texts: How were the arbitrary values used inside SHA-256 determined?

texts:
As I study SHA-256, I wonder how the values inside the algorithm were determined.
Take a look, for example, at how the 16-64th Words are generated. (in Java language)
    for (int j = 16; j < 64; ++j) {
        int s0 = Integer.rotateRight(words[j - 15], 7) ^
                Integer.rotateRight(words[j - 15], 18) ^
                (words[j - 15] >>> 3);

        int s1 = Integer.rotateRight(words[j - 2], 17) ^
                Integer.rotateRight(words[j - 2], 19) ^
                (words[j - 2] >>> 10);

        words[j] = words[j - 16] + s0 + words[j - 7] + s1;
    }

Just why were the values such as 15, 7, 18, 3, 2, 17, 19, 10, 16, and 7 chosen? Are these just arbitrary values that were randomly chosen for no reason? Or were these each chosen so that the algorithm is as difficult to reverse as possible?
    registers[7] = registers[6];
    registers[6] = registers[5];
    registers[5] = registers[4];
    registers[4] = registers[3] + temp1;
    registers[3] = registers[2];
    registers[2] = registers[1];
    registers[1] = registers[0];
    registers[0] = temp1 + temp2;

Also, in the main iteration loop (snippet shown above), why is the temp1 added to register[3]? Is that also just arbitrary or was it chosen for a particular reason?
Edit:
To rephrase the question without code and with equations, I'll put it another way.
In the equations to determine $W_t$ (for 16 <= t <= 63), you use the equation
$$W_t = \sigma_1 (W_{t-2})+W_{t-7}+\sigma_0 (W_{t-15})+W_{t-16}$$
Where
$$\sigma_0(x) = {ROTR}^{7}(x) \oplus {ROTR}^{18}(x) \oplus {SHR}^3(x)$$
$$\sigma_1(x) = {ROTR}^{17}(x) \oplus {ROTR}^{19}(x) \oplus {SHR}^{10}(x)$$
(according to FIPS PUB 180-4)
So, my question is, why were the arbitrary numbers in these equations chosen? The displacement of the word index by 2, 7, 15, and 16 appears to be random, but is there a reason to it? For the definition of $\sigma_0$ and $\sigma_1$, why were the arbitrary numbers 7, 18, 3, 17, 19, and 10 chosen?
The same question could also be asked about the main iteration loop, where $\Sigma_0$ and $\Sigma_1$ are used, which have just as arbitrary values in them.
As for the other question, it asks, why is it that $e = d + T_1$ in the loop from t=0 to t=63. It could have been placed in any of the other 6 working variables. Was it randomly chosen that $d$ would be the variable that has $T_1$ added to it?


texts: Why is OTP not vulnerable to brute-force attacks?

texts:
I saw this question on the book Understanding Cryptography.

  At first glance it seems as though an exhaustive key search is possible against an OTP system. Given is a short message, let’s say 5 ASCII characters represented by 40 bit, which was encrypted using a 40-bit OTP. Explain exactly why an exhaustive key search will not succeed even though sufficient computational resources are available.

It puzzles me because I think that as far as I know that the key has only $40$ bits, I could try all the possible $2^{40}$ keys and XOR them with the ciphertext to recover the message... Is there something that I am missing? How can it not work if we are assuming the attacker has computational power to do the exhaustive search?


texts: Estonian e-voting, vote verification system

texts:
I believe I do understand the basics of how the Estonian e-voting system works, but I'm stuck at their vote verification system. In order to get the vote verified, a client needs to encrypt all of the possible vote selections plus some random string with an election public key and then compare the given results with the voter's actual vote in order to find a match.

Here is where I got stuck. I've learned that RSA public encryption doesn't always put out the same result because of padding, so how is it possible that the client produces the same result as the one on the server?

I'm a complete beginner regarding cryptography and would therefore appreciate answers given in as basic a manner as possible.
Since I'm a beginner, I'm not really interested in the details of how they implemented it, but in how I could somehow reproduce this in my very much simplified PHP project using OpenSSL.

Let's say there are 3 candidates: Mike Miller, John Smith and Nick Stone. The voter chooses John Smith.

$public_key='--- election public key ----';
$vote='John Smith';
openssl_public_encrypt($vote, $encrypted_vote, $public_key);
Lets say $encrypted_vote gets stored in a database.

Vote verification:

$actual_encrypted_vote; //users actual vote retrieved from database
$candidates= array("Mike Miller", "John Smith", "Nick Stone");
$public_key='--- election public key ----';
$selected_candidate="";
foreach($candidates as $candidate){
    openssl_public_encrypt($candidate, $encrypted_vote, $public_key);
    if($encrypted_vote == $actual_encrypted_vote)
        $selected_candidate=$candidate;
}
echo "You voted for: ".$selected_candidate;

This obviously doesn't work, since RSA encryption, because of padding, always produces different results for the same key and data. So what should I do to get this to work?

Is it possible to set specific padding and use it for both encryptions, or is there another way?


texts: Why a Blockchain cannot confirm "Membership Proof" as can a Merkle Tree?

texts:
I'm currently reading the Princeton Blockchain Book, and came across this concept:

  Proof of membership. Another nice feature of Merkle trees is that, unlike the block chain that we built before, it allows a concise proof of membership.

The idea(from what I understood) is that, in the Merkle Tree, when we have a data block we can simply traverse the path towards the root, and then confirm that the root is indeed the correct one, hence confirming membership of said block. Why would one not be able to do that in a Blockchain, since it's an acyclic data structure and any valid block would allow us to reach the root?


texts: Anonymous Multi-Receiver Identity-Based Authenticated Encryption with CCA Security?

texts:
OK, I am confused. Does it mean that that the various anonymous multi-receiver IBE implementations actually do not have single public key per Identity, as as is the in the original IBE implementation?

Example paper: Anonymous Multi-Receiver Identity-Based Authenticated Encryption with CCA Security (PDF) by Fan et al.


texts: DLP instances for given number of congruences

texts:
Let $S$ be the set of $k$ congruences of the type $g_{i}^{x_i} \equiv h_i \pmod{n_i}, \quad \forall i,1\leq i \leq k$

What would be the best way to describe such set $S$ with a term in literature. The goal is that the reader immediately thinks about this set of congruences when reading the term.

Would it be a collection or set of DLP instances a valid reference?


texts: Safety of having many passwords hashed with the same salt?

texts:
I'm working on a web application where passwords must be hashed on the client before it can be send to the server. This is because the user's raw password is used for cryptography purposes and can't be sent anywhere.

My initial thought was to use a SHA algorithm, but then I was wondering if maybe using something like argon2 would be better. Because I have to validate the password on the server without having access to the raw password, I have to use the same salt when using Argon2.

Note that I will properly hash the client-side hashed password on the server again before saving it into the database. But the server will have access to the passwords directly from the client, so in case the server gets hacked and they change the code, they still won't have access to the raw password.

So my questions:

Is having access to many passwords that are hashed with the same salt a security issue?
Is using a SHA algorithm (like SHA-512) better in this case?


texts: Security of tokenization of plain text conversations - cryptanalysis

texts:
I came across a marketing video here. They claim to perform AES encryption and tokenization of sensitive data, at the corporate gateway, before it leaves the company firewall destined for the public cloud. So keys and token<=>plain text mapping tables remain at gateway and cipher text/tokens live in the public cloud.

The purposes of this question is to understand the real security of the product than just what is claimed. The video link is there but I've put screenshots below on the relevant portions. I did some basic analysis by simply eyeballing the video and seems the security is rather poor. You can clearly see, just from their public demo videos at the 2:19 mark, that

all strings are dropped to lower case => tokenized
letter casing 'flips' are then encoded (bitfield?) and appended to the token (eg "flip case of 1st character")
the token is wrapped within pre/post ambles or delimiters

Full resolution: https://i.imgur.com/6ZWXz3H.jpg

NOTE: Image is being referenced lawfully. Considerations include, but are not limited to, sections 107 through 118 of the copyright law, Title 17, U. S. Code. In particular, section 107 provides for lawful reproduction for the purposes of criticism, research as well as commentary.

The supposed security of such a system is that despite access to the "data in the cloud", no information is revealed. However, even without access to clear text counterparts, it should be fairly trivial to sort the "secured" tokens, drop the case encoding information, and then perform a frequency analysis and mapping it to regular English histograms. Presumably this is how they do their "search and sort, even inside encrypted data" feature.

My questions are:

How serious do you consider such a security system?
How many words/tokens of such "secured tokenized" data are needed to statistically decipher everything (with say, 90-95% confidence) assuming access to only tokenized data?
Any particular reason to encode the tokens in Chinese? I would do that to visually consume the space of one character (in browsers for humans) while still encoding 2-3 bytes per UTF-8 character.


texts: Two different keys decrypting same content

texts: is there some generally available algorithm which will encrypt a short string and generate two unique keys so that any of the two can be used to decrypt the message again? It doesn't has to be "super secure".


texts:
Can a monoalphabetic substitution cipher attain perfect secrecy?

Definition of perfect secrecy:

$${\rm Pr}[\,{\rm Enc}_k(m_1) = c\,] = {\rm Pr}[\,{\rm Enc}_k(m_2) = c\,]$$


texts: How to get a speedup linear in the number of iterations on unsalted iterated password hashing?

texts:
In their 2015 paper "More Rounds, Less Security?" Guo, Jean, Mouha and Nikolić claim in section 5.4 that one can recover a password $P$ given hashes of $D$ different passwords generated from $H^k(P)$ with about $T_1=\frac{2^n}{D\cdot k}$ hash evaluations.

Now I understand that using standard preimage search you are expected to find at least one preimage in $2^n/D$ evaluations of the full iterated hash, so $T_2=\frac{k\cdot 2^n}{D}$ hash evaluations.

The reasoning given for $T_1$ is:

  Now observe that the time complexity can be reduced by a factor of $k$.
  This is because evaluating one password guess requires $k$ evaluations
  of the hash function used inside [the password hash], but every
  additional guess has an additional cost of only one hash function
  evaluation. This effectively speeds up exhaustive search by a factor
  of $k$: given $D$ password hashes, recovering any of them has a time
  complexity of $2^n/(D \cdot k)$.

My question is now (based on my current understanding of the above quote):
Given $H^{i}(P)$ for $i\in\{1,\ldots,k\}$ using only one evaluation of $H$ how does one compute $H^k(P')$ for any $P'\neq P$?

Or asked differently but (hopefully) equivalently:
How exactly does this pre-image search speedup trick work where additional checks after the initial evaluation only cost one hash evaluation?


texts: AES Keywrap implementation supporting 8 byte keys

texts: NIST SP800-38F specifies key wrapping algorithms. An important distinction between KW (without padding) and KWP (with padding) seems to be that KW cannot be used to wrap keys of length 8 bytes i.e. 1 semiblock in the NIST specification. On the other hand, KWP is allowed to wrap keys of size less than 16 bytes. Is there a catastrophic failure if a (broken) KW implementation supports wrapping 8 byte keys?


texts: Which cryptographic attacks can AES 128-bit withstand?

texts: Most of the articles and forums are stating that the Brute Force attack can test the strength of an encryption algorithm. However, I am looking for those attacks that AES can withstand for the testing simulation purpose.


texts: Cyclic group collision resistant keyed cryptographic hash function

texts:
I am self-studying cryptography from a book and have come across a really difficult question that's doing my head in.

I would be very grateful if somebody can help me out here with this difficult question. NOTE : This is not homework, as I am self-studying.

It would be great if someone can take the time to explain a solution for either a) or b) so I can begin to understand them better, thanks !


texts: Known plaintext attack against Feistel ciphers

texts:
Assuming we have a Feistel cipher, with let's say 2 rounds i.e:

Plaintext $P=(L_{0},R_{0})$

$L_{1}=R_{0}$

$R_{1}=L_{0}\oplus f_{{K}_{1}}(R_{0})$

$L_{2}=R_{1}$

$R_{2}=L_{1}\oplus f_{{K}_{2}}(R_{1})$

With the keys $K_{1}, K_{2}$

With a known plaintext attack, assume we have some $x$ amount of pairs of $(P_{i}, C_{i})$ for the attack.

How would you proceed about the attack to find both keys and how long would it take? In my limited understanding, if we have $k$ as the size of each key, the first key would take $2^{k}$ evaluations and the 2nd key would take the same amount as well given that they are independent keys but assuming that's right, wouldn't that be the same cost as an exhaustive key search?


texts: Secure password-authenticated key exchange that allows for passwords to be stored as hashes, but does not make the hashes password-equivalent

texts: Are there any secure password-authenticated key exchange that allows for passwords to be stored as hashes, but does not make the hashes password-equivalent?  This would be useful for many authentication applications.


texts:
What I understand about the random oracle game:

  The adversary can query the oracle polynomial many times with the same (secret but unknown) key. From the output returned by the oracle, the adversary has to tell whether the oracle has chosen RANDOM or CIPHER (with probability more than .5).

Now, how does that stop adversary from replay attack? Say, the adversary has told the oracle to keep the same key twice. Both the times the adversary queries the with same message. Now, if oracle has chosen RANDOM, both the outputs will be different with very high probability. Whereas, if oracle has chosen CIPHER, both the outputs from oracle will match.

How the safe-guard is given from the trivial attack?

One idea came to my mind: The oracle has an infinitly large memory. Everytime the oracle is queried, it checks if the same input has be supplied previously. If so, it returns an error/ returns a valid output only when the input is not found in its memory. Is this idea meaningful?


texts: If the M-94 had only 10 disks, what would be the keyspace of the resulting cipher and what is the useful keypspace of the 10 disk cipher?


texts: Benchmark (hash rate) for SHA-3 (SHAKE128)

texts:
To estimate the time for brute-force attack we need to compute keyspace size divided by hash rate, where the hash rate (hash/second) varies depending on the computer's capabilities.

The website https://bench.cr.yp.to/results-hash.html shows the hash rate for different computers.  Can you explain the following two confusing phenomena?

The hash rate decreases as the message size increases.
Core i3 has a higher hash rate than Core i7 for SHAKE128.


texts: What kind of operators should I perform on 4-qubit state $|\psi\rangle_A|GHZ\rangle$ to get expression like $|\Psi\rangle_4$?

texts:
I'm reading the paper "Quantum secret sharing" by Hillery, Bužek and Berthiaume (Phys. Rev. A, 1999; preprint on arXiv) and I have a question about it.

Let's say Alice wants to send Bob qubit in state $|\psi_A\rangle = \alpha|0\rangle_A + \beta|1\rangle_A$, and she has one qubit from GHZ state $\frac{1}{\sqrt 2}(|0\rangle_a|00\rangle +|1\rangle_a|11\rangle)$. Then she performs a Bell basis
$$|\Psi_{\pm}\rangle_{Aa}=\tfrac{1}{\sqrt 2}(|00\rangle_{Aa}\pm|11\rangle_{Aa} \\ |\Phi_{\pm}\rangle_{Aa}=\tfrac{1}{\sqrt 2}(|01\rangle_{Aa}\pm|10\rangle_{Aa}$$ measurement on the qubits $(A, a)$.

In terms of projection operators and/or measurement operators, how can I get an expression for this 4-qubit state: $$\begin{aligned} |\Psi\rangle_4 = \tfrac{1}{2}[\, &|\Psi_{+}\rangle_{Aa}(\alpha|00\rangle +\beta|11\rangle) \\ +\ &|\Psi_{-}\rangle_{Aa}(\alpha|00\rangle -\beta|11\rangle) \\ +\ &|\Phi_{+}\rangle_{Aa}(\beta|00\rangle +\alpha|11\rangle) \\ +\ &|\Phi_{-}\rangle_{Aa}(-\beta|00\rangle +\alpha|11\rangle) \,] ?\end{aligned}$$

(I understand that if just simplify this expression I get $$(\alpha|0\rangle_A + \beta|1\rangle_A) \tfrac{1}{\sqrt 2}(|0\rangle_a|00\rangle +|1\rangle_a|11\rangle.)$$

For reference, here are the relevant sections of the paper: 1, 2


texts: I've used the C++ prog I found on the web to generate the standard Sbox with poly 0x11b, and also modified it to use a lookup table of all the multiplicative inverses of the 256 values, which also works fine.  I'm now trying to generate alternative Sbox using polynomial 0x11d, as used in the paper by Das, Zaman & Ghosh, but without much success.  I've again generated all the multiplicative inverses for the poly and used them in a lookup table, but I do not get the same results as the paper's authors.


texts: Can 2 bit commitment protocols be secure when sent together with the same bit

texts: Suppose I have 2 bit commitment schemes, C1 and C2 which are computationally hiding.Suppose I commit the same bit using both and send them to an adversary who knows that the same bit was committed. Is the scheme still computationally hiding, or are there counterexamples?


texts: How many AES-operations have to be watched for key-exploit by side-channel attacks?

texts:
If I would like to exploit a used key by side-channel attack, one that measures electromagnetic fields, how many runs of the AES-128 do I need to spy on for a successful exploit?

I can't use any programs or software on that device. AES is software implemented. And I try (theoretically!) to spy in a distance of X meters. I am able to reduce the noise by surrounding emissions. But I can't have any type of access. So the attack model specifies using a sniffer.

I do not need an exact number of traces. There are only certain values for trace/distance that I could think of. I just found the TEMPEST attack, which needs 400k traces in a distance of 0.3 meters and 2.3m in 1 meter.


texts: Given a secret - how does one generate a reproducible private key from it?

texts: Let's say I have a secret "hitheremynameisbob"... I'd like to use this to encrypt/sign things. Is this possible or is it always expected to generate random secrets?


texts: Where can I find Secp256k1 ECDSA test vectors?

texts:
I`m currently implementing an ECDSA library based on curves like secp256k1. I would like to test it using some test vectors, like http://csrc.nist.gov/groups/STM/cavp/documents/dss/ecdsatestvectors.zip . Is there any place where I can get some vectors for testing encryption with that curve?

Example vector has this structure:

var testVectors = []struct {
msg    string
Qx, Qy string
r, s   string
ok     bool
}

and looks like this (for P224 curve):

{
    "96b2b6536f6df29be8567a72528aceeaccbaa66c66c534f3868ca9778b02faadb182e4ed34662e73b9d52ecbe9dc8e875fc05033c493108b380689ebf47e5b062e6a0cdb3dd34ce5fe347d92768d72f7b9b377c20aea927043b509c078ed2467d7113405d2ddd458811e6faf41c403a2a239240180f1430a6f4330df5d77de37",
    "851e3100368a22478a0029353045ae40d1d8202ef4d6533cfdddafd8",
    "205302ac69457dd345e86465afa72ee8c74ca97e2b0b999aec1f10c2",
    "4450c2d38b697e990721aa2dbb56578d32b4f5aeb3b9072baa955ee0",
    "e26d4b589166f7b4ba4b1c8fce823fa47aad22f8c9c396b8c6526e12",
    false,
},
{
    "86778dbb4a068a01047a8d245d632f636c11d2ad350740b36fad90428b454ad0f120cb558d12ea5c8a23db595d87543d06d1ef489263d01ee529871eb68737efdb8ff85bc7787b61514bed85b7e01d6be209e0a4eb0db5c8df58a5c5bf706d76cb2bdf7800208639e05b89517155d11688236e6a47ed37d8e5a2b1e0adea338e",
    "ad5bda09d319a717c1721acd6688d17020b31b47eef1edea57ceeffc",
    "c8ce98e181770a7c9418c73c63d01494b8b80a41098c5ea50692c984",
    "de5558c257ab4134e52c19d8db3b224a1899cbd08cc508ce8721d5e9",
    "745db7af5a477e5046705c0a5eff1f52cb94a79d481f0c5a5e108ecd",
    true,
},


texts: What kind of information in cryptography is called semantic information?

texts:
I have been studying cognitive cryptography from this article. Its definition of cognitive cryptography is:

  Cognitive cryptography is a division of cryptography
  within which any information set can be secured using personal
  information contained in the biometric sets of information and
  semantic information unambiguously identifying individual features
  of protocol participants.

What does the following part of the definition mean?

  ...semantic information unambiguously identifying individual features...

I don't understand what semantic information means. Specifically, what kind of information in cryptography is called semantic information?

I would greatly appreciate your assistance.


texts: Yao's Garbled Circuit- Why does Alice need to rearrange the circuit?

texts:
My understanding of Yao's Garbled Circuit (based mostly on this summary) is as follows:

Alice creates a garbled circuit based on the function f to be computed. She then hard-codes her input into the circuit and rearranges the gates in such a way that Bob will not be able to figure out what the circuit does. She then assigns a pair of random keys, $K^0_i, K^1_i$  to each wire $w_i$. She sends Bob four (unlabeled, shuffled) values $X_s^a,X_s^b,X_s^c,X_s^d$ for each gate $g_s$. These $X_s$ values are chosen such that if Bob knows the keys  $K_i^{v_i}$ and $K_j^{v_j}$ for the two input wires of $g_s$ with values $v_i$ and $v_j$ then he can calculate the key $K_k^{v_k}$. Specifically, he does this by taking the XOR of $K_i^{v_i}$ and $K_j^{v_j}$ and each $X_s$ value. One of these four results will be $K_k^{v_k}$, the others will be meaningless random bits. Alice gives Bob the values $AUTH(K_k^0),AUTH(K_k^1)$ for some one-way trapdoor hash function AUTH. Thus, Bob can figure out which of the four values is not random bits.

I don't understand why Alice needed to hard-code her input and rearrange the gates. Could she not have just given Bob the circuit as is and the keys to her inputs? Except for his own input wires and wires determined from them, Bob does not know whether the key on a wire represents the wire being in the state 0 or the state 1. So even if he knows the function he is computing (what the circuit does) he should not be able to figure out what the values are of this function.

I also realize from this question that the keys as well as the X values would have to be generated again for a second computation. But I don't see why the structure of the circuit itself needs to change.


texts:
I would like a proof that accomplishes the following:

$N$ strings are part of a set $S$.  There is a do_proof function on set $S$ that produces a succinct witness statement $P$.

$$P = \text{do_proof}(S)$$

For some new string $X$ that is not part of set $S$, I have some proof

$$\text{prove_not_a_member}(X, P) = \text{True}$$

that proves that $X$ is not a member of $S$. Assume that $S$ is large and $P$ is constrained in size.

I was thinking about aggregate signatures but I'm not sure. Basically I am looking for a way to succinctly prove non-membership.  It does not have to be zero-knowledge.

Is there a cryptographic solution to provide a “proof of exclusion”?


texts: Combining Random Hashes - avoiding collisions and ensuring randomness

texts:
I have a series of integers which I want to convert to random integer (64 bit). The idea here is to produce random numbers very quickly. The issues that good quality random numbers are required with a low collision rate to ensure low correlation between entities. A series of integers are input and a number of desired samples are required that are a random as possible.

The hash?

The random hash is taken from Numerical recipes book and is fast as it used just bit shifts and XORs. This should be very fast. The inputs are a 64 bit integer and output is a 64 bit integer. Some of the numbers can work on 32 bit, so this might be an advantage later on in ensuring there is no overflow.

How to combine hashes?

I understand about using XORs in terms of maximizing entropy and ensuring the combination doesn't exceed 64 bits. However the issue is that if I have series of nested loops over integers then with 2 loops I may get the following

A = 0, B = 1 and then I have A= 1, B = 0 and these will be equivalent so I get a collision i.e.

(Hash(A=0) XOR hash(B=1)) = (Hash(A=1) XOR hash(B=0))

One way around this might be to do the following:

Hash(A) + k*Hash(B) where k = [int], say = 5

What worries me here is that if I have to use a 64 bit representation for i and j, then I am likely at some-point to reach over flow as I might get j near the MaxInt and multiplying by k is going to result in exceeding MaxInt. However if I assume that j is 32 bit, if k is low then I am careful about removing a deductable from i, the MaxInt issue can be avoided. Also I shall have to watch that the sum of i and j doesn't exceed the Max int. I can see using pure XOR's would be useful but it is troubling because of the collision rate.

Using another algorithm here with an increased key length (block cipher) maybe the way forward as we can increase the key length with something like Blowfish to handle many 64 bit integers concatenated to form a key. What worries me with Blowfish is slow with regard to handling the key and this needs to be super quick.

Are there any recommendations out there for a better way to handle this problem?

In summary,

Have inputs:

A: 64 bits
B: 32 bits
C: 32 bits
D: 32 bits
E: 32 bits

The output should be an integer/double that is has the fewest repeats/collisions as described above. The output is not being used for anything other than generation of random numbers, but important that those random numbers are not correlated for the input.

The hash currently being tested is:

inline Ullong int64(Ullong u)
{

  Ullong v = u * 3935559000370003845LL + 2691343689449507681LL;
  v ^= v >> 21; v ^= v << 37; v ^= v >> 4;
  v *= 4768777513237032717LL;
  v ^= v << 20; v ^= v >> 41; v ^= v << 5;
  return v;
}
inline Uint int32(Ullong u)
{
  return (Uint)(int64(u) & 0xffffffff);
}
Returns hash of u as a double-precision floating value between 0. and 1.
{
  return 5.42101086242752217E-20 * int64(u);
}


texts: Which blind signature schemes exist, and how do they compare?

texts:
I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there should be a elliptic curve scheme, which might have better performance than the other schemes.

In particular I'm interested in:

Performance - how expensive is it to create/validate the signature? I mainly care about the cost for the authority(does signing and verification), and less about the performance of the client (does blinding and verification)
Patents - Is the scheme patented? Have the patents expired?
Simplicity - Is it easy to understand? Is it easy to make subtle mistakes which compromise anonymity or security?

My current evaluation of RSA and Lucre:

Blinded RSA

Requires an RSA private key operation for signing. This is relatively expensive, especially if keys larger keys(say 2048 bit) are used.
Patented by Chaum, but the patents should have expired by now
Quite simple, even I understand it

Lucre

Not sure about the performance, but I don't expect much better performance than with RSA.
Paper claims it is patent free, at least in some variations
There are some subtle points. If used incorrectly the signer might be able to abuse being able to choose k in a way that compromises anonymity. I don't really understand it (yet).

Reading the paper a few more times, it seems like most variants of lucre aren't "real" signatures that can be verified by everyone. But rather you need to perform an interactive probabilistic proof. Some variants doesn't suffer from this problem, but they might have other problems.

My subjective impression is that I don't like lucre. It seems like its only raison d'être is that is avoids Chaum's patents. But if those are expired, this shouldn't be an issue anymore.


texts:
I am trying to work out the shared key between Alice and Bob in DHKE equation. The generator is 7 and the Prime P = 71. Bobs private choice of number is 28 and he also receives g ^ A = 70 from Alice. Alice does not seem to have a private choice of number in this equation, all I know is that g ^ A = 70. So how can I calculate the value of the shared key?

I am just having difficulty working it all out. The modulus arithmetic involved is also confusing me. If someone could try to explain it to me.

I know that it must be: A = 7^x (Mod 71) = 70;
and: B = 7^28 (Mod 71);

Then Alice Computes: gB ^ A (Mod 71);
and Bob Computes: (gA)^28 (Mod 71);


texts: What is the implication for differential privacy if $\epsilon = 0$?

texts:
In pure differential privacy, the parameter $\epsilon$ represents the desired privacy loss. The smaller the $\epsilon$ is, the more privacy we can obtain. What happens when  we want the privacy loss $\epsilon = 0$. Does that mean we need to keep the data permanently private and we do not answer  any queries from outside ?

Thanks


texts: Best way to reduce chance of hash collisions: Multiple hashes, or larger hash?

texts:
I would like to maintain a list of unique data blocks (up to 1MiB in size), using the SHA-256 hash of the block as the key in the index. Obviously there is a chance of hash collisions, so what is the best way of reducing that risk? If I also calculate the (e.g.) MD-5 hash of the block, and use the combination (SHA-256, MD-5) as the key, is the chance of a collision about the same as some 384-bit hash function, or is it a little bit better because I'm using different hash functions?

Thanks for the info!

Edit: My blocks come from normal user data on hard drives, but it will be many petabytes in total.

Edit2: As a follow-up (just tell me if this should be moved to a different question): Since the blocks can vary in size but can be up to some preconfigured limit (e.g. 1MiB), how will collision resistance be affected if I make the (64-bit) size of the block part of the key? That way you can only have collisions of blocks with the same size...


texts:
I’m developing an application that runs over TLS. In addition to password-based authentication we’d like to be able to use SSH keys.
Is there any prior art in using SSH keys for authentication over TLS? Does anyone know of any potential problems with implementing such a scheme?
Thank you!

UPDATE: After a bit more research, I’ve got a fleshed-out concept:
RFC 5705 key material exports appear to serve the same role as SSH session identifiers. Thus, the following:

C: Grab NN random bytes from TLS’s key export.
C: Sign those bytes using the private key.
C: Send the signature and the key in, say, an HTTP handshake.
S: Verify the signature via the public key, and verify that the key is authorized.

Would this work, be resistant to replay attacks, etc.?


texts: Are there MD5 collisions for inputs of different length?

texts:
There are many examples of MD5 collisions (some of them can be found here Are there two known strings which have the same MD5 hash value?). But as far as I know two inputs should have the same length to have the same MD5 (or same hash in general). Is it correct? Is there any proof of that?

Or otherwise examples of inputs of different lengths with the same MD5?


texts: plaintext distribution ,perfect secrecy cryptosystem

texts:
I have been trying to solve the next problem:
let pi be a perfect secrecy cryptosystem with specific plaintext probability distribution.
How to prove pi will have perfect secrecy for all other possible plaintext probability distributions?


texts:
I am a bit confused with different notations of elliptic curves.
Specifically, I am comparing the NIST specification with the SECG specification.

More specifically I want to know if the NIST curve $Curve P-384$ (NIST D.1.2.4) corresponds to $secp384r1$ specified in SECG (2.5.1).

I found a related question here on crypto.SE where it is said that these are the same curves and its just different notation.

This would mean:

Curve-P 384 = secp384r1
Curve-P-256 = secp256r1
...

However, I compared the curve parameters mentioned in both documents and found that there are deviations.

Equation: $a$ is fixed in the NIST case

NIST defines the curve as: $ E: y^{2} \equiv x^{3} - 3x + b (\mod p)$
SECG defines the curve as: $ E: y^{2} \equiv x^3 + a.x + b (\mod p)$

Basepoint G

NIST defines the basepoint as:

$G_{x}$ = aa87ca22 be8b0537 8eb1c71e f320ad74 6e1d3b62 8ba79b98
59f741e0 82542a38 5502f25d bf55296c 3a545e38 72760ab7
$G_{y}$ =  3617de4a 96262c6f 5d9e98bf 9292dc29 f8f41dbd 289a147c
e9da3113 b5f0b8c0 0a60b1ce 1d7e819d 7a431d7c 90ea0e5f

SEC defines the basepoint as:

$G$ = 04 aa87ca22 be8b0537 8eb1c71e f320ad74 6e1d3b62 8ba79b98
59f741e0 82542a38 5502f25d bf55296c 3a545e38 72760ab7 3617de4a
96262c6f 5d9e98bf 9292dc29 f8f41dbd 289a147c e9da3113 b5f0b8c0
0a60b1ce 1d7e819d 7a431d7c 90ea0e5f
which is the NIST versions $G_{x}$, $G_{y}$ concatenated and preceded by 04

I am not an expert on the math behind ECC, so I need help assessing if the mentioned deviations of the two specification mean that they are not equal and if so, what are the differences and why are they different?

Thanks!


texts: Is cryptography an interesting field for research?

texts:
I am now styding for first year bachelor's degree in Mathematics for IT. In the future I would like to major in the same field and possibly continue trying to get a Ph.D. But I still have options to take a different path.

Even though I have a long journey ahead, I am thinking about trying to write a "scientific bachelor's thesis" (that's how we call bachelor's thesis with scientific results on my university in my language) when the time comes.

Is cryptography a field with interesting and imporant problems to solve? I know about some interesting problems like P=NP and some stuff about (post-)quantum cryptography, but surely that's not what majority of problems are like.

So, is cryptography a field where it is easy to find meaningful and interesting problems to solve?

(I am not sure if this is the right place to ask this, so please inform me if I should ask somewhere else.)


texts:
I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt.

However, I have encrypted data that I need to sign, to prove the author of the encrypted data.

Encrypt wth recipient's public key
Sign with author's private key
Concatenate cipher text with signature

From reading papers such as this, it seems that the problems with sign-then-encrypt are quite subtle, but solutions are quite straightforwrd.

I haven't been able to turn up much on issues with encrypt-then-sign. I guess one problem is that someone could simply strip off the signature and replace it with their own. My first thought was to prefix the data with the author's public key before encrypting, but then the signature can only 'really' be verified by the recipient (public verification is more desirable for me).

What are the issues associated with encrypt-then-sign, and what solutions exist?

** Edit **

I thought of another potential solution to the problem of someone replacing the original signature with their own - using X.509 certificates. So in step 3 above we also concatenate the certificate of the author. When verifying the signature we check that the public key matches that of the certificate, and we also verify that the certificate was issued by a particular, trusted CA. With this scheme, not just anyone can replace the signature, only those who are issued a certificate from the trusted CA. Any issues with this approach?


texts: Can we assume that a hash function with high collision resistance also means a highly uniform distribution?

texts:
I want to use a hash function to generate a random sequence from number 0-n. And so I would like to find a good function that results in values that are seemingly random (does not need to be secure), but gives a sequence that is uniformly distributed.

Can I look at a function that has the property of high collision resistance and expect that it would also have a highly uniform distribution?


texts: How does ECDH arrive on a shared secret?

texts:
I read a brilliant, three part article on Elliptic Curve cryptography (one, two, three).  It was able to explain Elliptic Curves to me in a way that didn't require a math degree to understand.   The crux of the article is in page two, namely, when it discussed the "dot" operation:

In the brilliant animation above (all credit goes to the original author, Nick Sullivan), the author explained that the heart of EC Crypto is that if you take any two points on the curve, A and B, and draw a line from A to B, and then continue the line you end intersecting one, and only one, other point on the curve.  You then go to the x-axis opposite (up or down) to find a third point, point C.

This is expressed in the article as:

  A dot B = C

This can continue, using the initial point and the newly acquired point as necessary:

  A dot C = D
  A dot D = E

We can continue this process an arbitrary number of times, but we'll stop after, for the sake of an example, 25 steps and end up at a point Z.
Now we know that if we started at A and applied the process above, it would take 25 total "dot" operations to get to Z.  But supposedly, this is a number that is very difficult to determine from someone if they just knew where we started (point A) and where we ended (point Z):

  It turns out that if you have two points, an initial point "dotted" with itself n times to arrive at a final point, finding out n when you only know the final point and the first point is hard. To continue our bizarro billiards metaphor, imagine that one person plays our game alone in a room for a random period of time. It is easy for him to hit the ball over and over following the rules described above. If someone walks into the room later and sees where the ball has ended up, even if they know all the rules of the game and where the ball started, they cannot determine the number of times the ball was struck to get there without running through the whole game again until the ball gets to the same point. Easy to do, hard to undo. This is the basis for a very good trapdoor function.

Now, here is my question:  How do two parties use EC and the 'dot' operation to determine a shared secret over an unsecured medium?  Effectively, how do they use A, B, Z, or 25 from the examples above to arrive at a shared secret?

For the purpose of this question, I am not concerned with how the curve is determined, I'm content with the fact that there are pre-existing curves that both parties choose to use.

Also, I am not concerned with Ephemeral variants of DH or not, at this point, knowing the basic concepts described in the article above, I just want to know what values each party start with, and what they do with those values, and what (if anything) is shared across the wire.


texts: Why do cryptographic hashes need to be fixed length?

texts:
Why do cryptographic hashes need to have a fixed length output?

I know that the shallow answer is that an output that varies by key size or file size can leak information somehow, leading to cryptanalysis, but I would like some more intuition as to why this is the case.

In the case of using an HMAC, like HMAC-SHA256 or HMAC-SHA1, is it still the hash (SHA256 or SHA1) which is ensuring that the output is of a fixed length? Or does the HMAC algorithm come into play as well?


texts: IV transmission from Transmitter to Receiver side in CTR mode for every call

texts: I am using block cipher mode (CTR Mode) for the transmission of voice data. Need to know, how can I transfer the same IV at the decryption side (for every call) as the IV for the same packets on encryption and decryption sides must be the same.


texts: Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?

texts:
The fastest known attack against the Salsa20 family of stream ciphers requires 2137 simple operations against Salsa20/7, or 2244 against Salsa20/8. The 8-round version encrypts data at 1.88 cycles-per-byte on a Core2Duo, which is already extremely fast. As there's no real key schedule, cutting this down to two rounds should bring the speed up to 0.47 cycles-per-byte.

ChaCha is based on the Salsa core, but improves diffusion per round (quite significantly, as an attack taking 232 operations on Salsa20/6 instead takes 2127.5 operations on ChaCha6). The speed on the same CPU is equivalent. This is as fast as XorShift128+ (0.48 cycles-per-byte on Kaby Lake). Even worse for XorShift128+, the lowest bit is an LFSR, which may not be ideal for certain use cases such as Monte Carlo simulations.

This leads me to wonder, in situations where cryptographic security is not needed, could two-round ChaCha be used in place of another, fast PRNG? Would the output be indistinguishable from random data, sans cryptographic attacks?


texts:
I know that Huffman is not a encryption method, but I have a bit-stream that I know it's Huffman coded. However, the tree/table that maps the codes to real characters is not available. Surprisingly, during my searches I couldn't find helpful sources or even academic papers on this problem. It seems this problem has no literature.

Can anyone introduce a helpful resource on this? Is there any algorithm that I can devise or adapt to solve this problem?

P.S. Actually I know that the bit-stream is a JPEG file which is Huffman coded.

Thank you in advance


texts:
I am implementing a Certificateless Cryptography Algorithm by referencing the paper An Efficient Certificateless Encryption for Secure Data Sharing in Public Clouds. In this paper on page no. 4 during setup phase they have mentioned to choose hash functions (in my case it's SHA-256). But some of the notations are confusing me.

  Choose Cryptographic Hash functions :

  $H_1 : \{0,1\}^* \times Z_p^*  {\rightarrow} Z_q^*\\ H_2 : \{0,1\}^*
 \times Z_p^* \times Z_p^* {\rightarrow} Z_q^*\\ H_3 : \{0,1\}^* {\rightarrow}
Z_q^*\\ H_4 : Z_p^* {\rightarrow} \{0,1\}^{n + k_0}\\ H_5 : Z_p^*
 {\rightarrow} \{0,1\}^{n + k_0}\\ H_6 : Z_p^* \times \{0,1\}^{n + k_0}
 \times Z_p^* {\rightarrow} Z_q^* $

  where $n$, $k_0$ are the bit-length of a plaintext and a random bit
  string, respectively.

Can any one please explain me how do I interpret above hash functions. I have one more doubts in this algorithm,

Correct me if I am wrong
 $x$$H_1$ $(ID_A,w_0)$ means $x \times H_1(ID_A) \oplus H_1(w_0)$ where $x \in Z_q^*$

Or it has another meaning?


texts: Blockcipher: key space define permutations of blocks

texts:
An $n$-bit block cipher is a keyed function $f_k:\{0,1\}^n\rightarrow\{0,1\}^n$. There are $2^n!$ such functions. Most block ciphers seem to have only $2^n$ keys, although there is an AES mode that has a 256 bits key for a 128 bit block. This doesn't cover all of the key space though: a 128-bit key is roughly enough to fully cover a 34-bit block cipher.

For key lengths longer than block lengths, there exist a plaintext $x$ and two keys $k_0,k_1$ such that $f_{k_0}(x)=f_{k_1}(x)$. This can be seen by applying the pidgeon hole principle.
This is suggested to be dangerous, but I fail to see why.


texts: Does SpongeWrap (from the Keccak team) absorb ciphertext or plaintext?

texts:
I have been reading the Cryptographic sponge functions paper, but I'm still confused.

Does Keccak in authenticated encryption mode absorb ciphertext or plaintext?

Edit: Are there any test vectors to verify implementation of Keccak authenticated encryption?


texts:
I'm trying to understand the sentence in bold, in the follow paragraph of A new one-time signature scheme from syndrome decoding

Keygen: Given a security parameter $\lambda$, choose a suitable integers $k, n, r, u, w$ such that the actual difficulty of the SDP$(n,r,u)$ meets the level $2^{\lambda}$, with $u\leq w$.
The private key is a generator matrix $P\xleftarrow{$} \mathbb{F}_2^{k\times n}$  of a random $[n,k]$-code whose codewords have weight not exceeding $w$. This weight limit holds in particular for the rows of $P$. If each bit out of the $w$ bound is chosen uniformly from $\mathbb{F}_2$, the weight of each row of $P$ follows, by the central limit theorem, a normal distribution with ...

Could you give me some example of a bit out of the $w$ bound, please?


texts: How Does Prime Factorization Break ECDSA?

texts: I have heard that ECDSA will be broken in the not-to-distant future (roughly 15-25 years) by Quantum Computers running Shor's Algorithm. However, to my understanding, the only purpose of Shor's Algorithm is quickly finding the prime factors of very large numbers. Though time consuming, such factorization is by no means impossible on modern computers. The prime factors of public keys on the Secp256k1 curve can be found in a matter of hours with the proper algorithm. Is there a formula capable of deriving a private ECDSA key from a public one if the prime factors of that public key are revealed, or is there some other aspect of factorization which poses such a great security risk? I have been unable to find any information on the means through which these quantum attacks would be capable of breaking public key encryption despite the great concern over it. Any explanation, especially with mathematical examples, would be greatly appreciated.


texts: What is the proper approach to software licensing system?

texts:
I am willing to create a server side licensing system for my commercial softwares but not really sure what cryptography method I should be using for best possible security per the standard of modern cryptography and how should I implement the method.

My first requirement for the software that I am delivering, is to always be connected with the authorization or licensing server online in order to function. Secondly, I would be able to hand out a license key to the user and probably a public or private key to the user or the piece of software binary as needed. So, the client needs to prove to the server that it has a valid license key for the software and it has a valid software executable binary on constant basis as long as it is connected to the internet. So, basically it should be a 3 way verification system that I am trying to implement which will verify the software binary, verify the user and verify the license the user holds.

Now, what type of key pair cryptography I can be using in this regard and in what manner should I use them in client and server side? RSA, DSA, ECC, ECDSA or any other better alternative?

What could be the best approach for a system like this for best possible security and reliability?


texts: How to check a file was encrypted (really & correctly)

texts:
I would like to audit how an implementation of an encryption algorithm is really performed with the following given data of the problem:

the encryption mechanism is reversible (this isn’t a signature),
the algorithm is pretended to be AES, but might be implemented correctly or not, or worse something else,
the key is not known (in the case I am interested in, I want to check that all files are really and correctly encrypted, but I could play with specifically designed ones),
I don't have access to the source code.

At least I would like to be able to detect that the file is not encrypted.
Next I would like to be able to detect that the RNG is running in a tiny set or not really random.

In a first approach I thought to make an analysis of the randomness quality of the encrypted file: average value + standard deviation (with a tool like ent).
But I immediatly thought of artificial files with a perfect average value
and standard deviation which are perfectly regular and not the result of any encryption.
Then my first approach is wrong.

The environment in which I will make this audit is a Unix one.
( I cannot use tools or algorithms I cannot read, compile and check myself. )

Practical case:

I would like to check that my iPhone is correctly encrypted and what is the AES key derived from either a constant, my password, a hardware uniq identifier.
I would like to perform the same validation of an iPhone of any staff member which will ask me to make the same validation for his professionnal iPhone. This is a service toward users to provide them trust in what they think is encrypted and has to be.


texts: Security of cloud computational protocols in UC Framework?

texts:
The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is no honest majority players

Now when it comes to protocols designed for cloud computing, where few parties outsource computations to a service provider.  How do we prove the security of such protocols ?

Trivial example is Alice encrypts all her data using FHE schemes and outsources to Sally . Sally should now compute any function on the encrypted data requested by the Alice.

Notice that this simple case is different from two party secure function evaluation.

Now more complex protocols would be when Alice, Bob are two users who wants to execute some function on the shared data outsourced to Sally. So how do we prove security of  protocols designed for such functionality?


texts: Possibility of computing a and b values from the ciphertext?

texts:
Using paillier encryption, $N$ is the product of two large prime numbers, $s$ is sampled randomly from $Z_{N^2}$ we get $ C \leftarrow g^ms^N \bmod N^2 $ where $g=1+N$, By multiplying the cipher $c$ and a prime number $B$, we get the following equation:
$g^az^N = CB \bmod N^2$
Is it possible to compute the value of $a$ and $z$ ?


texts: Why does the NIST CTR DRBG apparently output the internal state when no additional input is given?

texts:
After reading through the specification of the FIPS CTR_DRBG in SP 800-90A (see Section 10.2.1), I got the impression that the output of the DRBG coincides with its internal state as long as no additional input is given.

Let $(K, V)$ denote some previously initialized internal state. Let $E: K \times V \rightarrow V$ denote what ever block encryption algorithm is used.

When the CTR_DRBG_GENERATE function is called with no additional input, the output is calculated as described in 10.2.1.5.1, more specifically in the loop in step 4, which amounts to

$E(K,V+1) || E(K,V+2) || ... || E(K,V+n)$,

provided enough bits are requested.

Then the internal state is updated by calling the CTR_DRBG_UPDATE function with $\operatorname{provided\_data}= 0$ as specified in 10.2.1.2. Here in step 2 apparently the exact same loop happens, as above in step 4, except that it only generates a string of length of the internal state. Still, the new internal state starts with

$E(K,V+1) || E(K,V+2) || ... $.

There is still a final XORing with $\operatorname{provided\_data}$, but since that consists of all zeroes, it does not change anything.

Am I missing something here? Outputting the internal state like this seems unnecessary, because it allows anyone observing the output to predict all future output. At least before non-zero additional input is provided to the generate function or a reseed happens. This makes this CTR_DRBG specification completely incompatible with the AIS 20 requirement for forward secrecy, see 4.6.1 (DRG.1.2).

It is also completely avoidable, by simply adding different constants before encrypting, e.g. n+1, n+2, ... . Interestingly enough this seems to happen for the HASH_DRBG (10.1.1.4), although the situation is a little different there.

I am at a huge loss of why this could be the case. Is there a different threat modeling than what I have in mind? Is this forward prediction resistance simply not considered important enough?


texts: Is this a typo/error in the Galois/Counter mode specification or have I misunderstood?

texts:
I've been reading the following document describing Galois Counter Mode:
The Galois/Counter Mode of Operation

On page 7 of the document, the following diagram describes the GHASH function used to authenticate data.  GHASH is defined as GHASH(H, A, C) where H is a 128-bit unsigned integer and A and C are two bit strings representing the authenticated data $A$ and ciphertext $C$.  $m$ and $n$ are used to represent the number of 128 bit blocks of data in $A$ and $C$ respectively.

Equation 4 and 5 look incorrect to me.  Is $C_i$ correct on line 4?  Won't $i$ already be larger than $m$ and thus this won't include the correct blocks of $C$?  Shouldn't this be $C_{i-m}$?

And the fifth equation, is this meant to be $C^{*}_{n}$ and not $C^{*}_{m}$?


texts: Choose Argon2i or Argon2id for secure password hashing on a website?

texts:
I make a website with authentication. I have studied a lot of answers to these questions, but I still don't understand what is better and safer to use for a website: Argon2i or Argon2id?
I know which attacks they protect against, but unfortunately I don't know which ones are dangerous for the website.
The only thing I realized is that Argon2d is not suitable for me, since It is used mainly for cryptosystems.

Also, although this is not entirely relevant to this question, when I
chose the hashing algorithm from bcrypt, scrypt, pbkdf2 and Argon2, I
chose it. Did I make the right choice?

Thank you all in advance for your answers!


texts: Does OpenTSA support PKCS11 to talk to HSMs?

texts:
We are planning to implement the time-stamping service (RFC 3161) using OpenTSA wanted to know: Does OpenTSA support PKCS-11 (Cryptoki) to talk to HSMs?

BTW: I did not find documentation or much information on OpenTSA. It would be really helpful if you could comment on the support of PCKS 11 by OpenTSA.


texts: Proving the possession of signature in zero-knowledge

texts: Does anybody know an efficient mechanism to prove the possession of a digital signature (e.g. RSA) on a certain attribute (message) in zero-knowledge? That is, without revealing the actual signature (against tracking, for privacy) prove that you have one? Thanks a lot in advance!


texts: Is there a companion algorithm for OTP to ensure integrity and/or authentication?

texts:
One-Time Padding is (theoretically) perfect encryption algorithm. Let's assume that these problems are solved:

Fast generation of independent and identically distributed random variables
Perfect key distribution system
Key only used once.
Key destroyed after use, without side channels that would allow any non-trusted third party to attain any key bits.

However, for modern information exchange, it is not sufficient to encrypt information (this is against Eve). In addition to encryption, it is necessary to also protect

integrity (this is against broken phone or cable) and
message authenticity (this is against Mallory).

Some recommendations in cryptography recommend to use security level similar for encryption keys and message authenticity keys (i.e. use 128-bit encryption key and 128-bit MAC key). For MAC tag, it is common convention for HMAC or to use at most half of the MAC key length as the output length. Some other algorithms use full block length of the function.

For information theoretic authentication tag security, I would expect that in order to transfer message with length $N$ bits, I would need at least another $N$ bits to transfer "authentication tag" matching with the message.

Choices for Integrity or Authentication

Here are some of example schemes:

Double the bits. I.e. when instead of 0110, process plaintext 00111100 with OTP. This'll eat twice as much key material than OTP, but will protect against any single bit errors, and many of other errors, because it is easy to check at the recipient. (If only worrying about integrity.)
Process concatenation of $P$ (plaintext) and $T$ (mac tag) via OTP. There is problem how to calculate $T$. My first idea would be to use some operation on binary Galois Fields $GF(2^n)$, such as multiplication $C * C$ and use OTP to send that "checksum". (Only for integrity, but detects integrity problems with larger probability than option 1.)

Any suggestions how to efficiently calculate $T$?
Are there any schemes which would provide usual security without key length $K=2N$?
Are some of preconditions incorrect?

For authenticity it would appear that these are valid options:

3. encrypt-then-mac with an information-theoretically secure mac.

4. mac-then-encrypt with an information-theoretically secure mac.

What would be suitable information-theoretically secure mac for implementing alternative 3?
Alternative 4 uses more key material than alternative 3. Are there any situations where alternative 4 would be profitable over alternative 3?

Previous Questions About The Field

You could think of this question as sort of add-on question to:
"Having 4096 bit keys and short (< 256 byte) messages, can I simply use the key as OTP?"


texts: Is solving a modular linear equation a hard problem when the coefficient is not an invertible element?

texts:
Assume that we have a linear equation like this:

$$ax=b \pmod n$$

when $x$ is the unknown, and $a$ is not an invertible element in $n$.

is finding $x$ a hard problem?

(by solving I mean finding an $x$ that satisfies the equation)


texts: Can one construct OTPs without using XOR?

texts:
The typical version of the one-time-pad (OTP) uses XOR to combine a key pad and a message. ($c=m\oplus k$)

Now let's assume some other scenarios which have the practical application of blinding. Do the below "OTP" constructions provide perfect secrecy?

The key $r\in (0;n)$ is chosen uniformly at random such that $r^{-1}\bmod n$ exists and shared between both parties. Furthermore both parties share some common modulus $n$ which may be an RSA-modulus or a prime. For a message $m\in (0;n)$, is the construction $c=m\cdot r \bmod n$ perfectly secure?
$r\in (0;n)$ is chosen uniformly at random  and shared between both parties. Furthermore both parties share some common modulus $n$ which may be an RSA-modulus or a prime. For a message $m\in (0;n)$, is the construction $c=m + r \bmod n$ perfectly secure? (I strongly suspect the answer to be "yes" here as this is a "commonly" cited method for secret message transmission via radio where $n=10^4$)


texts: AES in CTR mode, with a single key, and an IV derived from the plaintext

texts:
We need a system to compare cipher-texts for equality, without (the checking system) having access to the plaintext.

We found a library that uses AES in CTR mode, with a single key, and an IV based on the SHA1 has of the plaintext.

This question is closely related to another question here on crypto.SE, but in our case the IV is derived by calculating a SHA1 has of the plaintext.

The plaintext in question are key value pairs, where the key is a short textual identifier and the value is a key. The total plaintext size is around 1k in bytes, and, additionally, but separately, SSH key files.

Would there by be any implications for the secrecy of the encrypted plaintext?


texts: Error Correcting Codes Post Quantum Finalists

texts:
I have been looking into error-correcting codes in lattice, I am specifically hoping to find some information on hardware implementations for the NIST PQ PKE/KEM finalists (Saber, CRYSTALS-Kyber, NTRU).
I was reading this article on Timing Attacks on Error Correcting Codes in Post-Quantum Schemes and it mentions:

Kyber [31] and Saber [11] choose their parameters so that
their failure probability is small enough without need for ECC. NTRU [36] and
NTRU prime [6] even eliminate all decryption failures without using any ECC.
These schemes are therefore not vulnerable to side-channel analysis on ECC and
do not need the extra protection against these types of attacks.

I also understand the Lattice codes are also referred to as "Sphere packing". Something I have read about conceptually, although I am not sure how it works practically.
However, I have also seen a few articles (such a this) that have been published recently about RLWE (Ring-Learning with Error) that tackle error correction and fault detection in that space, however none of the finalists use RLWE (as far as I can tell?)
My question is somewhat broad:
I want to investigate ECC/fault detection in hardware (or more accurately their lattice counterparts), specifically with one of the NIST finalists. Does anyone have any insights into this sector of Lattice Cryptography? I am very new to this field (I'm a student, looking to define a thesis topic) but any insights would be appreciated.


texts: Simple description of a multi-party fair exchange protocol with trusted third-party

texts:
Imagine Alice wants to sell a file with important information to Bob for money. The file must be encrypted, so nobody can eavesdrop. It must also be signed upfront, so Bob knows it has not been fiddled around with. Trust is not established between them. Hence, a trusted third-party mediator is required. Ideally, the third-party mediator receives as little info/money as possible, but just enough so that neither Alice nor Bob can trick each other.
In other words: I am looking for an understandable description of a multi-party fair exchange protocol with a trusted third party. (For simplicity, let's assume the third-party is guaranteed to be reliable and available all time.) This question has a really nice, easy-to-understand description of such a protocol - except that it is not fully reliable because:

If Alice uses Bob's public key to encrypt the file, then upon receipt and decryption he might simply not send her the money.
Bob needs a way to verify the file's integrity, i.e. the file must be signed by Alice somehow.

One thing I was also wondering is to what degree non interactive zero knowledge proof protocols could be useful in this situation.


texts: Attribute based access control and role based, online bookstore example

texts:
I am asked to answer a question that says:

One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access in the subscription type they chose. Also if a book is not listed in the subscription list it's free for all and , every 15th of every month all books are free.

Describe with formal representation the above policy on ABAC.
How many roles does the RBAC model needs and which?

My question has to do with both. The attributes I have to define are {A,B,C,""}? Or did you define the date as an attribute as well{A,B,C,"",15}? In addition how many roles do I need in the RBAC model? A,B,C,NO,15? Or just a customer role as described in this answer on Security.se?


texts: so i had an idea recently for a cipher. the idea is as follows: for every ascii character in the input, replace it with a corresponding sequence of 25 binary digits that, when arranged into a 5x5 grid, make an image that relates to the character. take the output binary sequence, and convert it back to ascii. the benefits i think this cipher may have are: only the sender and recipient of the info know what images correspond to what characters, therefore making it harder to guess, since the 25 digits don't line up neatly with bytes, the data of some characters will overflow to the next byte, making it not as obvious whats going on, and lastly, it can easily be combined with other ciphers to make even the decrypted binary arrange properly still look like meaningless gibberish. my question is, does it provide any real level of security to a message transferred between two people, assuming those trying to decipher it have no prior knowledge about the cipher? thank you. by the way this is as a followup to my previous question about the vigenere cipher, as something else to add security to it. link to the question here: trying to identify the key of a vigenere cipher via brute force


texts:
I am running a comparison between CLEFIA(Lightweight cipher from Sony Corporation which is a standard now http://www.sony.net/Products/cryptography/clefia/standard/index.html) and AES 128-bit.

The comparison is done on an android device. (Galaxy S3)

For CLEFIA's code, I have converted their official code which is in C to Java from here http://www.sony.net/Products/cryptography/clefia/download/data/clefia_ref.c, and for AES 128-bit I am using Java's Javax.Crypto packages.

What struck me is that, instead of CLEFIA being lightweight and running faster (needs less resources, less cycles, etc), it was AES which was actually faster, and a lot. (Around 150 times and even more).

I unfortunately was not able to test both on sensors where the computational power and battery life is really minimal compared to a mobile.

Has anyone had an experienced with a lightweight cipher versus AES? (If needed, I do not mind sharing my code)


texts: Why exactly is a root hash used in relation to hash lists?

texts:
Wikipedia has an rticle about hash lists, although I find it technically not very detailed. For example: We could solve same problem by sending (authenticated) hash of each data block, together with each data block.

So, why the need for a root hash? Is it because this way you could send single authenticated root hash, and no need to authenticate each hash for each data block?


texts: What is special about an entropy count (RNDGETENTCNT) of 160 for libsodium initialization?

texts:
(Moved from StackOverflow)

In the Usage documentation for libsodium, before calling the initialization function sodium_init, they suggest you check the entropy count of the system's CSPRNG (i.e. use ioctl to query RNDGETENTCNT). That makes sense. In the example code, they check that the entropy is at least 160.

What's special about the 160 value?

The Linux CSPRNG now uses ChaCha20, right? But I would think that would require more than 160 bits of randomness to be initialized (e.g. it looks like the getrandom syscall in more-recent kernels blocks until it gets randomness of at least twice the ChaCha20 keylength, which would be 512 bits).


texts: What encryption should I use: Blowfish, Twofish, or Threefish?

texts: The title of this thread pretty much sums up what I'm asking: what is the best encryption to use out of the three — Blowfish, Twofish, or Threefish?


texts: Using RSA encryption with OpenSSL library: secure?

texts:
I'm working on a small program (in C) that writes encrypted log files, but there are a lot of articles out there that say you should avoid RSA whenever possible. However, most of these articles also seem to refer specifically to home-cooked algorithms involving RSA, because in such cases inexperienced crypto-devs tend to pick insecure parameters.

In my case I'm simply using the OpenSSL library and its RSA_public_encrypt() function, along with OAEP padding. The plaintext is received over the network and never fed directly to the program, any error messages will be reported only to people having local access to the machine it's running on. The private key can be either 2048 or 4096 bits long and will be stored offline and far away from the public key. The key pair is generated outside of the application, but also through OpenSSL:

openssl genpkey -aes-256-cbc -algorithm RSA -out foo.key -pkeyopt rsa_keygen_bits:4096
openssl rsa -pubout -in foo.key -out bar.pub

Is this setup:

Considered cryptographically secure? I know you could still attach a debugger and just read the plaintext strings from memory, but in that case you have bigger problems anyways so it's not really relevant for this question.
Future-proof (i.e. do I need to migrate it over to something else sooner rather than later)?


texts:
Assume we have a IND-CCA-secure PKC (Public-Key-Cryption) and we construct a commitment-scheme(commit, reveal) with that IND-CCA-secure PKC (so that commitment should be IND-CCA-secure too). But how can I prove that? I am a beginner and have absolute zero idea how such a proof works.
My idea: "the reveal-step" from commitment-scheme is uselss. so we can cut it? I heard something about reduction. But how does it work? Can anyone explain the reduction by using the example above step by step? Thank you!


texts: Why are in asymmetric cryptography as many keys as people involved needed?

texts:
The question: "10 friends wish to establish secure communications between themselves using asymmetric-key cryptography. How many keys need to be known by each user?" was posed by my teacher. He says 10 keys are needed. I say only 2 keys are needed. As long as they have copies of the same keypair (keypair=2 keys, a public and a private), they don't need more than two. Why in the WORLD would you need more than a public key and a private key?

Edit:

I have already seen a few questions of this type by googling. Turns out this kind of question never specifies that the people of the group must be able to talk individually to each other. Nevertheless, the student must always assume they want to talk individually and secretly. That makes no sense to me, but that's reality. Ie: In public key cryptography, how many keys are required for secure communication between n parties?

In other words, in criptography, when they say communication between N entities, it is not actually communication between N entities, it's more like N private communications between each of the N entities.


texts:
I'm attempting to get a better understanding of cryptography and have run into some questions about bcrypt.

Bcrypt relies on the blowfish cipher, which is a reversible method of encryption. But bcrypt is not reversible. How is that possible? Or am I mistaken? What does bcrypt do on top of blowfish to make it irreversible?
Why does bcrypt use blowfish instead of twofish or threefish?


texts: Are there any algorithms or alternatives to create short signatures?

texts:
I am searching for a algorithm to verify that a short message (size of about 20-30 bytes) was created by a specific device/user. The device/user can be partially offline.

Signing the data using rsa with 1024 bit is not possible since the content of the message will get to big.
The size of the signature should not exceed ~100 bytes. Are there any algorithms or alternatives to create short signatures. The algorithm does not have neccessarily have to rely on public/private key. Both parties are ment to be secure and can use the same key if neccessary.

The purpose is to prevent other devices/users to create messages in the name of some else device/user.


texts: Can I expand the modulus of an encryption scheme?

texts:
Take the lifted ElGamal as an example: suppose the original ciphertext is $<g^y \bmod q,g^m\bmod q>$. After some calculations, $m$ could be large enough to do modular. But I don't want $m$ to be reduced to a small value. So I was considering whether I can expand the modulus $q$ (e.g., multiply it with another prime $p$), without impacting the correctness of $m$.

Can I use the Chinese Remainder Theorem to achieve this?


texts: Converting R1CS to QAP - checking the last step

texts:
from reading Vitalik Buterin's excellent post on creating a QAP from an R1CS, I understood to translate a function into three groups of vectors, the number of vectors being the number of "gates" or constraints in our flattened code, and the size of each vector being the number of variables.

I understood also that to convert to a QAP such a that we end up with another three groups of vectors, with each vector i containing the coefficients of a polynomial that was interpolated from the ith values of each of the linear constraints from the original group (you know what I mean).

I want to check my understanding of the next step, whereby we derive a single polynomial by creating a (s · A) * (s · B) - (s · C) = H * Z

In Vitalik's example, does that mean that we perform the calculation as:

( 1 * A1(x) ) + (3 * A2(x)) + (35 * A3(x)) .....

so that using his example it would be:

( 1 * 0.833x3 - 5x2 + 9.166x - 5 ) + (3 * A2(x)) ....

What I wanted to make sure is that at this point, I'm supposed to be performing a dot product between the witness (1,3,35,9,27,30 in his example) and the corresponding polynomial from each  and group and NOT the between the witness and the EVALUATION of the corresponding polynomial from each group.

So for example, I shouldn't be doing this:

( 1 * A1(1) ) + (3 * A2(3)) + (35 * A3(35))  + (9 * A4(9)).....

that is, substituting x for the corresponding value in the witness

( 1 * 0.833(1)3 - 5(1)2 + 9.166(1) - 5 ) + (3 * A2(3)) ....


texts: What hash is concatenating with the data to be signed in TLS 1.3 CertificateVerify message?

texts:
According to specification, to create data that will be signed with server private key for CertificateVerify message, we need to concatenate 64 space characters, the string "TLS 1.3, server CertificateVerify", null and the hash of all handshake messages to this point. During the handshake process, we choosing the cipher suite and signature scheme...
So, if the cipher suite is, for example, TLS_AES_256_GCM_SHA384 and the signature scheme is rsa_pss_rsae_sha256 (different hash algorithms), hash of which algorithm should be used as handshake hash in data to sign, SHA-384 or SHA-256?


texts:
Disclaimer, this is not homework; I found the question statement here: Security of this PRF

To restate the question:

  Given $F$ a secure PRF with input size $\lambda$. Define $F'$ as
  $F'(k,x\mathbin\|x') = F(k, 0\mathbin\|x)\oplus F(k, 1\mathbin\|x')$
  with $x$ and $x'$ of $\lambda-1$ bits.
  Is $F'$ a secure PRF?

The given answer is no and it's clear that the PRF $F'$ is not secure. But I tried to provide a false proof that $F'$ is secure (but it's not) and cannot see what step the proof goes wrong.

First, to restate the counterexample:

  More specifically, for sake of simplicity let $F'_k$ be a keyed PRF
  $F'$ with key $k$ from the family of unkeyed PRFs $\{F' : \{0,
 1\}^{2(\lambda - 1)} \times \{0, 1\}^{2(\lambda - 1)} \to \{0,
 1\}^{\lambda - 1} \} $ and consider the following  $\mathsf{PPT}$
  adversary $\mathcal{A}$. $\mathcal{A}$ asks for the evaluation of the
  oracle $\mathcal{O}$ on $x_0 \mathbin\| x_1$, $x_0 \mathbin\| x_2$, $x_1 \mathbin\| x_2$, and
  $x_1 \mathbin\| x_1$. Then $\mathcal{A}$ computes the XOR of the first three
  oracle outputs and checks if the XOR is equal to the fourth oracle
  output. Observe that if $\mathcal{A}$ is given oracle access to
  $F'_k$, then $\mathcal{A}$ receives \begin{align*} F'_k (x_0 \mathbin\| x_1)
 &= F_k (0 \mathbin\| x_0) \oplus F_k (1 \mathbin\| x_1)\\ F'_k (x_0 \mathbin\| x_2) &= F_k (0
 \mathbin\| x_0) \oplus F_k (1 \mathbin\| x_2)\\ F'_k (x_1 \mathbin\| x_2) &= F_k (0 \mathbin\| x_1)
 \oplus F_k (1 \mathbin\| x_2)\\ F'_k (x_1 \mathbin\| x_1) &= F_k (0 \mathbin\| x_1) \oplus F_k
 (1 \mathbin\| x_1) \end{align*}
  and the XOR of the first three is exactly
  equal to the fourth and $\mathcal{A}$ guesses correctly with
  probability 1 given this case of the oracle. In the random case,
  $\mathcal{O}$ is equal to some truly random function $U$ and receives
  $U(x_0 \mathbin\| x_1) \oplus U (x_0 \mathbin\| x_2) \oplus U (x_1 \mathbin\| x_2)$ is
  unlikely to be equal to $U (x_1 \mathbin\| x_1)$, namely the probability is
  negligible. Hence $\mathcal{A}$ is a distinguisher.

Here is my "false proof" in an attempt at proving the statement "$F'$ is a secure PRF" and I'd really appreciate clarification on what step is incorrect.

Suppose $F_k'$ is not a PRF. Then there exists a $\mathsf{PPT}$ distinguisher $\mathcal{A}'$ and a constant $c$ and natural number $n \in \mathbb{N}$ such that $\mathcal{A}'$ distinguishes $F_k'$ from a truly random function with distinguishing advantage $\geq \frac{1}{n^c}$.
We now construct a distinguisher $\mathcal{A}$ (an oracle machine with access to $\mathcal{O}$ which is either from PRF family $\{F\}$ or truly random function $\{U\}$) for $F$ as follows.
$\mathcal{A}$ runs $\mathcal{A}'$. $\mathcal{A}'$ asks for queries of the form $x_0 \mathbin\| x_1$ as described above and $\mathcal{A}$ then queries the oracle $\mathcal{O}$ with $0 \mathbin\| x_0$ and $1 \mathbin\| x_1$, computes the XOR $\mathcal{O}(0 \mathbin\| x_0) \oplus \mathcal{O}(1 \mathbin\| x_1)$, and sends that to $\mathcal{A}'$.
$\mathcal{A}'$ will query polynomially many times in $\mathcal{A}'$'s input length so $\mathcal{A}$ will have to make twice as many, namely $O((2(\lambda-1))^l)$ queries for some constant $l$, which is still polynomial in $\lambda$.
Finally, $\mathcal{A}$ will output whatever $\mathcal{A}'$ outputs.
Note then $\Pr[\mathcal{A}^{\{F\}}(1^{\lambda}) = 1] = \Pr[\mathcal{A}'^{\{F'\}}(1^{2(\lambda -1)}) = 1]$ by construction since $\mathcal{A}$ effectively simulates oracle access to $\{F'\}$ when $\mathcal{O} = F_k$ for some $k$.
If $\mathcal{O} = \{U\}$ for truly random functions $U$, then $\Pr[\mathcal{A}^{\{U\}}(1^{\lambda}) = 1] = \Pr[\mathcal{A}'^{\{U\}}(1^{2(\lambda -1)}) = 1]$ because $U(0 \mathbin\| x_0) \oplus U(1 \mathbin\| x_1)$ is still truly random.
Then the distinguishing advantage of the new adversary $\mathcal{A}$ is also non-negligible and hence $F$ is not a secure PRF.

Again, where did I go wrong in this "false proof"?


texts:
Suppose that I want to encrypt some data using two different algorithm chained (e.g. AES and Serpent) and harnessing the benefits of CBC.

I can do:

SERPENT_CBC( AES_CBC(plaintext) )

or

SERPENT_ECB( AES_CBC(plaintext) )

Of course the second solution is computationally slighter than the first one.
But can it be considered as safe as the first one?

Links to papers or books that discuss this topic are welcome.


texts: How does a client verify a server certificate?

texts:
As far as I know,
when I request a certificate from Verisign (for example), and after they approved that I is me, they create a certificate (for me) that contains the digital signature and public key.
The digital signature is data that was created (not encrypted!) by their private key over my certificate data.
Now, a client connects to my site (which has an SSL certificate).

He reads the digital signature (from the certificate)
He knows which  algorithm used to create this signature, and he runs the hash again over my certificate data
Client uses his public key (in his store) of Verisign to decode (not  decrypt) the digital signature
If there is a match - all fine.
Client generates a random number, encrypts it with my public key, and my server accepts it and from now on - we are in symmetric mode.

I have the following questions:

Was I right?

Verisign creates the digital signature over my certificate data - which data?

The digital signature was created by what operation(?) over my certificate data? (Is this hashing?)

(I am not a cryptographer, but a  programmer who wants to understand this stuff.)


texts: Given partial key exposure and encryption oracle, can we recover full AES key?

texts: Suppose I have an encryption oracle for AES with some key $k$ (16 bytes) and that I know $n$ bytes of it. Is it possible to recover the rest ($16 - n$) in complexity less than $256^{16-n}$?


texts: Can I prove that hash of modified preimage is valid

texts:
Assume that hash(X) == Y

Alice knows both X and Y
Bob only knows Y

Alice generates a random nonce N and shares it with Bob.

Alice calculates H = hash(X⊕N) and shares H with Bob.

Can Alice prove to Bob that H really is hash(X⊕N) without sharing the value of X?

Edit:

X, Y, N, H are all 32 bytes.
The hash function is SHA-256.


texts: The difference between these 4 breaking Cipher techniques?

texts:
I'm trying to understand the difference between the following and what they actually mean :

Known plaintext attack
Known ciphertext attack
Chosen ciphertext attack
Chosen plaintext attack

Any clarification is much appreciated…


texts: TLS: Risks of using a NULL cipher with encryption implemented in application?

texts:
We have a browser-launched JNLP/WebStart application that is no longer able to establish client-server CORBA/IIOP communications across TLS 1.0/1.1 due to relying on a cipher suite that uses an obsolete encryption algorithm for confidentiality, now disabled in Java 8u171.  Client is Java.  Server is C++ on Solaris.

The TLS connection that relies on the compromised cipher suite is coming from inside the guts of an antiquated, unsupported ORB implementation (Visibroker 5.2.1).  It's source code is not available.  It does NOT support a stronger cipher suite.

Unfortunately, we are not able to replace/upgrade the ORB at this time, so we are looking for a safe, near-term workaround that allows for secure communication.

The ORB does support some cipher suites with a NULL EncryptionAlg where the KeyExchangeAlg and MacAlg are still considered approved in section 3.3.1 of NIST SP 800-52 Rev 2 (Draft 1/2018).

My idea is to configure the ORB to use one of these cipher suites and then rely on our application to provide confidentiality with a NIST-approved encryption algorithm.

What additional security risks exist, if any, with such an approach compared to having the cipher done by the TLS implementation?

Am I opening up a gaping hole in security by doing so or are they equally secure assuming the application code is implemented correctly?

I'm considering using the same technique described in RFC5246 (TLS 1.2) in our app's code to establish a shared secret between client and server.

Please let me know if you have any advice or suggestions.

Thank you!

EDIT 5/26/2018 attempting to provide more detail and some clarification of what I was considering:

My idea was to configure the ORB to use a cipher suite with a NULL encryption algorithm, such as TLS_ECDH_ECDSA_WITH_NULL_SHA.

I would then change our application code to encrypt any data to be sent across the ORB's unencrypted TLS socket with a NIST-approved algorithm such as AES_256_CBC.  Since our application does not directly use the ORB's TLS socket, it would encrypt fields of distributed objects before allowing the ORB to transmit them across the socket.  Likewise, it would decrypt those fields on the receiving side.

Am I losing any of the ORB's TLS session-provided guarantees besides confidentiality (i.e. client/server authentication, message integrity, replay protection)?  Here's a stackexchange answer that suggests the 1st two are kept: TLS: Is Integrity assured when using NULL cipher

If the non-confidentiality guarantees still hold, is there any security risk in sharing a symmetric key if the Java client generates the key, encrypts it with the server's public key, and then transmits that to the server across the unencrypted TLS socket (via ORB vendor API)?  The server of course is the only place that has the matching private key.

I'm unclear on the specific risks associated with this approach beyond the potential for bugs in our application logic to encrypt and decrypt every distributed object field.  Clearly this is ugly and not a long-term solution by any means, but I hoped it could be used in the short-term while we work on replacing/upgrading the ORB.  If it isn't a viable approach, then I need to find an alternative such as the tunneling that Maarten suggested.


texts: Diffie-Hellman insecure on addition modulo $n$

texts: Assume that the group $G$ is the set $\mathbb{Z}_{n} = \{0,\ldots, n-1\}$ for a 1024 bit integer and $+$ is addition modulo $n$. Then why would Diffie-Hellman key exchange in this group be insecure?


texts: easy hash algorithm to use without computer

texts:
I am searching for a simple hash algorithm(s) which can be used to calculate relatively secure hash without using of any computer. Some requirements:

use only simple arithmetics operations (+ - / *, maybe mod and abs)
base of 10 (letters can be substituted with groups of 2 digits), not binary
short time of calculations (limited number of operations per hash and limited number of digits per number)
simple calculation (normal person should be capable of memorize it)
if whole calculation could be done in memory, it would be a plus but it is not necessary
only short messages will be hashed (maximum 50 - 100 characters, about 35 on average)
relatively secure (of course no modern computers will be used to reverse / find a conflict)

Edit:

there is similiar question here:
 Is there a simple hash function that one can compute without a computer?, but all responses seems to be too complicated to fit in my requirements


texts:
I study cryptography as a hobby and I made a high school work (essay-like) about cryptography. When I was defending my work in front of a committee, one of the teachers confronted me about my suggestion of RSA usage.

I claimed that the public key can be freely available on a website for everyone to download it (and I've seen people do it that way). His argument was that what if someone was listening to my communication and as well was able to hack my website and change my public key to a different one. That way, he could decrypt at least one message encrypted with this key (before I would realise that I myself can't decrypt it).

Is it a correct argument or is it just my fault that I had my website hacked? I think that the latter is the right answer.


texts: How to check that an $km \times km$ block-binary matrix is an MDS matrix in $k$-bit words over $\operatorname{GF}(2)$

texts:
I have been reading about MDS matrices. It is defined as (paraphrased from Section 2.1)

An $n \times n$ matrix $M$ is MDS if and only if $bn(M) = n + 1$
where $bn$ (branch number) is defined as:
$bn(M) = \min_{u\neq0}({hw(u) + hw(Mu)})$ where $hw$ denotes Hamming weight.

It seems the MDS matrices like that of AES are defined over higher order fields like $\operatorname{GF}(2^8)$. It also seems the AES MDS matrix can be written as a matrix over $\operatorname{GF}(2)$. See this for example.
My question is, how does the MDS property translate to a binary matrix? Say, I am given an $n\times n$ binary invertible matrix, how can I understand whether this matrix is MDS or not?
I found some discussion in Section 2.1 about binary MDS matrices though, but could not get the idea.


texts: How to sign messages using the NOISE Protocol Framework?

texts:
I wanted to learn more about secure messaging and started a personal project using the libhydrogen library. From my understanding, instead of using public-key encryption, the library relies on the noise protocol framework to create ephemeral session keys shared by both parties to encrypt and decrypt messages. I was wondering if the same session keys can be used to sign and verify the messages, or should this better be done with another (not shared) key pair? Also, I couldn't find any information on how long these session keys should last. Are they intended to be used for several days, weeks, or longer, or should I think of a session key as a login to an online service that expires after 10-15min, unless you stay active?
As I said, I am new to the topic and there might be very straightforward answers. Unfortunately, I couldn't find this information myself. Thanks in advance.


texts: Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator

texts:
Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. The server performs some computation using client $A$'s and client $B$'s input and returns the result back to client $B$.

Now we want to consider client $B$ is corrupted and construct a simulator for that. I do know that if we use a zero knowledge proof of knowledge the simulator can obtain client $B$'s input. But in the above protocol we do not use a zero knowledge proof.

My question is: In the above protocol, how can a simulator in the ideal world obtain client $B$'s input and send it to the trusted third party (TTP)?

Some more details: consider client $A$ has $S_A=\{a,b\}$ and client $B$ has $S_B=\{c,d\}$. Client $A$ gives its set in clear to the server. Client B does as follows: computes $Enc_{B}(c), Enc_{B}(d)$ and sends them to the server. Then the server computes: $Enc_{B}(r_1\cdot a+r_2 \cdot c), Enc_{B}(r_3\cdot b+ r_4\cdot d)$, where $r_i \leftarrow \mathbb{Z}_p$. And sends the encrypted values back to client $B$. It's clear that the view of client $B$ is indistinguishable in real and ideal world, thus we do not need any zero knowledge proof of knowledge to prevent client $B$ from doing any particular things. Please ignore the fact that the result is nonsense.


texts:
I've been trying this problem:

Use the prototype function to hash message bit string into a length 16 message digest. Append (at the right end) the shortest nonce to the string (the spaces are just for easier reading)
1110 1011 0001 1011 0001 1100 1110 0111 1101 01

that will produce a message digest that begins with five 0 bits at the left end. The nonce is to be appended before the message string is padded

I believe there is a typo that is append to the "right end" I think it should be left end.
What I been trying was pad the message with 10 zeroes to get
1110 1011 0001 1011 0001 1100 1110 0111 1101 0100 0000 0000

then I split this into the following matrix:
[1110 1011 0001 1011]
[0001 1100 1110 0111]
[1101 0100 0000 0000]

but I'm not sure what the "nonce" is supposed to come into this.
Any suggestions what I might be missing or doing wrong?


texts: Modified ElGamal encryption (ElGamal encryption with messages in the exponent ) is implemented in a pairing friendly elliptic curve. Is it secure?

texts: In my scenario, I need to distinguish if the encrypted message is 0 or not. The message is encrypted by Elgamal encryption but with the message in the exponent. i.e. $(C,R)=(g^my^r,g^r)$ where $y$ is the public key. I wonder if my goal is just to distinguish if the plaintext is 0 or not, and the scheme is implemented in a paring friendly elliptic curve. In this case, I think I can use pairing to check if $e(C,g)=e(R,y)$, if the equation holds, then the plaintext is 0. A similar case, in helios voting protocol, the encrypted vote is either 0 or 1, if this voting scheme is implemented in a pairing friendly elliptic curve, I if it actually make the encryption non-sense?


texts: Best way to implement secure client/server communication in Python

texts:
For a college programming assignment I have to implement a secure communication protocol between a server and one or more clients. Upon instantiation of the server program, a file is generated, call it 'server_file'. This is then placed in a known location and assumed to be made available to the client program(s) via a secure channel unavailable to a hacker.

The client program will then generate its own file, call it 'client_file', and then must be able to send commands to the server (e.g. create new account, set some value, get some value, simple transactional requests). This client_file can be thought of as a client key or PIN that allows the server to know who the user is. The point is to make it so a MitM attack or other attack will not allow an adversary to subvert the system.

I have some passing familiarity with PyCrypt and a basic understanding of major cryptographic principles. However before I get started I wanted to elicit any ideas about the best way to implement this. I was thinking of using the server_file to sign (HMAC) the client_key and send the commands from client to server (along with the transaction message) using something like AES in CTR mode.

Does this seem like a good approach? Would you do anything differently? The purpose is to secure the communication channel.

Thanks in advance!


texts: Is there any LMS security proof besides the one mentioned in RFC 8554? Does LMS actually have a paper which describes a proof?


texts: Symmetric key in homomorphic encryption over the integers

texts:
Much like this question:
Public key in fully homomorphic encryption over the integers

I am also reading I'm reading Fully Homomorphic Encryption over the Integers, but I'm working on implementing the symmetric key implementation.

It says on the first page:

  The key is an odd integer, chosen from some interval $p ∈ [2^{η−1},2^η)$.

Where $η$ is the number of bits in the key and $p$ is the secret key.

Why is it that the high and low bit must be set to 1?

I've read the answer to the other question in regards to the low bit (the key being odd), but I don't see how it applies in this case so am a bit stumped.


texts: What would be the best plain text Cryptography method without the use of a computer?

texts:
What would be the best Cryptography method without the use of a computer?

  This could be a list of the current options available, that could be used without
  the use of a computer system/electronic device. Moreover, would like to identify what types of Cryptography techniques could be used to encrypt a small a amount of hand written, "plain text" without numbers or symbols just (characters). that being hard to implement or easy to implement.

Would like A brief description of:

E.g. types of cipher's
Different types of algorithm.
The range in security, low to high etc.


texts: What is base of $\log$ in Subexponential Algo for DLP?

texts:
I am currently going through this paper - "A Subexponential Algorithm for the Discrete Logarithm Problem" by Leonard Adleman.

On page 56, author mentions that Dixon's algorithm - Asymptotically Fast Factorization of Integers, works in $RTIME (O(2^{O{(\log(q)\log\log(q))}^{1/2}}))$ and on page57, mentions that $r_i, s_i$ are smooth with respect to bound $2^{c ({\log(q)\log\log(q)})^{1/2}}$ .

My question is are these logs mentioned in equation, base $e$ or $2$? Because in his paper (on page 255), Dixon has mentioned the complexity equation in $\ln$ which means natural log, i.e. base $e$.


texts: Finding IV in AES-128 having partial Key and plaintext

texts:
Let's suppose we have the plaintext, 14/16 char of the key and the first 2 and the last 36 chars of encrypted data (that is 64 char long). What I want is to find the IV. The cipher algorithm is AES (I think 128).

As I said, both the Key and the IV are 16 char long, the plaintext is exactly 32 char long and the cyphertext produced is 64.

What tool / process can I use to find the IV knowing all of this stuff? Note that I don't know the full key, but I have a big part of it, so probably some bruteforce is needed.


texts: Does choosing N to be product of safe primes avoid William's p+1 factoring attack on RSA?

texts: In this post, I found that choosing RSA modulus $N$ to be product of safe primes avoids Willam's $p + 1$ factoring attack. Suppose $N = p \cdot q$, where $p$, $q$, $(p-1)/2$ and $(q-1)/2$ are primes. In this case, certainly $p-1$ and $q-1$ are not smooth. They have a very large prime factor. But how can we guarantee that $p+1$ and $q+1$ are also not smooth? Why are they guaranteed to have large prime factors?


texts: Why does OpenPGP encryption produce different ciphertexts from the same plain text?

texts: With the same plain text to be encrypted and the same public key, OpenPGP tends to produce a different ciphertext every time I run the encryption operation. Why is this?


texts: Is there any chance of failure in Cryptography

texts:
With my limited knowledge of cryptography and its correct terms, functions (md5, base64, sha, aes or whatever) turn an input into encrypted output. For example, if the following input turns into following output:
input | output
______________
A     |  XX
B     |  YY
AB    |  ZZ

my question is: do such cryptography functions involve proven mechanism to avoid the failure of "repeated-output"? I mean, is there any chance, if inputing AB provides ZZ output, can there be any other input (like %) that might have the same output ZZ ?
What is the mechanism to ensure there doesn't exist two different input that provide the same output?


texts:
Is there anyway to detect encryption in real-time through a common signature or pattern recognition.

Say, a file is being encrypted using an AES-256 cipher, if I have access to the file stream - can I reliably detect an encryption operation?


texts: Shamir Secret Sharing: Using $a_0 \ldots a_k$ to store secret?

texts:
Let's assume I have a truly random secret $s$ that is 256 bits long, and I want to use SSS with e.g. $(k=4,n=8)$. The normal approach is to set $a_0=s$ and choose $a_1 \ldots a_{k-1}$ randomly, resulting in 256 bit outputs for the points.

My question: Is there any loss in security by splitting $s$ into $k$ slices (in this example 4 slices holding 64 bits each), and using those slices as $a_0 \ldots a_{k-1}$ in the polynomial? I can then reduce p from e.g. 2^256-189 to 2^64-59 and have reduced the size of each point to about 64 bits.


texts: Has anyone implemented the BB84 protocol?

texts:
Has anyone implemented the BB84 protocol and put it in production?
The BB84 is a quantum key distribution scheme developed by Charles Bennett and Gilles Brassard in 1984. It is the first quantum cryptography protocol.
I am thinking of incorporating the BB84 protocol into the network list of protocols at the IETF.
Nathan Aw


texts:
As far as I understand, there isn't an easy algorithm to find the generator of a cyclic group used in DH Key exchange. Is it true?
Given a large prime number like, e.g. 0x614423aaf0d10001f7d7, how can a generator of its group be computed (and checked that's true)?


texts: Why are cube and square roots of primes used as SHA constants?

texts: Do square or cube roots have properties that make them a better choice over, for example, the primes themselves?  Or is it arbitrary - would random numbers work as effectively?


texts:
In some non-interactive, pairing-friendly signature scheme, such as BLS12-381, is it possible to merge partially-overlapping aggregate signatures?

For example, say you have two aggregate signatures, $X = a + b + c$ and $Y = b + c + d$, and the (unique) public keys and messages for individual signatures $a$ through $d$, but not the individual signatures anymore.

Can you make a "merged" aggregate signature $Z = a + b + c + d$?

Can you make a "combined" aggregate signature $W = a + 2b + 2c + d$ that can still be verified, perhaps by keeping track of the individual multipliers?