to add extra keys and prefer to use the user master password, saved as salted-hash (ie. Secret Key Cryptography (SKC) with a single key to encode/decode).

Can I ask some directions here? I don't need anything super-strong, but maybe something not too easy to crack, and not too much difficult to implement as a newbie

PS: I need to encode with PHP, and decode with JavaScript (or even do everything with client-side JS). I hope the algorithms are used worldwide and I don't have to implement them myself :)


texts:
Suppose we have $g^x \equiv h \pmod N$ Where $N = pq$ and $p$, $q$ are distinct primes. Also $(p-1)/2$ and $(q-1)/2$ are primes.

If we know what $x$, $g$ and $h$ are, is it possible for us to know what $p$ and $q$ are?
I'm trying to find out but I'm running into closed doors.
I tried the following:
 $gcd(p-1 , q-1) = 2$
$g^{(p-1)(q-1)/2} \equiv 1 \pmod {pq}$
so $1 \equiv h^{(p-1)(q-1)/2} \pmod {pq}$

Any help is appreciated.


texts:
I was wondering whether there are any "blinded" encryption schemas, such as the following:
We encrypt message $m$ using $f(k)$, where $f()$ is some blinding function and $c = \text{Enc}(f(k), m)$, while the decryption works as $m' = \text{Dec}(k, c)$ and $m' = m$.
One possible option is, of course, public-key encryption schemas, but I was thinking about more efficient (in terms of performance) symmetric key encryption schemas which have this property.


texts: Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 for AEAD?

texts:
Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 or XSalsa20-Poly1305 for authenticated encryption?

My hypothesis is "no" because the key from X25519 is less than 256 bits long; therefore, it can be used in XChaCha20-Poly1305 directly, as ChaCha20 is considered immune to related-key attacks.


texts:
IEEE 1363 (or more precisely, IEEE 1363-2000) - the IEEE Standard Specifications for Public-Key Cryptography - has been inactive for so long, that it is now with status Inactive-Reserved by IEEE, and even considered withdrawn since Nov 2019.
Yet, it appears like a relatively well written standards document by a respected standards organization, on a topic that people in this crypto stackexchange care about. Can you tell me your opinions on this standard? Do people not care about IEEE 1363? I am aware that there are alternatives. Is any of the alternative standards more popular these days, leaving others like 1363 to fall by the wayside? Are there some trends in public key cryptography that I may be unaware of, that have led to IEEE 1363 falling by the wayside? Or do people just go with whatever comes from NIST, so don't see the need for alternative standards from IEEE?
Sorry, I'm just speculating. But that doesn't satisfy my curiosity. Please do help enlighten me?


texts:
What are the main weaknesses of a Playfair cipher, if any?

I know that they depend on none of the letters missing, but that is an easy fix if a letter gets dropped. Besides that, are there any other problems with it?


texts: Is there a well known way of splitting a piece of information so that the information is only recoverable if all the pieces are together?

texts:
By "splitting", I mean turning one chunk of information into more than one chunk. The new chunks do not necessarily have to be of a smaller size. I imagine the use of this could be something similar to the nuclear launch protocol, where two people with separate keys must be present.

Unfortunately, this is one of those hard-to-google questions. Google always returns results about splitting a file into smaller pieces for easier file transfer, which is unrelated.

A simple protocol I came up with for this is to XOR the data with random values. For example, to split a plaintext $p$ into 3 chunks, you generate two random values $r_1$ and $r_2$. You then save $r_1$, $r_2$, and $r_1 \oplus r_2 \oplus p$ as your pieces.

Is there a better known algorithm like this?


texts: show how LWE errors can have a greater impact on result

texts:
Hi weve been given the following question in one of our classes but have not been taught anything about it and is worded strangely. It is to show how the LWE problem works by showing how small errors can have a big impact on the result using the two equations below.

$$
\begin{bmatrix}100 & 99 \\101 & 100 \end{bmatrix}\begin{bmatrix}S_1 \\S_2 \end{bmatrix} = \begin{bmatrix}199 \\201 \end{bmatrix} mod  500 \rightarrow \begin{bmatrix}S_1 \\S_2 \end{bmatrix} = \begin{bmatrix}1 \\1 \end{bmatrix}
$$

$$
\begin{bmatrix}100 & 99 \\101 & 100 \end{bmatrix} \begin{bmatrix}S_1 \\S_2 \end{bmatrix} + \begin{bmatrix}0 \\1 \end{bmatrix} = \begin{bmatrix}199 \\201 \end{bmatrix} mod  500 \rightarrow \begin{bmatrix}S_1 \\S_2 \end{bmatrix} = \begin{bmatrix}100 \\-99 \end{bmatrix}
$$

Ive been trying to read about it on some papers but am having trouble understanding what they mean. Can anyone explain how to do this in a simple way.


texts: Point decompression on an elliptic curve

texts:
I'm programming an elliptic curve cryptosystem and I'm having difficulty with decompressing points. The following information is from my project specification as to my understanding:

Given a point $x$ and $y$, we can compress its representation since for every $x$ on the curve, there are two $y$s; one even and one odd. Therefore, we can express the point as $x$ concatenated with a bit $y'$, thus representing the point in half the bits. To do this, we calculate $y' := y \bmod 2$ to detect if $y$ it is even or odd and add this remainder to the $x$ value which has been left-shifted by one bit (one can think of this representation as $2x + y'$). I understand completely why we do this, in fact it's pretty ingenious. My problem is with decompressing the point which apparently involves square roots in a finite field.

Since the equation of the elliptic curve is $y^2=x^3+ax+b$, where $a$ and $b$ are parameters of the curve, we apparently need to compute square roots to uncover $y$. I know how to recover $x$ from the compressed representation; just subtract $1$ if it is odd and divide by $2$ and that's the $x$ coordinate. My specification noted the formula: If $p$ is prime and congruent to $3$ modulo $4$, then finding square roots of an element $z\in\mathbb F_p$ is easy. $z^{(p+1)/4}$ is one root and the other is its negative. This confuses me: Why is this a square root and how do I implement this computation?


texts: Function F is not resistant to collisions

texts:
If we have the following block cipher, E(k,m), why is f(x,y) not collision resistant?
$$f(x,y) = E(y,x) \oplus y$$


texts: Publishing only items your subscriber previously subscribed to, without you knowing which those items are

texts:
Let's say you were given a dump from a security breach. You want to share the email addresses affected by the breach with a separate company who pays you for this service so that they can protect their users. Maybe it's a security company, or maybe it's a large retail store wanting to prevent accounts with shared passwords from being hacked.

The constraints are:

You cannot know anything about the company's users. They can't send you a list of email addresses that they want to subscribe to, because even if they are hashed you could discover the list and compromise the privacy of the company's customers. If you are dealing with a EU-based company, it's also against the law for them to share this if I understand correctly.
You don't want to send each company the entire list, only the list of emails that they subscribed to prior to the breach. You might initially be one of the only people given this dump- it's not publicly available- and you do not want the entire list to spread by an employee at one of these companies.

Is there a cryptographic means by which the company can declare to you ahead of time which addresses they are subscribing to, without you being able to decrypt this subscription and learn anything about their users, but by which you can construct a message to them when a breach happens such that they will learn only the addresses in the breach which were also in their prior subscription?

If they want to check the same breach against a larger set of emails (possibly for nefarious reasons), they would be forced to declare a new subscription. This new subscription should be useless to discover any new addresses based off previous communications based off the previous subscription. Then they request a new notification for the breach based on their new subscription. If their new subscription is not suddenly suspiciously large, you repeat the original process with the new subscription.

Bonus if it's possible for you to obfuscate the actual size of the breach when performing the sharing.

This seems like it's perfect problem for cryptography to solve. What are the possibilities at our disposal?


texts:
In the paper "A Toolkit for Ring-LWE Cryptography", the proposed public key system has (ignoring subtleties of the dual) Alice generate $a$ uniformly and $s,e$ from a discrete Gaussian, then output $(a,as+e)\in R_q\times R_q$. Bob generates $s_b,e_b$ from a discrete Gaussian, has $m\in\{0,1\}^n$, and outputs $(as_b+e_b,s_b(as+e)+m\lfloor q/2\rceil)$. Then Alice calculates:
$$s_b(as+e)+m\lfloor q/2\rceil - s(as_b+e_b)=s_be-se_b+m\lfloor q/2\rceil$$ Then Alice can decode away the $s_be-se_b$, since they are small, and recover $m$.

Since Eve has just as much knowledge of the ring as Alice does, Eve ought to have just as much decoding capability (she could generate the decoding basis, for example). So as far as I can tell, the reason Alice can decode the final message but Eve cannot decode $as+e$ to $as$ is that in the latter case, Eve isn't really decoding over a lattice at all, since $as+e$ is still in the lattice given by the ring (or its dual). But for Alice, she's decoding a vector in $R$ to a point in the lattice given by $qR$. So the Gaussian error is small enough that Alice can decode the final message, but large enough that Eve cannot "decode" $as+e$.

Is this a correct description of what's going on?


texts: Product of Vigenère ciphers is not a Vigenère cipher with length of LCM

texts:
I have always thought that using two Vigenère ciphers leads to another Vigenère cipher with key length of LCM (least common multiple) of the two previous Vigenère ciphers. But I have stumbled upon this problem:

  Let $\mathcal{V}_1,\mathcal{V}_2, \mathcal{V}_3$ be Vigenère ciphers with key length $l_1, l_2\in\mathbb{N}$ and LCM$(l_1,l_2)$. Prove that for some $l_1, l_2\in\mathbb{N}$ is not $\mathcal{V}_1\times\mathcal{V}_2\approx\mathcal{V}_3$.

I have tried with some lengths but it worked so that the product was Vigenère with length of LCM. Would you give me example of lengths for which it doesn't work?


texts: Security of .net AES implementation and security of a hash MAC

texts:
My question rather splits into two sections:

Is AES correctly and security implemented in the .net Framework?

Are there any reviews of implementation mistakes that would weaken the security of AES (e.g. against timing attacks)?
Error-checking with hash-then-encrypt

I have a file i wish to transmit (encrypted), and would like to confirm that decryption was successful. To do this, I plan to take a hash of the file, append it to the file, then encrypt this. After decrypting, the receiver can re-calculate the hash, and compare it to the value I sent over.

Is there a better way to check the decryption was correct?


texts: NIST STS randomness testing inconsistent results

texts:
I have generated the nine datasets according to this document for AES-128 and testing these for randomness using NIST STS. However, the results are inconsistent. Sometimes there appear a * in the result files and sometimes it doesnot. Even the result files show different values on multiple testing of the same file.
Why the behaviur is inconsistent?
Most of them times, test fails with a mrginal value e.g if passing crietria is 120/128, then result is 119/128 with a *. Can this marginal failing be ignored?


texts: I have a hard time understanding the purpose of ADATA in GCM algorithm. Is ADATA the plaintext itself we would like to encrypt or is it some random data as for the IV ? Otherwise from what I have understood so far, is that one cannot get the GMAC (i.e. Tag) of some plaintext unless he does encrypt it where the ciphertext is fed to the XOR function. Is that right?


texts: Is this a valid scheme to authenticate through a 'human-readable' certificate?

texts:
Let's say Alice wants to talk securely to Bob over the internet, and Eve is not only eavesdropping, but has managed to get into a MITM position.
In this scheme Alice and Bob exchange $n$ (example $n = 2$) plaintext questions, at least one for both parties (these are toy example questions):

Alice, what brand of car did I ride you to the airport with last December?
Bob, what's the serial number of the flashlight I gave you yesterday?

Is it then secure for Alice and Bob to attempt to use authenticated encryption under key $H(A_1 || \dots ||\ A_n ||\ S)$ where $A_n$ is the answer to the $n$th question (both parties will include the answers to their own questions), $S$ is a cryptographically strong salt, and $H$ is a slow key derivation function like scrypt?
This will only work if the answers are the exact same, so let's assume the answers have exact unambiguous answers.
Then, using this (seemingly temporarily secure) authenticated channel, can Alice and Bob exchange long-term proper crypto authentication certificates to foil Eve's future attempts at MITM?
Obviously, security can only be as good as the quality of the questions, so let's assume that Eve does not know the answer to any of the questions until the long-term exchange has completed, but we must assume Eve will be able to figure out the answers at a later time.


texts: Predicting PRNG given some of its previous output

texts:
I a have a question about PRNGs and this is my very first experience with them. I have the following generator that takes a 56-bit seed $p$ during initialization and then chooses both $X$ and $Y$ randomly from the interval $[0, p]$.

Every time it is called, it returns the output of the next function:

def next(self):
    self.x = (2*self.x + 5) % self.p
    self.y = (3*self.y + 7) % self.p
    return (self.x ^ self.y)

I have the first 9 outputs of the generator and I need to predict the next output.

prng_output = [210205973, 22795300, 58776750, 121262470, \
           264731963, 140842553, 242590528, 195244728, 86752752]

I have thought of the solution which turned out to be correct by very slow, so apparently there must be another way to solve it.

My solution was to constrain the range of values for $p$ according to the given output. Also, generate all values for $X$ and for every value of $X$, calculate the first 9 values according to the previous equation and XOR it with the output to get $Y$. Finally, check of the sequence of $Y$s is valid or not (also according to the previous equation).

After some reading I learned that a reduced state (reduce the number of bits) of the generator can be determined.

So my question is how to crack the given generator, what is the "reduced state" of the generator, and how can I use that "reduced state"?


texts:
I have a system comprising N >1000 nodes.  At each node I would like to use HKDF to derive a unique 256-bit key, Kn (for the nth node), from a pre-shared master key, K0, and a locally-generated random bit string, Rn.

Kn would then be used to apply AES-GCM to UDP packets that the nth node sends to other nodes and the receiving nodes would independently derive the necessary Kn using K0 and Rn, which would be included in the packet header and protected as “additional data” by the AES-GCM MAC.

The HKDF implementation takes the following parameters…

Hash type: SHA256, SHA384, SHA512, BLAKE2B
Input key of arbitrary length (presumably K0)
“Additional Info” of arbitrary length (optional, but presumably Rn)
Salt of arbitrary length (optional)

My questions are:

What would be a good choice for the hash type?
What is a sufficient length for K0?
What is a sufficient length for Rn?
What is the purpose / benefit / need of the optional Salt?  Is it okay to omit assuming it can't be sent in the clear or pre-shared?
Any other general flaws / issues / recommendations w.r.t. this approach?

Thanks.


texts: I feel like I am missing some information regarding salting.  How does one choose the salt? If you reuse the same salt for all passwords, can it just be figured out and then used in conjunction with normal brute-forcing.  And what are the common ways to generate the salt?


texts:
RFC 7693 provides the following table of standard parameter sets for BLAKE2b without a key (where nn is the hash size in bytes):

|             | Collision | Hash |
| Algorithm   |  Security |  nn  |
+-------------+-----------+------+
| BLAKE2b-160 |   2**80   |  20  |
| BLAKE2b-256 |   2**128  |  32  |
| BLAKE2b-384 |   2**192  |  48  |
| BLAKE2b-512 |   2**256  |  64  |

However, for BLAKE2b with a key it only notes that the key length kk must be in the range 0 <= kk <= 64 bytes. The BLAKE2 documentation  doesn't seem to provide any more detail.

In RFC 2104, the definition of HMAC includes specific recommendations for the key length (where B is the block length and L the length of hash outputs of the hash function H):

  The key for HMAC can be of any length (keys longer than B bytes are
  first hashed using H).  However, less than L bytes is strongly
  discouraged as it would decrease the security strength of the
  function.  Keys longer than L bytes are acceptable but the extra
  length would not significantly increase the function strength.

Questions:

What are the recommended combinations of key length and output length for BLAKE2b as a MAC to get the usual 128-/256-bits of security?
What is a good way to estimate the bits of security provided by other combinations?
What is some good reading material that covers questions like this, since the audience of the RFC is clearly assumed to know such things?


texts: Can $y^2=x^3-x+1$ elliptic curve with $GF(3^m)$ where $m=97$ be used for Diffie Hellman key exchange?

texts:
I am new to ECC. I have just read about the elliptic curve $y^2=x^3-x+1$. I am copying the exact line

The elliptic curve is super-singular $E:y^2=x^3-x+1$ in affine coordinates defined over a Galois field $GF(3^m)$, $m=97$, whose irreducible polynomial is $x^{97}+x^{12}+2$.

Now I have three questions.

How is this curve different from than ordinary elliptic curve $(GF (2^m))$?
Can this graph be used to implement ECDH?
How secure is this curve compared to NIST's recommended curve parameters?

Thank you in advance for your help.


texts:
I'd like to have a peek at the firmware of a piece of Hardware. Its firmware is available as a .wav file to be uploaded via audio jack.

https://drive.google.com/open?id=0B6S_PcWWM1YlQnNwT2FSMnFzVE0

And it sure looks like straight forward frequency modulation. I think I can even make out a pattern: useful signal (8 waves, then 4 recurring waves as separator) and once in a while (didnt count the "bytes" inbetween) 0.5ms of unmodulated signal as a newline marker maybe?

Is there a software available to decode this? Or a name for me to start reading?
Got matlab ...


texts: Why does the image histogram with ASCII text embedded look this way?

texts: I used histogram attack on image with embedded text ASCII(LSB-method) and found the chi square value. All observed frequencies more than expected frequencies, that is tipical for empty image, and have almost the same difference. Also the p-value is too big, though the data is embedded. Why do we observe this phenomenon?


texts: AES Key Generation based on database guid

texts:
I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since the data being encrypted is personally identifiable information (PII) and the requirement is to be PII compliant, I am encrypting it all with AES256-CBC were the IV is generated randomly at each encryption and data is stored in a binary field in this format

<version><IV><encrypted data>

the version field is for future use should I need to change encryption/decryption algorithm, the IV is random and then the encrypted data.

as for the AES key, I am hashing the company GUID the database record belongs to using SHA256 (resulting in the same key on each server that is trying to decrypt the record from the DB)
I am unable to use SQL encryption for various reasons and must use code for encryption/decryption.

Is this PII encryption scheme secure? Any downsides? I know that no matter what key generation code I build, a hacker if he is already on my server could use a debugger or look at the .NET IL to decode what I am doing. That said, if he only gets the raw data from the DB is that data secure?


texts: Honestly I'm really confused about padding in RSA scheme. I don't study computer science, and I'm a beginner learning cryptography (self-taught). Can anyone  give me suggestions?


texts: Why do digital signatures use a hash algorithm instead of a checksum?

texts:
Based on my knowledge, all digital signature algorithms use a hash function to sign a message, and then encrypt the hash result. So why do these algorithms not use a checksum instead of a hash algorithm? By the end, both are going to encrypted, correct?
A checksum is faster than a hash algorithm.


texts:
FIPS 186-4 mentions two standards for RSA: PKCS #1 and ANS X9.31. PKCS #1 is used with SSH, X.509, etc. What is ANS X9.31 used with?

FIPS 186-4 has the following line:

  ANS X9.31, Digital Signatures Using Reversible Public Key Cryptography for the Financial
  Services Industry (rDSA), was developed for the American National Standards Institute by the
  Accredited Standards Committee on Financial Services, X9

So maybe it's used in proprietary finance applications? Are there any open standards that actually use it?


texts:
I'm trying to figure out block ciphers and this is the first time I've encountered the term "oracle adversary". It appears in the context of defining a PRP and a PRF. Can someone please explain what an "oracle adversary" can/cannot do? Or maybe help out with a link or something (I've tried looking it up myself, but I could only find the RSA Laboratories RSAES-OAEP Dictionary, which doesn't really clear things up).

Here's the context:

  (Pseudo-Random Function). A family of functions F : {0, 1}^k × {0, 1}^n → {0, 1}^n is pseudo-random if for all polynomial time oracle adversaries $A$, $$
\left|
\Pr_{K} \left[ A^{F_K(\cdot)} = 1 \right] -
\Pr_{R:\{0,1\}^k \rightarrow \{0,1\}^n} \left[ A^{R(\cdot)} = 1 \right]
\right|
$$ is negligible.


texts:
Today I was having a discussion with my cryptography lecturer about the keyspace of a ROT-13 cipher. He argues that the keyspace is 0 because it doesn't have a key.

Could anyone explain to me why the keyspace is 0 and not 1? I could understand if he said that it doesn't have a keyspace but I don't understand why it could have a keyspace of 0.

I was further confused when he said that it was possible for a cryptographic function to have a keyspace of 1. Could someone give me an example of a cryptographic function with a keyspace of 1 and explain how it is different to one with a keyspace of 0?

I feel fairly confused about something that seems like a pretty basic concept.

Thanks for any help.


texts: Is there a security proof for the Triple-DES construction in the ideal cipher model?

texts:
Suppose one has an ideal block cipher

$E \: : \: \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^k \times \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^w \: \to \: \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^w \;\;\;$ and $\;\;\; D \: : \: \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^k \times \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^w \: \to \: \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^w$.

One can obviously follow the Triple-DES construction with that block cipher and keying option $n$, to get the block ciphers

$\operatorname{enc}_n \: : \: \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^{(4-n)\cdot k} \times \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^w \: \to \: \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^w \;\;\;$ and $\;\;\; \operatorname{dec}_n \: : \: \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^{(4-n)\cdot k} \times \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^w \: \to \: \{0,\hspace{-0.04 in}1\hspace{-0.03 in}\}^w$.

One can easily show that is takes $\:$$\Theta$$\left(2^k\right)\:$ queries to $E$ and $D$ to break the security of $E\hspace{.02 in}$.

Regardless of which keying option is used, $\:\operatorname{enc}_n\:$ will be at least that secure.

For $\:n\in \{\hspace{-0.02 in}1,\hspace{-0.02 in}2\hspace{-0.02 in}\}$, is it known that $\:\operatorname{enc}_n\:$ will be a PRP family against adversaries that can make significantly more than $2^k$ queries to $E$ and $D\hspace{.03 in}$?


texts: Are there any publicly available Serpent s-boxes of a non-linear order 3, optimized for x86_64?

texts:
The original serpent paper claims that the s-boxes provided are of non-linear order 3, the maximum. However, this has turned out to be false, as some of them are of order 2.

Are there any s-boxes available for serpent that comply with the properties indicated in the paper, and ideally, optimized for x86_64 architecture ?

If not, how could one find strong s-boxes that both respect those properties and are resistant to known attacks against serpent ?


texts:
Is it okay to bail out early when length mismatch is detected?

Specifically, when verifying authenticated encryption, is it okay to bail out early if the wrong amount of ciphertext or the wrong amount of associated data is given?

As I understand it, these two are generally public quantities, and so this does not result in a timing attack.


texts: Do aes_256_gcm IVs just need to be unique for that key?

texts:
I'm using GCM (via openssl's EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))).

The IV's default length is 12 bytes.

It says that the IV must be unique, in the context of a particular key.

Does it matter if the IV is smaller or predictable?  I intend re-using a 64-bit sequence number and a 64-bit millisecond timestamp as an 8-byte IV.  So long as a restart introduces a 1ms delay, there can be no duplicate IVs.  (I will guard against 1970 timestamps.)

Is it necessary to add in some random bytes?  (These would need to be transported along with each message; I'm trying to keep the messages as small as is securely possible.)

If so, how many random bytes?


texts: What is the main difference between Unique signature and Verifiable Random Function?

texts:
The output of VRF contains two parts, the first is the output of the VRF hashing and the second is the proof of correctness. In a unique signature scheme, the signature also contains two parts which are similar to the VRF.

The previous works pointed out the VRF can be obtained via a unique signature, but in general, they have the same outputs, so I am confusing what are the main differences between them? Is there a generic framework of how to construct a VRF from the unique signature? Or we can say, once obtained a unique signature, then we can say it is a VRF?


texts: Why was the winner of the AES competition not a Feistel cipher?

texts:
The winner of the AES competition has a structure that does not qualify as a Feistel cipher, as explained in answers to this recent question.

However, most many of the AES candidates, and all 3 out of 4 some other finalists (Twofish, MARS) are Feistel ciphers, if we define that as a cipher transforming a block of data using a number of rounds which each can be expressed as:

split all the bits of the block $B_j$ into two disjoint portions $L_j$ and $R_j$ (typically of equal size);
compute some (typically round-dependent) function of $R_j$ and key with output $F_j$ of same width as $L_j$;
compute  $L_j'=L_j\oplus F_j$ where $\oplus$ is binary addition with removal of some carry bits (e.g. exclusive-OR, where all carry bits are removed);
recombine bits of $L_j'$ and the unmodified $R_j$ into a new block $B_{j+1}$.

Note: Serpent and RC6 can not be put in this framework (thanks to @Reid and @J.D. for pointing that). Neither can Rijndael/AES.

At the time of the AES competition, Feistel ciphers already enjoyed a well understood theory. In particular DES was among them, and essentially unbroken in practice except for its small key and block size. It would seem that proposing anything else than a Feistel cipher would be an uphill battle.

Yet, Rijndael won the AES competion, and does not fall under the above definition. Did a desirable characteristic of Rijndael made it preferred to the other candidates despite the apparent drawback of using a relatively untested structure? And if that characteristic could not be matched by a Feistel cipher, why?


texts: Contruct a protocol to determine if three secret keys are different, without revealing any of them?

texts:
I am trying to find a protocol for this problem:

Three persons, $A$, $B$, and $C$, know secret numbers $s_{A}, s_{B}$, and $s_{C}$, respectively. They want to know whether their numbers are all different, but none of them wants to reveal his number to any of the others.

If there are equal numbers between the three, this fact should be known, but no one shall discover which numbers are equal.

There is no trusted center (i.e. they can't use a fourth party doing calculations or similar), they only can communicate with each other.


texts: How will be cipher selected when client is running on version TLS 1.3 and server is running on TLS 1.2?

texts:
How will be cipher selected when a client is running on version TLS 1.3 and server is running on TLS 1.2?

The cipher list provided by TLS 1.3 client will be different than the version supported on the TLS 1.2 server.


texts: I've read the Bitmessage whitepaper and I found it rather lacking on the details, but it promises anonymous routing. Can it be considered a variation on mix-networks, where each peer acts as a mix-node?


texts:
Stream ciphers are vulnerable to replay attack if the same key k is used.

If E() is a stream cipher and an attacker intercepts the message m that's being transmitted at time t, how can the attacker compose an encryption of the following for any value of t?

E(k,t || m)

context: An Unilateral Authentication using Time-stamp


texts: Can I verify that digital object exists before a given date?

texts: It is possible to hash public info (e.g. new york times headline) into an object to verify that it existed after a given date. Is it possible to do the obverse, namely verify that an object must have existed before a given date?


texts: Why does xor-ing a second key into the plaintext of a blockcipher not improve security?

texts:
Let us assume that we have a very large number of known plaintexts.

How can we prove that $c= DES(K1,M \oplus K2)$ offers no advantage compared to DES?


texts:
Has anyone come across any implementations of Ntru TLS? I'm working a project for uni that does quantum secure encryption. It relies on a mix of Ntru & AES, but I can't find an implementation of Ntru TLS anywhere. (CyaSSL claims to have one but it needs a license to compile, I've contacted them, waiting to hear back)

Specifically, the following ciphers:

TLS_NTRU_NSS_WITH_RC4_128_SHA
TLS_NTRU_NSS_WITH_3DES_EDE_CBC_SHA
TLS_NTRU_NSS_WITH_AES_128_CBC_SHA
TLS_NTRU_NSS_WITH_AES_256_CBC_SHA
TLS_NTRU_RSA_WITH_RC4_128_SHA
TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA
TLS_NTRU_RSA_WITH_AES_128_CBC_SHA
TLS_NTRU_RSA_WITH_AES_256_CBC_SHA

Or – even better – has anyone encountered any type of SSL/TLS implementation that doesn't rely of the discrete logarithm problem, factoring prime numbers, or elliptic curves? I've scoured the internet and come up with nothing.


texts: Is it safe to use MD5 in a proof of work system?

texts: Here is the POW system: you are given a string and you need to compute a suffix so that first few bits of the MD5 value are all 0. I know MD5 is collision vulnerable, but is it safe to use MD5 here, or, state it in another way, is there a non-bruteforce way to compute the suffix?


texts: Do asymmetric signatures require constant-time verification?

texts:
To avoid a timing attack, HMAC signatures are usually compared in constant-time (every byte is compared, and the results aggregated).

Is the same necessary for asymmetric signature algorithms such as ECDSA or RSA?


texts: Why is double encryption that's equivalent to single encryption no better than single encryption?

texts:
In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about DES algorithm the authors say that:

  "if a cryptosystem is such that double encryption is equivalent to a single encryption, then there is no additional security obtained by double encryption"

Why is this?


texts: Malicious DH parameters without using composite numbers

texts:
I know that it's possible to generate DH parameters that lead to it being easy to attack (e.g. trivial composite numbers), but is it possible to create a malicious parameter that is not a composite number (and thus passes an arbitrary number of Miller-Rabin tests) but still makes attacking the DH group easy? It should be trivial to detect if the parameters have been generated to intentionally fall victim to the small subgroup attack, and the SNFV becomes impractical with realistic key sizes.

Questions similar to this have been asked before, but they seem to focus on composite numbers.


texts: Is there a cumulative commitment scheme?

texts:
For a certain application I need a commitment scheme where each user could make a commitment, and a single verification operation could verify all the commitments simultaneously, faster than single verifications. It's like a batch verification of signatures but we are able to build each commitment based on the previous one (that's not the usual case for batch verification of signatures)

Formally:
Each user i, makes a commitment $C(i)$ to a value $x(i)$, as $C(i):=Commit(C(i-1),x(i),open(i))$, with $open(i)$ the randomness used for computing the commitment, or nothing if the scheme is deterministic. $C(0)$ is an initial value.

Then $CheckReveal(C(n),x(1) .. x(n),open(1) .. open(n))\ $ verifies the commitment equations very fast (e.g. $O(\log(n))$ modexps or $O(1)$ modexps).

Obviously the simple scheme $C(i)=C(i-1)^{x(i)} \mod p\ $ does not work, because two parties $i$ and $j$ (in collusion) can now change their commitments setting $x'(i) = x(i) · k$  and $x'(j) = x(j) · \frac{1}{k}$.


texts: Private set intersection, using a semi-trusted server

texts:
Alice has a set $S$ of words.  Bob has a set $T$ of words.  They want to compute the intersection $S \cap T$ of their words, with the help of a semi-trusted third party Trent.  Trent runs a central server.  The server is normally well-intentioned and not malicious.  However, we are concerned about the risk of server compromise: a hacker might be able to break into the server, download all data stored on the server, and even control the server for a limited period of time.  Our primary security goal is to make sure that an attacker who manages to compromise the server cannot learn the set $S$ or $T$.  Also, neither Alice nor Bob should need to receive a copy of the other person's set (apart from the intersection).

I am aware of a super-simple protocol for this problem.  Trent picks a random symmetric key $k$ for a pseudorandom function (PRF).  Alice and Bob apply the PRF with key $k$ to each of their words and upload the result to Trent's server.  In other words, Alice computes the set $S^* = \{F_k(s) : s \in S\}$ locally and uploads $S^*$ to the server, and Bob uploads $T^* = \{F_k(t) : t \in T\}$ to the server.  Now the server can help them find the intersection: the server computes $S^* \cap T^*$ and sends it to Alice and Bob, and this will be enough for each of them to recover the intersection $S \cap T$.  This protocol is practical and has the benefit of being very easy to explain.  It is basically an application of (keyed) one-way hashing.  And, as long as the key $k$ is not stored on the central server, compromise of the central server does not lead to a violation of the confidentiality goals.

My question: Is this super-simple protocol approximately optimal?  Or is there some other protocol that provides even better security?  I'm familiar with all of the sophisticated protocols for private set intersection.  Do any of them offer any security advantages for this particular setting?  I'm most interested in practical benefits, rather than theoretical/foundational considerations.

This arises from a real-world problem involving data matching (matching of voter registration lists between multiple states, if that's relevant).


texts:
I haven't been programming much lately, so I figured I would make an encrypted instant-messaging program (read: Skype clone) with groups to hone my skills. That's not important though, I can do that. The problem is that I know almost nothing about cryptography, so I figured I'd ask here so I don't discover down the road that my way of doing crypto is all wrong and I have to remake everything.

Here's my plan:

When a client connects, it generates a keypair (or loads one from disk) and sends the public key off to the server.
The server broadcasts the public keys of everyone in a group chat to everyone else.
When a client sends a message, it encrypts (with NaCl's crypto_box) the message many times, once with each public key. Then it sends all of them off to the server, including information about which encrypted message goes to which client.
The server simply forwards the messages to the recipients, and the recipient decrypts it with his own private key and the sender's public key (again with NaCl's crypto_box).

There will of course be authentication, so someone can't just send their public key to the server, pretending to be someone else.

I have no idea how secure that method is, or if it can even work. If this is not optimal, how would you do it?


texts: Why does ε-differential privacy protect the subset of 1/ε edges in terms of graphs?

texts:
In the book The Algorithmic Foundations of Differential Privacy by Cynthia Dwork, Aaron Roth on page 24, databases that take the form of graphs are discussed.

We could on the other hand consider differential privacy at a level
of granularity corresponding to edges, and ask our algorithms to be
insensitive only to the addition or removal of single, or small numbers
of, edges from the graph. This is of course a weaker guarantee, but
might still be sufficient for some purposes. Informally speaking, if we
promise $\epsilon$-differential privacy at the level of a single edge, then no data
analyst should be able to conclude anything about the existence of any
subset of $1/\epsilon$ edges in the graph. In some circumstances, large groups
of social contacts might not be considered sensitive information: for
example, an individual might not feel the need to hide the fact that
the majority of his contacts are with individuals in his city or workplace,
because where he lives and where he works are public information. On
the other hand, there might be a small number of social contacts whose
existence is highly sensitive (for example a prospective new employer,
or an intimate friend). In this case, edge privacy should be sufficient
to protect sensitive information, while still allowing a fuller analysis of
the data than vertex privacy. Edge privacy will protect such an individual’s sensitive information provided that he has fewer than $1/\epsilon$ such
friends.

How do they derive the number $\large\frac{1}{\epsilon}$ in this discussion? Does the amount of $\epsilon$ still stand for privacy loss? Thanks for your help in advance!


texts:
If a hash function is written:

Hash(Hello||World)

Is that equivalent to Hash(Hello) +  Hash(World) or Hash(HelloWorld) ?

Similarly, is there any difference between Hash(Hello||World) and Hash(Hello,World)?


texts: Pair-friendly elliptic curves vs non friendly

texts:
Group law operations on pair-friendly elliptic curves are slower than in non friendly elliptic curves, but how much slower? Can't seem to find a performance comparison between the two for a given security parameter.

And what is the most efficient curve of each group?


texts: Why $f(x)=x^e$ is a bijection i.f.f $e\in{\mathbf{Z^*_{\phi(N)}}}$?

texts:
I understand that if $e\in{\mathbf{Z^*_{\phi(N)}}}$ then $\gcd(e,\phi(N))=1$
and if $e\not\in{\mathbf{Z^*_{\phi(N)}}}$ than $\gcd(e,\phi(N))\neq{}1$.

But I couldn't figure out why this implies bijection of $f(x)=x^e$.

I also tried to see examples but that didn't help me to explain the phenomenon.


texts: How useful is NIST's Randomness Beacon for cryptographic use?

texts:
NIST have just launched a new service called the NSANIST Randomness Beacon. It has been met with some initial skepticism. Perhaps the cryptography community would have used it before June 2013 when NIST had a trusted reputation. At first I thought it was a mistimed April Fool's joke, however it actually appears to be an ongoing serious project.

I am intrigued as to the potential uses of this randomness beacon and serious cryptographic applications that this service could legitimately provide, given that this service is potentially hostile and probably under adversarial control. I am assuming that using it for private cryptographic keys is out of the question.

I'll quote a few things from the specification in the Uses section that raised an eyebrow for me:

  First, the Beacon-generated numbers cannot be predicted before they are published. Second, the public, time-bound, and authenticated nature of the Beacon allows a user application to prove to anybody that it used truly random numbers not known before a certain point in time.

However this feature can not be true because:

  The Beacon will broadcast full-entropy bit-strings in blocks of 512 bits every 60 seconds.

So while normal users won't be able to predict the random numbers, in that 60 second window someone with a privileged access inside the NIST (or NSA) could easily have access to the next random bit-string a full 60 seconds before it has been "published". If this adversary with insider access were to become one of the regular users of an application using this beacon they would have knowledge of random numbers before other users providing a significant advantage depending on the type of application.

Given this information, what actual safe, fair and useful cryptographic uses could this potentially compromised beacon provide?


texts: Hash based stream cipher where the input is a constant, key, nonce and counter

texts:
This is a question out of curiosity !

A hash function produces an output that is considered computationally infeasible to reverse.

Let's consider, for the sake of illustration purposes a tried and tested hash function like SHA 256, belonging to any of the families ( 2 or 3). Since the block size for SHA 256 is 512 bits or 64 bytes, we could fill it in the following way, inspired by the ChaCha20 stream cipher.

cccc cccc cccc cccc kkkk kkkk kkkk kkkk kkkk kkkk kkkk kkkk bbbb nnnn nnnn nnnn

c - some fixed constants
k - key
n - nonce
b - counter (32 bits)

Each letter strings corresponds to a byte.

NOTE : The constants could be sacrificed for nonce bytes, hence facilitating a random IV, of bit length >= 128 bits. The counter could also be made to support 64 bits the same way.

We could generate $2^{n} . (blocksize/2)$ bytes of pseudo random key stream, that could be XORed with the plaintext to get ciphertext, where $n$ is the bit length of  the counter, $blocksize$ is the block size (in bytes) of the hash function, used.
In this case $blocksize$ is 64 for SHA 256...

Let the counter used be $n$ bits. There are $2^{n}$ possible values for the counter. Since output of the hash function   is $blocksize / 2 $ bytes for any individual value of the counter, the scheme can generate a maximum of $2^{n} . (blocksize/2)$ bytes.

Here $n = 32$ so we get, $(2^{32}) . (64/2)$ bytes.

I realize that, giving $x$ bytes of input (where $x$ = len(constants) + len(key) + len(nonce) + len(counter) ) and getting $x/2$ bytes as output from the hash function is a kind of inefficiency (SHA - 256), given the fact that the hash function has to run once more (for every input block of size $x$, (additional data of size $x$)) with MD complaint padding information (byte 0x80 followed by $55$ null bytes, and $8$ byte length encoding) . That could cost double CPU clock cycles, for every call to a stream generating function.

In the case of SHA 256 $x = 64$ bytes.

Also,
This scheme, is extremely inefficient compared to other stream ciphers available like Chacha20 / Salsa20 !

But,

Is this a good scheme ?
What are the possible security flaws,    (theoretical/implementation)
in this protocol?
If this is secure, can this scheme offer $256$ bit security ?
What are the possible Quantum attacks on this scheme ?
Since SHA-256 family of hash functions is immune to side channel attacks, will that be an added advantage?

Every advice and guidance, will be greatly appreciated! :)


texts: Only allow specific types of data to be transmitted via an end-to-end encryption service

texts:
I have a service that allows multiple parties to share domain-specific textual data. This data is also end-to-end encrypted. How can I be sure the sharing parties don't send non-domain-specific data, considering I receive it encrypted?

For example, assuming I require a specific algorithm to be used for the encryption, is there either:

a zero-knowledge proof that would verify that the original data matches a given regular expression

or

a homomorphic identity operation that, applied to valid domain-specific encrypted data, would result in no change to the data, but applied to anything else, would result in undecryptable garbage


texts: How to provide integrity even though using Authenticated Encryption?

texts:
Gilles made the following comment here:

using authenticated encryption does not guarantee integrity, only authenticity. You can't detect a rollback.

From what I gathered:

Authenticated Encryption provides authenticity of the data see here.

Authenticated Encryption is basically computing a MAC at the same time as you encrypt see here.

We have the usual 3 properties as follow:
confidentiality: only the authorized users can read the data (and understand it).
integrity: the users have the guarantee that the data have not been modified, or in other words only the authorized users can modify the data.
authenticity: the users have the guarantee that the data/entities are who they are (this is different from identification).
Gilles' scenario is the following:

Our beloved Alice store some data on a server, using Authenticated Encryption.
At some point Eve hacks into her server and take a copy of the encrypted data.
Alice store some data again on the server, still using her secure Authenticated Encryption.
Eve replace the data by the ones she took earlier (thus the tag is still valid).

Therefore we have a rollback. Bob accessing the data can see that they are authentic, i.e. they do come from Alice.
Can we consider that the integrity of the data is preserved or not ?
At the same time they have been modified (the replacement) but the previous data have not been modified (in order to keep the Authentication Tag valid). Should the property of integrity not being preserved in this case?
Is there any scheme at all that provide such property or is it something that should be provided using another way (e.g. a version system that is not kept at the same place as the data) ? In other words, is there any Encryption scheme that allows to detect roll backs (as far as I know, there isn't) ?

I do see that if the data have been modified then the Authentication is not provided anymore as the tag won't match. Or from a logical point of view:
$$\neg Integrity \implies \neg Authenticity$$
thus using the logical contraposition we get:
$$Authenticity \implies Integrity$$
Which seems to contradict Gilles' comment.


texts: Lamport-Diffie + attempting to invert OWF

texts:
I am studying Lamport-Diffie signature scheme and in my lecture present the follow algorithm  for attempting to invert the one way function $f$, where $f$ is used to compute the public key of this signature from the private key $sk=\left(\begin{array}{rrrrrr}
x_{1,0} & x_{2,0} & \cdots & x_{l,0} \\
x_{1,1} & x_{2,1} & \cdots & x_{l,1}
\end{array}\right)$. My question is Why will be possible execute the sentence 2, if $x_{i,b}$ are part of private key?


texts: What are the problems with Diffie-Hellman groups 3 and 4 (RFC 2409 + RFC 2412)?

texts:
In RFC 2409 and RFC 2412 Diffie-Hellman groups 3 and 4 were defined.
These are groups over elliptic curves based on Galois Fields with   and  elements respectively.

I know that these sizes are considered as too small for modern cryptography.

But anyway, there is very little info about these groups on the internet. Are there other reasons besides the fields' sizes for not using these groups?


texts: Is digest=HASH(HASH(a)+HASH(b)) equivalent to publishing two digests?

texts:
Is combining digests (created using a hash function) using arithmetic addition, and then hashing and publishing the result, less secure than publishing the set of digests?

Does the answer change if the outer hash function is different from the inner function?

I am working on a proposal for Bitcoin to enable m-of-n signatures for transactions, and am considering using a 160-bit digest of the public keys computed as:

digest = RIPEMD160(SUM(SHA256(public_key_n)))

The number of public keys involved will typically be less than ten, and will never be more than 20.  The order of public keys is irrelevant, I am just concerned with an attacker finding another set of public keys that hash to the same digest.


texts: Does some method exists to decrypt using some encryption keys (not all)

texts:
I'm searching for a method/algorithm that is able to manage different encryption keys and guarantee that some subset of that keys is needed to perform the decryption (not all).

For example:
$$D_{K1, K2}(E_{K1, K2, K3}(X)) = D_{K1, K3}(E_{K1, K2, K3}(X)) = D_{K1, K2, K3}(E_{K1, K2, K3}(X)) = X$$

A real-world like example is where I have a bank account shared with my life, and I needs to withdraw money given only one sign.

So, used $$K_i \ with \ i \in {1, 10}$$ to encrypt some message, I need only $k<10$ keys to decrypt my message.


texts: Would a "Triple AES" (in the sense of how Triple Des works) serve for a dramatic increase in safety?

texts:
The system requires to be as paranoid as possible regarding security. One of the few contemplated changes to the current design is to use multiple encryption. First proposal was to use Serpent on top of AES-256, but after looking into it, it seems like a triple AES could also serve the purpose.

So the options are:

Encrypted(Input) = AES256(key2, Serpent(key1, Input))

And

Encrypted(Input) = AES256Encrypt(key3, AES256Decrypt(key2, AES256Encrypt(key1, Input)))

Where all keys are independent and randomly generated.

In performance tests with input that is supposed to be representative of what I would find in production second option (a triple AES) outperforms using Serpent, being around 20% faster.

As far as I'm aware, even though DES is completely broken, Triple DES still sustains a moderately safe resistance, even though one can use theoretical meet-in-the-middle attacks. So, even though I haven't spent much time on this, even if AES was somehow broken within the next 15 years, this would still offer a significant protection to the data (I would be expecting around 512 bits). Is this a correct assumption?

I've normally just gone standard in the past (sha256 with salts for stored passwords, aes 256 with secure random keys and ivs, and 4k rsa when asymmetric encryption is possible), so I never explored more complex escenarios until the past few days, so I apologize for my probable incorrect conclusions.


texts: Using authenticated encryption along with signing

texts:
I know of a project that implemented e2e encryption using both authenticated encryption and public key signing. So the ciphertext produced for a message would be:
ciphertext = signature_Ed25519 + nonce + mac_Poly1305 + XSalsa20(plaintext)

I struggle to understand what the benefits of doing both could be, as MAC is already there to authenticate the sender. Any ideas?

The full flow is as follows:
Alice and Bob each have an X25519 encryption key pair for talking to each other.
Alice has an Ed25519 signing key pair that is used for everybody.

Alice sends a message to Bob:
1. encrypted = crypto_box(plaintext, nonce, bob_publickey, alice_secretkey)

This is provided by crypto_box().
encrypted is now = nonce + mac_Poly1305 + XSalsa20(plaintext)
2. ciphertext = crypto_sign(encryted, alice_signing_secretkey)

This is provided by crypto_sign().
ciphertext is now = signature_Ed25519 + encrypted


texts:
My professor showed us the basics of DES, and then displayed this slide where the Complement Trick can be used as a way of cracking DES.

Could someone explain the math to me please?


texts:
With the curve secp256k1, the order of the twist is 3×197×1559×96769×146849×2587814237219×375925338294461779×101009178936527559588563023359
But I can't understand what is formula of this twist(twist is not standart).
Article were "formulated" this twist - https://www.di.ens.fr/~fouque/pub/fdtc08.pdf


texts: Does AES-GCM without security tag turn into regular CTR Mode?

texts:
We are looking to implement a simple password based key agreement scheme. Part of this is deriving a symmetric key from a common passphrase known to both parties involved.

This symmetric key is then used to encrypt an ephemeral public key A and the resulting ciphertext is then sent to the other communication partner who does the same with his public key (B). Both sides then calculate the common secret using a regular Diffie-Hellman approach (both sides also include two additional static keys)

Both sides then complete a key confirmation step in which they assert that the common secret is indeed common and no man in the middle is between them.

Since the public keys A and B are randomized, an attacker should not be able to run a brute force attack on the password used to derive the symmetric key since an attacker should not be able to determine whether he has succesfully guessed the correct password as the output of the decryption function should also be random no matter what key is used to decrypt the random public keys.

Is this a safe assumption to make?

Now to the question stated in the subject line:

There is already an implementation of an AES-GCM mode as authenticated encryption scheme in existence to ensure integrity and confidentiality of exchanged ciphertexts. As stated in the previous paragraph this mode of operation would allow an attacker to have access to a sort of oracle to start an offline attack on the password used during the encryption process of the public keys and is therefore not suitable for that specific task.

The question therefore is:

If we use the implemented AES-GCM mode but without security tag (TAG_SIZE 0 bit) does this make the cipher behave like regular CTR mode as to the attacker can no longer start guessing passwords and knowing whether he has guessed the correct one and thereby losing this potential oracle?

/edit: To clarify: We plan to implement EAP-EKE as key exchange protocol (https://tools.ietf.org/html/rfc6124) I thought this to be not essential to the question in the title. In my understanding the protocol relies on the described behaviour (not being able to distinguish a correct password guess from an incorrect one) to guard against dictionary attacks on the password.


texts:
We implemented a rc4 (ARC4) variant for creating a cryptographic stream - question is:
Is this sound?

(I'll give an example for 32 bit variant, though 64 bit/larger is possible)

Algorithm is as follows:
We have an array of integers A (32 bit) and array of 8 bit numbers B.
Perform a round of rc4 to mix the B array positions.

We then shift the values of B into A, ie for 0..255, A[i]=(A[i]<<8)|B[i];
We rerun that 4 times such that each integer has 32 bits of random positions.

We keep A and B, we then pass the B keystream (arc4) through the A mixer.
Given a 32 bit value of "hash":

      hash = (hash>>8) ^ A[ arc4(B) ];

Thus the 8 bit arc4 is looking up 32 bit values, and XORing with the previous value of hash.
We then say the

       output= (hash)&0xff;

The output of the stream then is a nonlinear mix of the last 4 values of the arc4 algorithm.

Question:  Would this 'fix' the rc4/arc4 holes/issues that have been reported?

What is the cryptographic opinion of the community on the soundness of this algorithm?

Many thanks.


texts:
This seems like quite a dumb question, but I really don't know if I'm finding a answer anywhere. I understand that if i access a website that is secured with TLS, we exchange ciphersuites and so on, then decide on what algorithms to use. But, specifically, what is an example of a specific MAC my browser could use with a website secured with TLS? I mean the MAC itself and precisely how it works and so on?

Thanks!


texts: Proper uses for CTR and CBC AES block cipher modes

texts:
Assuming the following:

Key is randomly generated is being used (32 bytes+)
IV is also randomly generated
Crypto random key generator is used
Data being encrypted contains common bytes like { } and " and keys (like JSON)

Which of these modes (CTR, CBC) are more appropriate for storing sensitive information?

Is it possible for someone to discover the CTR counter value knowing some of the bytes in the original message?

Is CBC safer than using CTR for storing data, or would it be more susceptible to a padding oracle?

Is it just a bad idea in general to encrypt a self-describing data structure?


texts:
I have two prime numbers:

p = 37
q = 41

And I need to find whether any of these prime numbers, 5, 7 or 11, can be used as a valid encryption key e?

My working so far:

Computer their product:

n = p * q =  1517

Compute Euler totient:

m = (p - 1)(q - 1) = 1440

Find greatest common divisor:

a = 41
b = 37
r = 41 mod 37 = 4
a = 37
b = 4
r = 37 mod 4 = 1
a = 41
b = 1
r = 41 mod 1 = 0

GCD = 1

What do I do now? How would I find out which number could be a valid key?

Does the encryption key has to be comprime with m (1440)?

As if I got it right, the answer should be 5.

Sorry, but the this is not a duplicate, this is needed to help me understand the how to work out whether x, y or z is a valid encryption key, given two prime numbers!


texts: How does Diffie-Hellman apply to strings?

texts: I have been doing a lot of research on Diffie-Hellman, and I understand how Alice and Bob are able to get a shared g^ab using both of their private keys. However, I am unsure about how this can be applied to passwords (strings). I assume you have to do something with the hex version of both the password and g^ab, but what? Any help would be much appreciated!


texts: Because blockchain is decentralized, what would happen if there was no cryptography anymore to protect the blockchain? I know it would not be used anymore but why? "Hackers" could reverse transactions but I can't think of anything else...


texts: Groth-Sahai proofs and hardness assumptions

texts: I am learning Groth-Sahai NIZK proof system for Bilinear groups. While going through the literature, I am getting confused on how the proof system is related to Subspace Decision, SXDH or DLIN assumptions. In the proof system, what I understood is to prove the ownership of solution of a set of equations, e.g. Quadratic/Pairing Product etc. Then how does it relate to various hardness assumptions?


texts: Is there a way to "shorten" a Merkle chain?

texts:
If I have a Merkle chain of 3 items, is it possible to create a zero knowledge proof of the existance of a correct chain between hash 1 and hash 3?

Editing to clarify (Thanks Ricky), what I mean my a Merkle chain is:

   hash(foo)      = A1
-> hash(bar + A1) = B2
-> hash(baz + B2) = C3

An ordered set where you cannot replace any element without affecting the hash of the last element. To verify that it's correct you need to have all the data that the last hash depends on, I'm wondering if there's a way to prove that it's correct without having all the middle data.