texts:
I was reading a text on cryptology  by Wayne Patterson and came across the $L^3$ algorithm which reduces integer lattices with respect to their base.  I've also read on the NIST CFP A8 that attacks based on Grover's algorithm aren't really seen as viable.  There is already research covering vulnerabilities in the group rings of NTRU variants, and additional research showing approximate closest vectors return approximate shortest vectors in polynomial time.

Page 70 from "Mathematical Cryptology for Computer Scientists and Mathematicians" by Wayne Patterson states: "The central algorithm developed (and proved to run in polynomial time) by Lenstra, Lenstra, and Lovasz is the reduced basis algorithm. The algorithm begins with any basis $\beta_{i}$ for an integer lattice, and eventually computes a reduced basis in the sense of the previous section." Page 72 then demonstrates how to apply the LLL algorithm in a Shamir attack against knapsacks.

Quoting again from Patterson, "These two theorems (6.1 and 6.2) taken together give an estimate on how close a vector of the reduced basis must be to the shortest (non-zero) vector in the entire lattice." pg. 70.

  My question: Why would it be infeasible to encode the LLL reduction
  and group structures of NTRU variants as a search space in a Grover
  search to return an output that would break the NTRU schemes?  This would be in line with the Coppersmith and Shamir lattice attack from section 4.2 in the linked article of NTRU Variants.

This seems in line with oracle access to a subroutine based on the linked research by Goldreich, et al.

  Phrased differently, Can we know with certainty that LLL reductions
  and lattice attacks will not be made stronger if supplemented with
  Grover searches?


texts: Elliptical Curve Cryptography benchmark test

texts:
I have built web app that implement Elliptical Curve Cryptography. During testing using data set that i chose on my own, it already run well..

But, for now, i want to test it in some benchmark test, just like AES that have some input, key, and expected cipher test..

is there any similar test for ECC? some program or web app, to test if my curve is valid, is my algorithm resulting the right cipher etc?

Thank you :)


texts:
We are attempting to integrate our application in to a third party system. To do this we need to pass encrypted passwords in to this system. I have decompiled the assembly and looking at the code it seems that they are using something similar to XOR encryption (In a production system...) From what I can see from the decompiled code it does something like this:

The pseudo code bellow is wrong. Here is a link to the source code, decompiled , converted to C# and cleaned up a bit: http://pastebin.com/rAcXPvL6

string key = "1234567890123456"
string plainText = "test"
int[] keyData = GetAsciiValuesAsArray(key)
int[] plainData = GetAsciiValuesAsArray(plainText)
int prime = GeneratePrimeNumber()
string cipherText = ""

foreach(plainTextChar in plainData)
{
     int a = prime / 256.0 * 256.0 - prime % 256 / 256.0
     int b = prime % 256
     for(int i = 0; i < 16;i++)
     {
          keyData[i] = keyData[i] ^ GetAsciiValue(plainTextChar);
     }
     plainTextChar = plainTextChar ^ (a ^ b)
     int c = (plainTextChar / 16.0 * 16.0 - (plainTextChar % 16)) / 16.0;
     int d = plainTextChar = % 16
     cipherText = cipherText + ConvertFromAscii(c + 97) + ConvertFromAscii(d + 97)
}

Does this seem familiar to anyone? Hopefully it's a recognized algorithm and not something they have cobbled together themselves.

Thanks,

Joe


texts: TLS1.2 AES 128 CBC Encrypted Data size is not a multiple of block size

texts:
I know that TLS ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA transmit data as shown https://tools.ietf.org/html/rfc5246#section-6.2.3.2. From my understanding the ciphertext MUST be a multiple of the block size, which in this case is 16 bytes. However when I look at the below output from wireshark, I'm confused. After subtracting the 16 bytes corresponding to the IV from the beginning of the Encrypted Application Data, that leaves 100 bytes of ciphertext which is obviously not a multiple of 16. What am I not understanding?

EDIT: I've included information about the ciphersuite


texts: Why does LastPass hash their passwords with PBKDF2 this way?

texts:
LastPass is a password manager that I am sure many of you are familiar with. I have been studying LastPass's source code a bit. From their FAQs and what I can gather from their source code, the way they derive and store your encryption key is as follows:

The client application derives your encryption key using standard PBKDF2 with your master password, a variable number of iterations (5000 is the default, but you can set whatever you like), and your email address as the salt.

The resulting encryption key is used for encrypting and decrypting your vault information.

For the purposes of authentication with their servers, they then take that encryption key and hash it using PBKDF2 again, this time using the previously generated encryption key as the password input and the user's master password as the salt. This is done with just 1 iteration.

The resulting hash is then transmitted to the LastPass servers where (according to their FAQs since I cannot see their server source code) they again use standard PBKDF2 with a random salt and 100,000 iterations.

Pseudo code

pbkdf2(algorithm, password, salt, iterations, bytes)

Client

enc_key = pbkdf2(sha256, master_password, email, client_iterations, 32)
key_hash = pbkdf2(sha256, enc_key, master_password, 1, 32)

Server

stored_hash = pbkdf2(sha256, key_hash, random_bits, 100000, 32)

Questions

I am confused about the key hashing process that they are doing. It appears that they are using PBKDF2 as a means for computing a SHA256 hash to protect it during transmission to their servers.

Can you explain what using PBKDF2 with 1 iteration is doing in the above?
Is this the same as just doing something like a HMAC SHA256 hash?
Are there any concerns with something like a compromised server receiving this hash and being able to derive anything from it about the original encryption key or master password (prior to the stored hash being computed)?


texts:
Example: http://jsfiddle.net/KGtUE/

https://code.google.com/p/crypto-js/#Progressive_Hashing

sha256.update("abc");
sha256.update("def");
sha256.update("ghi");

vs

CryptoJS.SHA256("abcdefghi");

How does this work?


texts: What information about the ciphertext can an attacker discern if a key is used too many times?

texts:
Suppose that I use Blowfish or XTEA (both secure block ciphers with 64-bit block size) in CTR mode.

In these cases, I need to change the key after $2^{16}$ blocks to avoid leaking information with probability less than $2^{-32}$.

However, suppose that I make a mistake and use the key to encrypt a $2^{33}$-block ($2^{36}$ byte) plaintext.  What information can an attacker, knowing only the ciphertext, discern about the plaintext?


texts:
I'm stuck on exercise 4.19 from Introduction to Modern Cryptography.

  Let $F$ be a keyed function that is a secure (deterministic) MAC for
  messages of length $n$. (Note that $F$ need not be a pseudorandom
  permutation.) Show that basic CBC-MAC is not necessarily a secure MAC
  (even for fixed-length messages) when instantiated with $F$.

My idea was to construct the secure MAC $F'_k = m \| F_k(m)$, which would leak information on $F_k(m_1)$.
However, that would double the size of the MAC with every step.

Is there another/better/working solution?

Why are PRFs required for the CBC-MAC domain extension?

Edit: basic CBC-MAC refers to the following construction:

The book states that basic CBC-MAC is secure for fixed length messages when instantiated with a PRF.


texts: Difference between one-level and two-level E0 encryption

texts:
I am trying to understand the practical security implications of the way E0 is used in Bluetooth 2.1 devices. In reading up on the subject, I am seeing that encrypting a large amount of data with E0 when using a single key gives way to practical attacks. Only so-called one-level E0 is vulnerable to this attack. Two-level E0 somehow uses a different encryption key for each frame (with a frame being 2745 bits long), and attacks against two-level E0 require the first few bits of a large number of frames. In order to understand the implications of E0's weakness as used in Bluetooth 2.1, I need to understand the difference between one-level and two-level E0. I have two questions:

Is one-level encryption the act of using a single master key and encrypting all Bluetooth frames with it, and two-level encryption is using a single E0 keystream with a master key to generate temporary per-frame E0 encryption keys?
Does Bluetooth 2.1, which uses HMAC-SHA-256 for key generation, still use two-level encryption? If so, is a master E0 keystream used for generating each E0 frame key, or is HMAC-SHA-256 used instead, making it so the attacks against two-level encryption do not apply to E0 as used by Bluetooth 2.1?


texts: TypeA pairing, elliptic curves in pairing based cryptography

texts:
I am beginner to pairing-based cryptography. After downloading jpbc library, curve parameters files are seen as properties file. For example, for type A curve, following parameters are given.

type a
q 8780710799663312522437781984754049815806883199414208211028653399266475630880222957078625179422662221423155858769582317459277713367317481324925129998224791
h 12016012264891146079388821366740534204802954401251311822919615131047207289359704531102844802183906537786776
r 730750818665451621361119245571504901405976559617
exp2 159
exp1 107
sign1 1
sign0 1

PBC uses elliptic curve.Mostly,  as far as I know, most of papers describe pairing $e:G_1\times G_1\rightarrow G_2$, groups are cyclic group of prime order $q$ and $Z_q$ is used.

In typeA pairing,different $q$ and $r$,groups of prime order $q$ and $Z_r$ is used. When random number is generated from $G_1$ group, its length is greater than random number from $Z_r$.

I think previous papers have to combine desired curve and pairing to achieve $q$ size of group and $Z_q$ .How to combine named curve and pairing? May be there will be existing works implementation. Anybody, please explain nature of Type A and other systems. If it is possible, please help me with the link of existing implementations.


texts:
I have an encryption line of code as follows:

a^x mod y = rem // ^ is the power fx

Given x, y, amd rem during decryption, how can we find the value of a?

I was thinking of using  xth root of rem mod y, but it's not working; probably because of modulo congruence.

Can someone please guide me as to what needs to be done?


texts: Calculate if a digital signature is valid

texts:
In the book An Introduction to Mathematical Cryptography, it mentions a section on digital signatures and a theoretical example. I am having difficulty understanding the book and I was wondering if someone could better explain how you would be able to deduce if a signature is valid rather than finding what the signature is.

For example, $N = 1562501$ and the public key is $e = 87953$, the document $m = 161153$, and the signature is $d = 870099$. Is there a technique to find if it's a valid signature?


texts: Which algorithm is the simplest reversible fixed-size length-preserving symmetric "cryptography" with low probability of collision?

texts:
I am not a mathematician/cryptographer, so I could not take much advantage of this other question, and it seems (?) to have more requirements than me (SAC).

I say simple, because I need it to be have a fast implementation and also because security is irrelevant in my use case.
However, a low collision probability is an important requirement. By low I mean something comparable to the odds of MD5(textA + keyB) = MD5(textC + keyD), for different texts and keys. Both text and key have  a fixed size, e.g., 16 bytes. Plus sign here means concatenation.

For instance, AES would be suitable for this task, but it is 100x slower than MD5.
Of course, MD5 is irreversible, so I can't use it.

Another requirement is that it should also be non-commutative, i.e. encrypt(textA, keyB) != encrypt(keyB, textA) otherwise I guess I could just use the XOR bit-wise operation.

EDIT

What I have done so far was to implement the following 128-bit "cryptography" in Python. However, with many collisions:

def pepper(msg):
    bit = (msg & 0b1111111) % 120 + 8
    return msg ^ (2 ** bit)

def rev_hash(msg_int, key_int):
    """A "reversible hash", the nightmare of cryptologists."""
    lshift = (((msg_int & mask_127ones) << 1) | (msg_int >> 127))
    result = lshift ^ key_int
    return pepper(result)

def rev_unhash(encrypted_msg_int, key_int):
    xor = pepper(encrypted_msg_int) ^ key_int
    rshift = (xor >> 1) | ((xor & 1) << 127)
    return rshift


texts: Recasting randomly generated numbers to other widths

texts:
Suppose I have a list of randomly generated uint_8's, uniform over the whole range of uint_8. I write them into a file as raw bytes, no encoding.

Then I reopen the file and interpret the file as packed uint_16's (by pairing up adjacent bytes).

Is my reinterpreted stream of uint_16's a uniformly random distribution in the whole range of uint_16?
Now I reinterpret the bytes as packed int_32's. Is my reinterpreted stream a uniformly random distribution of int_32's, in the whole range of int_32?

Note: uintN_t is the type of N-bit unsigned integers, i.e. integers in the range $[0,2^N-1]$. intN_t is the corresponding signed type, i.e. integers in the range $[-2^{N-1},2^{N-1}-1]$.


texts: Security of GCM if Implemented with Stream Cipher instead of Block Cipher

texts:
Can GCM be implemented with a stream cipher instead of a block cipher? If no, then what security flaw does it have?

If yes, then which possibility from below two is better in terms of security? In terms of speed, option ONE seems better as Stream cipher will be initialized only once in it (assume the input data consists of n blocks{0,1,2...n-1} where each block is of 128 bits).

Generate an output stream of length $n+1$ blocks $\{0,1,2,3....n\}$ from stream cipher using single key and single IV. Then  XOR the $n$ blocks $\{1,2,3...n\}$ of this output stream with $n$ blocks of plaintext to create ciphertext. Multiply ciphertext blocks together(as in GCM, shown as $\operatorname{mult}_H$ in figure below) and XOR the result with $1^{st}$ block  (0) of output stream to make AUTH_TAG.
Generate an output stream of length $n+1$ blocks $\{0,1,2,3....n\}$ from stream cipher, where each block is generated with incremental IV (like Counter) but same key. Then XOR the $n$ blocks $\{1,2,3...n\}$ of this output stream with $n$ blocks of plaintext to create ciphertext. Multiply ciphertext blocks together(as in GCM, shown as $\operatorname{mult}_H$ in figure below) and XOR the result with $1^{st}$ block (0) of output stream to make AUTH_TAG.


texts:
In the document http://web.cs.ucdavis.edu/~rogaway/papers/eax.pdf (p. 7) Rogaway et. al. state that EAX is not a generic composition of an encryption and an authentication method.

The EAX algorithm is given in the following Image:

(the image is taken from p. 7 of the referenced paper and simplified by omitting the associated data)

So, the plaintext M is encrypted by a CTR block cipher mode and the resulting ciphertext is authenticated by an OMAC tag. So far, this looks pretty much  like an encrypt-then-authenticate based generic composition. The only thing particular here is, that the tag $\mathcal{C}$ isn't the final tag but is XORed by the tagged nonce $\mathcal{N}$.

My questions are:

Why isn't EAX considered to be a generic composition ?
Would EAX be a generic composition of the block cipher mode encrytion and the OMAC authentication, if $\mathcal{C}$ would be used as authentication tag T ?

Added: Actually, I think the answer depends on the point of view.

(1) Proof of security: Security proofs for generic compositions assume that two different, independet keys are used for encryption and authentication. As EAX uses the same key for both, security results for generic compositions don't apply to EAX. So in this point of view EAX is not a generic composition.

(2) Design principle: When one tries to classify AE algorithms, one can look how they are designed. By design, a generic composition is an algorithm that runs an encryption and an authentication algorithm in a (generic) order that is independent from the primitives: E.g. Encrypt-then-Authenticate, Authenticate-then-Encrypt, etc. In this point of view I would consider EAX (as well as CCM) as a generic composition.


texts: Do I need to prepare plain text before encryption?

texts:
When I want to encrypt chat messages (in ASCII) before sending, whether it brings some bit of security if I add some extra bytes to the message or shuffle it in some way? I can even try to make data to look like uniform distribution.

Because chat messages consist only of letters and even words, but don't contain binary data and other bytes except that from ASCII, so it gives some information about unencrypted data to eavesdropper.

But I'm afraid that some manipulations over the text could bring much more information to the attacker than doing nothing.


texts: Does exposing algorithm, key size and IV weaken the security?

texts:
I am using an encryption program to encrypt my documents. Previously I have used PGP and AxCrypt, so I just wanted to see how this new tool encrypts the file.

This tool is keeping parameters like cipher name, key size,initialization vector etc. in plain text.

I want to know whether exposing these details can anyway help an attacker to focus his attacks.

Below are the top few lines of a sample encrypted file:

  »     ÌšÚ>Öùq¸ë®ûÑÅ#Ÿ £¦É² $Náøj_{
                "artifact":"header",
                "cipher":{
                         "algorithm":"AES",
                         "IvBytes":"c6+TSc609YSMQSeorKSwAg==",
                         "mac":{
                               "enabled":false
                               },
                         "mode":"CBC",
                         "padding":"PKCS7",
                         "keySize":256,
                         "blockSize":4096,
                         "iv":"c6+TSc609YSMQSeorKSwAg=="
                         },
                "metadata":{
                            "name":{
                                    "encrypted":false,
                                    "value":"~$$tmpFDC6.tmp.bc"
                                   }
                           },
                "version":1,
                "encryptedFileKeys":[{
                                      "type":"data",
                                      "id":"2705583903525488672",
                                      "value":"KIgNTpyr1+9QLSUijmpxh0jnfyi/6fIY2zoBzMsw2/B3WDmbV3+M2QsLbCLei++G8UDsjyjFiooXQpWJbUF75+Sg2AhhHS4YkvytSrgUW3/J56ky+a0XDti46e0I94oHAstL/BrS31NIqkCQW80qCja4nEzkRyHE5j3W8SR9nh8I2oDSONesy/BenzIUjz3IoNnYD750LKR7IA7xrJ75hT9uYZ9oZr9EKcKPR0Fwyy1dnVCaJWrstjnAYunnKw8irU70zmYxh6ytDsc3x70e7aj7rikQ7n3H4CquOyPqvIESpuGGWzlrTAvNoT8UHJuegAxWEMewOVkAYuwEcUnOIQt5YV8/B8ds+hfyAGRD4rf7GjsCExC+t69ekeDB63+s7LcmkCsZJKpiER3D3+OpYaANQxs2ceIEPPEPOrVbL98eTJa42elL29CeIkA5rmYtMhv6Nh+baH5LxOWxTrKM4n+dlnSwsd//CupGC0jWi8JNCu9MEx0o33S1TgqEGjYRSBLh/rfQu7CaYB4JxaluuqfOstb33JESaX77b1jBadwj1t977ZGKw4HK3HMcrQoJL1yjEd71uHOOX5bgKrvz1V9hrxNkT6MseeSV7N9Vf38oYAZrSz0dGemQBNpxZMwhKu9qd6Xi6V8v5Az7CcYcaEtQCc+tO7F3Vgmfv92U5WQ="
                                     }]
                }


texts: Signature generation using hash function

texts:
I want to generate a valid signature for a message using the below algorithms:

Hash function: $H(x) = (x+3) \bmod 10$
(I am unable to understand the given parameter for hash function and how am I supposed to use it in hashing a message.)

Encryption: RSA with the following parameters

Private key: 11
Public key: 5
Modulus: 14
(I had tried but failed in using these parameters in RSA encryption. I want to know the possible way or hint to be able to use these exponents in encrypting the hash of a message.)


texts: Are all stream ciphers algorithms based XOR with the key?

texts:
I'm new to cryptography and I try to understand more how the stream encryption works.
When it comes to stream encryption I understand that the paradigm is to perform 1-to-1 bit encryption; the input message is XOR'ed with the key.

What happens when the key length is less than the size of the message?
Does all algorithms perform the same XOR operation with the key or there are other operations to be performed as is the case with block cipher where multiple rounds and derivate keys are used?

How can I better understand the stream cipher?


texts:
I think it's neat how a person can prove that two discrete logarithms are equal without actually revealing the value.

So, conversely, is there a way for me to prove that two discrete logarithms are not equal without revealing either logarithm's value?  Assume that I know (by construction or by oracle) the discrete logarithm value for any pair of elements (from the 4 given elements) and I thereby know that all are unique.


texts:
Considering a stream cipher that produces a ciphertext $c$ from a message $m$ and a key $k$ is it possible to apply operations (multiplication and/or addition) directly to $c$ without knowing the key ?

Example : $m$ > encrypt > $c$ > $c+5$ > decrypt > $m+5$

I can not manage to get a valid $m$ at the end. I tried to work with hex values, binary data… no success so far. Could you please confirm if this kind of operation is possible on AES-ctr / Xsalsa20 (this one uses nonces) and how to properly do it? Thanks !


texts: Is there a pen-and-paper way to securely share a secret via public key encryption?

texts:
We have several questions tagged pen-and-paper talking about encryption, hashing, signing, etc. but no question asks about exchanging a secret via public key encryption in a secure way.

Does any solution exist, which would allow us to exchange a secret via a public channel (think: key exchange) using nothing but pen-and-paper and which can be handled by people who are not (what one might call) “math wizards” (read: people who can calculate whole algorithms using nothing but their brain) but who do know their way around maths and who do understand crypto?

As far as I’m aware there isn’t any such solution in classic (pre-computer) cryptography. But that doesn’t automatically mean it can’t be done.

Of course, potential solutions won’t offer the security we get and expect from computer-based solutions like RSA or elliptic curve cryptography. Yet, to keep it simple let’s assume we’re not trying to protect ourselves against nation-state adversaries here. Nevertheless, suggestions should provide a usable security margin.

What would be a not so neck-breaking way to exchange a secret over a public channel using nothing but pen-and-paper means? Is it even possible to do so in a somewhat secure way without using computers, mobile phones, or other, even more rudimentary tools — like mechanical machines — that aren't always available? (Hence the tag pen-and-paper.)

To clarify: I am not looking for something which resembles a toy cipher made for the purpose of “demonstrating to a 12-year-old how encryption works” and/or to be used in a “fantasy story”. My question asks for an actually usable and secure solution (as mentioned above).


texts: RSA Signing: SHA512 incompatible with PSS?

texts:
I am wrapping the RSACng class from the .Net API.
Whilst unit testing, I run checks against an array of possibilities:

Key Size = 1024, 2048, or 3072 bits
Padding Mode = PKCS v1, or PSS (=PKCS v2?)
Hash Algorithm = SHA-1, SHA256, SHA512

I test for all 3*2*3=18 possible configurations. All tests pass except one combination:

Key size = 1024 bits
Padding Mode = PSS
Hash Algorithm = SHA512

Should this be expected, and how could have I anticipated it? So far, Google has not been my friend.

I also ran a similar batch of unit tests for RSA encryption, and noted a 1024 bits key is incompatible with OAEP-SHA1 and OAEP-SHA256 padding modes. I suspect the key is not large enought, but I was again unable to read some info as to why this was happening.


texts: Does the XML Encryption flaw affect SSL/TLS?

texts:
A "practical attack against XML's cipher block chaining (CBC) mode" has been demonstrated:
XML Encryption Flaw Leaves Web Services Vulnerable.

Does this weakness of CBC-mode which is used here also affect SSL/TLS?

Related: Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?


texts: Is division possible in the Paillier Cryptosystem? i.e. given a the cipher-text $C$ of an integer $M$ the plain-text divisor $D$, and only the public key, can one compute the cipher-text of $M/D$ ?


texts: How effective noise based voice encryption against attack?

texts:
In WWII the primary way of encrypting radio broadcasts was to have the broadcaster transmit a signal with noise added from record, while the receiver would have an identical copy of the record subtracting the noise.

Assuming that the noise is totally random, and the record is never replayed. How would one attack it?

While this isn't strictly a cryptography question, do modern encrypted radios that work in frequencies that are too low to transmit digital data like this still use this principle?


texts: Explanation of the term "view" for algorithm or adversary

texts:
What is the view of an algorithm/adversary? Is view just a term used to describe the output over a set of inputs for a probabilistic algorithm?

For example:

  Consider experiment Mac-forgeA,Π (n). In that experiment, the view of
  A when run as a subroutine by A is distributed identically to its view
  in experiment Mac-forge A',Π' (n).

Also, I've always assumed an identical distribution is one that is literally identical to the original distribution. I just had the thought that it may be a distribution that is output with identical probability as the original distribution. Are either of these guesses correct?


texts: Why must we hash lot of times in rainbow tables?

texts:
I don't get the utility to chain and reduce in generating rainbow tables.
Hash functions are made to not have collisions, or at least chain only 2 times so we don't return to the concept of the hash dictionary.

So why do we bother the machine to hash and reduce thousand of times to only store the latest value?


texts: Ring-LWE instance with errors also in the public polynomial

texts:
Consider the ring $R_q = \mathbb{Z}_q[X]/(X^d+1)$, the Ring-Learning-With-Error assumption states that the distribution of $(a, as + e)$ is close to uniformly random, where $s \in R_q$, $a$ is uniform in $R_q$ and   $e$ has small norm (say $\|e\|_\infty \leq \beta$).

How pseudorandom is $(a+e', as+e'')$, where $e', e''$ have bounded norm say strictly less than $\beta$?

How about the general case where there are multiple instances?


texts: Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy

texts:
I am trying to find the protocol with the least overhead, which still meets the following requirements:

Server Authentication of server identity to client. The client has an authentic copy of the server long term public key.
Perfect Forward Secrecy.
Confidentiality, integrity, authenticity of payload, including:

Replay protection.
As little clear text Handshake and Header data as possible, to aid application specific implementations of traffic analysis counter measures.

The protocol operates over TCP (or equivalent, or higher). Serialization of messages is assumed. In particular, both sides are presumed to maintain a state that, at all times, unequivocally determines which content encryption key to use for decrypting any packet that arrives from the other side.
No Client Authentication of client identity to server. This is presumed to be done by the protected application layer, if necessary.
The Client and Server share fixed, implementation specific security parameters, including Diffie-Hellman domain parameters, KDF and AE algorithm choices etc. However, these parameters might differ between different implementations.

I have seen the CurveCP protocol, which appears to have slightly different design criteria.

This is what I came up with:

$Label_i$ denotes a fixed, implementation specific octet string. Different labels will be used for key derivation at different steps in the protocol.

All protocol messages have a header that consist only of a protocol version field and a length field. Both are included as authenticated data in the MAC calculation if the message is encrypted.

The long term key pair of the server is denoted $S^0$.

$Client$: Generate ephemeral key pair $C^1_{publ}, C^1_{priv}$
$Client \rightarrow Server$: $Hello_C^1 \leftarrow C^1_{publ}$
$Server$: Verify that $C^1_{publ}$ is not congruent to 0, 1 or -1, and that it belongs to the right subgroup.
Both $Client$ and $Server$: Calculate the intermediate shared secret $M^1_{tmp}$ from $S^0$ and $C^1$. Calculate $k_{tmp} \leftarrow KDF(M^1_{tmp},Label_0)$
$Server$: Generate ephemeral key pair $S^1_{publ}, S^1_{priv}$.
$Server \rightarrow Client$: $Hello_S^1 \leftarrow AE_{k_{tmp}}(S^1_{publ})$
$Client$: Verify and decrypt $Hello_S^1$. Verify that $S^1_{publ}$ is not congruent to 0, 1 or -1, and that it belongs to the right subgroup.
Both $Client$ and $Server$: Calculate the shared secret $M^1$ from $S^1$ and $C^1$.
Both $Client$ and $Server$: Calculate $k^1_S \leftarrow KDF(M^1,Label_1)$ and $k^1_C \leftarrow KDF(M^1,Label_2)$
Both $Client$ and $Server$: Set $Ctr_S \leftarrow 0$ and $Ctr_C \leftarrow 0$
... $Client \rightarrow Server$: $Packet_{Ctr_C} \leftarrow AE_{k^1_C}(Ctr_C||"m"||Message)$
... $Server \rightarrow Client$: $Packet_{Ctr_S} \leftarrow AE_{k^1_S}(Ctr_S||"m"||Message)$

... later rekey before the counters wrap around to zero, as follows:

$Client$: Generate ephemeral key pair $C^i_{publ}, C^i_{priv}$
$Client \rightarrow Server$: $Hello_C^i \leftarrow AE_{k^{i-1}_C}(Ctr_C||"hello"||C^i_{publ})$
$Server$: Verify and decrypt $Hello_C^i$. Verify that $C^i_{publ}$ is not congruent to 0, 1 or -1, and that it belongs to the right subgroup.
Both $Client$ and $Server$: Calculate the intermediate shared secret $M^i_{tmp}$ from $S^{i-1}$ and $C^i$. Calculate $k_{tmp} \leftarrow KDF(M^i_{tmp},Label_0)$
$Server$: Generate ephemeral key pair $S^i_{publ}, S^i_{priv}$.
$Server \rightarrow Client$: $Hello_S^i \leftarrow AE_{k_{tmp}}(S^i_{publ})$
$Client$: Verify and decrypt $Hello_S^i$. Verify that $C^i_{publ}$ is not congruent to 0, 1 or -1, and that it belongs to the right subgroup.
Both $Client$ and $Server$: Calculate the shared secret $M^i$ from $S^i$ and $C^i$.
Both $Client$ and $Server$: Calculate $k^i_S \leftarrow KDF(M^i,Label_1)$ and $k^i_C \leftarrow KDF(M^i,Label_2)$
Both $Client$ and $Server$: Set $Ctr_S \leftarrow 0$ and $Ctr_C \leftarrow 0$

...etc.

Does this protocol meet the requirements, or is something missing?


texts: PBKDF2 when dkLen and hLen have the same size

texts:
I was reading RFC 2898 and something is not clear to me. When I use PBKDF2 with SHA-256 and I want a derived key with length 32 bytes (the same length as my hash function output), your derived key only exists out 1 block (l = 1) of size hLen = 32 bytes.

This seems trivially, but i want to be very sure! Is this correct?


texts: Why is prime number size important for RSA security?

texts: RSA modulus is $N = pq$ where $p$ and $q$ are prime numbers. I read from somewhere that the time it takes to decrypt the RSA encryption increases exponentially as key length increases, which depends on the value of $N$, which in turn, depends on $p$ and $q$. Are there any mathematical proof to explain this phenomenon?


texts: What's the maximum length for AAD in GCM?

texts:
int mbedtls_gcm_starts( mbedtls_gcm_context *ctx,
                int mode,
                const unsigned char *iv,
                size_t iv_len,
                const unsigned char *add,
                size_t add_len )
{
    int ret;
    unsigned char work_buf[16];
    size_t i;
    const unsigned char *p;
    size_t use_len, olen = 0;

    /* IV and AD are limited to 2^64 bits, so 2^61 bytes */
    if( ( (uint64_t) iv_len  ) >> 61 != 0 ||
        ( (uint64_t) add_len ) >> 61 != 0 )
    {
        return( MBEDTLS_ERR_GCM_BAD_INPUT );
    }
}

Above is a part of the implementation of GCM (Galois/Counter Mode) by mbedtls.

The implementation puts a restriction on the length of AAD (additional authenticated data), that is, the length of AAD cannot be greater than $2^{61}$ bytes.

My questions:

Is there an actual limit on the length of AAD, or that's just an implementaion-specific restriction?
Theoretically, can I input an AAD of any length?


texts: Remove padding (CBC) from decrypted text

texts:
I have a bit problem with padding. Everything goes fine when I encrypt the text BUT when I decrypt I see some extra characters. Sometime's one character sometimes more and I dont know how to remove them.

But one question I am really upset with is that why does padding show in my decrypted text BUT now others?

Here's my code (PHP) to generate IV:

if($iv = openssl_random_pseudo_bytes(32)){
        $final_iv = substr(base64_encode($iv), 0, 32);
    //The IV size should be 32 characters
}

Here's example of the paddings:

E¢9Àšæ—–Í

Qcn«ûØ›§Ñ¼waf—®

º„%¬â;¸*Í”¨Ö


texts:
I'm looking at tweetnacl, its crypto_sign_keypair, crypto_sign, and crypto_sign_open functions modify and use the output of crypto_hash in various ways.

I would like to swap crypto_hash for another hash function with the same length output. While I would normally avoid doing something like this due to lack of knowledge, in this case it seems like it might be fine. The output of crypto_hash is presumably uniformly distributed, seemingly random, and so tweetnacl is surely not making any assumptions about the output of its hash function. If it's replaced by another function with the same length output, then I assume tweetnacl will use its output just as happily?


texts: What is the difference between a forgery attack and an user impersonation attack?

texts:
I'm new to cryptography, so I was searching for a forgery attack, but unable to find anything.

Can anybody tell me the difference between forgery attack and user impersonation attack?


texts: How are state wiretaps obtaining plaintext from encrypted transmissions?

texts:
According to the US 2011 Wiretap Report, encryption — on the off chance that it is encountered — has been no hurdle to retrieving the content of a conversation.

  Public Law 106-197 amended 18 U.S.C. § 2519(2)(b) in 2001 to require
  that reporting should reflect the number of wiretap applications
  granted in which encryption was encountered and whether such
  encryption prevented law enforcement officials from obtaining the
  plain text of the communications intercepted pursuant to the court
  orders. In 2011, encryption was reported during 12 state wiretaps, but
  did not prevent officials from obtaining the plain text of the
  communications.

— US 2011 Wiretap Report, page 8–9 (emphasis added)

Why was this encryption not successful?

Unfortunately the report includes very little detail about what kind of transmission and encryption was involved in any of the 12 cases.


texts: Verification using recovered public key from ECDSA signature and normal verification: what are the differences?

texts:
For ECDSA, a given signature and its message can be used to recover the public key used to sign it (produce 2 public keys). By making comparison of these recovered public keys against the known public key, one will be able to verify the signature.

Does this method differ from the conventional signature verification? If it does differ, is there any performance difference between these two methods?


texts: Is it possible to create an easy to use encryption/decryption method that will never be comprimised?

texts:
In the comments of the question "Why programming languages don't provide simple encryption methods?" the following statement was made:

  A well thought out, tested and understood standard that has undergone
  extensive review by the crypto community has a much better [chance] of
  avoiding compromise than a system designed by a single engineer using
  a fairly low level library.

to me such a system would have the following requirements:

Encryption would require nothing more than a string of text to encrypt and an easily programmatic producible "key".
Decryption would require nothing more than an easily programmatic producible "key".
The result would not ever be able to be determined with out access to the key even given a reasonably huge finite (IE more than we can ever expect to have available) amount of computing power.
No method of attack would ever trivialize the determining the key or the source text used for the encryption.

My opinion is that the nature of encryption is that it is impossible for a standard like this to work given an infinite amount of computing power. We may be able to do this for the computing power of today but eventually given enough power it will be trivial to decrypt any scheme if we know how the scheme works and it only requires a single key. Is such a scheme possible?


texts: Do I need to worry about the IV if I use a 32 byte random salt with SCrypt and AES-GCM?

texts:
I am encrypting a DEK (data encryption key) with a KEK (key encryption key). The KEK is generated from a password using scrypt with default parameters and a 32 byte randomly generated salt. The encryption algorithm is AES-GCM.

What are the implications for the IV in this case? Let's assume that the IV is initialized to 0 (96 bits of 0s). If I re-use an IV with a key then this is bad news. Since the key is generated from the password it will always be the same. But I do generate a random 32 byte salt each time I re-encrypt the file which should provide a different key each time. I would assume that a 32 byte salt would change the KEK significantly so that the zero initialized IV would not pose an issue for GCM. Is this a valid assumption?


texts: Are any of the practical implementations of ORAM being used in a real world system?

texts:
The concept of Oblivious RAM (ORAM) was first introduced by Oded Goldreich and Rafail Ostrovsky in 1996. However, in the past 5-10 years there has been a surge in the amount of research that looks into various realizations, optimizations and implementations of ORAM. My questions are two-fold:

Although ORAM was introduced around two decades earlier, why is there a sudden spike in the interest of ORAM by the research community?
Various applications of ORAM have been put forth, which includes: secure computation, data-outsourcing and secure processors. Is ORAM currently being employed in any real world systems for an application that it was intended for? If yes, please provide me with some reference.


texts:
TweetNacl is all-in-one crypto library. It's very easy to use, so I often include it in my projects;

But recently I need to use Elligator, I had to use LibElligator. It would be very usefull to have Elligator func in TweetNacl.

I am not a cryptographer so it's hard to me to undersand internals of both libs.
Is it posible to implement elligator hashing based on math of TweetNacl?


texts: Universal composability: Can an ideal functionality call other ideal functionalities?

texts:
I'm new to universal composability.
I'm trying to define a protocol, $\pi$, in UC.
The protocol involves 3 parties: A, B, and a smart contract $C$. Parties A and B interact with each other and with $C$.
Each party, including $C$, makes calls to multiple primitives (e.g. symmetric key encryption: $Enc$, commitment scheme: $Comm$, etc).
One approach is to construct the protocol in the real world and assume the contract is fully trusted.
Then, in the ideal world, I can define an ideal functionality, $F$.
Then as a theorem, I say $\pi$ UC realizes  $F$ in ($Enc$, $Comm$)-hybrid world.
Question 1: To make the definition simpler/neater, in the real world, could I define an ideal functionality $F_c$ for the smart contract where $F_c$ calls other functionalities like $Enc$, $Comm$? The reason I thought it would be simpler is that, I could explain the smart contract side protocol separately, remove its detailed description from $\pi$ and add $F'_{c}$ to the hybrid world, in the above theorem.
Question 2: In general, is it ok if an ideal function calls multiple other ideal functionalities?
Question 3:  What is a wrapper functionality? Can a wrapper functionality call multiple functionalities?


texts:
Suppose we have two secret keys K1 and K2, I'd like to ask if there is any encryption scheme that allows us to derive another key K12 from K1, and K2 and for a message x, EK12(x) = EK1(EK2(x)).

EK(x) is the encrypted text of x using key K.


texts: Are public key and private key exchangeable?

texts: If I get a key pair from RSA algorithm, can I make Private-Key public, and keep Public-Key secret without breaking the security of encryption and signature?


texts: Ways to make white-box cryptography AES implementation more difficult to be broken

texts:
Background: I want to use white-box cryptography to hide the keys stored in a client application.

I am looking for existing implementations of white-box cryptography, such as AES 128 or 256. But I found that almost all the existing implementations are breakable in some reasonable period of time. For example, see the CHES 2017 challenge and BGE attacks on the original Chow's scheme, etc. I haven't been able to find a mature/unbroken implementation so far.

My objective is to make WBC implementation very difficult to be broken. As we know,

1) WBC aims to protect cryptographic algorithms against key recovery

2) Code obfuscation aims to protect against the reverse engineering of a cryptographic algorithm.

Thus, I want to use a published WBC implementation (may be broken already), and then apply obfuscation on the code (e.g., C++).

Is the above way reasonable (if we cannot find a proper implementation)?
Please recommend any mature WBC implementations (not broken yet)
Any better ideas? (other than re-design & evaluate a new WBC algorithm)


texts: Are there any practical methods of steganography?

texts: There isn't a whole lot of information on steganography in the modern age, from what I can tell. A google search for steganography usually brings up a list of very impractical methods (e.g. tattooing a message on a guy's head then waiting for hair to grow over it). The only modern (and practical) method I've seen involves manipulating the least significant bits of an image. This method appears everywhere when you search for steganography. Are there any other practical methods of steganography?


texts: Is the new preprint "An Algorithm For Factoring Integers" by Yingpu Deng and Yanbin Pan worth reading?

texts:
I just discovered on the eprint server of the IACR the paper mentioned in the title. Scanning quickly over the paper I didn't find anything spectacular, so I doubt that their new(?) approach will be any good. But as I'm not an expert in the field of factorization, and as the proof for Primality $\in$ P is also deceptively "low-level", I wonder if someone here with more knowledge about factorization could quickly judge if the paper is worth reading.

EDIT: The paper I'm wondering about seems to be connected to the polynomial time primality test by Manindra Agrawal, Neeraj Kayal, and Nitin Saxena. So please be sure to know (or better: understand) the AKS-test before answering here.


texts: Trustless exchange without a third party

texts:
Is there a cryptographic (or even not entirely cryptographic) way of exchanging objects between Alice and Bob that would not require a third party, and Alice and Bob would not need to trust each other? For example, Alice and Bob have Y and X objects (some information) and want to exchange them (in other words both Alice and Bob after transaction will have access to the set Y∪X). How can they do this directly to each other?

Is it possible to solve this problem, for example, using private keys, zk-proofs, etc? Is it possible to solve it in principle?

Thank you!


texts: Intuitive explanation of the $\varepsilon$ parameter in differential privacy

texts:
I think I have a decent intuitive understanding of what the $\delta$ parameter means in $(\varepsilon,\delta)$-differential privacy: I can explain it to a non-specialist in terms of "what are the chances that something goes horribly wrong".

Even if I understand (and can work with) the formal definition, I'm not sure I could do the same for the $\varepsilon$ parameter. I've recently been asked to design a differentially private mechanism for a simple survey, and I have no idea which $\varepsilon$ to choose in practice nor how to justify this decision.

Ideally, I'd like to successfully explain what a particular choice "means" to somebody who isn't a privacy specialist. Any idea how to do that?


texts: Variants of Bilinear Diffie-Hellman Assumption

texts:
Could someone point me to the paper/reference where the following variant of q-strong Bilinear Diffie-Hellman assumption was used?

Given $s \in \mathbb{Z}_p^*$ and $g, g^{\frac{1}{s}}, g^{s}, g^{s^2}, \ldots, g^{s^q}$ it is difficult to compute $g^{\frac{1}{s + c}}$ for $c \in \mathbb{Z}_p^*\setminus \{-s\}$.

Essentially, I am looking for the variant which has $g^{\frac{1}{s}}$ as a part of the public parameter.


texts: Crypto Vs crypto-less key establishment protocols for Internet of Things applications

texts:
With the advent of IoT, crypto-less key establishment protocols exploiting intrinsic channel randomness of physical layer are gaining great interest. These crypto-less protocols are computationally inexpensive and thus suitable for low-power devices. Specifically, they require almost 61 times less energy than for ECDH. However, crypto-less protocols require relatively high time for establishing the secret key (several minutes) as compared to ECDH (few milliseconds).

My question is about the performance benefits of ECDH and physical layer key establishment.

What is an ideal time period for the key establishment? To be specific, for video surveillance applications where normal traffic is very high, how much time should be allowed for the key establishment? Is crypto-less key establishment enables the requisite level of usability?

2.These crypto-less protocols also prone to passive eavesdropping due to the absence of any prior trust. Is some pre-shared secret during deployment a good option for IoT scenarios?


texts: Is it safe to use shared secret as a symmetric key in one way communication?

texts:
I have a one way communication from one device to another, which needs to be secure and there cannot be any feedback in the other direction. Now both sides happen to have ECC P-256 key pairs and they know public keys of each other. So, I thought it would be natural to use the shared secret which is already 256bit - suitable for AES256, in which sender can encrypt the message and receiver can decrypt it.

Note: By shared secret I mean the usual $x$ coordinate of multiplying public key of $A$ and private key of $B$, or public key of $B$ and private key of $A$ - which are the same. I am not referring to calculated secret that is based on some random value generated each session, that would require I believe two way communication, which is not possible in this settings.

Now I am wondering if this by itself is sufficient, maybe I am overthinking this but I see two issues:

Such derived key is not uniformly distributed
If the symmetric key gets compromised, it requires that at least one side changes its key pair, as opposed to having a key different for every session, so only data for one session would be compromised.

I thought about generating some pseudorandom sequence of bytes on the sender's side, adding it to the shared secret, then hashing it altogether and use the result as a symmetric key - using SHA-256 would again give exact size of key for AES256 (this should also address the issue 1.). Then the random sequence of bytes would be part of the message, so receiver could do the same.

Now is this secure? Is there better way to do this, within the one way communication constraint? Or maybe this all is unnecessary and just using the shared secret directly is enough?

The linked questions (duplicates) are talking about shared secret, but I don't see how they address the one way communication problem I have here. There is no issue in calculating the shared secret, and also it is no issue of how random is the shared key, it is more about whether keeping the symmetric key the same (based on shared secret) for every session, or whether to apply some additional processing to ensure it is different each session, and if so, how to do it safely.


texts: Application of Non-deterministic Processors in side channel attacks

texts:
I was reading the abstract of "Non-deterministic Processors" paper by "David MayHenk L. MullerNigel P. Smart", in the abstract, they have mentioned the Kocher paper about "Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems"

What is the application of Non-deterministic Processors on a side-channel attack?


texts: GPG implementation of ECC "Encryption" (ECDH) vs RSA

texts:
My understanding of GPG with traditional RSA keys, is that RSA is by definition can be used to both sign and encrypt.

This is because RSA can be directly applied to plaintext in the following form: c = m^e (mod n).

I understand that GPG supports Elliptic Curves now, however, given that ECC generally uses ECDH hybrid approaches in order to encrypt data, how does GPG implement this?

As I understand the basis of ECDH is that Alice and Bob can reach the same secret as:

pubAlice * privBob === pubBob * privAlice...

However, when using RSA the recipient doesn't need your public key to calculate a shared secret to decrypt, it would seem that using GPG ECDH one needs the public key of the sender to decrypt.

I have successfully decrypted data sent via GPG ECC keys, without the senders public key, how does that work?

Is the public key of the sender sent as part of the cipher text?


texts: Storing passwords in a publicly available database

texts:
I have a public database where users need to store configuration files. The file can contain passwords. Everyone can read config files but only the server can read passwords in them.

In the browser, when a user wants to add a password to the the config file:

User hash the password using bcrypt
User encrypts the hashed string with public key A
User adds the encrypted string to the config file and saves it to the database

A third party server will then connect to the database, this server knows the private key for A. This server verifies if some plaintext password match with the encrypted hash.
Other users see the config file, but they can't see what passwords are in it.

Some precision :

I don't care if another user edits the encrypted password, and I don't care who edits the password, so I don't think I need to sign anything.
It's really a public database, like a mysql instance without any security.
I do the hashing on the client in case the private key gets stolen. It will take a long time to reverse the hash for all passwords.

It seems secure to me. Is it? Is there a simpler way?


texts: Why does a "never-repeating" nonce limit a key to safely encrypt only a single block?

texts:
This questions comes from a section outlined in RFC 5297 on SIV-AES. The paragraph in particular outlines the idea of a never repeating nonce vs an "almost always" non-repeating nonce.

  If the nonce is random, a requirement that it never repeat will limit the amount of data that can be safely protected with a single key to one block. More sensibly, a random nonce is required to "almost always" be non-repeating, but that will drastically limit the amount of data that can be safely protected.

I don't understand the limitation described in the first sentence. Given an IV and a nonce, what exactly about "never repeating" prevents encrypting more than a single block per key?

It seems to imply that I would need to generate BOTH a new key and nonce for each block I want to encrypt. My current reading of this would imply that I would need to generate a new key AND nonce for each block in say CTR mode but I know this isn't true.


texts: How could you find the preimage of an isogeny function?

texts: How do you know if an isogeny is surjective or not, and how do you tell how many points on E maps to E'? Does the answer lie in the degree of the isogeny function?


texts:
I have been tasked with moving an authentication service from our provider to somewhere else. The code base for the current service is not available to me, but I know these things:

I have a 65 character plaintext key
Something labeled a "nonce" with 3 characters and in plain text
An encrypted string which (possibly coincidentally) begins with the nonce and is 35 characters long.

I have tried many of the googled suggestions without luck. Mostly nobody even mentions using a nonce.

Can anyone give me some idea of what I might want to do to decrypt the string? Nodejs or python would be my tools of choice?


texts: encryption of digest of unkeyed hash function is susceptible to forgery?

texts:
I have a question in mind.
Suppose we have a collision-resistant unkeyed-hash function $H(·)$ which outputs a 128-bit digest, and a semantic secure symmetric encryption $E(·,·)$ in the
following way, we can design a Message Authentication Code (MAC) in this manner, so given a message $m$ and the secret key $k$, the mac is the encrypted digest,
$t=E(k, H(m))$.

Is it susceptible to forgery if the encryption is in CBC mode or CTR mode? My intuition tells me that it is possible, but I have no idea of constructing the forgery for them. Any suggestion is welcome, thanks!


texts: Toy one-way hash function for six digit number

texts:
I need to copy some data from a secure server to my laptop to work on it with a program (this description is very vague, I know). The data have six digit employee numbers and we are strictly prohibited from downloading data with these.

I was wondering if there is a really simple hash function I could put in a spreadsheet to convert these employee numbers into a one way hash so I can download these? All I care about is being able to tell which data came from the same employee number. I am not terribly concerned about a few collisions either, the set is small enough I could look for those.

I was thinking some simple xor with an added salt or squaring and taking some digits but everything seems like it would be too guessable especially if there is a series of sequential employee numbers in a row.

For example, hash

123456

to somerandomlookingstring, but I need to be sure the next result is

123457

is not terribly similar, so not like: somerandomlookingstrifh

I feel like this is something hardcore crypto people may know off-hand, some mini ancestor of MD5, some evolution of ROT13, but light enough for thousands of spreadsheet cells.


texts: Why Diaspora Federation pod communication protocol shares AES keys over asymmetric encrypted channels?

texts:
As I was looking over the diaspora federation Magic Envelope documentation, I noticed something weird:

{
  "aes_key": "...",
  "encrypted_magic_envelope": "..."
}

After some thought, I realized that it uses asymmetric cryptography to send a symmetric key. But other technologies such as TOR or OTR, or even Signal, perform Diffie-Hellman over an asymmetrically-encrypted channel.

So I wonder, why choose to do that? Do they choose that due to the stateless nature of the HTTP protocol used in the Salmon Protocol on top of a webfinger communication? If yes, what affected the decision to do that?


texts: Can I prove set membership and uniqueness without revealing the element?

texts:
Assuming a publicly known set $\Psi$ with $N$ unique elements.

I have a set $\Sigma=\{\sigma_1,\sigma_2,...,\sigma_m\}$ where $m\leqslant N$. I would like to publicly prove that all the elements in $\Sigma$ are unique and are also elements of $\Psi$. I would like to do this without actually revealing the elements of $\Sigma$.

I happened upon this paper. If I understand it correctly, the above should be possible by publicizing commitments for every $\sigma$. However most of the paper is way over my head and I'm not really sure what commitment scheme I should use, what extra information should be made public and how exactly would a third party Verifier go about verifying the claim.


texts: How secure will this be against brute-force attacks?

texts:
I'm looking into encrypting files like this: First, I SHA-1 hash the password. Let's say the password is something normal like "hello123", and then hashed. Then I encrypt a file using this:

openssl aes-256-cbc -a -salt -in file -out file.enc

(using the hash for the password).

So it's basically just an AES-256-CBC encryption with a salt.

How easy would it be to crack this by brute force? (Assuming the attacker knows that we have aes-256-cbc with salt and that the original password is hashed.) For instance, how long time would it take these days, on "normal" hardware?


texts: Term for non-ARX symmetric-key cryptographic primitive design strategy

texts:
What's the term for describing designing symmetric-key cryptography primitive out of bitwise operations and shifts and rotations?

The closest thing I've found is this Keccek team's page calling it NORX, but the linked reference says NORX is actually an AEAD algorithm.


texts: Ciphertext manipulation for ciphers with intermediate tags

texts:
I have been looking into the CAESAR submissions as I'm interested in a cipher that can process a stream of unknown or large size (E.g. socket, file) while providing authentication. My understanding is that the current standard approach is for the application to slice the data into blocks and use some well-known AEAD mode like GCM (including the chunk number to prevent block suppression, duplication, and reordering).

However, ciphers like Keyak v2 take care of this by themselves by supporting intermediate tags, which combined with being online makes for a good fit for the above use case. Note that tags in Keyak v2 authenticate all plaintext chunks prior to that tag, thus protecting against suppression, duplication, and reordering of intermediate chunks; also worth mentioning that this is a Encrypt-and-MAC approach.

All this got me thinking of potential attacks against ciphers making use of intermediate tags. The way Keyak v2 is designed an attacker can't remove intermediate chunks from the ciphertext, but (s)he would be able to remove as many blocks as (s)he wanted starting from the back. This is interesting as is something you can't do against for example GCM because the MAC is applied over the whole ciphertext. A (contrived, I know) example would be for an attacker to remove the last blocks of the transmission of a number:

Original Ciphertext: 1000|Tag1|0000|Tag2
Modified Cipphertext: 1000|Tag1

The victim would have no way to detect such ciphertext modification as long as the removal of the block doesn't break the semantics of the underlying protocol (like in this example). I know that this is also possible if you're slicing the data at the application level and using GCM, but I expected the likes of Keyak v2 to solve it somehow. Unless I am missing something important, this looks like a relatively big downside of intermediate tags.

What's wrong with my reasoning? Is this just a risk we have to assume if we want to process streams in this way?


texts: Generate random numbers whose sum is equal to a constant value modulo n

texts:
I want to generate $n$ random numbers $u_i \in [ 0, 2^{\kappa + 1})$ such that $\sum u_i = c$ $mod$ $2^{\kappa + 1} $, where c is a constant.
Also, taking $n - 1$ random numbers and subtracting their sum from $b \cdotp 2^{\kappa + 1} + c$, where $b \cdotp 2^{\kappa + 1}$ is the closest multiple of $\;2^{\kappa + 1}$ that is greater than sum of the $n - 1$ random numbers, to get the $n^{th}$ random number a good solution?

P.S. I want to know if there's a solution to this problem that'll ensure good statistical properties.


texts: Looking at just EC Public Key parameters, how can you tell if it is invalid?

texts:
I am trying to handle when a parsers goes off the rails and reads an EC public keys wrong (just the X and Y components, I know the curve prior).
Right now I check for the following (false means invalid):

Is the key even on the Curve?
Is the Public Key X component less than the Curve's Base Point X?

I am pretty confident in #1, but not as confident in #2. #2 was just made by never seeing a case that contradicted it.
So my question is, 1) are these two checks correct? 2) are there other checks that can detect bad public keys?


texts: Can a file encrypted with one tool be decrypted with different tool?

texts:
I'm new to cryptography and I'm trying implement a file encryption feature into a Python program but I'm running into a big issue...what is needed for someone else to decrypt the file?! Obviously, I can decrypt the file on my end. I'm not worried about that.

Basically, I need to encrypt a file and send it to another person who then needs to be able to decrypt the file using their system. I thought the other person would just need to know the form of encryption used (AES, RSA, etc) and the respective key to decrypt the file. But I guess that's not the case.

So, what is required to get this scenario to work? I know I'm not the first person to want to send an encrypted file to someone else and have them decrypt it.

This is what I need to know:

Can a file encrypted using Python be decrypted using, say...C# or another programming language?
Exactly what information about the encryption process is required for the person receiving the encrypted file to successfully decrypt the file?

Your help will be greatly appreciated. I don't know what I'd do without a community like this.


texts: I see following x.509 certificate attached(or may be signed, not sure) with OpenPGP key. Is that s/MIME certificate attached with PGP? What that does? Can this be created with GnuPG or probably, how it can be created.


texts: Asymmetric encryption property required in an authentication protocol

texts:
We want to choose an asymmetric encryption scheme for use as follows:

A device holds its private key, with the corresponding public key known and trusted by all.
The device also holds a small $b$-bit secret bitstring $S$, assumed having been chosen uniformly at random and also known by one legitimate user, only.
The device performs authentication rounds indexed by $i$, where it

produces and outputs some wide (say, 256-bit) uniformly random and unpredictable nonce $N_i$;
then receives a cryptogram assumed prepared by enciphering with the public key the plaintext $S\mathbin\|K_i$, where $K_i$ is some wide (say, 256-bit) uniformly random secret, and $N_i$ is an auxiliary input of the encryption (e.g. concatenated with the plaintext),
then deciphers that cryptogram and performs some additional test (e.g. comparing $N_i$ in the deciphered plaintext to the last $N_i$ produced);
if that succeeds

if the field of the deciphered plaintext expected to contain $S$ in fact contains something else, locks up forever;
otherwise, makes some use of $K_i$.

The legitimate user tries, indefinitely, to performs authentication rounds per that protocol across a public channel where an adversary can perform MitM. The adversary succeeds is s/he manages, with probability sizably better than $2^{-b}$, that the device uses a $K_i$ known to the attacker, or a $K_i$ other than one encrypted by the legitimate user after the device last drew $N_i$. We assume the device's implementation is immune to side channel and fault attacks, and disregard DoS attack locking the device.

What's the weakest well-studied security property that a generic asymmetric encryption scheme must meet to be safely usable with that protocol, when the cryptogram is $S\mathbin\|K_i\|N_i$ and the later field is checked against $N_i$ after decryption?

Is it OK to use RSAES-OAEP of PKCS#1v2.2 with label $N_i$ and plaintext $S\mathbin\|K_i$ ?

What ECC-based encryption scheme has that property? Or can we make one?

Motivation: this is a simplified model of user PIN presentation to a Smart Card, by a method assuming no secret beyond the PIN on the presenter side, where some card OS API makes the PIN accessible only thru a comparison primitive (preventing the use of PAKE), we ignore the customary allowance of up to two or so consecutive errors, and we want a bare minimum of communication passes in a round. The dual success criteria mimics both use of $K_i$ as (or towards derivation of) a session key for a secure channel, and allowing some operation independently of $K_i$ after PIN-based authentication.


texts:
I am a beginner in cryptography. I studied many time pad attack and now I want to solve a popular exercise, It consists 11 ciphertexts (s1,s2,...,s11), that encrypted by a same key and I want to find plaintext(p11) of s11.
I know:

p10 ⊕ k = s10
p11 ⊕ k = s11
p10 ⊕ p11 = s10 ⊕ s11

Now, what should I do for getting p11?
If assume k = s10 ⊕ s11,
so:

  s11 ⊕ k = p11
  s11 ⊕ (s10 ⊕ s11) = p11

. Is it correct?


texts:
I am trying to find an efficient way to implement the Grøstl matrix multiplication on python3.

So far I have managed to get this result :

    # M2 = GF(2^8) * 2 multiplication table
    # for each column i :

    s0 = state[(i<<3) + 0]
    s1 = state[(i<<3) + 1]
    s2 = state[(i<<3) + 2]
    s3 = state[(i<<3) + 3]
    s4 = state[(i<<3) + 4]
    s5 = state[(i<<3) + 5]
    s6 = state[(i<<3) + 6]
    s7 = state[(i<<3) + 7]

    h = s7 ^ s6 ^ s5 ^ s4 ^ s3 ^ s2 ^ s1 ^ s0
    xh = M2[h] ^ h

    state[(i<<3) + 0] ^= M2[M2[s7 ^ s6 ^ s4 ^ s3] ^ s6 ^ s4 ^ s3] ^ xh ^ s1 ^ s3
    state[(i<<3) + 1] ^= M2[M2[s0 ^ s7 ^ s5 ^ s4] ^ s7 ^ s5 ^ s4] ^ xh ^ s2 ^ s4
    state[(i<<3) + 2] ^= M2[M2[s1 ^ s0 ^ s6 ^ s5] ^ s0 ^ s6 ^ s5] ^ xh ^ s3 ^ s5
    state[(i<<3) + 3] ^= M2[M2[s2 ^ s1 ^ s7 ^ s6] ^ s1 ^ s7 ^ s6] ^ xh ^ s4 ^ s6
    state[(i<<3) + 4] ^= M2[M2[s3 ^ s2 ^ s0 ^ s7] ^ s2 ^ s0 ^ s7] ^ xh ^ s5 ^ s7
    state[(i<<3) + 5] ^= M2[M2[s4 ^ s3 ^ s1 ^ s0] ^ s3 ^ s1 ^ s0] ^ xh ^ s6 ^ s0
    state[(i<<3) + 6] ^= M2[M2[s5 ^ s4 ^ s2 ^ s1] ^ s4 ^ s2 ^ s1] ^ xh ^ s7 ^ s1
    state[(i<<3) + 7] ^= M2[M2[s6 ^ s5 ^ s3 ^ s2] ^ s5 ^ s3 ^ s2] ^ xh ^ s0 ^ s2

It works perfectly fine, however I was wondering if there would be a better way to do it, like by doing more intermediate precomputation, and without using more than one lookup table.


texts:
In two-dimensional even parity, how do we determine the corner parity bit?
Here's an example:

    1  0  0  1  y

    0  1  0  0  y

    0  1  0  1  y

    0  1  0  1  y

    x  x  x  x  z

Finding the parity bits where the x's and the y's is fine, But what about the parity bit in the lower right corner (z)? Do we look at the number of 1's in the corresponding column and/or in the corresponding row?


texts:
I'm wondering whether such interesting symmetric-key encryption exists or not (from theoretical perspective):

We encrypt a vector of messages $(m_1,m_2,\cdots,m_\ell)$ using the symmetric key $K$ to obtain a ciphertext $CT$. Then to decrypt the ciphertext, the decryption algorithm, using the same symmetric key $K$, takes as input an identity $i$ and the ciphertext $CT$ and outputs the partial message $m_i$.

If such symmetric key encryption scheme does exist, what assumption can it be based on?


texts:
I'm extending a VoIP application that uses UDP to transport data.
The idea is to use AES to encrypt each audio packet. For each call, a key will be randomly generated.

The scenario inclues:

Packet loss, no retransmission;
Each packet will have noice in it (so it's very unlikely to send two identical packets);
Each datagram will carry one audio packet;
Encryption key won't be stored anywhere and will be discarded after the call.
Encryption will be done using openSSL EVP, following this example.

Questions:

Which cipher mode should I use, taking into account packet loss? I was thinking about CTR since it does not depend of previous/next packet to encrypt/decrypt each packet.
Is it safe to NOT use an IV in this case (always use zero or NULL)?
As far as I got my code done, I had to initialize a new EVP context for each audio packet, so that there wouldn't be any bytes left to be written to the encrypted datagram. If I don't do this, my audio packets may be currupted. Is this the right way to overcome this issue?


texts: How can a Vigenère cipher be broken if the message is short?

texts:
I was watching a Stanford lecture on Vigenère cipher and in it the professor said that – to break the cipher – we assume the length of the key is known. We then break the cipher into groups of this known length and then pick up (successively) the first, second, etc. members of each group and then break each of these using Caesar cipher.

The problem is: how would one break the cipher if the message length is short? Because then, we can not use the method which utilizes the frequency of letters to break the code.

For example:
Given the ciphertext ZZZJUCLUDTUNWGCQS and key is of size 6, can you crack this?
(Assuming you don’t know that the plaintext is WHATANICEDAYTODAY and the key is crypto.)


texts: Can you help me understand pairing $e:G \times G \to G_T$ and ( Decision) BDH assumption?

texts:
From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$

I have some trouble to understand this map $e:G \times G \to G_T$. Am I right to understand this to be the "multiplication" of two elements in $Z_p^*$ where $p$  is prime. For example, can  $e(U=g^u,V=g^v)$ be "seen" as the form $UV$ in $Z_p^*$ ?

Another problem is about the BDH assumption, which says that given $g^a,g^b,g^c$ compute $e(g,g)^{abc}$. There are also the Decision-BDH which says that given $g^a,g^b,g^c$ and $e(g,g)^z$, determine whether $$e(g,g)^z \stackrel{?}{=} e(g,g)^{abc}.$$

As to this two assumptions, where the obstacle lies?

At last, as  $e(g^a,g^b)$ can be efficiently solved, what's the algorithm it involved? And could someone do me a favor to give me the source code of the algorithm? If that I will deeply appreciate it.


texts: What is Indistinguishability Obfuscation?

texts:
I've been studying functional encryption. I recently read that a multi-input functional encryption (MIFE) implies indistinguishability obfuscation (IO).
Can someone please brief me: what is indistinguishability obfuscation (IO), and are its implications for crypto?


texts: Upgrade password hash in an existing system: Pbkdf2( salt , OldSha1Hash )

texts:
Background    [Updated]
Consider a situation where a website was created over a decade ago and user account password storage was done by storing SHA1(password) into the database.

It would be great to upgrade the system to use Pbkdf2(salt, password) with a large work factor of say 50000 for the password hashing using HMACSHA256 as the prf.  The resultant hash | salt could be stored in the database and used to validate the visitor when they return and supply a password.  This approach seems to be well regarded here on crypto.stackoverflow.com.

It would be great to be able to improved the hashing for all the existing accounts without needing users to reset their password.  So I'm wondering if the following approach is good from a security perspective.

  OldHash = SHA1(password)
  UpgradedHash = Pbkdf2(salt , OldHash )

  StoredInDatabase = UpgradedHash | salt

One desirable property of this approach is that all existing password hashes can be upgraded to using Pbkdf2, salt and a high work factor without needing to have the passwords reset.  All the new passwords could even be handled the same way just to keep all the hashes consistent.  So new passwords could work like this:

  Hash = Pbkdf2(salt , SHA1(password))
  StoredInDatabase = Hash | salt

Rational for Upgrading the Hashes
The need to upgrade the password hashes is because the SHA-1 hashes don't include salt and SHA-1 has since been reported as broken. The goal in upgrading the password hashes in the database is to reduce the likelihood that a hacker with access to the database of password hashes could obtain the corresponding passwords for those accounts.

Question
Does this seem like a security valid approach for upgrading the password hashing approach in an existing system?


texts:
In FIPS 186-3 appendix D.2 "implementation of Modular Arithmetic", they show shortcuts for solving
$$B = A \mod m$$

for select Curves.

How would you go about determining a valid short cuts for the various curves?
If I wanted to practice on using a small finite field (e.g. 23, 31) because it's something that could be solved by hand. And I wanted to use one of the mentioned shortcuts, how would I go about deriving it?


texts:
Let $m \in \{0, 1\}^{2n} = m_1 || m_2$. Let's also assume that $F_k$ is a PRF and $G$ is a PRG defined as $G: \{0, 1\}^n \rightarrow \{0, 1\}^n$. Now, Let's define the $MAC$ scheme as follows:

$$MAC(m) = F_{m_1}(k \oplus G(k\oplus m_2))$$

Where $k \in \{0, 1\}^n$. I think it's correct, but I have not seen much examples of using the message itself as PRF's key. That is why I am getting confused. Is it correct and/or secure?


texts:
In my course there is a remark saying that in CFB encryption mode, the plaintext must not a multiple of the block length.

Why?


texts: What is a man-in-the-middle attack (for instance in Diffie-Hellman)?

texts: I'm new to cryptography and I just started learning about the Diffie-Hellman key agreement. I read that this system is vulnerable to a man-in-the-middle attack when used alone. What kind of attack is this?


texts: Is there a way to confirm that a homomorphic division (multiplication with inverse) using ElGamal produced the correct result?

texts:
By running some tests I observed that if I perform a homomorphic division (multiplication with the multiplicative inverse) between two values using the ElGamal scheme, I get the correct result when the division produces a whole number.
For example, D(E(10) / E(2)) = 5 which is the expected result (here "/" denotes division applied homomorphically).
But if I try D(E(10) / E(3)) the result is a very large positive or negative number.
This might be expected since, I think, ElGamal supports homomorphic division only when the dividend is divisible by the divisor. My question is given only the decrypted result of such operation, is there a way to know whether the division "succeeded" in the sense that it is the result of a division where the dividend is divisible by the divisor?


texts:
I have a message $m_1$ and I want to encrypt it by XORing it with two keys $k_1$ and $k_2$:

$$c_1 = m_1 \oplus k_1 \oplus k_2$$

So far so good.

Now I was wondering if I could create a "fake" result with a different message $m_2$:

$$c_2 = m_2 \oplus k_1 \oplus k_2$$

This way, if I'm forced to hand over $c_1$, I can give $c_2$ instead and $m_2$ will be reconstructed (instead of $m_1$). I know OTP keys shouldn't be reused, so maybe this can't be called OTP (or can it?).

So the question is: Is this safe? Can $m_1$ be reconstructed from anything different than $k_1$, $k_2$, and $c_1$? Eg: $c_2$, $c_1$, and $k_2$. Don't consider $m_1$ and $m_2$ as options since they are gone after the encryption, they aren't stored anywhere.

Note 1: The messages and keys have a fixed length, about 150 characters, which isn't a lot. This doesn't give enough material for cryptanalysis, right?

Note 2: Each key is going to be given to a different party; that's why I don't combine $k_1$ and $k_2$ into a single key.


texts: How to construct a “toy” version of the Ascon permutation?

texts: I want to obtain a “toy” version of the Ascon permutation defined for five 8-bit words (instead of five 64-bit words.) It seems that it is possible to use the same bit-sliced 5-bit S-Box. But is it possible to use the same sequence of constants (0xF0, 0xE1, 0xD2, ...) XORed with the middle word? And what is a suitable example of a set of five different 8-bit linear diffusion functions?


texts: Is $E_{k}(x) = F_{k}(x) \oplus F_{k}( \bar x)$ PRF?

texts:
$E_{k}(x) = F_{k}(x) \oplus F_{k}( \bar x)$ and F is PRF which maps $\left \{0,1 \right \}^n \times \left \{0,1 \right \}^n $  to $\left \{0,1 \right \}^n$.

Let two messages $m_{0} = 0^l $ and $m_{1} = 1^l $

For these two message $E_{k}(x)$ will generate same text given same key.

Therefore a distinguisher D can distinguish with $m_{0}$ to $m_{1}$.

Therefore $E_{k}(x)$ is not PRF.

Is this proof holds on $E_{k} (x)$ ?

Any better solution like using probability etc?


texts: Calculating the privacy that Renyi ($\epsilon, \delta$) Differential Privacy satisfies

texts:
I add differential privacy (DP) to my machine learning models by using PyTorch-DP. PyTorch-DP supplies me with the values: $\epsilon$ and $\delta $. I know that the $\epsilon$ tells us something about the probability $\rho$ that the privacy of individuals in the dataset (DP) is broken. So, a $\rho$ of 0.5 might correspond to an $\epsilon$ of 2 (depending on the statistics that are released).
So now, my question is: With the implementation that PyTorch-DP uses (Renyi DP calculated by using the Moments Accountant method), to what $\rho$ does the $\epsilon$ correspond to? If I do not know this, how can I say something "meaningful" about the level of privacy $\rho$ that $\epsilon$ satisfies?


texts: UNIX password scheme and encryption function

texts:
Recent versions of Unix store encrypted passwords in a file that is not publicly accessible. Such files are called shadow password files.

In the UNIX password scheme, if only the operating system and system administrators have access to the password file. What are the security requirements for the underlying encryption function Ek?


texts: Differential cryptanalysis - breaking the last round of FEAL4?

texts:
I've been trying to learn cryptanalysis. I've come across this resource which proved very helpful:

http://theamazingking.com/crypto-feal.php

So far I've been almost successful in breaking FEAL4 using differential cryptanalysis - I've got three of four rounds down and working on the last one. Basically the method (as I understand it, anyway) uses differential characteristics to isolate a particular subkey, allowing one to brute-force it independently of the others.

But apparently, for instance breaking the last round (as done on the webpage) yields 4 subkeys which are, from the attack's point of view, equally valid. This means the complexity of breaking the next round increases by a factor of 4, which in turn increases exponentially as more rounds are broken.

So my question is - is the method shown on the webpage "flawed" in some way, or is this result simply a consequence of the key space being so much larger than the block space (2^192 vs 2^64), which means there are many equivalent keys for a given ciphertext?


texts: I am trying to do multiplication in the GF($2^3$) defined by the irreducible minimum binary polynomial $X^3+X^2+1$. I want to multiply $A(x) * B(x)$ where $A(x) = x$ and $B(x) = x^2$. The multiplication is easy, and I get the result: $C'(x) = x^3$ However, I am confused on how to do the modulo in $X^3 + X^2 +1$. I am convinced that it can be done by XOR'ing in long division: $1000 \oplus 1101 = 0101$. Is this the correct result then: $101$?


texts: Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1?

texts:
I am from a web development background (I don't know an awful lot about cryptography or how the algorithms themselves work), so I am asking this question in simple terms.

Consider a hash of the word 'test' using SHA1:

a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

If I were to use SHA512 instead and then simply take the first 40 characters of the output:

ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

ee26b0dd4af7e749aa1a8ee3c10ae9923f618980

Questions

Are there any security implications for hashing and storing sensitive data like this?
Is it more or less secure than using the full SHA1 hash?
Is there an increased risk of hash collision when using the truncated version?

This is sparked by a debate over somebody doing this, where their reason was that it would be better to use the SHA512 version because it is a more secure algorithm, and by truncating it a potential hacker wouldn't know which algorithm was used in the first place.

My understanding was that SHA1 would always produce a unique value, whereas there is a chance that the first 40 characters of a SHA512 output could appear many times.


texts: Advantages of Pallier vs Goldwasser-Micali

texts: It is easy to see that both Pallier and Goldwasser-Micali are homomorphic addition schemes and are secure but what would be the advantages of choosing one over the other?


texts: Using the encryption matrix from AES, how do you compute the decryption matrix?

texts:
So I don't want the answer but somewhere to start with this problem, first I want to know if my logic and thinking is on the right path before I dive right into computing the decryption matrix so here is the question:

Recall the encryption matrix for AES is $E = \begin{bmatrix}1&x^2\\x^2&1\end{bmatrix}$ over the finite field $\mathbb{F}_{16}$ with irreducible polynomial $x^4 + x + 1$. Compute the decryption matrix $D = E^{-1}$

My thought is find the inverse of each individual polynomial in the matrix but I think that's way to simple to do but, calculating the inverse of each polynomial in the matrix we would just divide by the irreducible polynomial right?

Another thought would be using the same steps as the hill cipher?

please let me if I am on the right track or I'm not even close to the start of it all


texts: statistical distance in symmetric-key encryption

texts:
Prove that for any symmetric-key encrytion scheme $\Pi=(Gen, Enc, Dec)$ with message space $M$ and key space $K$, there exist $m_0, m_1 \in M$ such that $\Delta(Enc(K, m_0), Enc(K, m_1))\ge 1-\frac{|K|}{|M|}$.

I know that $\Delta(X,Y)=\max\limits_{T\subseteq S}(Pr(X\in T)-Pr(Y\in T))$, but I have no idea about the inequation above. I tried to prove by contradiction but failed.


texts: DES-CBC with random IV - how big is the keyspace? Can COTS tools crack it?

texts:
I've spent the night reversing the implementation of the 'Basic Text Encryptor' from Jasypt [1]. The algorithm is defined in documentation as 'PBEWithMD5AndDES'.

The implementation is this:

A random 64-bit salt is generated
The secret is generated as

secret = password + salt
for i in range(0, 1000):
    secret = md5(secret)

The first 8 bytes of the secret are then used as the DES passphrase, and the last 8 bytes of the secret are used as the IV, and used to encrypt data with DES-CBC.

Given this, am I correct in thinking the total keyspace for the implementation is 120 bits (56+64)?

I have written a proof of concept reversal in python, but I'm interested in calculating how long it would take to brute force a real key. So far I've been unable to induce hashcat into decrypting something encrypted with this algorithm, and I'm unsure if it even can.

My questions are:

Is the keyspace really 120 bits?
Am I missing something or is hashcat not capable of cracking this?
Can other tools crack it?
Is it even possible to deduce correct outputs without making assumptions on expected output (eg all output must be ASCII data, or match a file header)

Edit: To reduce any confusion, my decryptor is as follows

import base64
import hashlib
from Crypto.Cipher import DES

passphrase = "123456" # Key used to encrypt
# Salt randomly generated at encrypt-time, and stored at
# the beginning of the encrypted data:
salt = base64.b64decode("vqmy2fiCipU=")
enc_b64 = "vqmy2fiCipVBIhiAzDfvTL0301DLgTqd"
enc_data = base64.b64decode(enc_b64)
if (salt != enc_data[0:8]):
    raise Exception("Salt does not match enc_data salt")
enc_data = enc_data[8:]

m = hashlib.md5()
m.update(passphrase.encode())
m.update(salt)
result = m.digest()

for i in range(1, 1000):
    m = hashlib.md5()
    m.update(result)
    result = m.digest()

# value of result is: md5("123456" + salt) iterated 1,000 times.

key = result[:8]
iv = result[8:16]
des = DES.new(key, DES.MODE_CBC, iv)
print(des.decrypt(enc_data).decode())
# > Hello World

[1] http://www.jasypt.org/api/jasypt/1.8/org/jasypt/util/text/BasicTextEncryptor.html


texts: Where should I start to learn cryptography?

texts:
I want to learn cryptography. I just wanted to ask people who are experienced about the field where I should start. Any recommendation would be something for me.

Thank you in advance.


texts: Is Ed25519 really constant-time as widely implemented?

texts:
Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the original submissions) rely on table look-ups performed with secret index to achieve high performance.

That is notoriously a big no-no, but I see that concerns are waived due to the use of conditional move constructions.

For instance, the fundamental construct is often:

void fe25519_cmov(fe25519 *r, const fe25519 *x, unsigned char b)
{
  int i;
  crypto_uint32 mask = b;
  mask = -mask;
  for(i=0;i<32;i++) r->v[i] ^= mask & (x->v[i] ^ r->v[i]);
}

where mask is either all 1s or all 0s.

I am not totally convinced by this construction.

For instance, when implemented in C, what are the chances that the compiler deobfuscate this into a branch?

For an assembly implementation, what is the chance that XOR by a mask depends on the number of 1s set in the mask?

Is safe to use this approach beyond Ed25519?


texts:
Thanks to a certain pandemic going around I was wondering whether there is any cryptographic way to remotely deal cards without the dealer being able to know them and without requiring to trust a server for that. My first impulses involved secret-sharing and zero-knowledge-proofs but that is probably not even related... Some first thoughts:
Given a stack $S$ of $N$ cards, $n$ shall be dealt to each hand $H_i, i\in\{1,2,...,p\}$ of $p$ players with the following requirements:

$N\ge n\cdot p$ (obviously)
Once a card has been drawn it cannot be drawn by someone else as well, i.e. $$\forall i\neq j: H_i\cap H_j = \{\}$$
No one must be able to determine which cards anyone else has nor which ones remain in the stack. Just passing around the encrypted state of a shuffle bag is thus not good enough. Maybe everyone should contribute some encrypted randomness which in a second round is used to determine the dealt cards?
At some point one must be able to proof a specific card is§ currently in the hand.

Is there any method which can achieve this?

§ I guess a blockchain could be used to keep track of the cards changing places later on


texts: Is Functional Encryption about Access Control over encrypted data alone?

texts:
Informally, In functional encryption system , a decryption key allows a user to
learn a function of the encrypted data. But all i see is that the function acts as an access control over the data.

Can we have richer functions, say can a user add two cipher texts and get the result in plain text using decryption key ?

Are there any known forms of functional encryption schemes that allow anything else other than access control ?


texts: How badly does disclosing an M-bit prefix of an N-bit private key compromise security?

texts:
I apologize profusely for knowing nothing about cryptography, please go easy on me!

I'm working on a project where I have a 2048-bit RSA private key and a public certificate generated from the private key. I encrypt secrets at one end-point using the certificate and decrypt them at another end-point using the private key.

On decryptor app startup, the code that parses the private key will throw an exception if the private key is unparseable. Right now the exception message discloses the first 21 bits of the key. My question is whether, and to what extent, this could compromise my secrets' security if the exception message got into a log file and was stolen by a malicious attacker.

Does disclosing the 21-bit prefix effectively reduce my 2048-bit private key to a 2027-bit private key? Or does it actually compromise things worse? Or does it not materially change the difficulty of guessing the full 2048-bit key?

EDIT: My private key is required to be DER-encoded in PKCS#8 format, so we are likely talking about the first 21 bits of a DER-encoded, PKCS#8-formatted, private key.


texts: What does the encrypt function from Stanford JS Crypto Library do?

texts: The Stanford JS Crypto Library appears to be trusted by many people. Unfortunately there isn't a lot of documentation. Their encrypt function is documented as a "simple encryption function" (that's it). The default values in the source code look like it's AES-128? Are there any restrictions on input, like length, special characters, etc?


texts: Brute force encryption keys base on their length

texts:
I need to clarify if my understanding is correct.

if I am using 4.2 GHz CPU -one core only- that means:

4.2 billions hertz = 4.2 billion operations per second. (about 2^32)

So:

32 bit key : 2^32 \ 2^32 = 1 second

64 bit Key : 2^64 \ 2^32 = 2^32 = 4294967296 seconds = 136 Years

My Questions:

1) Is my way of calculation is correct?

2) In Assembly language : is one line = 1 operation?


texts: I'm looking for a very clear explanation of how to forge a CBC-MAC. Given M1 = m1 and M2 = m1||m2 and M3 = m1|| m2 || m3$ and their respective MACs are MAC1 MAC2 and MAC3. How would I go about forging a valid MAC on a distinct message? Could I (for example) say (M4||M3 XOR MAC3)?


texts:
We talk of related keys and related key attacks, but what is a 'related key'? So in three related parts:-

How can one key be related to another key?
Is there a metric describing the degree of relationship?
Is there a link between the nature of  keys' relationships and any specific cryptographic functions?


texts: Password-Managers: what is the IND-CDBA attack logic?

texts:
In the work of Paolo Gasti and Kasper B. Rasmussen On The Security of Password Manager Database Formats, they describe two attack forms: IND-CDBA and MAL-CDBA.

While I understand the MAL-CDBA attack by modification of records in the DB, what is the attack logic of IND-CDBA?


texts: Property of Multiplicative group of integers mod n

texts:
While practising on paper I've realized of a property of multiplicative group of integers mod $n$.

First, let's define $G$ being $p$ a prime and $g$ a primitive root mod n or a generator of a subgroup of $p$ whose order is a factor of $|G|$.

Example:

$p=23$

$|G|=p-1=22$

Then find a valid $g$ whose $Ord_{p}(g)=p-1$ or $Ord_{p}(g)=2$ or $Ord_{p}(g)=11$ being $11$ and $2$ the factors of $22$. We'll define $q$ as a factor of $p$ so $q=11$ in this case.

Using the mechanism of testing a primitive root we find that:

$2^{11}$ $mod$ $23 = 1$ So $Ord_{p}(2)=11$

We found that $2$ isn't a primitive root mod n so it generates a subgroup of order $11$

Now we compute $g^{q-1}$ $mod$ $p$:

$2^{10}$ $mod$ $23 = 12$

Now if $Ord_{p}(2)=Ord_{p}(12)$ then:

$12^{10}$ $mod$ $23 = 2$

Summarizing, this property satisfies that if two generators have the same multiplicative order then if you raise the first generator to $p-2$ or $q-1$ you will obtain the second generator as a congruence.

I want to know if this make sense. Would this method reveal any info of the exponent used by the involved parties?

Thanks for your effort and time!


texts: "Kernel attack" on MinRank -- why do we guess $\left\lceil \frac k n \right\rceil$ vectors?

texts:
The kernel attack on MinRank is described here (page 5). My question refers to this line:

  Note that if $m = \left\lceil \frac k n \right\rceil$, the system essentially has only one solution $\lambda = (\lambda_1, \ldots, \lambda_k)$.

Why is this so? I understand that when $m = \left\lceil \frac k n \right\rceil$ the described system is never underdetermined, but how does this help? Any insight / further references?


texts: How does a certificate authority issue a digital certificate?

texts:
I am new to cryptography and I want to know the details of how a Certificate Authority issues a digital certificate.

From what I know (please correct me if I'm wrong at any parts of my explanation):

If Alice wants to request a digital certificate, Alice will send her public key to the Certificate Authority.

The Certificate Authority will then check whether the public key sent by Alice is legitimate, and will generate a digital certificate using the Certificate Authority's private key to sign Alice's public key.

Now, if Bob wants to communicate with Alice, Bob will get Alice's digital certificate to confirm Alice's identity. If Bob confirm the recipient is really Alice, he will then encrypt his message with Alice's digital signature public key and Alice will decrypt the message with her private key.

Three questions came into my mind:

Does Alice sends only her public key to request a certificate
from the Certificate Authority?
How does the Certificate Authority prove that the public key is
legitimate and belongs to Alice, since the Certificate Authority does
not know Alice as well?
What are the things that a Certificate Authority checks for before
issuing a digital certificate to a person?


texts: Turn a password into a key without using salt

texts:
Assume I have a password with sufficient entropy but may not be uniformly distributed, how can I turn the password into a key that can be used for symmetric encryption?

I think there is surely such a method because when you type gpg -c it asks for a passphrase (more or less a password) not a key.

Ideally this method doesn't require a salt for ease of implementation, unless it's proven impossible.


texts: Can One-time-password be used as nonce in HMAC to prevent replay?

texts:
Note: In the following post OTP = one-time-password

I am working on a project wherein I need send one way messages between two end points. There is already a shared secret via a side channel between the two end points. No user is not involved at either of the end points. Due to some constraints I don't have control whether or not encryption will be used when the message is actually send, so I have to assume the message is going over plain text. The reader can assume the messages as some sort of "action".

The packet carrying the message also contains HMAC of the message calculated using the shared key. I need to prevent replay attack. From wikipedia, I see the options being: OTP, nonce and time stamp.

I can only assume that the clocks between two end points are roughly synchronized (both end points have some reliable time source). I'm thinking of adding some kind of nonce when computing the HMAC. I want to ask whether the option I selected below would be correct for nonce. I want to use some standard technique. I do understand that nonce cannot be repeated.

My first question is that whether certain OTP values can be considered as nonce (the wikipedia categories make them appear distinct).

I found the TOTP algorithm which can calculate a one time password using a shared key and timestamp. I want to ask whether TOTP can be used as nonce.

TC = floor((unixtime(now) − unixtime(T0)) / TS),
TOTP = HOTP(SecretKey, TC),
TOTP-Value = TOTP mod 10d, where d is the desired number of digits of the one-time password.

TC will be stored in an unsigned 64 bit variable. Since HOTP is a hash function (assume SHA-256), TOTP won't repeat (until the unsigned 64 bit TC reaches its max value and wraps around). My second question is whether TOTP can be used as nonce when calculating HMAC ?


texts: Weird exam question about RSA and Chunksize

texts:
I'm studing RSA theory, and I've a question about an exercise of an exam of the past year...

The image below is a question for past year's exam. Is a True/False answer.

A and B for me are clear. A is True, whereas B is False.

But the problem comes with C and D. The bit representative of a 1357 modulus is 10.4 bits. Theoretically I would say that the Input blocksize (m) should be small than n (modulus). So 10 bit chunksize as input should be correct, as 11 bit input is exceeds 10.4 bit and the input cannot be larger than the modulus (two different values will give the same encrypted result)

But the problem is the output. As the modulus is 10.4 the output is required to be 11 bit... because c= m^e mod n being m=10bit but n=10.4 bit will result in (at least) C=10.4 bit (should be coded as 11 bit)

So the problem arises at the decryption... makes no sense to decrypt 11 bit, that should be splitted to 10 bit + 1bit+padding... and this, for me doesn't give the original result.

As I've always understood that Input and Output sizes MUST be equal.

On the exam I would anser T F but C and D I would leave them in blank.

Any of you have a different interpretation of this situation?

Thanks in advanced!


texts: When all shares of a secret are given to adversary as a permuted matrix

texts:
Suppose we have a secret $\sigma$.

The secret comes from a universe in which the elements are not necessarily distributed uniformly.

We split $\sigma$ into $n$ shares $[\sigma_1,...,\sigma_n]$ (using Shamir secret sharing). So the order of shares matters.

We know given all the shares in the right order one can recover the secret.

We permute all the shares in a matrix (see below). We fill the empty indices with some dummy (or random) values $d_{i,j}$
\begin{matrix}
    d_{11}       & \sigma_{n} & \sigma_{2} & \dots & d_{1,m} \\
    d_{21}       & d_{22} & \sigma_{i} & \dots & d_{2,m} \\
    \dots                                   \\
    d_{k,1}       & d_{k,2} & \sigma_{3} & \dots & \sigma_{1}
\end{matrix}

Question: Given the matrix, can the adversary recover the secret with a high (or non-negligible) probability?

I emphasis that $\sigma$ may have very greater distribution probability than the other elements of the universe and the adversary knows that probability.

Please note that the values $k$ (number of rows) and $m$ (number of columns) are independent of the number of shares $n$ and we can increase them if it's needed.

====================================

Edit:
Newly added:

Suppose we have two permuted matrices one contains shares of secret value $\sigma$ and dummy values; and the other matrix contains shares of $\gamma$ and random values. We give away the two permuted matrices and one-to-one mapping of the elements to the adversary. The mapping tells the adversary that value in $i,j$ position in one matrix corresponds to value $k,l$ position in the other matrix.

Question: Would the adversary learn the secret values $\sigma$ and $\gamma$ with a non-negligible probability.