texts:
I have a basic understanding of how strong encryption works on digital data. Bits can be changed so that they appear completely random and map one-to-one back to the original set, given the correct decryption key (and possibly other parameters).
But we always talk about digital encryption, never anything that would work on an analog system as far as I know. Good encryption didn't exist until relatively recently (or cryptanalysis would not have been as useful as it was during World War II) while phones and televisions, both using mostly analog signals until the internet came along, have existed for much longer. To my knowledge, nobody seems to have ever come up with secure and practical ways of encrypting them without converting them to a digital signal first.
Upon searching for analog encryption systems I came across DigiCipher (the successor to Videocipher), but it seems to use binary data since Wikipedia mentions that it uses a MPEG-2 compressed stream. Other sites mention that scramblers were used to prevent television channels from being watched by non-paying consumers, but scramblers have little to do with encryption since they (as the name suggests) are not intended to make the message unintelligible. Wikipedia's secure voice article only briefly mentions analog signals and then goes on to describe different digital systems.
The only real analog encryption scheme I found was on that Wikipedia page about secure voice communications. It works by adding noise before transmission and subtracting it on the receiving end. This sounds similar to a one-time pad, but it probably wasn't used only once, which means that all encryption became useless if the phonographic record(s) with the noise were stolen.
Thinking this through, digital encryption algorithms may be used to generate new analog records so that they're no longer a one-time pad. A secret key and variable number (e.g. yymmdd) could be used as input to a digital encryption algorithm, which then produces the noise to be added to the analog signal. Modern (secure) encryption algorithms are not doable by hand at a reasonable speed far as I know though, so I'm not sure how practical this idea is when all you have is mechanical or analog technology. They would have needed a computer.
Have we not (yet) figured out how to securely encrypt signals in a truly analog way (without the use of impractical one time pads), is it impossible (proven, somehow), or are existing algorithms just obscure because there are few applications for them (now that almost everything is digital)?


texts: Why is a Feistel Network able to both encrypt and decrypt just by using the round keys in a different order

texts:
Using a feistel network, to encrypt something you can just use the round keys. But to decrypt it, the same order of processes is applied, however the keys are used in reverse.

My question is: What makes this property of Feistel networks possible?


texts: How to protect against ephemeral key reuse in some signature schemes?

texts:
Given that some signature schemes (for instance Elgamal) use an ephemeral key that cannot be reused ever. How do people usually protect against this?

I'll elaborate more: if you reuse the ephemeral key in Elgamal for two different signatures you have (AFAIK) effectively given away your secret key. If the same public/private key pairs are normally used for long periods of time (sometimes years), how can you be sure that you never repeat the ephemeral key?

I know this key should be chosen randomly and given its length the probability of reuse is very tiny. But the risk is so big that I think it's worth taking some countermeasure.

Is there any standard way of dealing with this or am I totally missing something?


texts:
Let $H()$ be a cryptographic hash function.

Question: Can we consider $c= H(r||i)$ as a pseudorandom value, where $i$ is a public value, $1\leq i\leq n$, and $r$ is a large uniformly random value/key?

Edit (added after 1st comment was provided): $i$ values are just integers, $r\xleftarrow{R}\mathbb{F}_p$, where $p$ is a sufficiently large prime number. Note that we want to use the above function for multiple $i$'s where $r$ is used for all but kept secret.


texts: How can 3DES encryption use decryption in the middle step?

texts:
I have been reading about the 3DES algorithm and I cannot understand one part. In 3DES we do following operation: $$C=E[K_3,D[K_2,E[K_1,P]]].$$
Where $C$ is ciphertext, $P$ is plaintext, $E$ is DES encryption and $D$ is DES decryption.

In the second part we have the decryption with $K_2$. How can we decrypt a cipher with one key ($K_2$) which was encrypted with another one ($K_1$)?


texts: Multiple Decryption Keys Where Decrypted Result Reveals Which Key Was Used

texts:
Is there an encryption scheme such that

you can encrypt some data (such as an image) once,
generate multiple decryption keys that can decrypt the ciphertext (so far this is just shamir's secret sharing, but wait for it!), and
when the data is decrypted it comes out slightly modified/"watermarked" in a way that reveals which decryption key was used to decrypt it (so in the image example, maybe some pixels are a little bit off, and if you know the algorithm, the encryption key, the possible decryption keys, and the original image, you can figure out which decryption key was used).

Obviously, a simple layering of modifying the data after it is decrypted does not work, because then an untrusted party implementing the decryption step can just skip the modification and get the original un-watermarked data. I was wondering if it is possible to make it so that the modification and decryption are intrinsically linked such that there is no unmodified decryption possible - either the data decrypts watermarked to that specific key, or not at all.


texts: What is the benefit of zero knowledge identification (Fiat Shamir) over a standard digital signature?

texts:
Let's say there is a public key $v$.
Peggy has to prove to Victor that she has the corresponding private key $a$. Of course she doesn't want to disclose $a$ to Victor, but just to prove that she has the key.
Question: What is the benefit of "Solution 2" described below (a.k.a. Fiat-Shamir), which seems more complex and using zero knowledge proofs, when there is an easy solution (see Solution 1)?
Solution 1 (easy):

Victor generates a random number $r$, encrypts it with the public key $v$, and sends the encrypted message $r_E$ to Peggy
If Peggy has the private key $a$, she can decrypt $r_E$ into $r$, and send $r$ back to Victor and claim: "Hey Victor, here is $r$, this is the proof I can decrypt your message $r_E$, so this proves I have $a$"
If Peggy doesn't have the private key $a$, she cannot decrypt $r_E$, so she cannot prove anything.

I don't know the name of this simple scheme, but I think this can be done with nearly any public/private key encryption algorithm, and it seems safe.
Solution 2 (Fiat-Shamir, interactive zero knowledge proof):

$a$ is the private key, $v = a^2 \pmod n$ is the public key

Peggy generates a random number $r$ and sends $x=r^2 \pmod n$ to Victor

Victor sends 0 or 1 (randomly) to Peggy

If Peggy receives 0, she has to send $r$ to Victor (he can then check if $r^2$ is $x$ modulo $n$)
If Peggy receives 1, she has to send $y = r \times a \pmod n$ to Victor (he can then check if $y^2 \times v^{-1}$ is $x$ modulo $n$)

Repeat from step 2 at least $k$ times: the higher $k$ the smaller the probability ($2^{-k}$) of passing the test succesfully without actually knowing $a$

What is the benefit of complex Solution 2 when you can just do Solution 1?


texts: What is the advantage of XTS over CBC mode (with diffuser)?

texts:
I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser.

I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC (with diffuser) and the advantages of XTS.

Both modes encrypt data units almost the same way. For CBC, the sector number is somehow used to build the IV, for XTS, there is a "tweak value", which also includes (somehow) the block offset, so each data block can be encrypted independently (makes sense when encrypting harddrives/partitions). I cannot really see the advantage of XTS.

Now, they write the following about XTS:

  There are several advantages over alternatives such as AES in CBC: there is no requirement for an initialization vector (the tweak key can be derived from the block number); each block is encrypted differently (since the tweak value will be different); and unlike AES-CBC, AES-XTS prevents an attacker from changing one specific bit in a data unit by xor-ing each AES input with a different shifted version of the encrypted tweak.

Maybe they just compare XTS against CBC (without diffuser)... if so, does anybody know any advantage of XTS?

And can somebody explain the second advantage: "AES-XTS prevents an attacker from changing one specific bit in a data unit by xor-ing each AES input with a different shifted version of the encrypted tweak."?


texts: Pairing Field size as security parameter

texts:
I have read Pairings for cryptographers: It states that the groups $G_1$ and $G_2$ are groups of points on the curve and the group GT is a subgroup of the  multiplicative group of a related finite field $F_{q^k}$. l is the order of these three groups. It then states that the sizes for $q$ are more comparable to RSA rather than like RCC. I implemented a type D curve. Lynn states for the type D curve that 170 bit for q (and l) should be sufficient.

I have problems to understand this all since I am missing some mathematical background. The size of q is very much depending on the type of curve. Or is Lynn's statement just outdated? When I implement a scheme based on this particular "type D"-curve, how do I define the security parameters and how do I justify my decision?

I would have thought, that the group operations in $G_1$ are the fastest and all others are slower, therefore this size matters. But now I think this is too easy and wrong.


texts: Isn't fully homomorphic encryption trivial with a complex enough decryption function?

texts:
Consider the following exchange:

Alice has some plaintext $x$. She sends the encrypted version $\mathcal E(x)$ to Bob.
Bob returns $(\mathcal E(x), T)$, where $T$ is a turing machine encoding the function he wants to preform on the unencrypted data.
To decrypt this result, Alice first decrypts $\mathcal E(x)$ to get the original plaintext $x$, and then runs the turing machine $T$ with $x$ as the input. The decrypted result is the output of the turing machine.

By sending back $T$, Bob essentially offloads the work of actual computation on the ciphertext to the decryption function. However, from what I can tell, this is technically still a fully homomorphic encryption system, as it allows Bob to execute an arbitrary function on the plaintext, without ever knowing the plaintext himself (since the computation of the Turing machine is done by Alice).

Is this cryptosystem actually considered homomorphic encryption? Is there a subtlety in the constraints for a FHE system that excludes this? Or is it just rejected for being pedantic and useless?


texts:
my use case is the following: Sharing a secret on the blockchain from one participant over a smart-contracts with revealing the secret only after some condition is verified (another participant has paid for it).

Since every content on the blockchain is publicly available, I'm looking for a cryptographic way of exchanging keys.

This use case should be quite common for smart-contracts.


texts: Find plaintext of RSA by solving extended euclidean algorith for two encrptions with two different exponents for same plaintext


texts: How can I implement ID based encryption using RSA?

texts: I want to implement ID based encryption using the RSA encryption algorithm but how can I edit the algorithm for IDs.


texts: Computing $a$ and $b$ from $a+b$ and $ab \bmod N$, where factorization of $N$ is unknown

texts:
I have
$$\{a+b, a^2+b^2 \bmod N, a^3+b^3 \bmod N,\ldots\}$$
and
$$\{ab \bmod N, a^p b^q \bmod N, a^{p^2}b^{q^2} \bmod N, a^{p^3} b^{q^3} \bmod N,\ldots\}$$
The factorization of $N=(2p+1)(2q+1)$ is unknown. $p$ and $q$ are unknown too. $i \in \{1,2,...\}$ is a set of positive integers.
Can I compute any thing like $a^i \bmod N$, $b^i \bmod N$, $a^{p^i} \bmod N$ OR  $b^{q^i} \bmod N$ for any integer $i$? Just one of them is enough for me.


texts: Can compressed data be made to look like random data?

texts:
I saw the question "Decryption honeypots" and realized that if the message was compressed before being encrypted, then checking compressibility would not help you identify the decoded message.

So if the message is compressed by a known method is there a fast way to determine if it is a compressed message (right key) or random data (wrong key), without attempting the decompression method every time?

Edit: I was thinking about a scenario with large (1 gigabyte uncompressed), relatively verbose files like XML which can have a compression ratio of 8:1 An Analysis of XML Compression Efficiency, using a compression algorithm with an output that is nearly uniform. Also with padding on the compressed message to avoid attacks like CRIME as mentioned in the answer below (it seems hilarious to zip something smaller then pad it back to the same size, but this is to hopefully make it harder to decrypt).


texts: Calculating the Min Entropy of a string of bits

texts:
Let's say you are looking to collect some randomness from your computer. At a given time stamp, you can always collect the following 16bits as part of the time stamp:

First 5 bits are fixed and always the same
The next 4 bits are not perfectly random and exhibit a probability of 1/8 for the different possibilities
Finally the last 7 bits are perfectly random, always

What would be the min entropy of one time stamp?

My intuition thinks the min entropy would be 3 bits (from the 4 imperfect bits) + 7bits from the last section, giving Min Entropy = 10 bits for one time stamp. Does this make sense?

EDIT: Rephrased the 2nd bullet point


texts: Generating nicer diceware passwords without losing entropy

texts:
Yes, another one of those "I have found a great password-generation strategy"  waiting to be shot down!

It seems that although diceware aims to be a secure and user-friendly password generation method, there is a consensus that its output is not typically user-friendly. Over the years I have read many posts asking how to generate "nicer" passwords from it.
For example 1 2 3 and in particular 4.

To get "nicer" passwords, whatever that means, the suggestions are typically:

create your own word list (a lot of effort and need a longer password for same entropy since manual word lists are typically shorter)
use a selection method but be aware you lose entropy (e.g. pick $1$ out of $16$ passwords at the cost of $4$ bits of entropy)

But it seems to me that there is an easy way to get a more memorable yet shorter password, especially if you're bilingual. What you need is a set of $N$ disjoint diceware word lists, each with $6^5$ words.

When drawing a word, lookup the dice combination in the $N$ lists and pick the word you like most.

This is exactly as secure as drawing from a single list. Indeed, assuming there is no overlap between the lists, this is equivalent to processing the $6^5$ sets of $N$ words to create your own "preferred" word list and use a standard diceware on that list.

1 - Am I correct that generating a password in this fashion does not decrease entropy?

In practice, it is hard to find non-overlapping lists (unless you speak several languages, and even then there might be duplicates). The impact of overlaps is trivial to quantify when $N = 2$ but

2 - What is the impact of overlaps between lists when $N > 2$?

Even better, pick your $2$ preferred out of $N$ and flip a coin to choose. You just increased the entropy ($+1/$word) and still get a nicer password than single-list diceware.

Pushing this idea further: there are around $500$K words in the English language, from which one can create $\dfrac{500\cdot 10^3}{6^5} \approx 64$ non-overlapping word lists. For each dice combination, pick your favorite $K$ out of $64$ and pick a final word at random.

That's $\log_2(K)$ extra bits of entropy per word, so with $K=4$ you have $14.9$
 $bits/word$ instead of the standard $12.9/word$.

Nicer and shorter password for the same entropy / more entropy for the same number of words.

You control the trade-off between entropy and nicer words by adjusting $K$. With $K=8$ you gain $3$ $bits/word$ whereas with $K=1$ you get your preferred words but standard diceware entropy.

3 - Why is nobody doing this? This is easy enough to automate. Unless something above is wrong?


texts:
When I was perhaps nine years, I borrowed a book from the library on various maths and CS topics. It outlined various simple ciphers, including one that I used a lot, just for fun. I can't remember the name of the book, or the name of the cipher, so I hope you can help me with the latter one.

It is a monoalphabetic substitution cipher with words as key. The key, an arbitrary word in the alphabet, is concatenated with the alphabet itself, and then duplicate letters are removed (keeping only the first occurrence). The resulting word is the cipher alphabet.

For instance, using the modern English alphabet and the key "STACKEXCHANGE", the cipher alphabet would become "STACKEXHNG" (key, later duplicates removed) concatenated with "BDFIJLMOPQRUVWYZ" (alphabet without letters from key):

plain  : ABCDEFGHIJ KLMNOPQRSTUVWXYZ
cipher : STACKEXHNG BDFIJLMOPQRUVWYZ

Of course, this cipher is insecure past the "highest" letter in the key (Y=Y, Z=Z), but it's still interesting as a practical explanation of substitution ciphers (perhaps even more, due to its weaknesses).

To repeat my question: does this scheme have a commonly known name? Or is known to be attributed to a person?


texts: How is the ciphertext labeled with a set of attributes in Key-Policy Attribute-based Encryption (KP-ABE)

texts: My question is about Key-Policy ABE (KP-ABE). What does it mean when a "Ciphertext is Labeled with set of attribute"? How is it labeled?


texts: How can public key not reverse encryption if the algorithm is known?

texts:
I've been reading about WhatsApp getting "end-to-end" encryption, and when reading about it, I've notice something.

If I want to send a message from cell $A$ to cell $B$, since there's a public key, I will pass my message through this "algorithm" and send to the cell $B$.

My question is, knowing the public key doesn't automatically gives you power to reverse engineer the message sent? How is that possible that knowing the algorithm that created a code and the code itself doesn't get you the original information?


texts: Provably secure way of expanding permutations

texts:
Gimli is a 384-bit permutation that makes use of an internal 96-bit permutation which works on columns. Every 4 rounds starting from the 1st a "small swap" is performed and every 4 rounds starting from the 3rd round a "big swap" is performed, these work on the first 32-bits of each column (see https://gimli.cr.yp.to/linear.png)
The Chacha20 permutation is a 512-bit permutation with an internal 128-bit permutation which works on rows every odd round and diagonally every even round.
If we assume that the internal permutation of each algorithm is absolutely random, would the whole design be considered provably safe? What kind of safety margin does each design allow for? For example, would chacha20 with a random 128-bit internal permutation be just as secure as a 512-bit random permutation, and would Gimli with a random 96-bit internal permutation be just as secure as a 384-bit random permutation?
If neither of the above designs is provably safe, is there something else that offers a provably secure way of constructing a bigger permutation out of a smaller one?


texts:
The only time a shift cipher considers to be perfectly secure is when used on a single letter of plaintext and no more. Having that in mind, we can say it is certainly not perfectly secure.
Caesar cipher is perfectly secret only in the special case with the assumption that 26 keys are used in equal probability. Suppose that we have a plaintext of 50 characters long if each key for each character is chosen equiprobably then you end with
26^50 possible keys.
That is my answer, is it correct?


texts: Is the Blum Blum Shub PRNG suitable to create initialization vectors?

texts: Is it a good idea to use a Blum Blum Shub Generator to create my initialization Vector (IV) in AES-OFB (Output Feedback Mode)?


texts: Entropy of two concatenated random values

texts:
In this Intel blog posting, the author claims:

  The amount of work required to brute-force predict a random value that has n bits of entropy is $O(2^n)$. If you concatenate two values together, the entropy required to brute force the result becomes only $2^n + 2^n = 2^{n+1}$. By combining two n-bit random values, each with n bits of entropy, in this manner you get a random number with effectively only one additional bit of entropy.

Is this correct? My intuition suggests it would be $2n$ bits of entropy. But on the other hand, the two values are independent, so I can kind of see why it might be $n+1$ bits. Can anyone explain this?


texts: RSA: Decrypting message with public key and private key

texts:
I am trying to decrypt a message which its ciphertext in Hex A3 BB 05 00.
The original plain text is 8 bits and it is encrypted by a 32 bits RSA key.

I have successfully found the public key is $(e=947,n=2671079)$ and the private key is $(d=713604)$.

Then, I try to convert the Hex string to integer 00 05 BB A3 (Little Endian) $=375715$.

Finally, I calculate $C^d \mod n = 375715^{713604} \mod 2671079 = 544824$.

  Calculate in python: C**d % n

My problem:

1) what does $544824$ mean? Is it the original plain text or I need to further converting this number?

2) The plain text should be 8 bits, why the result I get is larger than 8 bits?

thanks!


texts:
I am trying to decrypt a text(~900 characters) and I started with the assumption that its a Vigenère cipher as the one of the identifier tool identified it as Vigenère cipher and also the Index of Coincidence (IOC) for the ciphertext is 0.04492. So I used another tool to check the IOC values for different key lengths (up to 20) but I see the IOC for all the key lengths is not anywhere close to 0.06 which is typically the case for every piece of Vigenère ciphered text I have seen. And in my case, the IOC for all the key length (up to 20) is around 0.045. I think this means either of the two things

The key length is greater than 20 and I need to manually somehow compute the IOC for values > 20 as most of the tools available only offer key lengths up to 20

this is not a Vigenère cipher at all, in that case, I don't even know how to proceed in terms of identifying the correct cipher.
Any advice will be appreciated
Thanks


texts: Ephemeral Diffie-Hellman in a symmetric crypto context

texts: I'd like forward secrecy in a case where the two sides have a shared long-term symmetric key. I intend to use AES in GCM. It looks like ephemeral Diffie-Hellman is the best way to generate the session keys. My question is, is it sufficient to just encrypt the key exchange using the long-term key, or should that be also authenticated?


texts: What are requirements of the audio input to be encrypted using AES?

texts:
I want to inquire that what are requirements of the audio input to be encrypted using AES. Is encrypting a mp3 file different from encrypting an aac file?

Thanks!


texts:
I am new to cryptography and have a question.
If I try to wrap some key using an AES key using DES3_CBC_PAD as a wrapping mechanism will this go to work?
I am doing this operation inside an HSM.


texts: Does BLS aggregating signatures allow duplicate signatures?

texts:
If there is a message $m_1$ that $H(m_1) \rightarrow g^r$
and there is another message $m_2$ that $H(m_2) \rightarrow g^k$, where $g^k$ is also a generator of $G$, is this possible?
then $g^r$ could equal $(g^k)^m$, where $m < p$, $p$ is the order of $G$.
Then any message could be expressed in this form $(g^k)^m$, so if we allow aggregating duplicate messages from one same signer, it is not safe in BLS?


texts: An arithmetic circuit for the indicator function?

texts:
The indicator function (or characteristic function) is defined as
$f_{t^*}:\mathbb{Z}_q\to \mathbb{Z}_q$ satisying that
$f_{t^*}(t)=1$ if $t^*=t$ and $f_{t^*}(t)=0$, otherwise. (Here $t^*\in \mathbb{Z}_q$ is given to define the function.)
I am dealing with transforming the function into an arithmetic circuit with addition gates and multiplication gates.
I know that if $t^*, t\in \{0,1\}$ then we can use a single NAND gate (in  Boolean Algebra) for this function. However, using arithmetic circuits, the transformation seems not to be trivial.
Could you please help me about this?
Thank you very much!
Updated:
The (one-variable) indicator function (or characteristic function) is defined as
$f_{t^*}:\mathbb{Z}_q\to \mathbb{Z}_q$ satisying that
$f_{t^*}(t)=1$ if $t=t^*$ and $f_{t^*}(t)=0$, otherwise. (Here $t^*\in \mathbb{Z}_q$ is given to define the function.) More generally, in the case of multi-variable, we define $f_{t^*}:\mathbb{Z}_q^d\to \mathbb{Z}_q$,   $f_{t^*}(t_1, \cdots, t_d)=1$ if $\exists t_i$ such that $t_i=t^*$ and $f_{t^*}(t_1, \cdots, t_d)=0$, otherwise.
I am finding polynomials that can be used to represent these functions.
So far, I have found some for the one-variable case:

Using Lagrange Interpolation: As $t, t^* \in \mathbb{Z}_q=\{0,1, \cdots, q-1 \}$ then such a polynomial should go through the points $(0,0), (1,0), $ $\cdots, $ $(t^*-1,0), (t^*, 1), $ $(t^*+1, 0),$ $ \cdots,$ $ (q-1,0)$. We can construct $f_{t^*}(t)=\frac{t(t-1)\cdots (t-t^*+1)(t-t^*-1)\cdots (t-q+1)}{t^*(t^*-1)\cdots (t^*-t^*+1)(t^*-t^*-1)\cdots (t^*-q+1)} (\bmod q)$ via the Lagrange Interpolation method. However, the polynomial has degree of $q-1$ and looks complicated to analyze.
Using Fermat's Little Theorem: The Fermat's Little Theorem states that if $q$ is a prime number, then for any integer $a$ not divisible by $q$, the number $a^{q-1}=1 ~(\bmod q)$.  Then we can construct $f_{t^*}(t)=1-(t-t^*)^{q-1}~ (\bmod q)$, if $q$ is prime. This polynomial looks simpler but may still be not helpful in case $q$ is a very big integer.

The question is that is there any more polynomials that are simpler than those above.
This question raised when I was trying to apply the idea at Section 4.2-4.3 of paper: https://www.iacr.org/archive/eurocrypt2014/84410298/84410298.pdf to the indicator function.


texts: Is any group of bits in a SHA-1 hash more/less unique than another?

texts:
Is there any bias in certain parts of the hash? E.g., first n bits are more/less unique than the last/middle n bits? Is there any particular property of any group of bits that makes it more/less unique?

Thanks


texts: Can someone steal the key between 2 clients which are using Symmetric Encryption?

texts: Can someone which is not authorized be able to listen between the conversation of 2 clients and catch the key? Because if I understood correctly one client needs to send the key through a channel so the another client could decrypt the data... So yeah that's my question; Can someone not authorized in that time frame catch the key and then start decrypting any data that passes through that channel?


texts: Would dividing a random number by a constant "ruin" it?

texts: If I get a random number from a cryptographically secure random number generator then divide it by a number, say 2, is it still cryptographically secure?


texts: Is this a novel secret splitting method, or a different view of an existing one?

texts:
I did try this on Information Security, but they were happier to see it moved here. The crypto content is quite low. It's more about secret storage and robust recovery of information, for instance allowing the sysadmin's password to be recovered by a quorum of other users, should he go under a bus.

I should am aware of a number of secret splitting methods, Shamir's polynomials and Blakely's hyperplanes for instance. I have not seen the following described anywhere in the literature, and AFICS, notwithstanding it operates over finite fields, it does not appear to be the same as Shamir's.

While I was playing about trying to understand the mathematics behind Raid6, it became apparent that the ability to reconstruct data in the face of missing portions could form the basis of a threshold secret splitting scheme.

The normal Raid6 operation employs what in forward error correction would be known as a systematic encoding. That is, the encoding operation is designed to render the input information 'in clear' at the output, as far as possible, to minimise computation. For example, in the case of a 6 drive with 2 redundancy Raid6, the encoding of data abcd by matrix multiplication is as follows

 | 1 0 0 0 |           | a |
 | 0 1 0 0 |   | a |   | b |
 | 0 0 1 0 | x | b | = | c |
 | 0 0 0 1 |   | c |   | d |
 | 1 1 1 1 |   | d |   | P |
 | v w x y |           | Q |

resulting in the plain data on the first 4 drives, simple parity on the 5th, and the more complicated sum on the 6th drive using the distinct non-unity multipliers vwxy from the appropriate Galois Field, GF(256) for byte based discs or messages.

The data can be recovered from any four of abcdPQ, in the general case by inverting the appropriate reduced matrix, though in practical drives, a more efficient method is used that takes advantage of the systematic encoding when possible. This is equivalent to a six share threshold 4 data split, with obviously no secrecy.

In the secret splitting mode, the multiplication would be replaced by

 | m00 m01 m02 m03 |            | e0 |
 | m04 m05 m06 m07 |   | d  |   | e1 |
 | m08 m09 m10 m11 | x | r0 | = | e2 |
 | m12 m13 m14 m15 |   | r1 |   | e3 |
 | m16 m17 m18 m19 |   | r2 |   | e4 |
 | m20 m21 m22 m23 |            | e5 |

where mxy are distinct multipliers from GF(256) [edit, thx poncho, obvious, but I failed to state it first time round] that form a matrix for which any reduced square matrix is non-singular (not guaranteed with a random selection)[/edit], d is the data message, rx are independent cryptographically secure random numbers, ideally from a one time pad, and ex are the encodings. The random data is used only in the encoding, and does not have to be stored or transmitted to the decoder.

As far as I can see, all six encoded channels have the input data combined with 3 random numbers, so without the full theshhold number of shares, the data is unrecoverable. I am sure that at least one, and possibly several of mxx can be replaced with unity, while retaining security. [edit]In fact, specifying a column of unity multipliers feels like being sufficient to enforce non-singularity for any reduced matrix.[/edit]

The scheme can be trivially modified to any number of shares and threshhold level, using a GF(p) where p>shares.threshhold.

I am not suggesting this might be in any way superior to the existing known methods, especially not Krawczyk's which is far more efficient for large secrets. But given the straightforward formulation, I'm surprised that I've not seen it described anywhere.

Is it novel? And does it work as well as I think it should?


texts: Does a key derivation function always generate an even distribution of bits in the resulting key?

texts:
I am a student of crypto.  During our study course, we went into the AES-128 algorithm.  All the examples given used an initial key k, 128 bits and we only briefly touched on the key derivation of PBKDF2.  We looked at the key as a series of bits of fixed length and discussed the security and so forth.

If the 128-bit key is generated from a function that takes a password as an input, will the distribution of 0 and 1s across the resulting key k always be random?

Let's say I have a dictionary of 'real' passwords from say a leaked website (a good sample size of say 1M), and put these passwords through a PBKDF2 function and recorded the keys k1, k2, through kn (where n=1,000,0000).

If I were to draw a histogram of frequency of bits 0 through 127 being set or not, if the keys were indistinguishable from random I would expect an even number of bits being set across the board.  Picture if you will, balls falling through a matrix and landing in 1 of 128 slots.

My questions are, is that the case?  Is it possible to see a skew (i.e. do the resulting keys bunch in one area of the spectrum of bits, maybe a curve of sorts?

My rationale behind asking is that is the resulting keys were to bunch to a particular resulting key type, it would narrow the key space to attack the AES-128 encryption.

Therefore, is it true to say that the AES-128 is only as good as the password derivation function having been used to form the key to begin with?  If the resulting keys are poor, the key space would narrow?


texts: Is there any point to encrypting a file if it's transferred via ssh?

texts:
Suppose I have two machines which can ssh into each other. Is there very little point in using gpg with a password protected symmetric cipher to transfer a sensitive file, and going to the effort of sharing the password - over, say, an encrypted call?

I realize that theoretically the ssh communication could be compromised without the password which protects the encrypted file being compromised, but what I'm asking is does the whole system need an overhaul if I'm leaning on ssh being secure for sensitive file transfer?


texts: Encryption algorithm with shortest ciphertext for long strings

texts:
EDIT:
My original problem was that if I have to encrypt large amounts of data, AES would expand the data even more, but this is not the case. This question states that AES does not expand data at all.
ORIGINAL QUESTION:
I have a list of data URIs containing image data that I need to encrypt and save to a file. On average, the data URIs I need to save are thousands of characters in length and may get longer depending on how I configure my system. Currently, I am using the AES encryption algorithm.
What encryption algorithm would provide the shortest resulting ciphertext for strings of this length?


texts: Examples of flattening code to create an R1CS

texts:
When preparing logic for use in a zkSnark, one needs to first "flatten" the code so it can be written as a series of constraints.

I'm finding it hard to find examples of doing this. For instance, how would I do convert the following logic into a series of constraints:

if ((input_1 && input_2) || input_3) {
  result = input_1 + input_2
} else {
  result = input_3
}

How would you go about converting this into an arithmetic statement that can then be then re-written as a series of constraints?  Or does there exist any examples of this sort of process that someone could learn from?


texts:
For example, the "Mental poker" protocol asks for Bob to encrypt each card with his key, shuffle them, and then pass them to Alice.  Alice then encrypts each card with HER key, shuffles them, and then hands them back.  Bob removes his original key and .....

Looking at homomorphic cryptosystems, elGamal seems to work well, but the result of any encryption gives TWO numbers:

$a = G^k \mod P\\
b = y^k \ DATA \mod P$

This makes me ask: How is a re-encryption done with elGamal?


texts:
I'm implementing a cryptographic primitive and I have a question about the memory model. The function (simplified) looks something like this:

void encrypt(unsigned char *out,
             const unsigned char *in,
             const unsigned char *pub_key)
{
  unsigned char buf[OUTPUT_SIZE];
  size_t i, j;

  memcpy(out, in, OUTPUT_SIZE);
  for (i = OUTPUT_SIZE; i < INPUT_SIZE; i += OUTPUT_SIZE) {
     compute(buf, in[i], pub_key);
     for (j = 0; j < OUTPUT_SIZE; ++j) {
        out[j] ^= buf[j];
     }
  }
}

To summarize: the input (plaintext) is chopped in blocks of size OUTPUT_SIZE and a computation is done on each block (except the first). Each iteration, the result of a computation on the input block and the public key gets stored in the buffer. The output (ciphertext) is the result of the binary sum (xor) of all processed blocks. The caller of the function has to provide an allocated memory block for the output. This memory may reside on the stack or the heap.

My question is: is this construction secure? I am afraid that because the memory is provided by the caller, there are scenario's in which an adversary can inspect intermediate values of this memory through sidechannels and learn about the secret plaintext. On the other hand I'm thinking: if the attacker has access to the out buffer, then why not also to the in buffer?


texts: Multiple random keys vs multiple keys derived from master key

texts: If Alice is going to share a symmetric encryption key and a kmac key with Bob using asymmetric encryption (sign with static key, encrypt with ephemeral keys - an authenticated KEM), what are the advantages and/or disadvantages of sending 2 random keys (signed, encrypted assymetrically), compared to sending 1 master key (signed, encrypted assymetrically), where multiple keys can be derived from it using something like kmac or hkdf?


texts: Wrong Miller's Weil Pairing implementation?

texts:
I tried to implement the Miller's Weil Pairing algorithm in python using the book "An introduction to mathematical cryptography" by Hoffstein, Pipher and Silverman.

I tried my code with the example given in the book and I get the correct response.

I tried with another example but I have problems with it.
It is stated in the book that we must choose a random point S $\notin$ {0, P, -Q, P-Q}. I took the following elliptic curve $E : Y² = X³ + 3X + 8$ over the field $\mathbb{F}_{13}$.

$E(\mathbb{F}_{13}) = \{0, (1,5), (1,8),(2,3),(2,10),(9,6),(9,7),(12,2),(12,11)\}$

I tried to compute $e(P,Q)$ with $P = (1,5)$ and $Q = (12,2)$. As $-Q = (12,11)$ and $P-Q = (9,6)$, I tried with all the other points but I always have an error at some points in the computations because I end up with zeros at both numerator and denominator in this function.

There is probably something that I didn't understand or something wrong with my implementation. Could someone explain to me what is the problem ?
Here is my code with the first example that works and the second that causes the problem : http://tpcg.io/GZNfns


texts: Can I use Pollard'-Rho even when the order is not a Prime?

texts:
I am now solving the ECDL problem.

I want to use [discrete_log_rho] in SageMath, but I can not use it because ORDER is not a prime number.

Can I change it to a decimal number close to ORDER at my disposal?

I tried to use another method, but the size of F was 100bit, so I could not use BSGS because of memory problem.

If I can not use Pollard's-Rho and BSGS, what else is there?


texts: Validate per round rather than cycle-walking in FPE

texts:
I was thinking about FPE specifically for numbers, CC, phone, SS #, etc. and I thought of some small "optimization" that could be implemented. Can I validate the string length after each round in the Feistel network, and repeating a round with the same tweak if the data is invalid, and continue until a set # of tweaks/successful rounds have been done.

For decryption, it would be much the same, since any invalid round could simply take the tweak of the preceding successful round.

Is there any downside to this approach (ie. security flaws, does not actually optimize run time, etc.)?


texts:
I’m trying to understand how a program checks for passwords and how fast it iterates through a loop.

I think I understand how to calculate the minimum required strength for my password.

Estimate that an adversary can guess one billion (10^9) combinations a second (Snowden)
Want to make the data safe forever. Let’s define forever as one million years.
That’s (one day $= 86,400$ seconds – say  $10^5$) times $365$ (say $10^3$) times one million ($10^6$)
At minimum my password must be greater than $10 ^{(9+5+3+6)} = 10^{23}$

OK. So far so good.

If we come up with a randomly arrived at password that requires at least 10^{23} then the password is safe.

Now let’s say that we want an algorithm that can be remembered; that can be salted and that one can make different levels of difficulty.

I understand the concept of a dictionary attack but trying to fine-tune my understanding.

Let’s assume that we have a dictionary of words from which to compose the password.
Let’s assume that this dictionary has a length of $1000$.
I’m assuming that a dictionary attack simply loops through an array.

So, if we have selected four randomly selected words {  CORRECT HORSE BATTERY STAPLE } from that dictionary (of a $1000$ words) ones
password strength would be $1000^4$ (assuming random means one can repeat the words) or $10^{12}$.

QUESTION 1: Is each loop through the array one iteration? Does that mean that the password would be uncovered in $10^3$ seconds? (I’m assuming yes. Just affirming)

Say the attacker assumes people may substitute zeros for Os then both HORSE and H0RSE would need to be tried.

QUESTION 2: Has the time iterating through the loop doubled? Would the attacker have to evaluate STAPLE to see if, it too, had an O?

Say I add a character between each of the words {  CORRECTXHORSEXBATTERYXSTAPLE } That would add very little to the difficulty, it would up the complexity by just $26$ but if I used a different letter between each word then the difficulty would increase by $26^4$.

QUESTION 3: How does one calculate the effort required by the attacker?

Take dictionary (assume for simplicities sake)
Iterate through first time (takes $10^{12}$ / $10^9$ seconds)
Iterate through a second time substituting zeros for ohs.  (Assume one oh per word – for simplicities sake) so that takes another $10^{12}$ / $10^9$ seconds
Iterate through a third time substituting @ for ohs
Iterate through a fourth time substituting ! for I
And so on …

Even If the attacker must do $1000$ such substitutions it would turn out to be 1000 iterations. If each iteration takes $10^3$ seconds then the total time is $10^3 \cdot 10^3$ or $10^6$ seconds.

What we get from this is adding complexity by substitution is far less effective than increasing the length of the password.

If we add another dictionary entry to CORRECT HORSE BATTERY STAPLE, for example - CORRECT HORSE BATTERY STAPLE PIANO then the difficultry would have increased to $1000^5$ or $10^{15}$.
$10^15/10^9$ is $10^6$. We keep things simple and have the same defense.

Is the above reasoning correct?  And by the way I’m purposefully avoiding birthday attacks – that will be part of another question. :)

Moderators – I understand that this does not fit in well with the Q/A format expected by StackExchange.


texts:
I'm storing the salted hash of a credit card number in a database. What I'd like to be able to do is determine if two different entries in the same database correspond to the same credit card.

Specifically, let $C_1$ and $C_2$ be two credit card numbers (which may or may not be the same). Let $S_1$ and $S_2$ be two different salts. If $H_1 = hash(C_1, S_1)$, and $H_2 = hash(C_2, S_2)$, I need a function, $f$, such that $f(H_1, S_1, S_2) = f(H_2, S_1, S_2)$ if and only if (with very high probability) $C_1 = C_2$.

Can this be done securely?

Possible Solution

A friend of mine, who is a cryptographer, suggested the following:

Let $h(C, S) = g_1^{h_t(C)}g_2^{S}$ mod $p$, where $C$ is the credit card number, $h_t(C)$ is a "traditional" hash function, and $g_1$ and $g_2$ are generators that meet the Diffie-Hellman requirements, and $p$ is the corresponding prime.

If we do that, $f(H_1, S_1, S_2) = H_1g_2^{S_2}$ has the desired property.

A few questions:

Does this seem secure?
If I used a library, like the Bouncy Castle libs, to pick $p$, $g_1$, and $g_2$, would it be safe for a non-cryptographer to code this up? In other words, how easy would it be for a non-cryptographer to screw up the implementation in a non-obvious way?
Advantages or disadvantages of this compared to the two other solutions proposed below. I tend to favor this because I'm familiar with Diffie-Hellman, while the others involve some techniques with which I am not familiar. Additionally, I suspect that there are more libraries for Diffie-Hellman since it's old and popular.


texts: Derivation of birthday paradox probability

texts:
I am trying to come up with an explanation of the probability of birthday collision.

$P$(no collision among t people) = $(1− \frac{1}{365}) · (1-\frac{2}{365}) ··· (1-\frac{t-1}{365})$

  For one person, the probability of no collision is 1, which is trivial
  since a single birthday cannot collide with anyone else’s. For the
  second person, the probability of no collision is 364 over 365, since
  there is only one day, the birthday of the first person, to collide
  with:

  $P$(no collision among 2 people) = $(1− \frac{1}{365})$

  If a third person joins the party, he or she can collide with both of
  the people already there, hence:

  $P$(no collision among 2 people) = $(1− \frac{1}{365})·(1−\frac{2}{365})$

While it is clear how we get the probability of collision for 2 people, it is not intuitive to me that how we get the probability of collision between 3 people. I'd expect the probability would be $(1−\frac{2}{365})$. For example, when you roll the dice, the probability of $6$ is $\frac{1}{6}$, and the probability for 5 or 6 is $\frac{2}{6}$. It is not $\frac{1}{6}$·$\frac{2}{6}$ which seems to be the case in birthday collisions.

I'd appreciate an answer with an intuitive explanation.


texts:
When a user registers, a random personal salt is generated. Then hashing is done like so:

hash(hash(USERNAME . PEPPER . PASSWORD) . PERSONALSALT)

Then the personal salt is encrypted using password as key and placed in the database along with hash. When user attempts to log in, personal salt is decrypted, and used to hash and compare. Is this a good idea? The hashing function is SHA-256 iterated roughly half a million times depending on sever specs.

Yes I am aware that "rolling your own encryption" is a mortal sin. I am just wondering hypothetically if it would function. I would never use something made sketchily in a production environment.


texts: How can we compare an encrypted number with a normal number?

texts:
I am currently doing a project on privacy preserving encryption using a k-means system and the Paillier encryption algorithm (homomorphic algorithm). I have to send an image of a skin disease to the server as an encrypted image.

To do this, k-means is applied on the encrypted image and the image is sent to the respective party with k-means already applied. The decryption happens on the party side.

However in the k-means algorithm itself, I have to compare an encrypted pixel value of the image to a normal number, and this is where I am getting stuck.


texts: Unleakable shared secret under realistic assumptions?

texts:
Can two devices share a common secret in a way that an adversary who compromises one of the two devices after deployment is unable to reconstruct the shared secret, under the following assumptions:

before deployment, there is a secure initialization phase, e.g., in which a pre-established secret is stored in both devices
after deployment, the two devices are physically separated (possibly a few miles/km apart from each other) and unable to communicate with each other (including via any 3rd party)
during attack, the targeted device is offline (inoperable) for a few minutes
after attack, a compromised device leaks all data, thus, among others, all secrets
both devices do not possess tamper-proof hardware, not allowing to delete secrets upon tampering, etc.

Due to the assumptions, the common secret must be volatile, thus, being constantly changing data. Note that using a PRNG with a pre-established secret is not enough, since an adversary can after device compromise reconstruct the PRNG stream (having the pre-established secret).

A possible solution to this problem may be using an entropy source that produces the same random data on the two devices and has a very high throughput (maybe atmospheric noise or similar?). Before deployment, both devices pre-establish a secret filter that allows them to process the sheer amount of entropy from the source during deployment (e.g., listening on a specific channel, XORing every Xth bit, etc). During deployment, both devices constantly derive the common secret using entropy source and filter. An adversary may try to compromise a device, retrieve the secret filter, and reconstruct the common shared secret. However, as the target device is offline for some time during attack (see assumptions), the adversary misses so much data from the entropy source that he is unable to buffer this data and thus is unable to reconstruct the common secret in the end using the secret filter.

Do you know whether there is an entropy source that provides these properties? Or do you know another solution to this problem?


texts: Is there hierarchical key generation that completely tolerates leakage?

texts:
Is there a hierarchical key construction algorithm that achieves forward/backward privacy with any (unlimited) leakage of private non-master keys?

What I mean is that if there's an unbounded number of generated keys where their private key is revealed, the master private information is still safe.

The paper "Hierarchical deterministic Bitcoin wallets that tolerate key leakage" is only safe up to k keys, and takes O(k) space to share the public key generation information.

Has there been anyone getting k -> infinity with O(1) space?


texts: Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?

texts:
According to ssh_config(5), HostKeyAlgorithms “specifies the host key algorithms that the client wants to use in order of preference ... The default for this is:
ecdsa-sha2-nistp256-cert-v01@openssh.com,
ecdsa-sha2-nistp384-cert-v01@openssh.com,
ecdsa-sha2-nistp521-cert-v01@openssh.com,
ssh-ed25519-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
ssh-rsa-cert-v01@openssh.com,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

This lists ECDSA keys before Ed25519 key, and also prefers ECDSA keys with curves nistp256 over nistp384 and that over nistp521.
I was under impression that Ed25519 is generally superior to ECDSA keys, and that keys with higher n curves, at least of these three, are more secure.
So why OpenSSH lists the algorithms in this order?
Also, I'm developing an Android application that uses SSH as a transport. It also needs a list of preferred host key algorithms. Would it be a good idea to replicate OpenSSH's list in the app? Or should I prefer ed25519 over ecdsa with nistp521 over -384 over -256 over rsa keys?


texts:
The following key enhancement to DES was proposed in order to increase the complexity of finding the keys by exhaustive search.

$$\text{DES}^V_{k,k_1}(M)=\text{DES}_k(M)\oplus k_1$$

where the keys’ lengths are $|k|=56$ and $|k_1|=64$ ($k_1$ has the same length as the block length). Show that this proposal do not increase the complexity of breaking the crypto-system using brute-force key search. That is, show how to break these schemes using on the order of $2^{56}\ \text{DES}$ encryptions/decryptions.

You may assume that you have a moderate number of
plaintext-ciphertext pairs, $C_i=\text{DES}^V_{k,k_1}(M_i)$.

Let $r$ be the number of pairs indexed from $1$ to $r$.

I define $\forall\ l\in\{0,1\}^{56},\ i\in\{1,\dots,r\}:\text{K}(l,i) = \text{DES}_l(M_i)\oplus C_i$.

My proposal for an adversary is:

for every l of size 56:
     for i = 1,...,n:
          compute K(l, i)
     if for all i != j : K(l,i) == K(l,j)
          return <l,K(l,1)> as the keys of the cryptosystem

It is true that if in some iteration $l=k$ before returning, all the $\text{K}(l,i)$ will be equal to $k_1$ (from the definition of the new crypto-system), so we will return $k,k_1$ as the keys.

But, I think that it is possible that for some $l\neq k$ the $\text{if}$ in the second $\text{for}$ loop will be satisfied since we are checking only a small amount of messages. In such a case if we meet $l$ before meeting $k$ the return of the algorithm will be false.

question

Is it possible to break the crypto-system deterministically with the given complexity, or we must allow  some error probability?


texts: What is the difference between a permutation and a shuffle (transposition cipher)

texts:
A non-cryptographic definition of a permutation is "2a: the act or process of changing the lineal order of an ordered set of objects. 2b: an ordered arrangement of a set of objects
The Wikipedia article on Random permutation states that "A good example of a random permutation is the shuffling of a deck of cards: this is ideally a random permutation of the 52 cards."
An ideal block cipher is a pseudorandom permutation.
Shuffling a deck of identical cards would result in output indistinguishable from the input. Applying an ideal block cipher to an all-zero (or all-one) plaintext block would yield a random ciphertext block, not the same all-zero (or all-one) input block!
What's an easy-to-understand difference between a shuffle (equivalently a transposition cipher) and a permutation in the sense meant by cryptographers?


texts: Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?

texts:
Like people always say: “Attacks only get worse…” — which is why I'm asking early.
I have been reading the paper “RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis” published December 18, 2013 by Daniel Genkin, Adi Shamir, Eran Tromer.
Attack
In short, they discovered that it is possible to crack 4096-bit RSA encryption keys using a microphone to listen to high-pitch noises generated by internal computer components. In one of their setups, they only used a mobile phone which was placed 30 cm from a target laptop, with the phone's internal microphone pointing towards the laptop’s fan vents… successfully achieving a full key extraction in this conﬁguration and distance.

image source: https://www.cs.tau.ac.il/~tromer/acoustic/
The proof in that 57-page paper is hard enough to start thinking about related crypto-solutions. Especially since the paper mentions that rather simple hardware like parabolic microphones and laser vibrometers can be used for distant acquisition.

image source: https://www.cs.tau.ac.il/~tromer/acoustic/
Now, I know this audio-based key recovery attack is a new one (published December 18, duh) but there has been quite some research on hardware-related attacks in the past already — like measuring the electrical potential of a computer's chassis during encryption etc. — and beyond that, the crypto-community tends to search for a solution to every problem encountered. So, I can imagine that there might be something out there I'm not aware of, which might be fit enough to lift one or more security impacts of acoustic cryptanalysis; especially in the described case(s) of acoustic key recovery attacks.

image source: https://www.cs.tau.ac.il/~tromer/acoustic/
(Partial) Mitigation
Related to solutions, the paper's website  mentions

…software countermeasures…

but also notes

How vulnerable are other algorithms and cryptographic implementations?
We don't know. Our attack requires careful cryptographic analysis of the implementation, which so far has been conducted only for the GnuPG 1.x implementation of RSA.

and

Q9: How vulnerable is GnuPG now?
We have disclosed our attack to GnuPG developers under CVE-2013-4576, suggested suitable countermeasures, and worked with the developers to test them. New versions of GnuPG 1.x and of libgcrypt (which underlies GnuPG 2.x), containing these countermeasures and resistant to our current key-extraction attack, were released concurrently with the first public posting of these results. Some of the effects we found (including RSA key distinguishability) remain present.

(italic emphasis mine)
and last but not least the paper states on page 48 (as a conclusion at the end of it’s “Mitigation” section):

This too foils our key recovery attack (but not key distinguishing).

(italic emphasis mine)
Question
The paper and website obviously imply that a “key distinguishing” problem still exists and that it represents a potential attack vector. They also seem to imply that no general, one-fits-all solution to the problem does not exist at the time of writing. Especially not when thinking about non-RSA ciphers. Yet, chances are that there’s something out there I haven’t heard of yet.
Can we ensure the security of a crypto-algorithm and/or -scheme against acoustic cryptanalysis? Does any generally acknowledged crypto-scheme, crypto-solution, or crypto-protocol exist which would be able to provide cryptographic security/defense against the described and maybe even other acoustic cryptanalysis of (non-RSA) ciphers?
Simpler asked: What cryptographic measures enable us to ensure the security of a crypto-algorithm and/or -scheme against acoustic cryptanalysis and/or acoustic attacks?


texts:
I would just like to ask what is the classification of both BFV and CKKS scheme are they Somewhat Homomorphic or Fully Homomorphic?

Brakerski/Fan-Vercauteren (BFV) [Brakerski12, FV12, BEHZ16, HPS18]
https://eprint.iacr.org/2012/144.pdf

Cheon-Kim-Kim-Song (CKKS) [CKKS17]
https://eprint.iacr.org/2016/421.pdf


texts: How did || come to be used in crypto texts to represent concatenation?

texts:
In RFC5647, NIST SP 800-38D, etc., || is used to denote concatenation. How did that come to be?

In most programming languages || represents "or" and + denotes concatenation and the fact that crypto texts just kind of mixed it up seems to make for an easy gotcha.


texts: Is the error distribution in Learning with Errors (LWE), the discrete Gaussian distribution?

texts:
In $\mathbb{Z}$, the discrete Gaussian distribution is defined as $D_{Z,s}(x) = \frac{\rho_s(x)}{\rho_s(\mathbb{Z})}, x\in \mathbb{Z}$.
In LWE, $(\overrightarrow{a}, b = \langle \overrightarrow{a}, \overrightarrow{s}\rangle + e)\in \mathbb{Z}_p^n\times \mathbb{Z}_p$, the error $e$ is just sampled by rounding from continuous Gaussian, but in [GPV08], the author said that rounding is not the $D_{\mathbb{Z},s}$, their statistical distance is not negligible($\Omega(1/s^3)$).
The error in LWE is not discrete Gaussian? Or what's the relation between the error in LWE and the $D_{Z,s}$?


texts: Calculating the inverse modularity of the determinant for Hill cipher

texts:
I'm trying to decrypt a message encrypted with Hill Cipher, but I don't understand how to find the determinant so it solves the equation $det * 1/det = 1 mod 26$.

The determinant for my key matrix is $62$.


texts: Hamming Weight of Solutions to the Frobenius Equation

texts:
My area of research is algorithms for calculating optimal addition chains.
I have a new high performance algorithm that at its core benefits from estimating the number of set bits ($v(n)$ Hamming weight) in a solution to the Frobenius equation.
So for example with a given $n$ and $a_i\geq 1$ if

$n=\sum_{i=1}^z a_i x_i,\ x_i\geq1$

Then if I can bound $\max_{i=1}^z v(x_i)$ from below it makes a huge impact on the performance.

To my untrained eye this seems like something that might come up in cryptography. Trying to extract information about a pre-image from the image. I my case the number of set bits.

We can cleary use a simple bit counting technique as a first level:

$\max_{i=1}^{z}v(x_{i})\geq\left\lceil \frac{v(n)}{\sum_{i=1}^{z}v(a_{i})}\right\rceil$

Magically though (and I hope people have seen something similar to this) we can generalize this to:

$\max_{i=1}^{z}v(x_{i})\geq\left\lceil \frac{v(n\bmod m)}{\sum_{i=1}^{z}v(a_{i}\bmod m)}\right\rceil ,\,m=2^{j}-2^{k},\,j>k$

Here $n\bmod m$ is the least non-negative value from the residue class of $n$ modulo $m$.

You can do this because unexpectedly (to me at least) $v(n\bmod(2^{i}-2^{j}))\leq v(n),\,i>j$.

I have only gotten performance increases currently for when $m=2^j-2^{j-1}=2^{j-1}$. Essentially looking at a window of bits.

It's also possible to multiply both sides of the Frobenius equation by a constant in the hopes that the bit counts on each side allow you to infer a greater lower bound:

$\max_{i=1}^{z}v(x_{i})\geq\left\lceil \frac{v(nm)}{\sum_{i=1}^{z}v(a_{i}m)}\right\rceil $

I only see performance increase with $m=3$ currently.
Does this sort of thing come up in cryptography? Are their known techniques for say following the bits through multiplies etc? Obviously I would like to get some root property of the bits in the $a_i$ and $n$ to go more directly to the lower bounds for the bits in the $x_i$.


texts:
I'm wondering why hash constructions aren't parallel like CTR mode for encryption?

For example: We have ideal block cipher E, where we encrypt message block with counter and xor output block with message block. Then we xor (sum) all blocks and encrypt it with length of message and xor with sum of all blocks to get hash. If last message block is shorter than block size it is padded with zeroes.

$H_{0} = E_{0}(m_{0}) \oplus m_{0}$

$H_{1} = E_{1}(m_{1}) \oplus m_{1}$

$...$

$H_{n} = E_{n}(m_{n}) \oplus m_{n}$

$H_{sum} = H_{0} \oplus H_{1} \oplus ...\oplus H_{n}$

$H = E_{Length}(H_{sum}) \oplus H_{sum}$

Is such construction known to be insecure? Or is it secure?


texts: How should I generate secure random numbers deterministically?

texts:
I have a 256-bit seed; call it P. From P, I need to derive 219 256-bit numbers deterministically.

There's a catch, however: I want to derive them in any order. For example, I might need the 7878th number, followed by the 51st number. For that reason, deriving them with a stream cipher is inappropriate for me. Also, if one output is revealed to the attacker, it should not be possible to derive a different output.

My intuition is that I could use a hash function to derive each number, but I'm concerned that it wouldn't have the properties necessary to prevent an attacker from deriving one output from a different output.

What type of cryptographic construction should I use?


texts: Issuer generate credential in CL signature scheme

texts:
In the paper CL signature scheme, the authors describe the scheme to generate and verify credentials. I have a question regarding the credential generation from issuer. In page 11, section 4.4, protocol 2 (2:2), the organizer $O$  generates a random prime $e$, and calculates $c= (P\cdot d)^{1/e}\bmod{n}$.

My question is how is $O$ able to do the calculation? Based on the strong RSA assumption, it's difficult to find $c$ and $e$ such that $c^e = P\cdot d \bmod{n}$


texts: Why do look up tables speed things up compared to brute force?

texts:
I'm currently reading up on lookup tables and efficiency. In my uni script it says the following:

For Brute Force:

Preparation time: $O(1)$
Disk space requirement: $O(1)$
Time required to crack the password: $O(2^n)$

Full lookup table:

Preparation time: $O(2^n)$
Disk space requirement: $O(2^n)$
Time required to crack the password: $O(1)$

I'm not sure I'm understanding this correctly.

As far as I understand, for Brute Force:

$O(1)$ is the time required to look up the password in my table of all possible passwords.
The disk space requirement is simply as large as needed for a list of all possible passwords, so $O(1)$ as well

My questions:

Why is the time needed to crack the password $O(2^n)$? How is it determined?

It seems I don't understand the concept of a lookup table either. As far as I see, a lookup table will simply hash the full list of possible passwords (so required disk space is larger) but what then? Why is the cracking of the password per se faster?

I think I'm missing something crucial here. Any help will be appreciated.


texts: Threshold cryptosystem with a required share

texts: I am trying to find an implementation or variant of a (k, n) threshold cryptosystem (as described here Shamir's Secret Sharing) where we can fix at least one of the k key parts, i.e., instead of ANY k key parts able to decrypt the ciphertext I want at least one of the k key parts to be a certain/fixed key part. So sort of a joint account cheque where k out of n signatures are required but the signature of the accountant should always be there. Any ideas?


texts:
In Chapter 6, Question 6.8, of his book “Cryptography and Network Security Principles and Practices”, William Stalling asks:

  Why do some block cipher modes of operation only use encryption while others use both encryption and decryption?

ECB and CBC use encryption function and decryption function while CFB, OFB and CTR use encryption function for decryption as well. What is the logic behind it? Is it because ECB and CBC generates output of Block Cipher type – while CFB, OFB and CTR generates output of Stream Cipher type?


texts: Difference between Zero Knowledge Proof and Challenge Response Protocol

texts:
What exactly is the difference between Zero Knowledge Proof & Challenge Response Authentication?
I searched online and the best I could find are these:

techtarget.com

Zero-knowledge password proof systems depend on cryptographic methods
that enable both parties -- client and server -- to authenticate to
each other. These systems allow each party to confirm to each other
that they have a correct password, but without the need to share that
password with each other

cse.scu.edu : Implying that both of them are different and one improves on the other.

An instructor in my university had asked this question in one of the assignments and when I received the answer key for the same, I found this:

Distinguish between challenge response and Zero knowledge entity
authentication.
Challenge-response identification – Strong authentication.
Cryptographic challenge-response protocols is that one entity (the
claimant) “proves” its identity to another entity (the verifier) by
demonstrating knowledge of a secret known to be associated with that
entity, without revealing the secret itself to the verifier during the
protocol.  This is done by providing a response to a time-variant
challenge, where the response depends on both the entity’s secret and
the challenge.  The challenge is typically a number chosen by one
entity (randomly and secretly) at the outset of the protocol.  If the
communications line is monitored, the response from one execution of
the identification protocol should not provide an adversary with
useful information for a subsequent identification, as subsequent
challenges will differ.  Challenge-response protocols can be realized
by symmetric-key or asymmetric-key cryptography
Zero-Knowledge Proof
–  ZKP concept.  A disadvantage of simple password protocols is that
when a claimant A (called a prover in the context of zero-knowledge
protocols) gives the verifier B her password, B can thereafter
impersonate A.  Challenge-response protocols improve on this: A
responds to B’s challenge to demonstrate knowledge of A’s secret in a
time-variant manner, providing information not directly reusable by B.
Examples of ZKP.  Fiat-Shamir identification protocol.
Feige-Fiat-Shamir identification protocol.  Guilou-Quisquate
identification protocol.

which I feel is either wrongly worded or entirely wrong (leaning on the latter).
So, what exactly is the difference between them or are they not different at all? If possible, please explain with an example along with real-life algorithms where each of these is used.


texts:
I remember $e=3$ is a bad choice for textbook RSA. But I can't really recall why. What happens if I choose $e=3$? Can I retrieve the message by simply calculating $\sqrt[3]{c}$? Why can't I do that with bigger $e$s? Is it possible to retrieve $d$, $p$ or $q$?

I remember that we had something with the Chinese Remainder Theorem (CRT), but when I look at it now, I does not seem to make any sense.

I'm thankful for fast responses!


texts:
A MAC (or HMAC) can be represented by the general formula:

MAC = H(key, message)

I am calling "Multikeyed Hash" the operation (probably there exists already a name for this concept, which I don't know) below:

MkHash = H(key1, key2, key3, ...., keyN,  message)

Are there known algorithms to compute that? Note that I can't simply concatenate the keys myself, because an attack could be built using the fact that:

MkHash = H((key1, key2), key3, ...., keyN,  message)

would result in the same MkHash.


texts: Enigma message decode errors, and protocols to prevent them

texts:
I was looking at some Enigma messages for some random reasons, and I wondered if there were ever issue pulling the correct words out the strings of characters of if there was a protocol for it.  For instance, here is a decoded message from here:

KRKRALLEXXFOLGENDESISTSOFORTBEKANNTZUGEBENXXICHHABEFOLGELNBEBEFEHLERH
ALTENXXJANSTERLEDESBISHERIGXNREICHSMARSCHALLSJGOERINGJSETZTDERFUEHRER
SIEYHVRRGRZSSADMIRALYALSSEINENNACHFOLGEREINXSCHRIFTLSCHEVOLLMACHTUNTE
RWEGSXABSOFORTSOLLENSIESAEMTLICHEMASSNAHMENVERFUEGENYDIESICHAUSDERGEG
ENWAERTIGENLAGEERGEBENXGEZXREICHSLEITEIKKTULPEKKJBORMANNJXXOBXDXMMMDU
RNHFKSTXKOMXADMXUUUBOOIEXKP

As one can easily see, the words are just chained together, and therefore, strange things can happen.  An example I came up with in English:

kidsexchange

Which could be "kids exchange" or "kid sex change".

Were any protocols in place to protect against a vague message in Enigma or any other plain text encryption system?


texts: Is the representation problem as hard as the discrete logarithm problem?

texts:
I found the assumtion that finding a representation in a cyclic Group G for a randomly chosen value y is as difficult as solving the DL problem.

That assumption was without proof so I am not sure if it is correct. Can someone give a proof or a contradiction?


texts: Security of CCM using 8 byte MAC within TLS

texts:
In the Dutch "IT Security Guidelines for Transport Layer Security (TLS)" the ciphersuites using AES-128-CCM_8 (i.e. CCM with a 64 bit authentication tag) are considered "insufficient".
This is the only reason given:

AES-CCM_8 is a variant of AES-CCM with a truncated authentication tag, which has a lower security equivalent for integrity protection.

Now I can see that changing messages would only give you 32 bit of security for the MAC construction due to the birthday attack. However, if the messages are unique for a given key and given that the connection is lost whenever the MAC is invalid, I can only assume that the full 64 bit security is still in effect. The verification oracle required for such an attack seems missing.
Now 64 bit security isn't much, but given that there are three security levels: good, sufficient and insufficient, I wonder if "sufficient" would not be better fit. Do note that CCM security with a full authentication tag is considered "sufficient" in a side-note within the same document.
Are there any attacks that I'm overlooking or would the 64 bit security strength be enough to warrant the "insufficient" security level?


texts: Block cipher encryption of decryption with the same key

texts:
With block chipers can I assume that

Enc(k,Dec(k,m))=m

Meaning if I decrypt something with a key k and then encrypt the result with the same key k, do I get what I originally had? Using the same BC scheme of course.

I can't right? It's possible that it has some random parts, no?


texts: Why invent new hash functions for zero-knowledge proofs?

texts:
Recently, new hash functions were invented. Their primary purpose is serving the needs of zero-knowledge proof systems. I'm talking about Poseidon-256, Starkad-256, etc. See the paper.

What is the main advantage of those hash functions against existing ones like Blake3 or SHA3? How are those functions different?


texts: Understanding the Hidden Subgroup Problem specific to Integer Factorization

texts:
I've been reading about the Hidden Subgroup Problem (HSP), specifically trying to understand how it is related to the integer factorization problem. I've read What exactly is the impact of the hidden subgroup problem on cryptography? but it doesn't cover the specifics I am having trouble putting together.
To define the HSP:

Given a group $G$, a subgroup $H \leq G$, and a set $X$, we say a function $f : G \Rightarrow X$ separates cosets of $H$ if for all $g_1, g_2 \in G$, $f(g_1) = f(g_2)$ if and only if $g_1H = g_2H$.
Hidden subgroup problem: Let $G$ be a group, $X$ a finite set, and $f : G \Rightarrow X$ a function such that there exists a subgroup $H \leq G$ for which $f$ separates cosets of $H$. The function $f$ is given via an oracle. Using information gained from evaluations of $f$ via its oracle, determine a generating set for $H$.

What I can't figure out is how to reduce the integer factorization problem to an HSP problem, and then why the (abelian) HSP problem is not solvable in polynomial time without a quantum computer using e.g. Shor's algorithm.


texts:
Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol).

From crypto point of view they are mostly the same designs (using same EC stuff djb has done). IP addresses are not relevant for identity anymore as identity is established via use of PKI.

This is great, long-lived session can move from one IP to another one, and session can be kept up, as IP address does not matter.

However I don't think either of them expose identity to MITM. I think there might be quite nice use-case in your own home FW or corporate FW to say 'Alice can connect to server X port 22'. Then regardless what IP Alice is using, as long as she offers the specified identity, she is passed by the FW.

Could it be possible for arbitrary MITM to securely inspect identity so that no other arbitrary MITM could have faked it?


texts: Are there any proof of work style encryption algorithms? i.e. an encryption algorithm which takes a lot of work to encrypt, but is easy to decrypt

texts:
I'm wondering whether or not there is an encryption algorithm, or at least the possibility of one, which takes a lot of work to encrypt, yet can be decrypted very easily?

I have come across this question Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt? and https://stackoverflow.com/questions/9766579/high-cost-encryption-but-less-cost-decryption, but neither answer my question.

I am NOT looking for a hash of the data, I specifically need to encrypt it in a way which requires lot of work, and then be able to decrypt it very easily.

Whether the algorithm is symmetric or asymmetric is irrelevant.

Thanks


texts: Are there lower bounds to how efficient one can make obfuscated code?

texts:
I am wondering if there are any theoretical reasons why obfuscated programs cannot be nearly as efficient as the plaintext programs and whether there is any necessary computational overhead from running obfuscated code instead of plaintext code.

Let $\mathcal{O}$ denote an indistinguishability obfuscator; for each circuit
$C$ and random data $\mathbf{x}$, $\mathcal{O}(\mathbf{x},C)$ is an obfuscated circuit that computes the same function as $C$. Is it possible that the obfuscator $\mathcal{O}$ only increases the depth, width or gate count of the circuit $C$ by a linear factor? If not, then what level of complexity overhead is required for the obfuscated circuit
$\mathcal{O}(\mathbf{x},C)$? In other words, given a measure $L$ of the complexity of a circuit (for example, $L(C)$ could denote the depth of the circuit $C$), does there exist a constant $\alpha$ and an obfuscator $\mathcal{O}$ where $L(C)\leq\alpha\cdot L(\mathcal{O}(\mathbf{x},C))$ for each circuit $C$ and string $\mathbf{x}$? For which functions $f$ and complexity measures $L$ does there exist a constant $\alpha$ and an obfuscator $\mathcal{O}$ such that $L(C)\leq \alpha\cdot f(\alpha\cdot L(O(\mathbf{x},C)))$ for each circuit $C$ and string $\mathbf{x}$?

I am not very much interested in the computational complexity of the obfuscation operator $\mathcal{O}$ (as long as the obfuscator $\mathcal{O}$ terminates in polynomially many steps), but I am instead interested only in the complexity of the resulting obfuscated circuit $\mathcal{O}(\mathbf{x},C)$.


texts: 128 bit AES CBC bit flipping on second block

texts:
I have a 128 bit AES cipher in CBC Mode with the IV prepended to the message. I am aware of the security issues here, but that is exactly the point of my example. I would like to change the plain text message via bit-flipping, which I have partially implemented in the example below:

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
from Crypto.Random import get_random_bytes

key = b'WOAH, SO SECRET!'
block_size = 16 # in bytes (128 bit)

def encrypt_data(data):
    iv = get_random_bytes(block_size)
    cipher = AES.new(key, AES.MODE_CBC, iv)
    enc = cipher.encrypt(pad(data, block_size, style='pkcs7'))
    return iv + enc

def decrypt_data(data):
    iv = data[:block_size]
    cipher = AES.new(key, AES.MODE_CBC, iv)
    padded_params = cipher.decrypt(data[block_size:])
    return unpad(padded_params, block_size, style='pkcs7')

# 128 bit blocks for better visualization
plain = b'Hello everybody!' \
        b' This is a very ' \
        b'cool message,wow'

wanted = b'THIS CAN CHANGE!' \
         b' This is a very ' \
         b'cool message,wow'

cipher_text = bytearray(encrypt_data(plain))

for block in range(len(plain)//block_size):
        for i in range(block_size):
                block_idx = (block*block_size)+i
                xor_byte = plain[block_idx] ^ wanted[block_idx]

                cipher_text[block_idx] ^= xor_byte

result = decrypt_data(bytes(cipher_text))
print(result)

Above code outputs:

b'THIS CAN CHANGE! This is a very cool message,wow'

Which is exactly what I want!

However, I only ever managed to change the first block sucessfully, by changing the preceding block of the cipher message (in this case IV, which does not affect the rest of the message). If I modify my example with a wanted message like that:

wanted = b'Hello everybody!' \
         b'THIS CAN CHANGE ' \
         b'cool message,wow'

My code outputs:

b'g\x114\xb4\xc4\xd6\xd6\x16\xcf\x88\x87\x99\xea@\xe4\x11THIS CAN CHANGE cool message,wow'

I understand, that this happens due to the fact of using CBC mode and the impact of blocks on each other as described here. But what exactly am I missing here? How can I change my message to the desired output after decryption?

b'Hello everybody!THIS CAN CHANGE cool message,wow'

I'd appreciate any push in the right direction.


texts: How do I calculate Base64 conversion rate?

texts: Basically I need to have a base64 encoded signature that has to be 96 characters long. However, I do not know what length I need to have the signature at so when I encode it, it can be that exact size. Does anyone know how to convert it? Also, does anyone know how to convert it in base64 encoding or any byte size encoding?


texts:
Say players use Shamir's secret sharing to share a value $k$ such that each player now holds $k_i$, a share of $k$. How can they securely compute $k \bmod m$ for some $m$.

Of course they can interpolate to get $k$ and then reduce it $\bmod \hspace{2pt} m$. But how can they perform some operation on their shares to obtain shares of $(k \bmod m)$ without revealing $k$?


texts: Time complexity of Euler's totient function

texts:
I believe there are different time complexities for Euler's totient function depending on how you execute the algorithm. The two I know of are:

Iterate through 1 to k and calculate each $\gcd$: $O(n \log(n))$
Factor n first and then use Euler’s product formula: $O(n)$

Are there any other possibilities?


texts:
I read that non-primes only have co-factors, but Edwards have a co-factor and it is defined over Fp s.t. P = 2^255 -19 which is prime right?

How is the co-factor created, some have co-factor 4 and some have co-factor 8?

Am I right in saying that P256 for example, has no co-factor because it is of prime order?

I have seen a Twisted Edwards Curve with prime order, but also had a co-factor, was I mistaken?

I have also seen the case where co-factor = 1. This is strange because in order to make sure that the value is in the subgroup, we must multiply it by the co-factor. If co-factor is 1, then this is irrelevant.


texts: Key management in Java + Remembering passwords

texts:
I'm new within the area of crypto so I apologise if I am bad at explaining this, or have misunderstood certain areas.

I'm currently developing a Java Fx application which includes the use of a 'remember password' option.

The password needs to be reversible. So in this case I need to use encryption (I know hash + salt (e.g. using Bcrypt) is better but I cannot do that without the user having to enter their password every login).

I'm just wondering what the best way to achieve this is.

For example, I could create a Java KeyStore to store a key pair and then store the password encrypted elsewhere in a configuration file. But I'm not sure how to go about storing the password for the KeyStore. Also, I'd need to encrypt the private key right? And would need to secure the passphrase for the private key? (Again, I'm a nooby so correct me if I've misunderstood anything)

Does anyone have any advise on a good, secure method to handle this? It doesn't have to be the way I have explained (using JKS) - I'm open to alternative approaches.


texts: Hash functions vs. keyed hash functions in the context of private key generation

texts:
I'm designing a key distribution mechanism and have thought of using a securely generated/acquired private key as a seed for a sequence of private keys to be distributed to a number of users using a key encryption key which is exchanged through a secure channel during the initialization step.

The setting is as follows:

k is a secure private key
h is a cryptographically secure one-way function

n keys are generated using h and k:

$$
k_1 = h(k)
$$
$$
k_2 = h(k_1) = h(h(k))
$$
...
$$
k_i = h(k_{i-1})
$$
...
$$
k_n = h(k_{n-1})
$$

This scheme broadens the surface of attack as if one key is compromised, all subsequent key can be easily compromised as well.

Would it be more secure to use a keyed hash function to generate the keys, using a hash of the original key as the input key for the respective hash function?


texts: Tell me like I'm 5: How are algorithms secure if people can see them

texts:
I have a limited understanding of encryption of data. I know that servers and clients can encrypt and decrypt information through a variety of methods. I also know that security through obscurity is not a good idea and that there are very reliable open-source encryption options.

That said, I've been told (or read somewhere) that the type of encryption used is non-reversible. i.e. you can't decrypt something by knowing the algorithm. This is the bit that I can't grasp. How can an algorithm not be reverse engineerable? Why are open source encryption options considered more secure than proprietary equivalents?

Thanks


texts: Industry standard recommendations for memory usage defaults for a password hashing function?

texts: I've been looking around for any studies done on this topic with respect to memory-hard password hashing. I'm inclined to simply impose no extra overhead by default, to be honest, but I'd really like to know what the industry standard recommendations might be.


texts: Does the SSH protocol preserve integrity if an endpoint is cloned?

texts:
I am trying to find out if the SSH protocol preserves integrity of the transferred data in the following scenario:

The SSH client is running on a virtual machine, at some point in the middle of the connection a snapshot is made of the virtual machine and another copy of the client is brought up in some location.

I am assuming that the adversary has no direct control over any of the endpoints, but has full control over the network between them. This means the adversary could feed all three nodes with a stream of data for which TCP sequence numbers as well as checksums would be correct. What I don't know is to what extent the additional checks performed by the SSH layer will help preserve integrity in this setting.

Obviously the adversary can pick one of the two clients and pass only data from this client to the server where it will be accepted. And the adversary can pass data from the server to the chosen client. In that case the chosen client and the server will continue communicating without any problems. I assume the adversary would also be able to pass the data from the server to the other client, which would accept that data (at least until the next key negotiation).

What I don't know is if the adversary can go beyond this and feed the server with a mix of data from the two clients.

In the above scenario could the adversary pick some data from one client and some data from the other client and get the server to accept it? If it could that would mean the server would accept a stream of data that does not match anything produced by either client.

If the message authentication code used by SSH would cover not just the payload data in the current packet but also the message authentication code of the previous packet, then I believe the integrity would be preserved.

But as far as I can tell this is not the case. So I am suspecting the answer is that there is nothing preventing the adversary from sending packet number $n$ from the first client to the server followed by packet number $n+1$ from the second client and getting the server to accept both.


texts: Usage of twists at pairing-based cryptography

texts:
First of all I would like to understand how twists are used in pairings. The 2nd step is, how to use them to improve the calculation speed?

Say $E'(\mathbb F_{p^2})$ is a twist of $E(\mathbb F_p)$.

I just thought about choosing $m_1,m_2\in (0,\lfloor \sqrt{\operatorname{ord}(E)} \rfloor)$ randomly, define $m=m_1+m_2\cdot \lambda$ and performing $mP=m_1P+ m_2\psi(P)$, where $P\in E$ and $\psi:\ E\to E'$. My main thought about this technique is, to reduce the size of the integers $m$ and performing two scalar multiplications in different groups, if this might be a speed-up. But then we should have $\psi(P)=\lambda P$ for any, maybe large $\lambda$. If this idea was already mentioned before, could someone link me a paper or any other source?

Feel free to edit this post, if necessary, and add tags. :)

Edit1:
To make the explanation (maybe) a bit easier, consider $E:\ y^2=x^3+x$ and the twist $E':\ y^2=x^3+2^{1/4}x$ over $\mathbb F_p$ and $\mathbb F_{p^2}$ with the embedding degree $k=16$.

Edit2: If I remember well, we should consider a type-2 pairing, where $G_1\neq G_2$ and $\psi:\ G_1\to G_2$ is efficient, but $G_2\to G_1$ is not efficient. I guess this holds in our situation, since $\newcommand\F{\mathbb F}\F_{p^2}=\F_p[x]/(X^2-2)$ for $p\equiv \pm3\pmod 8$.


texts:
Whirlpool uses a modified version of the AES / Rijndael algorithm.

Can Whirlpool take advantage of AES-NI instructions (or possibly other specialized constructs) on Intel and Intel compatible processors?

Or is the underlying AES algorithm modified too much for AES-NI to be compatible with the algorithm?

As an additional (optional) question: would it be feasible and secure to adjust Whirlpool to be able to use AES-NI if Whirlpool is not compatible?


texts:
RSA is homomorphic wrt multiplication and therefore it is not IND-CCA2. But how to show it.
What are the steps to win IND-CCA2 game?

How is the probability of winning calculated?


texts:
I was thinking of the problem of naming&shaming, victims don't want to reveal themselves. Yet the public wants to know, and have some confidence in the veracity of statements. Such confidence could arise for instance from multiple victims naming the same person. I was thinking cryptography could come to the rescue.

I'm having trouble even in the formal definition part. Initially I though multi party computation could allow a group of people to each name (or not) and only if a name passes a threshold is it revealed, and all members of the group could attest the name passed the threshold. But thinking of practice issues, we may want a async process, where after setup different people submit their testimony separately with minimal back and forth. We may not know in advance who will participate and want to be able to work with a subset members. The minimal number of people to ensure reasonable anonymity is rather small say 100, but we may want to increase the requirement significantly if we are thinking about minimum number of colluding members to reveal which specific member named someone.

I quickly run into impossibilities, If we allow ad-hoc groups to form and vote together then a not so large malicious group could break anonymity. I'm looking for a solvable variant of this problem.


texts:
Let $\mathcal{H} : \{0,1\}^* \rightarrow \{1,\cdots,n\}$ be a hash function.

I believe that in the Random Oracle model, the probability that an adversary $A$ can find a message $M$ such that $\mathcal{H}(M) \leq k$ is at most $(q+1) \frac{k}{n}$, where $q$ is the number of queries $A$ makes to $\mathcal{H}$.

What happens for a quantum adversary $B$, which can query $\mathcal{H}$ in superposition? I suspect that the probability that $B$ produces a message $M$ such that $\mathcal{H}(M)\leq k$ is bounded by $c q^2 \frac{k}{n}$, where $q$ i the number of quantum queries that $B$ makes to $\mathcal{H}$ and $c$ some constant.

I suspect this because this can be done with Grover's algorithm and I heard that Grover's Algorithm is optimal in some setting.

Is this true? What values of $c$ would work? How would you prove this?


texts:
I'm looking at a way to encrypt a file so that our software will only allow users with the proper license to use it (see details below). I have some notions on that topic, but barely more than knowing it's very easy to get things wrong. I'm sure what we're doing must be rather common (up to the details), but I wasn't lucky with my search results so far. As such both links and hints are welcome. And my apologies if I don't use proper terminology.

Description of the workflow

So far we've come up with two option. Option A is the clear favorite in the team, but in case business requires it we also have option B.

Option A:

We have a bunch of images that customers can buy to display on their computer
A customers wants to buy M images from us, each to be displayed on N of their computers
Our software generates a "key" linked to the computer it's running on and the customer sends us the N generated keys
We encrypt these MxN images and send them all as a single zip file, along with anything else we may need
The customer opens the zip file in our software; that will copy M ciphertexts to disk, the ones that are allowed for that computer
When the customer opens an image, we decrypt the ciphertext to a temporary file and run an external process to display it*

Option B is similar, except that all ciphertexts are already packaged in our installer. The user only buys a key to decrypt them

*This is an unfortunate weak point to our system, but necessary for now (may change in the future). We're not looking for perfect encryption, mostly something that makes it difficult to bypass by average users

Restrictions

Each license is only valid for a single computer
Clients don't get to see the plaintext image without a license
The system must be easy to use for our customers

In particular there shall be no user input at all once the ciphertext is installed

Customers may not have internet access
All customers have access to the same set of images

But we may also create custom images for a specific client at some point

A motivated client will be able to compare the plaintext and the ciphertext
The decryption part will be written in C++

Optional, nice to have

Signature as proof that the images are coming from us
Tracability in case a clever user manages to repackage the image for use in another machine
Temporal validity of the license (ex.: 1 year)

Tamper-proof (so a user cannot just change the system clock)

If the decryption can be done in Python too it will give us freedom in the future

Current idea

After writing all this and reading the links proposed by stackexchange, I'm inclined to use a combination of symmetric and asymmetric keys for option A:

Software contains two public keys 1 and 2 in code (RSA for both?)
Software retrieves some ID, for example Windows product ID or MAC address, ...
Software encrypts ID with public key 1 and sends the resulting ciphertext_1 to the server
Server uses private key 1 to decrypt ciphertext_1
Server signs image with private key 2
Servers computes hash(ID+filename) as key to encrypt the image + signature into ciphertext_2 (using AES? Twofish? A simple password-protected zip file?) and sends it to the client
To display the image, the software recomputes hash(ID+filename) to decrypt ciphertext_2 and checks the signature with public key 2

Does that sound sensible? Does it matter if the signature is done on the plaintext as opposed to the ciphertext_2? I'm mostly unsure about if, when and how it's best to hash the ID. And whether or not I should add a "salt" like the image name, some hard-coded string, and/or text to communicate / store on disk.


texts: CBC-MAC with length appended not UF-CMA secure followup

texts:
I know that CBC-MAC is not UF-CMA secure if the domain contains message of arbitrary length. Read from this post
But what if we append the length of the message when run the MAC algorithm. (to MAC message X) $$CBC_{special}(X||<X>)$$ where <x> is the length of x written in n bits.
I read the explanation from this post too, where it gave the following examples:
"
Take any $m_1,m_2,m_3$ of length $n$ (where $n$ is the block length), with $m_1\neq m_2$. Query the oracle with $m_1$, then query the oracle with $m_2$, and finally query the oracle with $m_1\|n\|m_3$."
But if you query the oracle with $m_1\|n\|m_3$, the $CBC_{special}$ will run as $CBC_{special}(m_1\|n\|m_3||<3n>)$ and this is not a valid tag right?


texts: Broadcast Encryption Scheme and Internet of Things

texts:
I am reading about Broadcast Encryption these days. Can we apply Broadcast Encryption to IoT? Can we use Broadcast Encryption in Internet of Things?
Are there any articles/research papers on this?
Thanks.


texts:
According to Wikipedia,

$n(p;H)\approx \sqrt{2H\ln\frac{1}{1-p}}$

Let n(p; H) be the smallest number of values we have to choose, such that the probability for finding a collision is at least p. What if I wants my probability to be 1? In this case, $p = 1$ and $\frac{1}{1-1}$ is undefined. May I know how to find minimum number of values required to get a collision with the probability of 1 using the formula above?


texts: Factorization of a number obtained by a modular multiplication operation can reveal factors of the used operands?

texts:
Consider a number $r$ obtained by:

$r=a \cdot b \mod n$

Can knowing the factorization of $r$ reveal some information (bits) of $a$ and $b$ ?


texts: Why is noise growth from relinearisation ignored in the FV crypto scheme?

texts:
I'm going through the FV scheme  and SEAL and there are a couple of things I'm not understanding with respect to noise growth of relinearisation.

On page 8 they say to choose T so that the noise growth from relinearisation is similar to that of multiplication. Why do we want the noise growth to be size and not just as small as possible? On page 9 they follow up saying if they choose large T they'll get large relinearisation noise, but then all following relinearisations don't cause the noise to increase? How is this? I multiply c1*c2, relinearise, then multiply that by c3 and relinearise again, why wouldn't the noise increase?
On page 11, first paragraph after lemma 3, they mention they can ignore the noise from relinearisation because it's smaller than multiplication. Why can they ignore it? Isn't that making the bound on ||v_mul|| smaller than it should be (and possibly lead to a bad decryption)?
In the BFV basics example in SEAL, they show how relinearisation actually increases their noise budget compared to repetitive multiplication. Why is this? If we follow what the FV paper says, relinearisation should increase the noise, and therefore reduce the noise budget.


texts: Dishonest verifier running a concurrent zero-knowledge protocol

texts:
Suppose Alice and Bob are engaged in the graph 3-colorability Zero-knowledge protocol in which Alice permutes a coloring $\varphi:V\rightarrow \{1,2,3\}$ for a graph $G(V,E)$, and then sends a commitment of each vertex $v$, $\{\pi(\varphi(v))\}_k$ to Bob.  Bob then randomly selects an edge of this graph to which Alice opens the commitment for the corresponding vertices.  Finally Bob verifies that for edge $(i,j)$, $\pi(\varphi(i))\neq\pi(\varphi(j))$.  They then iterate this process $|E|^2$ times until Bob is convinced with high probability that Alice indeed knows a 3-coloring of the graph.
This is shown in Goldreich, Micali, and Wigderson [1991] to satisfy Completeness, Soundness, and Zero-Knowledge.  However, what is to stop a dishonest verifier from running a concurrent protocol much like a man-in-the-middle attack to convince some third-party that they know the coloring?
Suppose Alice is convincing Bob that she knows a 3-coloring, and Bob is convincing Charlie that he knows the same 3-coloring.  Bob simply passes on each message received from Alice to Charlie and vice versa.
The actions in order will look like:

$A\rightarrow B: \{\pi(\varphi(v_1)\}_{k_1},...,\{\pi(\varphi(v_n)\}_{k_n}$
$B\rightarrow C: \{\pi(\varphi(v_1)\}_{k_1},...,\{\pi(\varphi(v_n)\}_{k_n}$
$C\rightarrow B: (i,j)$
$B\rightarrow A: (i,j)$
$A\rightarrow B: (k_i,k_j)$
$B\rightarrow C: (k_i,k_j)$

So how is this not a violation of Soundness? Since Bob does not know a 3-coloring for $G(V,E)$ yet he is able to convince Charlie with high probability that he does. My thought is that zero-knowledge protocols should work like Deniable Authentication signatures, but I'm having difficulty finding literature addressing this type of attack on ZK protocols.  If it's not a violation of Soundness, an explanation or citation as to why would be very helpful.


texts: Proving at most one affine permutation mapping $x$ to $u$ and $y$ to $v$ with $x,y \in \mathbb{Z}_n$ and $\gcd(x−y,n) = 1$

texts: Suppose that $x,y \in \mathbb{Z}_n$ with $\gcd(x−y,n) = 1$. Prove that for any $u,v \in \mathbb{Z}_n$ there is at most one affine permutation mapping $x$ to $u$ and $y$ to $v$.