texts:
I would love to have a system where the password is never send in plaintext (even with TLS) to authenticate a user. I've come up with this protocol, but I'd rather use something proven.

Registration:

Client (javascript in a browser) generates a 2048 bit RSA keypair (using Forge js)
Client generates hash from the users password using pbkdf2 with 68000 rounds
Client encrypts the private key with the above hash as the passphrase using AES 128 in OpenSSH format
Client sends the encrypted private key, public key, pbkdf2 salt and the username to the server

Login:

Client requests the encrypted private key and the pbkdf2 salt using the login name
Client generates hash from the users password using pbkdf2 with 68000 rounds and salt from the server
Client decrypts the private key using the pbkdf2 hash
Client requests a challenge from the server
Server sends an challenge that is encrypted using the user's public key using OAEP-SHA1 (Using cryptography.io)
Client decrypts the challenge and sends the plaintext challenge to the server
Server sends an limited use token to the client to use the api with

TLDR: Is there a login protocol where the client can prove authenticity to a server without sending a password. The user can then use a token for API calls that expire after a set time/a few calls. This system cannot use oauth.


texts: Secure and efficient encryption of a continuous data stream on behalf of a third party using asymmetric cryptography

texts:
I want to design an API-based system that is able to securely encrypt a stream of data received on behalf of an external user in such a way that the data can only be decrypted using a secret that only the user knows (i.e. after encrypting the data, the server itself would not be able to decrypt it again). Naturally, my first thought was to use asymmetric cryptography for this:

The server would generate a private/public key pair (e.g. using RSA)
The private key would be securely handed to the user and erased from the server, the public key would be stored on the server.
When new data arrives for the user, the server would generate a random key for a symmetric encryption scheme (e.g. AES) and use this key to encrypt the data. It would then use the users public key to encrypt the symmetric key and store it together with the data on the server.
The user could then decrypt the data by downloading the encrypted data with the corresponding encrypted symmetric keys, decrypting the symmetric keys using his/her private key and finally decrypting the data using the decrypted symmetric keys.

The main challenge is that the data which is received on behalf of the user consists of many small packages that arrive continuously over time. In order to encrypt them following this scheme it would thus be necessary to generate and encrypt a new symmetric key each time a new data package arrives, which is doable. However, the decryption of the data could become very inefficient, as the decryption of an RSA-2048 encrypted message can take several milliseconds on modern hardware, so if there are many thousands or even millions of messages for a single user, their decryption could take hours.

I therefore have two questions:

Is this a reasonable scheme? If now, which elements are missing or would be advisable to implement in addition (HMAC, signing, ...)?
Is there any way to increase the efficiency of the decryption process, preferably one that does not involve storing the symmetric key on the server over an extended period (which would be a security risk)?

Edit

The user does not upload the data, it is generated by a third-party on behalf of the user. The motivation behind the scheme is to provide the third party with a secure, asynchronous channel to store data that a user could securely pick up at a later point in time. The assumption is that the third party is not able or willing to provide the infrastructure for this by themselves and instead want to use an external service.


texts:
I've already asked a few - as yet officially unanswered - questions about RSA-KEM with regards to the input secret encrypted using the public key here and (less on topic for this question) here.

CodesInChaos already commented in the first question linked to. It seems logical that having the most significant bit set to zero during generation of the random value $z$ to not impact security all that much.

Still, the use of random number generators for large amounts of data can be a draw back of the mode of operation, especially when they are required to generate  4096 bits of randomness for a single RSA operation. This could be an issue if said random number generator is slow or if insufficient entropy is available to the random number generator.

My related questions are:

Can we reduce the amount of input keying material to the KDF further without reducing the security of the RSA operation? If yes, by how much?
If yes, is there a good distribution of random bits required (half to the left, half to the right?)
If no, could we use a one-way primitive such as a XOF or indeed MGF-1 after retrieving the required number of bits for secure key derivation, and feed that to RSA-KEM?

Or should I just run away and use RSA OAEP instead if I run into situations where a fast DRBG is not available?


texts: How secure is file header encryption for large files?

texts:
I'm having trouble location information about whether or not encrypting a file's header is good enough. The files in question are media files that range in size from 500mb to 4GB.

If I had no performance or time constraints, I would simply encrypt the entirety with AES256. However, with my current implementation (in C#), it takes about 3 minutes to decrypt a 2GB file. This is about 2m45s beyond my time limits.

How vulnerable is that file's contents without the file header?

Apologies if this question is silly, this is my first foray into file security.


texts: Finding RSA private exponent with a chosen ciphertext attack?

texts:
Let's say there's this blackbox app that has a known modulus $N$, private exponent $e$, and takes ciphertext $C$ encrypted against $N$ and $e$ input and outputs plaintext $M$.

The encryption is done via textbook RSA (i.e. $C=M^e\bmod N$ and $M = C^d\bmod N$). Is there any way, using some form of CCA or whatever the sort, to recover the primes/private exponent of the RSA key? I know CCA is traditionally used to find the plaintext rather than the key, but since the app, in this case, decrypts the message for  us, there is no need. Is it even cryptographically possible?


texts: How to calculate the entropy of passwords?

texts:
Here is a cartoon about password entropy. http://xkcd.com/936/

I dont quite understand how the entropy is calculated in the cartoon assuming they are calculate correctly. But in general, I dont have much idea about how password entropy is calculated.


texts: Any Supersingular Isogeny-based Diffie-Hellman (SIDH) key exchange recommended Curve Domain Parameters?

texts: For existing ECDH, I understand that there are recommended Elliptic Curve Domain Parameters. May I know if there are such similar considerations in SIDH? Any recommended Curve Domain Parameters?


texts: What makes LSBit steganography detectable? And what would help in concealing it?

texts:
In a project of mine I took a 24-bit bitmap image and I performed LSBit steganography over it (saved a black and white image inside each of the planes R, G, B) using pixel shuffling and xor encryption.

Is my stenography easy to detect? And what would it take to conceal it?


texts:
In my model I use two different keys, one for authentication and the other for the encryption / decryption of the data that the user saves, each derived from the master password with a KDF function.

How can I safely manage the password recovery for the user if I have no trace of the  master password on my database?

What do you think about https://mega.nz mode? In a nutshell:

When registering, it makes you download a file containing a key (I think your password or encryption / decryption key is encrypted with this random key and stored in their database).
In case of loss of the access password, it asks you to upload that file containing the key to reset the password.

Is it a good option? It can be done better?


texts: Is RC4 secure with a single-use 32-byte random key prefix and 3072 prefix bytes discarded?

texts:
Are there any known attacks against RC4 if used with a single-use, random-generated 32-byte key, and 3072 random bytes prepended to the plaintext?

Are there any reasons why we should consider such a use of RC4 less secure than an other state-of-the-art stream cipher with a single-use, random-generated 32-byte key?


texts: Zero-knowledge voting with hidden weights

texts:
Assume a voting with delegates, where each delegate's vote $v_i \in \{-1,1\}$ has a certain weight $w_i$ depending on the number of people who elected the delegate.

Is there a way to calculate the sum of votes $\sum_{i} v_i w_i$ without revealing $w_i$?


texts:
In RFC 3526 there are a series of primes listed as standard parameters used for Diffie-Helman. The primes are list in two formats. One is the long format, where the number is given in hex. For example:

  FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
  29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
  EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
  E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
  EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
  C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
  83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
  670C354E 4ABC9804 F1746C08 CA237327 FFFFFFFF FFFFFFFF

Then they have the short hand version:

$$2^{1536} - 2^{1472} - 1 + 2^{64} * ( [2^{1406} pi] + 741804 )$$

Obviously, the short version takes less space in code. The question is: how do I interpret it? What is the meaning of the $pi$ term in the square brackets?


texts: Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?

texts:
I'm basically looking at this construction to turn a tweakable blockcipher $E_c(x)$ taking a key $k$, nonce $n$, counter $c$ (forming tweak $t = c||n$) and an input $x$ into a PRF on an arbitrary-length message $M$ that has $m$ blocks. Without further ado:

$$tag = E_0(E_1(M_1) \oplus \dots \oplus E_{m-1}(M_{m-1})  \oplus M_{m} \oplus E_{\ell + |M_m|}(0) \oplus E_{\lambda + |M_m|}(0))$$

$l$ is a constant larger than any legal value for $m$. $\lambda$ is larger than any legal value for $l + |M_m|$. $|M_m|$ is the length of the final block, and the XOR of the last two elements $M_{m} \oplus E_{\ell + |M_m|}(0)$ is truncated to $|M_m|$ bytes. $E_{\lambda + |M_m|}(0)$ is not truncated.

The closest to this construction what I found is the authentication part of OCB3 mode defined in terms of the tweakable blockcipher. How the last block is handled however is quite different.


texts:
What are "reduced variants" of stream ciphers and how do they relate to lightweight cryptography?

How do their internal states compare to those of non-reduced variants? Security aspects?


texts: Can a digital watermark be still extracted from the reprinted digital watermarked image?

texts: If I'm able to extract a watermark from a printed watermarked image, will I be still able to extract the watermark information if I first scan the printed watermark image and reprint it (make a copy of printed watermarked image with high quality scanner and printer)?


texts:
This is regarding an online roulette game that claims to be fair. Here is the explanation:

Two strings are created:
STRING1 = "[NONCE]:[SERVER SEED]:[NONCE]"
STRING2 = "[NONCE]:[CLIENT SEED]:[NONCE]"

HMAC-SHA512 is used to hash STRING1 with STRING2 as the secret key, giving us a 128-character hex string.

The first 8 characters of the hex string are taken and converted to a decimal.

This decimal is then divided by 429496.7295 and rounded off to the nearest whole number.

This whole number is used as your roll, with the maximum possible value being 10,000.

My question is, is the output of HMAC-SHA-512 100% random in order to use it as a random number generator like that, or in other words, is there equal chance to hit any number?
Can HMAC-SHA-512 output even start with "FFFFFFFF" or with "00000000"?
The way I see it, it is 50% less likely to hit the first number (1 or 0) or the last number (10000).


texts: Problem with anonymously merging information from distributed sources

texts:
Some Background:

There is an entity with an identifier and some information. The identifier of this entity is a string with a known scheme/pattern(Which means the total number of such possible entities is say 10-100 million).

Information about the entities is stored in two geographically distributed systems.
A third system is responsible for aggregating information about these entities.

And here is where the security comes into play - The third system should not know the actual identifiers of the entities and should not be able to derive the actual identifiers.

Existing proposed solution:

Both of the sites storing information about the entities decide upon a one way hashing algorithm to use, say 'PBKDF-2' and also securely communicate a long random salt that they will use while hashing. Both the sites do the one way hashing and send the hash as identifier to the third entity. The third entity can still merge the entities based on the hash but does not know the actual identifier.

Problem with the solution:

Since the set of all possible entity identifiers can be recreated(about 10-100 million), someone can execute a dictionary attack fairly easily. The salt makes it a bit more difficult but that's just some more additional overhead and does not provide a lot of comfort.

Alternatives proposed:

Use multiple hashing cycles with different salts
Use multiple hashing cycles with different salts and ciphers(scrypt, bcrypt and PBKDF-2)
Use mappings of identifiers to random strings (but that adds the overhead of always communicating the mappings between the two systems)

Please let me know if any of the three approaches listed above is acceptable. If there is some other more known/acceptable solution to scenarios like above(which I imagine must be plenty out there), I would gladly appreciate and accept them.


texts:
How do I calculate the entropy of a password selected as described?

Choose 4 distinct words randomly from a list of 2000 words. Words can contain special-character substitutions. For example, the following substitutions may be used:

 Sub = {a; 0; i; e; /a; 8}
 Letter a -> @; Letter o -> 0; Letter i -> {1; !} Letter e -> 9;
 Letter a -> 6; Letter 8 -> &

Assume, uniform selection of alternatives:

ex: i is mapped to {i; 1; !} with the same probability.

Assume 90% of words have 1 of the letters in Sub, and 50% of them have 2 letters in Sub.

I know that since we're selecting 4 words from a list of 2000, then entropy in general must be 2000x2000x2000x2000, which expressed in bits would be around 44bits, since each word contributes about 11 bits (2^11 = 2000). Now I don't know how to attribute the fact that these words may contain special symbols. Please help. Thanks


texts:
I am looking for a secure key diversification function to create individual AES keys for a local smart card deployment. The keys need to be derived from a secret master key and the smart card serial number. Key calculation can happen on the host system.

Is it secure and practical to use PBKDF2(password=master_key, salt=serial_number, rounds=1000, dkLen=16) to get individual keys, or would an easier scheme like AES(key=master_key, data=serial_number) suffice?

Edit: the master_key will be created only for this purpose, with at least 128 bits of random data from a proper RNG. An issue that I wondered about is: typically, the salt is also a high-entropy value. Will this scheme become vulnerable if the serial numbers are not high-entropy (but still unique)?


texts: RSA Encryption - What property of RSA keys is causing the output after 5x RSA to be the same as the input?

texts:
For example,
R (R (R (R (R (m))))) = m where R(m) denotes the RSA encryption with public keys N and e.

What property of the RSA keys would cause this?


texts: Is Pseudo-Random Generator (PRG) in OpenSSL uniformly distributed?

texts: I need to know can we use PRG of OpenSSL as a PRF?


texts:
I need some help with hash value calculation.
 I am a bit confused by this statement that I found on w3 website on calculation of a DigestValue for xmldsig ( http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/Overview.html#sha256 ):

  A SHA-256 digest is a 256-bit string. The content of the DigestValue
  element shall be the base64 encoding of this bit string viewed as a
  32-octet octet stream.

Does that mean that the sha256 hash value has to be converted to a 32-bit string before encoding it to base64?
If yes, could someone please tell me how this can be done? I'm a kind of a n00b, but I haven't found info on how to do that on the internet.


texts: How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?

texts:
RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large (encrypted) message.

How can I do this?


texts: Diffie-Hellman key exchange - why is modulo operation necessary?

texts:
Could someone explain why it's necessary to have the modulo operation in the Diffie-Hellman key exchange?

Let's imagine we do DH without the modulo operation ($A = g^a, B = g^b$). Would that not work, because the logarithm ($a = \log_gA$) is easy to calculate? And why does the modulo operation have to be done with a prime?

I know it's a basic question, sorry. I understand the protocol, but not the maths around what is easy to calculate and what isn't. I guess we need $A = g^a \bmod p$ instead of just plain $A = g^a$, because $\log_gA \bmod p$ is very hard to calculate... would it be easy to calculate it without the $\bmod p$?

Many thanks in advance.


texts: Fundamental difference between the constant, key, nonce, and counter bits in Salsa20/ChaCha20 or AES-Encrypt?

texts:
The Salsa20 core function takes a 128-bit constant, 256-bit key, 64-bit counter, and 64-bit nonce and produces a 512-bit value.  Or more generically, it is a mapping from 512-bit values to 512-bit values.

Is there a reason specific input bits were chosen for specific purposes?  For example, if the some of the counter bit positions and key bit positions were swapped, would this result in a weaker cipher?  What if we used the constant bits as additional key bits?

What about AES-Encrypt?  If we view AES-128-Encrypt as a mapping from 256-bit values to 128-bit values, can we use whichever of the input bits we want for the key and IV input block without weakening it?

Edit: Clarifying my AES question: I wrote IV but I meant input block.  (Depending on the mode of operation, the input block might be an IV, plaintext block, counter, etc.)

And now that I think about it, it's clear that the key bits are different from the input block bits.  Given the output of AES-Encrypt and the input block, it's difficult to determine the key.  However, given the output of AES-Encrypt and the key, it's trivial to determine the input block: just apply AES-Decrypt.


texts: Let's imagine that I've got a number modulo n given by DH protocol. I want to use it as a key for  AES encryption. So I have to cut this number to fit it in AES (128,192 or 256 bits). I can use hash functions to achieve that, but what hash function is suitable for key deriviation? Can I use SHA2?


texts: How is it possible for a VPN connection to be created through the ISP?

texts:
I will be theoretical here. Let's say you want to create a VPN connection with some VPN provider. You have to agree on some key to encrypt the data. how can you get the key without your ISP knowing it? Even if you are the one who creates the key, the ISP still sees it as it's being sent to the VPN provider.

An analogy would be, say...
Alice(you, or the client), John(ISP), and Bob(VPN provider) are sitting in a room.
Alice is trying to convey a message to Bob without John understanding it.
So Alice tells Bob that they will speak French(instead of English). Now john knows their language. no accomplishment. Even if Alice talked about a complex method of encrypting the message, John will know it, since he is in the room.

Unless Alice and Bob had agreed on a method before they were in the room, they won't be able to communicate privately.

An other way would be for Alice and Bob to already have some keyword X which only they know, which counts as 'a method before they were in the room', but I think that's unlikely in a VPN.

End of analogy...

So how is it possible for you and VPN provider to communicatea key without ISP knowing it?


texts: Digital sign HTML form data before sending it to server?

texts:
I need to encrypt and digital sign an html form that contains sensitive data. The legal need is that the user can't deny that he filled the form and the data sent was not altered.

I was thinking to generate server side RSA public key and private key, and I will store the public key in  the database with a technical id.

Then I send the private key to the html page (ajax call or at load). The Javascript code will encrypt the form before sending it. The Javascript will send the encrypted data and the public key id so i can retrieve it server side and can decrypt it.

Is it the good approach, or do you see any security issues?


texts: BB84 - Bits needed to detect Eve's presence

texts:
From Quantum Computing: A Gentle Introduction:

  In the BB84 protocol, how many bits do Alice and Bob need to compare to have a 90% chance of detecting Eve's presence?

I am having some trouble calculating this value. I understand that 50% of the time, Eve measures in the wrong basis and sends Bob a different bit than Alice sent, and after Alice and Bob compare their measuring bases, on average, Bob is left with 50% of his measured qubits. Therefore, given that Eve eavesdropped, there is a 25% probability that a given remaining bit is wrong. From this information, how would I calculate the number of bits needed to detect Eve with 90% confidence?


texts:
For example, There are 3 clients.
I want to deliver specific value $x$ to all clients.
 $x\leftarrow {0,1,2,...,q-1}$ where q is a large prime number.
By using function
$f(x)=x*y_{i}*z_{i}$ where i=1,2,3  for 3 clients
 $y_{i},z_{i}\leftarrow {0,1,2,...,q-1}$  Where client 1 knows y1,z1. client 2 knows y2,z2 and client 3 knows y3,z3.
This kind of key distribution is secure or not.
If not, give me advice.


texts: Is there any existing obfuscation scheme that makes cipher text indistinguishable from plain text?

texts:
Suppose a totalitarian government (in the name of anti-terrorism / protection of intellectual property):

has outlawed encryption itself - encryption is only approved for cases where the state has reviewed the design and made sure it can decrypt/inspect the message, and made any unapproved encryption a criminal offense
has total control over anything in and out of the network at ISP-level, as well as anything that passes through web services

How could two citizens Alice and Bob, using approved (and monitored) instant messaging service to set up a secure line of communication, conceal the fact that the communication is encrypted, i.e. to make it indistinguishable from unencrypted data, or at least, make it computationally- or financially-infeasible to distinguish it from plain text?

For example, no one would assume the following message to be encrypted:

  Across the Great Wall, we can reach every corner in the world.

But it would be assumed that the following is:

  WZ2A805Wq3rzpiuzE+ZCulgDrn76pVRW5PVUJ4DDadFQD4P9PsTeegbo5CAkqI4yZrO//p
  sYT+ZQkqZ6IrSGng==

  599D80F34E56AB7AF3A62BB313E642BA
  5803AE7EFAA55456E4F5542780C369D1
  500F83FD3EC4DE7A06E8E42024A88E32
  66B3BFFE9B184FE65092A67A22B4869E

For the purpose of this question, we assume the following technical details:

the IM service is text-only, binary data is not allowed (in an IM setting, sending primarily small binary fragments back and forth would probably raise suspicion anyway)
communication between Alice and the IM service, Bob and the IM service, are both end-to-end encrypted. A government agent Eve has a copy of the decryption key the IM service used
proof that the message is encrypted is not required. I.e. Eve does not need to know the plain text or the algorithm used to produce the cipher text. She only needs to tell, with a reasonably-low false-positive rate, if a message is the result of an encryption
the endpoint is secure, no backdoor or malware on the computer/router, etc.

I'd like to know if there are any reliable research on this, is it feasible or not, and if feasible, any existing protocol or algorithm developed for this?

Eve, in case you are watching, I'm asking this for academic purposes only.


texts: Generating passwords using Password-Based Key Derivation Function

texts:
I was thinking of using different and independent password for different websites, but not storing them in some password manager so I don't need to backup the passwords. I thought I could use some cryptographic technique to do this, and I come up with a script that do the following:

User input a master password into the script.
User input a name, or domain - whatsoever, into the script as site name.
The script use PBKDF2 with HMAC (hashlib.pbkdf2_hmac in Python) to generate a key, using the master password as the password input and site name as salt, 250000 as the number of iterations and 8 bytes as the key length.

Doing this currently takes around 1 second on my computer.
The resulting key is treated as a number, and is converted into base 75. Each resulting digit is then mapped to a character using the following array:

0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz

The script output the resulting string and that string is used as a password for that site.

There's three goal I want to achieve with this script:

Given the same master password and same site name, the script should output the same string and it is a good secure password to be used on website.
Given only the generated password and site name, it should be impossible for an attacker to compute the master password (At least it should take a long time if the master password is strong).
Given only the generated password and site name, it should also be impossible for an attacker to compute password for other site name.

My question is: is this a secure password generator? The master password I used is basically just like a password that this script will output.

My implementation of this can be found here.


texts: Does revealing shares of the result reveals shares of the inputs?

texts:
Suppose Alive and Bob have shares of two polynomials $P,Q$, say, Alice knows $P_A,Q_A$, Bob knows $P_B,Q_B$ s.t. $P=P_A+P_B$ and $Q=Q_A+Q_B$. They perform some operation $f$ over the shared values, to obtain shares of $f(P,Q)$.

If they reveal the shares of $f(P,Q)$, will this give hints on their individual shares of $P,Q$?

I am supposing that one cannot deduce $P$ or $Q$ with the knowledge of $f(P,Q)$. I just want Alice and Bob to know $f(P,Q)$ without leaking shares.


texts: Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?

texts:
As in the title, given $g$, $g^{ab}$ are big elements in a prime group $Z_p$ and $b$ in prime group $Z_r$ ($p > r$, $g$ is one generator of $Z_p$). $a$ is unknown and also in $Z_r$, is finding $g^a$ a hard problem?

update $a$, $b$ and $ab$ are group elements of $Z_r$..


texts:
Suppose

\begin{align*}
  g^r &\equiv h \pmod N, \\
  h^s &\equiv g \pmod N,
\end{align*}

for known $g$, $h$, $r$, $s$, and $N$, but not $\phi(N)$.

Then $$g^{r\cdot s - 1} \equiv 1 \pmod N,$$ so I can calculate $r\cdot s - 1 = k\cdot\phi(N)$.

Is $g$'s order $(r\cdot s - 1)/k$?

I think g's real order to be divided $\phi(N)$.

But $k$ is so big that I do not know what to do anymore.
How can I factorize N?

Note. In this case, we also have $g^{(r\cdot s-1)/3} \equiv 1 \pmod N$.


texts: How to overcome issues with big ciphers? E.g. with small vs. big Vigenére Ciphers

texts:
I understand that bigger ciphers show more recurring patterns and therefore should be easier (or at least faster) to decrypt as you'll have a better statistical analysis, being
However, if we use an evenly grown key, would this still be true?
I've been wondering as I'm trying to decrypt a Vigenére cipher which seems (according to the analysis of the average Index of Coincidences) to have a key length of 81 characters in 1052 characters.
My problem is that after I calculated the chi-squared values, there are many very similar ones like 32.xxxx and 33.xxxx. If I'm to take both, I'd have to split the possible keys at this character's position to cover all possible ones - am I right on this? However, I couldn't be sure that those are really the key letters (as the value with 45.xxx could be also the right one).
This would result in many keys decrypting to equally many different plain-texts, which I would have to walk through manually. Is there a way to be more precise on finding the key I may have missed?
Even If I should've missed some letters out of those 81 - shouldn't those "errors" occur just once per miss every 81 enciphered characters? In this case, I just would have to guess about 10 right to get at least one fully decrypted word.
Here we're getting to the problem (or misunderstanding) I'm facing:
According to the chi-square values calculated the most probably keys are just decrypting the cipher to nonsense-text and I can't even recognize single words.
How could I work from here further? Are big ciphers considered "easier" to crack because we do have at least the information I got as we may haven't even got those with a small one?
I hope my questions are clear - any help on resolving them would be greatly appreciated.
PS: To make it more visible than the key length is most likely really 81, here's the analysis of average IC values:

The text I supposed to be a Vigenére cipher actually wasn't one, it was a base64 encoded archive file. However, this does not change my question on how to overcome really big keywords appearing in great numbers. At the moment I'd think: take the one that's most probably it (according to chi-sq) and try every one of those.
Any other ideas?


texts:
Let $pk=(N,e)$ (resp. $sk=(N,d)$) denote the public (resp. private) key in a plain RSA signature scheme. Define the function $\textbf{Int}: \{0,1\}^* \to \mathbb{Z}_N^*$ as follows: on input string $x=(x_1\parallel \dots \parallel x_n)\in\{0,1\}^t$ we set
$$\textbf{Int}(x_1\parallel \dots \parallel x_n)=\sum_{i=1}^{n}2^{n-i}x_i$$
We also let $\mu$ denote an ASCII character to byte mapping in which $\mu(0)=0^8$, $\mu(1)=0^71$, $\mu(2)=0^610$, $\dots$, $\mu(9)=0^41001$. Given an ASCII message $m=m_1,\dots, m_n$ we define $\textbf{Encode}(m)=\textbf{Int}(\mu(m_1)\parallel \dots \parallel \mu(m_n))$.

Finally, for an ASCII message $m$ we can set
$$\textbf{Sign}_{sk}(m)=\textbf{Encode}(m)^d \mod N$$
$\textbf{Verify}_{pk}(m,\sigma)$ returns $1$ if and only if $\sigma^e=\textbf{Encode}(m)$.

Suppose Alice signs the message $m=$ Please pay Bob the following amount from my bank account (USD): 50. Suppose that Bob obtains $\sigma=\textbf{Sign}_{sk}(m)$. Explain how Bob can obtain a signature $\sigma'$ authorizing the bank to transfer more than $\$ 50$. How much money can Bob make? Assume that the Bank denies transfers above $750$ million (USD) without in person authorization. You may assume that $\textbf{Encode}(m)<N/2^{64}$.

So I am not familiar with ASCII characters. But overall, I am not sure where to begin, nor which topic I should be referring to. Can I get some help started with this question?


texts: Why no swapping block in the last round of DES?

texts:
Round 16 on the encryption side, and round 16 on the decryption side of DES have no swapping module.

Why is it like this? Can anyone provide any justification?
This is my homework question.


texts: Why is the function $f$ one of the inputs of the verification algorithm in homomorphic signature?

texts:
As we known, a homomorphic signature scheme consists of the usual algorithms $(\text{KeyGen} , \text{Sign} , \text{Verify})$ as well as an additional algorithm $\text{Evaluate}$ that “translates” functions on messages to functions on signatures. If $\sigma$ is a valid set of signatures on messages $m$, then $\text{Evaluate}(f, \sigma)$ should be a valid signature for $f(m)$.

In several papers I read, the evaluation algorithm is defined as
$$\sigma' \gets \text{Evaluate}(pk, \tau, f, \vec{\sigma})$$
and the verification algorithm is defined as
$$0 \text{ or } 1 \gets \text{Verify}(pk, \tau, m, f, \sigma')$$
such that for every messages $\vec{m}$, every tag $\tau$, there is
$$ \text{Verify}(pk, \tau, f(\vec{m}), f, \text{Evaluate}(pk, \tau, f, \vec{\sigma})) = 1$$
I want to know why $f$ is one of the inputs in the algorithm $\text{Verify}$.

Why cannot we the define the verification algorithm as
$$0 \text{ or } 1 \gets \text{Verify}'(pk, \tau, m, \sigma')$$
such that for every messages $\vec{m}$, every tag $\tau$, there is
$$ \text{Verify}'(pk, \tau, f(\vec{m}), \text{Evaluate}(pk, \tau, f, \vec{\sigma})) = 1$$

I think that homomorphic signature schemes are similar to homomorphic encryption scheme. In homomorphic encryption schemes, the decryption algorithm does not use $f$ to decrypt the ciphertext. If the verification algorithm needs $f$, how can we verify correctly if the signatures are calculated by the evaluation algorithm for more than once?


texts: Can I compress $192$ byte key into $16$ or $32$ bytes which can be later used in KDF to recover full key

texts: I have a key $k$ which is $192$ bytes long. Is there a secure way to first compress this key into $16$ or $32$ bytes, but in such a way that later given those $16$ ($32$) bytes I can use a key derivation function in order to recover the full $192$ bytes $k$?


texts: Is RSA encryption without padding secure with NIST Key Establishment schemes?

texts:
NIST SP800-56B standard (addressing IFC-based Key Establishment schemes) defines some key establishment (KE) schemes using the RSASVE primitive in which the common secret $Z$ is encrypted with RSA-EP  (basic RSA encryption without padding).

I understood that RSA encryption should mandate one of the two padded schemes (PKCS#1 v1.5 or OAEP) as defined in the PKCS#1 standard.

I've got two related questions about this:

Is such basic RSA encryption of common secret $Z$ without any padding - of which all security obviously relies) secure?
If yes, for what use cases is RSA encryption without padding secure? In which use case is padding required?


texts:
I am writing a python program for the Enigma machine. I know what the ground setting (Grundstellung) is but I don't know the difference between ground setting and ring setting.

What's different between ground setting and ring set in the Enigma machine?


texts: What’s the difference between a Fast wide pipe and a Narrow pipe construction?

texts:
I'm learning more about the Merkle–Damgård construction, including its "alternatives".

I learned about the fast wide pipe construction and the narrow pipe construction, explained here. However, I can't find any images showing the process of the narrow pipe scheme in detail (presuming it's not the same as the FWP construction).

What is the difference between these two constructions? And is there one construction proven to deliver better results than the other?


texts: Is it safe to exchange cryptographic salt and initialization vector in messages?

texts:
I have a client which does the following:

salt = randomBytes(16)
iv = randomBytes(16)

// secret is a user-specified passphrase
key = pbkdf2(secret, salt)

message[0] = salt.toHex() + iv.toHex()
message[1..n] = encrypt('message content', key, iv)

// to notify server that message stream is ended
message[n+1] = end_message

I'm wondering if it is safe to send both salt and iv to the server like this?

The server does:

if(count == 0) {
  salt = message[count][0..15].toBytes()
  iv = message[count][16..31].toBytes()
  count++
  return
}

if(message[count] === end_message) {
  log(output)
  count = 0
  output = ''
  return
}

// for every subsequent message until end_message
key = pbkdf2(secret, salt)
output += decrypt(message[count++], key, iv)

AES-256-CTR is the encryption used.


texts: Implementation of garbled circuits using RSA

texts: I was just reading these notes  on garbled (Yao) circuits and I just stuck trying to figure out how an implementation of Table 1 would work using RSA encryption. In RSA the public key is $(n,e)$. So for the first row, for example, I guess that ${\rm Enc}_{k_1^0}(k_2^0)$ means: "encrypt the "message" $k_2^0$ with the key $k_1^0$". So does the value of $k_1^0$ stand for $n$ or $e$ of RSA? What am I missing here?


texts: Cheating in a commitment scheme based on discrete log

texts:
Question:

Consider the following commitment scheme:
Public parameters: large primes $q$ and $p$ such that $p = 2\cdot q + 1$, and two generators $g, g'$ of a $q$-order subgroup of $\mathbb Z_p^*$.

Alice commits to $t$ in $\mathbb Z_q$ by uniformly picking $r$ from $\mathbb Z_q$, and sending $g^t \cdot g'^r$.
She opens the commitment by sending $s$ and $r$.
Suppose both parties are poly-time bounded.
If Bob gets to pick the public parameters, can he somehow cheat? (Alice verifies the parameters in poly time)

Attempted solution:

If he can cheat, I think Bob needs to choose $q$ and $p$ in a smart way, because even if he picks $g$ and $g'$ to be equal, he is stuck with computing discrete log, which isn't possible in poly-time.

I thought maybe Bob can pick $q$ to be a Carmichael number, then Alice will think it is actually prime (by checking with Miller–Rabin algorithm).

Two problem I ran into with this:

I'm not sure how much it helps him to solve the problem — he can solve it modulo the prime factors of $q$ and use CRT, but if the factors aren't small enough its still exponential.
Maybe there is no prime $p$ such that $p=2q+1$ for a Carmichael number $q$.

I think my solution fails because of the problems above... would appreciate a pointer in the right direction.


texts:
I'm working on a solution where JWE is needed between an Android app and a backend written in Node.JS, using node-jose. I've been struggling a lot since it seems there is no out of the box compatibility between Android - if you want to use the HW backed keystore - and any node JWE library when it comes to the RSA key, because:

Android supports these ciphers for the HW backed AndroidKeyStore provider. Note, RSA-OAEP-256 (MGF1 SHA-256) is NOT supported; for some reason Android only supports MGF with SHA-1 even for OAEP-256.
node-jose only seems to support OAEP schemes with the same MD for OAEP and the MGF:

RSA OAEP with SHA-1 and no explicit MGF1 (meaning MGF1 SHA-1)
RSA OAEP with SHA-256 and no explicit MGF1 (meaning MGF1 SHA-256)

Nimbus JOSE Java library doesn't support the Android KeyStore out of the box, but I've patched it to use RSA/ECB/OAEPWithSHA-256AndMGF1Padding(SHA-1)
Nimbus JOSE has deprecated RSA-OAEP (SHA-1) in favor of RSA-OAEP (SHA-256)

The incompatibility is surprising to me, you'd think there would be an off-the-shelf solution for implementing JWE between Node.JS and Android. But I'm wondering about RSA OAEP SHA-1. Nimbus JOSE deprecated it, is it discouraged to use it? Has it been proven vulnerable?

Also, in the future, I want to support the iPhone. I don't know much about iOS, but it seems Apple also has an HW protected key store ("Secure Enclave"). However, it only supports EC!

So if one wanted to build a solution where a mobile phone and a backend server uses JWE for encrypted communication, what's my best bet?
My idea is that the mobile app creates a key pair in its hardware-backed Keystore, gives the public key to the backend, and the backend can then create JWEs where the public key is used to encrypt the CEK. But considering Android only supports RSA with some flavors such as RSA OAEP with SHA-256 andMGF1+SHA1, and Apple only supports EC, I guess I'd have to support both RSA and EC on the backend, and if needed patch libraries such as node-jose and node-forge to fit my needs. But perhaps I'm going around this all wrong?

Ref: node-jose issue


texts: Calculating the multiplicative inverse of a number in $GF(2^n)$ where $n > 8$

texts:
Suppose that:

We have a polynomial $g(x)$ of degree $n$.
$n > 8$.
$q$ is the multiplicative inverse of $p$ in $G(2^n)$ modulo $g(x)$. If $p = 0$, then $q = 0$.

This could be used:

As a non-linear substitution stage in a block cipher, where $y_i = S(x_i)$ and $S: \{0, 1\}^{16} \rightarrow \{0, 1\}^{16}$.
In the decryption routine of a block cipher, where the round keys are used in finite field multiplication during encryption and their inverses need to be known for decryption.

I've seen log/antilog tables presented as the "standard" solution for calculating multiplicative inverses over a finite field, but if $n$ is bigger than 8, like, say, 16 or 40, that's going to take a very long time. What would be another method of calculating $p$'s $q$ that would consume less time and computational resources?


texts: Encrypting small packets with low data rate

texts:
I'm trying to build my own layer of encryption on top of our bluetooth communication. We can't use bonding because of some specific features we need to support. I'm a beginner when it comes to encryption, and so I wanted to run this by someone with more experience. Please look over my planned approach and point out any flaws or improvements:

Communication is between an iPhone and a bluetooth peripheral. At the start of any connection, the iPhone will generate a random public/private key pair. The public key will be sent to the bluetooth device.
The bluetooth device will generate a random symmetric key, encrypt it using the iPhone's public key and send it back to the iPhone.
All future communication will now be performed using the symmetric key for encryption/decryption.
A security passkey that is generated once for the bluetooth device and used to identify an authorized user is encrypted and sent from the iOS device to the bluetooth device. If the passkey is wrong, the connection is killed. If it is correct, the iOS device now has full access to the bluetooth device via encrypted packet communication. Each new connection will have a new private/public key pair and a new symmetric key.

Because packets are maximum 20 bytes and data rate is around 1200 bytes/second, I plan on encrypting packets using AES256 CTR encryption, as this has the advantage of the encrypted data being the same length as the original data.
Are there some flaws to my approach that I'm not aware of? Are there flaws with my plan to use CTR so the encrypted data is the same length as the original? Is there a better approach to accomplish what I want?
Edit:
I have a few questions about my specific use case.

I only need to keep the security passkey that is transmitted at the beginning of communications secret, as without that, an attacker wouldn't be able to do any sort of replay attack since new security keys are generated each new connection session. Is this flawed thinking?

Using Diffie-Hellman to generate a symmetric key, then using a stream cipher (CTR) to encrypt communication, would this be secure? Each packet would be encrypted with a new counter value (initialization vector) that would not be reused for the session, which would also be sent with the encrypted packet for decryption on the other end. My understanding is that this method would be perfectly secure as long as I never used the same initialization vector to encrypt two different packets. Is this correct thinking? My main purpose in wanting to use a stream cipher is so my encrypted data length is the same as the unencrypted data length.

Due to point 1 above, is it possible for me to safely get away with using the same initialization vector for all packets encrypted for the entire session, as the next session will have completely different symmetric keys, or will doing this open my protocol up to being decoded by an attacker, enabling them to aquire the passkey mentioned in point 1?

Edit2:
Based on comments by Thomas M. DuBuisson, I see that there are several issues with my approach that I hadn't thought of previously. One major issue being I need to make sure I have a solid random number generator on the bluetooth device. In light of the points he made, and after doing more research on how to securely exchange keys with a limited resource device, I thought of another approach that might be easier with the available resources, and I hope a little more secure.
Sorry for my lack of experience in this area, but I'm trying to learn what I can and hopefully not make any stupid mistakes.


texts: Risks hashing salt + 5 - 8 number pin with PBKDF2

texts:
I have been tasked with putting a simple sign in experience in place where the user types in their ID and a 5 to 8 numeric value as the password or PIN as it is called here.

I am using ASP .NET Core and using Identity Server 4 as the core implementation for issuing tokens. I have to implement the login page and know the requirements to make a secure page/cloud system.

From my research, Bcrypt is the defacto hashing mechanism to use to perform this task, but I have a couple of concerns:

That if/when as they say in the security industry the system is compromised, with such a short PIN, even if we use a large salt, it will be very easy to calculate all of the PINs as there is technically only a small number of outcomes compared to free text passwords.
There is not a verified implementation of Bcrypt in .NET - ASP.NET Core uses PBKDF2 and as it is part of the framework, so with that I think I gains credibility here.

My default answer in these situations is to use Auth0/Azure AD B2C or some other huge company who does this stuff day to day and enforce complex passwords but the requirement is very specific and cannot be fulfilled by the operators out there.

I have done a risk analysis around this and presented it to the business which they accept, but the niggling questions here are:

is there anything more modern than PBKDF2 and verified that I should be using?
Are my concerns valid that the the passwords will be easy to crack if the systems data stored are compromised?
What auditing mechanisms would you recommend in a system like this?


texts: Help with cryptanalysis of branching in schemes based on Multivariate Public Key Cryptography

texts:
I'm familiarized with the structure of branching found in Multivariate Cryptography, as it allows us to partition a $n$-tuple over $F_{q}$ into a $k$-tuple where the $i$-th element is in $F_{q^{\lambda_i}}$ for $\lambda \vdash n$ and $k$ is the partition length.

Thus, instead of having just a single private polynomial over $F_{q^n}$, we have $k$ private polynomials $f_i(X_i) \in F_{q^{\lambda_i}}[x]$. The speedup is significant as we can divide the decryption/signing process into multiple execution units, so it's highly parallelizable.

The mathematical representation of this technique can be given as:

$$\phi : F_{q}^n \mapsto F_{q^{\lambda_1}}\times \cdots \times F_{q^{\lambda_k}}, \quad (x_1,\cdots,x_n) \mapsto (\varphi_{\lambda_1}(x_1,\cdots,x_{\lambda_1}),\cdots,\varphi_{\lambda_k}(x_{(1+\sum_{i=1}^{k-1}\lambda_i)},\cdots,x_n)$$

where:

$$\varphi_{\lambda_i} : F_q^{\lambda_i} \mapsto F_{q^{\lambda_i}}, \quad  (x_1,\cdots,x_{\lambda_i}) \mapsto \sum_{i=1}^{\lambda_i}x_i y^{i-1}$$

Define $\mathcal{F}=(f_1(X),\cdots,f_k(X))\in F_{q^{\lambda_1}}\times \cdots \times F_{q^{\lambda_k}}$ as the private polynomial map composed of $k$ polynomials over distinct fields. Then let
$P(X)$ be the public map composition that is publicly published:

$$P(X)= T \circ \phi^{-1} \circ \mathcal{F} \circ \phi \circ S (x_1\cdots,x_n)$$

where $S,T \in GL(n,F_q)\times F_q^n$ this is both $S,T$ are affine transforms.

It results that the original scheme $C^*$ presented by Matsumoto-Imai in 1 included the branching variant based in a selected partition $n_1 + \cdots + n_d = n$. The general description can be stated the same as the presentation I gave above.

I'm struggling with the cryptanalysis of branching techniques applied on schemes based on $\textbf{MPKC}$. In my research, the $k$ private polynomials found in $\mathcal{F}$ are $\textbf{HFE}$ polynomials instead of Mat-Imai monomials. However, it seems that branching is discouraged when $k>2$, so it's not fancy anymore.

Can someone give me a simple explanation on why the technique exposed in 2 (section $4$), 3 (section $11.2$) and 4 (page $3$) works?

What I've understood at this point is that cryptanalysis on branching pursues the separation of these branches into independent sets of equations, each set $i$ concerning variables that don't come from branch $\lambda_i$. Once these sets are computed, apply exhaustive-search on each branch as these branches are small.


texts:
I've studied linear cryptanalysis, but i don't think I have it very clear.
I've the following doubt:
I've constructed a "cryptographic" hash function for an exercise, and now i want to show summarily that is secure from "linear cryptanalysis".

My idea was simply to create a linear approximation like this:

X_1 XOR X_2 XOR ... X_n XOR Y_1 XOR Y_2 XOR ... Y_m

which involves the input and the output (whose bits X_i, Y_j respectively, are XOR together) of my hash function, and for a very large set of random input (about 1000000), to count how many times the result of this operation was 0, and how many time was 1. Then if the number of 0 does not differ much from the number of 1 (i.e. with probability about 0.5 the result is 1, and with probability about 0.5 the result is 0), my function it's ok, otherwise it's not secure.

My doubt is: Is this method right? What bits of the input and output i have to include in the linear approximation, all?

PS: I don't have to do linear cryptanalysis but only a very general analysis based on it.


texts: Zero Knowledge and Computational Indistinguishability

texts:
Having some trouble understanding the following line:
“Alice conveys zero knowledge to Bob if Bob can sample
from a distribution of messages that is computationally indistinguishable
from the distribution of messages that Alice would
send.”

From Page 122, https://www.cs.cornell.edu/courses/cs4830/2010fa/lecnotes.pdf

Could someone give a practical example of this sentence?


texts: Can RFC 5649 be used to wrap multiple keys with the same KEK?

texts:
I am unable to convince myself that RFC5649 is secure when storing multiple keys with the same KEK. My point is: RFC5649 uses AES-ECB, therefore the usual weakness of this method applies, namely an observer can deduce equalities among sections of the wrapped keys.

However, the sizes of the wrapped content make it less likely to have collisions (except for the AIV, but I do not believe that that could be an issue), as the payload will be 256bits of random data.

My question is therefore, is it secure to wrap multiple keys with the same KEK? If the answer is no, then what is the point of RFC5649 and what alternatives are there available?

(I believe the same doubt applies also to RFC 3394)


texts: How fast does a pseudorandom number generator have to be in order to be competitive?

texts:
Let $\{x_n\}_{n}$ be the pseudorandom sequence produced by a cryptographically secure pseudorandom number generator $G$. What is the cost of computing a term in the sequence for a competitive pseudorandom number generator (PRNG)?

Let me clarify: among the cryptographically secure PRNG, I would like to know which one has the lowest computational cost.


texts: Are Merkle Dags really Dags in most cases?

texts:
Let $H$ a cryptographic hash function of image length $n+1$ and $s_0$, $s_1$, ... , $s_k$ a finite sequence of bitstrings (length $>n+1$), such that $s_j$ contains a hash of $s_{j-1}$ for all $1\leq j \leq k$, that is $\langle s_j(0),...,s_j(n)\rangle = H(s_{j-1})$ (The first $n+1$ bit of each $s_j$ are the hash of $s_{j-1}$).

Is it possible and if yes how likely, that the sequence $s_0$, $s_1$, ... , $s_k$ is a loop? I.e. that $s_0=s_k$?

Edit: If important for the answer, $s_j$ must not necessarily begin with the hash of $s_{j-1}$ but contain it at least at a fixed position in the bitstring. The soley point of the question is to find Merkle DAGs/Trees which are not well defined due to the existence of those cycles.

If its infeasible, I would like to see a deduction from the axioms of a cryptographically secure hash function.

Edit: Relating the question to the title: If such a loop can be found as a path in a Merkle Dag (or in the extrem case a Merkle tree), then the resulting data structure is neither a tree nor a dag anymore.

Edit-2: From Fixed point of the SHA-256 compression function we know that fix points of cryptographic hash function can be found, so it might also be possible to come up with bitstrings $s_0$ of length $>n+1$ that contain their own hash in the first $n+1$ bits. So it is indeed possible to find those loops with $(s_0,s_0, \ldots, s_0)$ for arbitrary $k$'s. In fact the answer from Is there a string that's hash is equal to itself? estimates that this happens frequently (The answer assumes strings of length $n$, but can be extended to our case)

So it boils down to the question of the possibility to find strings strictly larger then their hash, that nevertheless contain their hash as a substring.


texts: Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

texts: According to the web page for NewHope, an R-LWE post-quantum key encapsulation mechanism (KEM) candidate for standardization, it comes in types that are IND-CPA or IND-CCA secure. I know what CPA and CCA security are, but I don't understand the difference between the two types of NewHope and why there needs to be a choice between one or the other (unlike, say, RSA-OAEP which provides both).


texts: Is a hash function based on multiple nested iterations of HMAC-SHA-256 cryptographically weaker than SHA-512?

texts:
Let $M$ denote a message.

Choose (arbitrarily or randomly) five different sequences of bits (their lengths are allowed to be arbitrary, assuming that our HMAC construction will not exceed the maximum input length for SHA-256). Denote them by $S_i$. For example, we can simply choose “0”, “00”, “000”, “0000” and “00000”.

Consider the following function:  $$\begin{array}{l}
H(M) = H_5 \mathbin\Vert H_6,\\
\end{array}$$

where $$\begin{array}{l}
H_1 = \text{SHA-256}(M),\\
H_2 = \text{HMAC-SHA-256}(M, H_1 \mathbin\Vert S_1),\\
H_3 = \text{HMAC-SHA-256}(M, H_2 \mathbin\Vert S_2),\\
H_4 = \text{HMAC-SHA-256}(M, H_3 \mathbin\Vert S_3),\\
H_5 = \text{HMAC-SHA-256}(M, H_1 \mathbin\Vert H_3 \mathbin\Vert S_4),\\
H_6 = \text{HMAC-SHA-256}(M, H_2 \mathbin\Vert H_4 \mathbin\Vert S_5)\\
\end{array}$$

(assuming that $M$ is the message for HMAC, and the part that ends with $S_i$ is the key).

Is $H(M)$ weaker than $\text{SHA-512}(M)$? If yes, in what aspects?


texts:
The MAC size is reduced to 80 bits in truncated_hmac extension , which says "forging of MAC values cannot be done off-line: in TLS, a single failed MAC guess will cause the immediate termination of the TLS session."

Question 1 (main question):
So can I reduce MAC size to something even smaller, say 32 bits?

Question 2:
The truncated_hmac extension does not effect AEAD. Can I reduce the tag's size in AEAD, e.g. GCM or CHACHA-POLY?


texts: Subset-sum one way function is one way on it's iterates if subset-sum is one-way

texts:
Working through the Moni Naor's slides from his lecture Foundations of cryptography (Lecture 3), the slides state that the subset sum function is one-way on its iterates if it is one-way, where the subset-sum function is earlier defined as:
$f: \{0,1\}^{mn+n} \rightarrow \{0,1\}^{mn+m}$:
$$f(a_1, a_2, \dots, a_n, b_1, b_2, \dots, b_n) =
(a_1, a_2, \dots, a_n, \sum_{i=1}^n b_i a_i \mod 2^m)$$,
where $b \in \{0,1\}^n, 0 \leq a_1, a_2, \dots, a_n \leq 2^m$
One way on its iterates is defined as:
A function $: \{0,1\}^* \rightarrow \{0,1\}^*$ is called one-way on its iterates, if

$f$ is a polynomial-time computable function
For every probabilistic polynomial-time algorithm $A$, every positive polynomial $p()$ and all sufficiently large $n$'s: for all $k \leq p(n)$
$$Pr[A(f^{k}(x)) \in f^{-1}(f^{k}(x))] \leq \frac{1}{p(n)}$$
where $x$ is chosen uniformly in $\{0,1\}^n$ and the probability is over all possible values of $x$ and all possible coin tosses of $A$

I don't understand how $f^{2} = f(f(x))$ is even defined for the subset sum function? What's the reason that the subset-sum function is one way on its iterates?


texts: Helios: Where are admin tools stated in the paper

texts:
I read the Helios Paper Helios: Web-based Open-Audit Voting.
In section 4.4 Anonymization they are saying that "once the voting period ends" the admin can "shuffle" (re-encrypt and permutate), "shuffle proof", "decrypt" and "decrypt proof" and then finally do the tally.

I tested an election and none of these tools were available except for the tallying part.

Did they change this?


texts: Extractability for Simulator in Malicious Model

texts:
It is sometimes required while proving the security of a protocol in the malicious setting that the simulator is able to extract the witness set of the adversary, who tends to be the prover of possessing some knowledge, in the ZKP step of the protocol.

I was having issues understanding how the simulator would be able to extract the witness set without the discretion of the adversary?
If the simulator is able to do so, wouldn't that defeat the purpose that the ZKP is zero knowledge, at least to the simulator?
I also read that the witness extraction by simulator doesn't necessarily have to be probabilistic polynomial time. Can someone please elaborate on this?


texts: What is a good way to handle longer strings using FPE?

texts:
While experimenting with this FPE based on FE1

http://botan.randombit.net/manual/fpe.html

(well actually a port of it in C#)  I found when the string length gets too long (number of characters N) basically it's designed to throw an exception

So the byte array for the modulus is limited to this value

    // Normally FPE is for SSNs, CC#s, etc, nothing too big
    private const int MAX_N_BYTES = 128 / 8;

And this is where we check the length of the byte array

    /// <summary>
    /// A simple round function based on HMAC(SHA-256)
    /// </summary>
    private class FPE_Encryptor
    {
        private System.Security.Cryptography.HMACSHA256 mac;

        private byte[] mac_n_t;

        internal FPE_Encryptor(byte[] key,
                         BigInteger n,
                         byte[] tweak)
        {
            mac = new System.Security.Cryptography.HMACSHA256(key);

            mac.Initialize();

            byte[] n_bin = n.encode();

            if (n_bin.Length > MAX_N_BYTES)
                throw new Exception("N is too large for FPE encryption");

            var ms = new MemoryStream();

            ms.update_be(n_bin.Length);
            ms.update(n_bin);

            ms.update_be(tweak.Length);
            ms.update(tweak);

            mac_n_t = mac.ComputeHash(ms.ToArray());
        }

        internal BigInteger F(int round_no, BigInteger R)
        {
            byte[] r_bin = R.encode();
            var ms = new MemoryStream();
            ms.update(mac_n_t);
            ms.update_be(round_no);

            ms.update_be(r_bin.Length);
            ms.update(r_bin);

            byte[] X = mac.ComputeHash(ms.ToArray()).Reverse().ToArray();
            var X_ = new byte[X.Length + 1];
            X.CopyTo(X_, 0);
            X_[X.Length] = 0; // guarantee a positive interpretation
            BigInteger ret = new BigInteger(X_);
            return ret;
        }
    }

However say I want to encode a long string like this "Asddasdasdasdasdasdasdasd"

I'm in Base 52 so my modulus is very large 7944811378381908491977011631194721432371200

Which after converting to byte array using

    internal static byte[] encode(this BigInteger n)
    {
        if (n.IsZero) return new byte[0];
        else return n.ToByteArray().Reverse().SkipWhile(h => h == 0).ToArray();
    }

gives a length of 18, bigger that the maximum 16.

Does anyone have suggestion how to deal with the larger number of characters in the plaintext you want to encrypt?  I was thinking to chop it up into fragments and encrypt the pieces if the string gets longer than a maximum value.  Would this be acceptable?


texts: Can non-assembly crypto libraries truly be secure against timing attacks?

texts:
http://cr.yp.to/antiforgery/cachetiming-20050414.pdf states the following:

  So what went wrong? Answer: NIST failed to recognize that table lookups do not take constant time. “Table lookup: not vulnerable to timing attacks,” NIST stated in [19, Section 3.6.2]. NIST’s statement was, and is, incorrect.

Sections 10 - 15 (inclusive) of that paper propose that changes be made to how things are placed in the L1/L2 caches of the CPU to remedy the issue. However, you're only ever really going to be able to control what's in the L1/L2 cache with assembly.

So how secure can non-assembly code truly ever be against timing attacks?

In the case of AES the afore mentioned paper says that you can get closer to constant time by doing away with the s-box lookups but even then it seems that there could still be issues with what's in the L1/L2 cache. If not with the s-boxes then with the plaintext and ciphertext themselves or the various components of the key schedule.


texts: Why don't crypto-currencies use the Lamport signature scheme?

texts: The Lamport signature scheme is faster, less complex and considerably safer than ECDSA. It's only downside - being only usable once - isn't really a downside when signing transactions, since you could just include your next public key whenever signing it. Why isn't, thus, the Lamport signature scheme used in crypto currencies such as Bitcoin?


texts: Strong RNG for encryption/authentation algo

texts:
I saw in the market several hardware options for creating strong RNG to produce strong KEYS:

HSM
TPM internal TRNG
Intel RDSEED (TRNG)/RDRAND

My questions are;

What is the strength/entropy difference between them? (using intel RDSEED is much lower cost than buying an HSM)
Why feeding TRNG seed (like RDSEED) into the PRNG mechanism (RDRAND)? doesn't that lower its strength?
Cant I use RDSEED for creating a key (using KDF) without RDRAND?


texts: How to correctly evaluate the security of DH in TLS

texts:
I'm trying to understand and evaluate the security impact of DH in TLS.

As far as I can tell, there are four major different implementations of DH in TLS.

DH
DHE
ECDH
ECDHE

With the ephemeral DH's, forward secrecy is possible, which I consider a huge bonus to security.

What I'm not too sure about is the elliptic curve part. With elliptic curves, the public certificate (?), used for DH, can be smaller than without elliptic curves and still be considered secure.

I have something in my mind like, non-elliptic-curve DH should have at least 2048 bit, to be considered secure.

Is my information correct?

How can I determine the key length (or public certificate size, I'm not sure what exactly I'm looking for here), of my server?

Can I use the information from the .pem file, used for DH (see comment below)?

openssl dhparam -inform PEM -in ./file.pem -check -text
DH Parameters: (4096 bit)
        prime:
             [...]
        generator: 2 (0x2)
DH parameters appear to be ok.
-----BEGIN DH PARAMETERS-----
[...]
-----END DH PARAMETERS-----

So in this case the DH key length/public certificate size would be 4096, correct?


texts: Diffie-Hellman Secret Exponent Size and Shared Secret Usage

texts:
I'm developing my own protocol and I'll use Diffie-Hellman to achieve PFS. It will work in this way:

The symmetric encryption algorithm will be AES_256_CBC.

The DH parameters will be:
P: a 2048-bit safe prime as defined in RFC 3526.
Generator: 2 (also defined in RFC 3526).
Secret Exponent: a 512-bit ephemeral random number *

If it is true that the secret must be twice the security level, it should be OK

Only the secret exponent will be different every time and P and G will be always the same (forever).

The key-exchange will be authenticated with RSA-2048.

Once the shared secret is computed, it will be used to derive a 256-bit symmetric key (perhaps with HKDF) to setup a AES-256 cipher that will run in CTR mode to generate a 1024-bit random material that will be splitted in four parts:

2 x AES-256 keys (write and read keys)
2 x HMAC-SHA256 keys [write and read keys, 256-bit each]


texts: Building multiple keys from the same input using a KDF

texts:
Let's say I have a single secret with high entropy, S, for the entire application. I want to generate keys K1, K2 for 2 different users of the app. I run:

K1 = PBKDF2(S, salt1)
K2 = PBKDF2(S, salt2)

where each salt is some 128 bit random number.

Is this a safe construction or do KDFs (or PBKDF2 specifically) have any properties that user 1, knowing K1, could infer any part of K2?

EDIT:

Assume a non-broken hash and a sufficient number of iterations for the KDF


texts:
Suppose you would like to prove authenticity of messages where the message space is small. Suppose the meaning of the message depends highly on the context, e.g. on time but also on events that are hard to encode, like political or social events. An extreme example would be a message space of "yes" or "no" (1 Bit), which are obviously context-dependent. Consider, e.g., the answer to the question: Do you love me? It also depends on who asked the question.

If you just use digital signatures, someone could just replay a pair of a message and a digital signature in a different context, giving it a completely different meaning, but still using someone else's correct signature.

How could you prevent these replay attacks?

I first thought of randomisation/salting, but all the probabilistic encryption schemes that I know use public salt, so an attacker could just re-use the salt as well.

Disclaimer: I'm not planning to build my own crypto. I'm just wondering how this problem could be solved, since to me, it doesn't seem so far away from reality...


texts: Breaking hashless variant of the Rabin Signature system with chosen message attack

texts:
I heard that we can break the Rabin Signature system using chosen-message attack. For a message $M$ that is a quadratic residue modulo $N$, the signature is $x$ such that $x^2 \equiv M \pmod N$. I can't find a message to ask for its signature in order to spoof my message $M$.

Any suggestions?


texts: Security level difference: supersingular vs non-singular elliptic curve

texts:
In some evaluation of elliptic curve cryptography, it says that for same security level

In supersingular curve over $F_p$ with group of prime order $q$, p=512, q=160 bits

In non-singular curve , p=160, q=160 bits.

How to know such difference?


texts: What are the different use cases between an HMAC and digital signature?

texts:
I understand that both an HMAC and digital signature are used to check the integrity and authenticity of a message. Further, I understand that a digital signature is non-repudiatible.

What I do not understand is when to use an HMAC vs a digital signature, in practice. I appreciate the help!


texts:
This is regarding the number post-quantum key exchange protocol New-Hope (https://eprint.iacr.org/2015/1092.pdf). In the paper, we can see that the number of samples generated by the protocol is $2n$ where $n$ is $1024$, the rank of matrix $a$. Once in server side $b\leftarrow as+e$ and once in client side $u\leftarrow as'+e'$. But the authors in the paper (page 18 appendix B) says that the number of samples in each instantiation of the protocol is $5n$.

I can't understand why. Also, as far as I know the LWE samples are related when the matrix $a$ and the secret $s$ remains same. But, in the protocol the secret changes $s$ and $s'$.

Can someone please explain this?
Thank you in advance.


texts: Are passwords generated from sine vulnerable to certain attacks?

texts: A friend mentioned that he used the sine of a number, i.e. sind(54), to generate long passwords. This way he only has to remember sine 54 and have a calculator to get his password back. I am wondering if this is secure. It can easily generate a long password, but because the numbers are not random would it be vulnerable to some type of attack if they new the numbers were generated using sine?


texts: If I use the AES-256 option in WinZip to encrypt a file, is it any less safe or less secure than using PGP encryption?


texts: Can ECB be turned into a secure algorithm by adding obfuscation of the plaintext patterns?

texts:
Just to preface this I'm very new to cryptography. However, I've been reading that ECB should not be used under most circumstances due to its symmetry which allows attackers to gain information about the plaintext from observations of the ciphertext.

It got me thinking about a way obfuscate patterns in the plaintext before encryption occurs.

Let's say for instance each block of plaintext is XOR'd with a randomly generated "key" of maybe 1 or 2 bytes that is stored with the block and then encrypted along with it, effectively hiding any observable pattern.

In this manner wouldn't the obvious attacks that ECB would normally be prone to be completely dismantled?


texts: Have there been efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction?

texts: Have there ever been some publicized efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction (MD5, SHA1, SHA2, ...)?


texts: Is there a bilinear map on a non abelian group or non cyclic group?

texts:
I've recently been studying a pairing map on cryptography.
In usual definition, a pairing map is always defined on the cyclic group G.
Is it possible to construct a bilinear map on a non-abelian group or non-cyclic group?

If it is possible, how can construct it? If not, why are they impossible?


texts: Is a padding oracle attack possible if data is only encrypted internally on a server (e.g. for storage)?

texts:
I read something about the padding oracle attack when analysing the use of an AES-encryption of data in a database and was "scared" it could be a serious issue.
But after investigating a bit further, I now came to the conclusion that in our specific scenario it should be no matter at all. I would like to validate this, because I have the feeling to not fully understand the attack method.

I have got the following scenario:

Clients send plain text messages to an application server (Java). This messages shall be stored in a database, but not as plain text; they have to be encrypted (synchronous encryption with a static encryption key). We use AES-128/CBC/PKCS5Padding, while the encryption is done by the application server, which is the only instance that knows the encryption key.
This means, the server does not offer an external interface, which could be used to send (modified) encrypted data packages. So there should be no chance for an end user / external hacker to do an padding oracle attack.
Or, in other words, there is no instance / server acting as "oracle".

The only attack scenario would be an internal attempt to hack the encryption, let's say a person who has access to the database (e.g. a database administrator with a criminal attitude) and by that to the encrypted messages. But due to the fact the application server does not offer any interface and the attacker does not have access to the encryption key, he should have no opportunity to make an padding oracle attack (?).

Also, an attacker would not discover the encryption key by being successful with an padding oracle attack, he only would decrypt specific messages. So even if the database administrator with access to the database and with an account for the application would change the encrypted data directly in the database to check if decryption still works (the data is displayed in the client / web site = no padding exception), he only could decrypt his own data by doing that, which actually wouldn't be of any use for him.

My question: Do I understand this right or do I miss anything important?


texts:
I'm designing an id obfuscation system.
My system includes:

Embedded chips, each chip has a unique 32-bit address (id).
Server
Insecure low-bandwidth unstable one-way channels from the chips to the server.

The chips send messages to the server over the insecure channel.
The messages are simple "I'm alive" notifications. There is no meaning to forging messages (no benefit to the attacker).
The server should be able to recover which chip sent which message. However, I don't want attackers to be able to trace specific chips for long period of times, i.e., the messages should not contain the chip's id, but an obfuscated id, which should change once in a while (in my case every ~5 minutes on average).
In my case, $2^{16}$ different obfuscated ids per chip are enough (the obfuscated ids will repeat every ~227 days).

One way to obfuscate the id is to encrypt the id together with a counter. For example, use a 48-bit block cipher to encrypt the concatenation of the 32-bit id with a 16-bit counter, that increases every ~5 minutes.
I don't know of any 48-bit block cipher, but 64-bit block-ciphers, such as Blowfish and Skipjack, can also be used: by encrypting the concatenation of the 32-bit id with a 16-bit counter and some fixed 16-bit value (could be zeros).

However, there are two more requirements:

The encryption secret key must not be saved on the chips - Some of them may fall into the wrong hands and be reverse-engineered.
Asymmetric encryption cannot be used ... They take too much time and create too large outputs (over 64-bit).

This means that all the obfuscated ids must be pre-calculated and saved on the chip. It also means that using a 64-bit block-cipher will consume 33% more space on the chip than a 48-bit block-cipher.

Since I don't know of any commonly used 48-bit block cipher, I had the following idea.
For each each, encrypt all concatenations of the 32-bit id with any 32-bit value.
Save on each chip only the results that end with 16 zero bits (obviously, without last 16 zero bits of each obfuscated id).
There should be around ${2^{32}}/{2^{16}}$ such obfuscated ids for each chip, which is exactly the amount I need.

The server will receive the 48 bit obfuscated id, pad it with 16 zero bits, decrypt, and slice the first 32-bits of the result to recover the chip's real id.

The only flaw is that the pre-calculation of the obfuscated ids for each chip is time consuming.

Can you see any flaws in my algorithm, besides that? Do you have any suggestions to improve it?

Another approach was to use 32-bit block ciphers (skip32), and call them several times so all the 48-bits are used. However, from what I learned, 32-bit block ciphers are considered obsolete.

Furthermore, if you have any suggestion that includes a stream cipher, please notice that the channels are unstable and messages may drop - CBC mode will not be recoverable on the server side. CTR mode that includes sending the counter is also problematic, because an attacker can trace a chip merely by watching the counter in the messages - if a message's counter is 123, and 5 minutes later I see a message with a counter of 124, it probably originated from the same chip (syncing all chips is not practical).


texts: Using a nonce as a salt for key derivation

texts:
I'm currently playing a bit with PyNaCl (python binding to libsodium) and I want to use the secretbox for symmetric encryption between two parties, which means they both must know the (in my case randomly generated) nonce, so I would just send it with the ciphertext.
I derive the secret key with argon2id from a password, but this needs a salt.
So I was wondering whether it would be dangerous to use parts of the nonce as the salt, so I only have to transmit the nonce.
I don't think it would be problematic because the salt is just used to prevent rainbow table attacks etc.
I know it is dangerous to reuse a (key,nonce)-pair, but since the key is derived from both a password and the salt and the nonce is randomly generated every time, I don't see this as a problem.
Am I correct or is there a problem I'm not thinking about? Or is there a better approach? Also I'm asking more from the academic side of things and less from my implementation, that was just to explain how I came to the question.
In case there is already a similar question, please point me towards it, I did try the search but nothing really fitting came up.
Tl;dr: Is it generally cryptographically problematic to use a part of nonce for an AEAD scheme as a salt for a KDF ?


texts: State of the art techniques for Anonymous Authentication?

texts:
What are the state of the art techniques for Anonymous Authentication? What are the most popular ones? The problem domain I am considering is with respect to different users accessing cloud content; lets say watching movies in Netflix. I am looking for schemes that prevents linkability, and also schemes that allows linkability.

Please let me know if it is too vague to answer, and I would try to narrow it down.


texts: secure multiparty computation for multiplication

texts:
Suppose there are $N$ parties $p_j$, each with a binary $b_j\in{\{0,1\}}$. The problem needs to compute the multiplication of number of ones times that of zeros, that is, $R=(\sum{b_j})\times(N-\sum{b_j})$.

The computation should be secure in the sense that no party can know more than the final result $R$. For example, it's not ok to perform secure sum, because then $\sum{b_j}$ is known, which is sensitive in my problem. So, is there any existing secure computation protocol that fits my demand?


texts: How do I find the key of the Vigenere cipher is if I already know the key length?

texts:
Hi I am stuck in trying to crack the code of finding the key to decrypt a huge message. I have the frequencies of the letters:

A 121
B 0
C 10
D 60
E 39
F 100
G 123
H 19
I 0
J 74
K 87
L 119
M 35
N 8
O 30
P 2
Q 27
R 0
S 135
T 26
U 47
V 47
W 140
X 24
Y 29
Z 78
A 121
B 0
C 10
D 60
E 39
F 100
G 123
H 19
I 0
J 74
K 87
L 119
M 35
N 8
O 30
P 2
Q 27
R 0
S 135
T 26
U 47
V 47
W 140
X 24
Y 29
Z 78

So far I figured out that the first letter is an "S" since W = 22 so 22-4 = 18 which is "S"


texts: Signature over MAC value for a random key

texts:
Would it be possible to create a signature scheme like this:
$
\DeclareMathOperator{Gen}{Gen_{\Mac}}
\DeclareMathOperator{Mac}{Mac}
\DeclareMathOperator{Sign}{Sign}
\DeclareMathOperator{F}{F}
\DeclareMathOperator{H}{H}
$

$$k_d = \Gen$$
$$m_d = \Mac(k_d, M)$$
$$S = \big(k_d, \Sign(K_{priv}, m_d)\big)$$

So instead of a hash, you'd use a random key.

I know that $$H = \big(k_d, \Mac(k_d, M)\big)$$ is not necessarily secure as you'd give the adversary the ability to choose any key. However, in this case the result is signed as well.

If it isn't secure, are there ways to make it secure? For instance, I could imagine RSA that contains the $k_d$ and recovers it using message recovery. Or ECDSA where an additional hash is calculated over $k_d$ and $m_d$.

Primary goal is to make a faster signature generation by replacing a slower hash with a possible faster MAC such as GMAC.


texts:
I am currently experimenting with the Blowfish encryption.

I noticed that the decrypted message and the original message doesn't have the same length.
This applies for the ECB, CBC and CTR mode.

The difference of bytes from the original message to the decrypted message are
just trailing zeros at the end of the array.
However, the zero-padding-length at the end seems to vary.

Is there :

A way to produce a decrypted output with the same size as the input message?
A way to calculate the length of zero-padding at the end
(so that I can cut them off in the end)


texts: Creating a private cryptocurrency without trusted setup

texts:
I am interested in creating a cryptocurrency which keeps the sender, the receiver and the amount private and does not require a trusted setup.

I have already read the Zerocash protocol but It uses zk-SNARKs which require trusted setup.
I have also read the Bulletproofs protocol which creates short proofs and without a trusted setup so it would be great to use it.

The problem is that Zerocash creates commitments and calculates the address public key using hash function. I would like not to have to prove that a hash function was computed correctly because the proof would be long ans slow.
The second problem is that in Zerocash the sender proves that he owns that address private key and some random numbers such that they combined create a commitment that exists in the Merkle-tree of previous created coin commitments. I cannot find any protocol for proving set membership of a commitment C ϵ S that I know it’s opening; I can only find the opposite (i.e. to prove that one item x ϵ S is the opening of a commitment C).

Is it possible to prove that I know an opening x of a commitment C ϵ S without revealing neither the x nor the C and without a trusted setup?
Is it possible to create/link the address public and the address private without a hash function such that the sender can create that commitment with the address public and the receiver can prove the above with the address private key? What type of commitment would be possible?
How Is possible to fit the coin’s value and the nullifiers to all this? Does a cryptocurrency like that exist?

Thanks.
P.S.
Links to technical papers are welcome.
If this questing best fits in bitcoin.stackexchange.com please let me know.


texts: Why don't we have 256-bit security level digital signature schemes (in common use)?

texts:
Recently (2016) I've been researching on post-quantum digital signature schemes, and read about BLISS, BLZZRD, REBLISS schemes. What I've noticed about them is that they lack a parameter set for 256-bit security level.

I went to the Wikipedia page on NSA Suite B and learned that CNSSP-15 require only 384-bit curve for digital signature. And then I clicked on this link in the reference section at the bottom of the page, and found out only ECDSA-with-SHA{256,386} required for the profile.

It baffles me. Why is 192-bit security sufficient (upper-limit if you will) for digital signatures when we have 256-bit variant of AES? And what reference backs this up?


texts: repeatedly hashing result and using reverse sequence as RNG secure?

texts:
I want to have a source of randomness for which:

no one but me can predict the next number in the sequence.
I know the entire sequence in advance, but I have no way of manipulating it once the first number in the sequence has been shared with others and everyone can verify that this is the case.
it's okay for this sequence to be finite, with the total length being determined in advance.

So, one idea was to take a secret and hash it a few million times. Something like this:

N1 = sha3(secret)
N2 = sha3(N1 + 1)
N3 = sha3(N2 + 2)
N4 = sha3(N3 + 3)
.....

I would then publish the sequence in reverse, starting with Nn. The +# in each step is to avoid loops.

Now the question is, is this secure? Thinking back to my information security classes I recall that one shouldn't apply encryption multiple times as this weakens security.

So,

A: does this mechanic of creating the pseudo-random sequence somehow facilitate it for an attacker to predict an arbitrary future element (from which he then easily could rebuild the chain down to the current element)?
B: does this mechanic of creating the pseudo-random sequence somehow allow me to cheat?


texts:
I have just read about the perfect security of an OTP encryption and what came to my mind was that what if the Pad used for encryption/decryption did not have to be transported separately from the message, but instead together with it?

And what if it was computed using an algorithm from the message itself (from all the characters in an 1:1 way so that it had the same size) providing a random-looking pad for encrypting the message, and after encrypting the message would be stored in an interwoven way in the message itself, expanding the file size by a factor of 2. The encrypted file itself would have double size of the original one but no-one would be able to find out what is the message and what is the key since it would be interwoven using a secret algorithm, perhaps the same one as was used for generating the pad.

Would this be a good encryption comparable to real OTP with the pad transferred and generated separately? Did I just invent the wheel, or is this a breakthrough thing (I mean storing the pad inside the file in a secret way preventing others to extract it)?

I know calculating the pad from the message itself would perhaps break the real randomness so this could be avoided and the pad simply taken from a real random key number generator.


texts: Decrypting message as MSB in regev scheme

texts:
I was watching this FHE video and it define Regev encryption scheme as fallow :
kyegen:

sk : choose $t = (1,s)^t \in \mathbb{Z}_q^{n+1}$
pk = $A \in \mathbb{Z}_q^{m*(n+1)}$ random except $[A * t]_q$  small

Enc: for random $r \in \{0,1\}^m $ output and $\mu \in\{0,1\}$

$c \leftarrow (\mu,0,...,0).\frac{q}{2} + r.A$

Dec : compute
$$\langle c,t\rangle =  \mu.\frac{q}{2} + r.A.t = \mu.\frac{q}{2} + \; small \; (mod \; q)$$

Decrypt $\mu$ as MSB$([\langle c,t \rangle]_q)$

But i can not understand how decryption works? what i think is  for example for $q = 8$ if $[\langle c,t \rangle]_q \in [2,6)$ message is 1 and if $[\langle c,t \rangle]_q \in [6,8) \cup [0,2)$ message is 0 (if absolute value of small in $\langle c,t\rangle$ be less thatn $q/4$). I cant understand how the message would be MSB$([\langle c,t \rangle]_q)$ ? for example if we use 3 bits for each number MSb of both 0 and 3 would be 0.
Edit
responding to @kelalaka answer. beside $q$ being odd which is important but not very much what made me confused at first place was this section of Regev's paper. I think what you said is true when "small" bounded like $0<= small < q/2$. for example for $q = 7$ we have something like
$$000\\001\\010\\\\011\\---------\\100\\101\\110$$
and what i said when $-q/4<= small < q/4$ and depends on error distribution you choose at first place. but still not sure.
Edit 2 : actually it was kinda a silly question. for future reference if somebody(with low probability) came across this question. Homomorphic Encryption is a good paper from SHai Halevi, the guy in the video. and at secction 2.1    Notations and Basic Definitions you can find definition of $[\;\;]_q$ and much more.


texts: Why does a perfect secrecy can be achieved when decryption correctness is not totally required?

texts:
By Shanon theorem, a perfect secrecy encryption scheme must use a key space of equal size as the message space.

But when the correctness requirement is weakened such that $Pr[Dec_k(Enc_k(m))=m]=1/2$ we know that the key space may be smaller than the message space.

Generally, what is the lower bound of the key space when the scheme correctness requirement is $Pr[Dec_k(Enc_k(m))=m] >= 2^{-t}$? (and why?)


texts: Key exchange if forward secrecy is not an issue

texts:
Let's say that we have a cryptosystem where Forward Secrecy and Man-In-The-Middle attacks are not an issue, purely hypothetically.

Would it be correct for a key exchange with any given public-key algorithm to simply work as follows?

Alice calculates public & private key
Alice sends the public key to Bob (and Eve intercepts it)
Bob encrypts a random session key with the public key
Bob sends the encrypted session key back to Alice (and Eve intercepts it)
Alice decrypts the session key using the private key, Eve cannot decrypt in any reasonable amount of time

And all future communications would be encrypted with the session key. Are there any glaring vulnerabilities in this, besides forward secrecy and man in the middle attacks?


texts: Key construction in the Full Cramer-Shoup cryptosystem

texts:
The Full Cramer-Shoup Encryption scheme needs to choose six random numbers from $\mathbb{Z}_q$, which we denote them by $ x_1,x_2,y_1,y_2,z_1,z_2 $. Then the scheme hides these random numbers in the values $c=g_1^{x{1}}g_2^{x{2}}$, $d=g_1^{y{1}}g_2^{y{2}}$, $h=g_1^{z{1}}g_2^{z{2}}$.

It is clear that the proportion of public key to private key is near to 1:2, because we can denote them by binary-tuple, which have two private keys and one public key, such as $((x_1,x_2),c)$, $((y_1,y_2),d)$, $((z_1,z_2),h)$.

Is it possible we use the less private keys to achieve the scheme, because my intuition tells me it have so many private keys?


texts: Significance of IV in Merkle-Damgård construction

texts:
Is Merkle-Damgård essentially encrypting the IV with the given message? I may be wrong but this is how I understand Merkle-Damgård:

  There is a message of an arbitrary length, which is broken up into blocks before it can be encrypted; the blocks can be padded if necessary. Then a fixed IV is used and the first block of the message is run through a compression function using something like AES (possibly derived from a block cipher) with the IV. The output is then taken as the IV for the next round. In the end, the resulting output is the same size as the IV.

What is my error in understanding?


texts:
Ok, it's kind of stupid question, but I want to make sure.

What is the length of the ElGamal cipher? It's equal to the size of 2 elements of the cyclic group, right? But lengths of elements are NOT always the same, right?

Toy example:

We pick p = 23, q = 11 (p = 2q+1), our generator is 18, so
G = {18,2,13,4,3,8,6,16,12,9,1}. Sekret key x is 6 (a random form {1,q-1}), h = g^x mod p = 8.

Now is the fun part:

1) Encryption of m = 18 with  r = 8 is (16,3)

2) Encryption of m = 18 with  r = 7 is (6,9)

Am I getting different length ciphers because it's the toy example or what? Padding? All group elements have identical length? I haven't noticed any length difference in the real ElGamal implementation.


texts: Is it possible to derive a constant value from different signatures of a private key?

texts:
For example perhaps deriving the same PRF from RSA signatures on different messages from a (not known) private key?
Struggling to find the proof of why not.


texts: Pseudorandom generator and AE-secure encryption

texts:
How would you answer the following question (I have to translate it from German):

The existence of a pseudorandom generator implies the existence of a AE-Secure encryption scheme (AE = authenticated encryption)
YES or NO

I would say "NO" because (as far as I understand) AE-secure schemes should use two keys (one for encryption and one for authentication).
But maybe I'm wrong because of missing background knowledge.


texts: Mechanism of PBKDF in encryption key generation with passphrase

texts:
I want to roughly understand how the mechanism works of generating an encryption key from a passphrase, by which we encrypt a volume or file.

I'm familiar with public key encryption, the concept of a salt and the password hashing approach to password verification. A salt prevents attackers from precomputing a dictionary of derived keys.

I don't understand the main merits of deriving an encryption key from a passphrase, by which we then encrypt the data. From what I've read, it's key stretching- and strengthening that accounts for the main merit; a longer- or higher entropy key is more secure that the supposedly weak passphrase.

My first confusion arises from the random nature of the derived encryption key. Shouldn't this be a deterministic process? A passphrase should correspond to a certain unique hash, in order to verify it?

As a whole, I find this mechanism quite vague at the moment, and would love some elaboration on it. :)

Update

The salt is the only random component, which is passed with the encryption key. Hence, the key derivation key is deterministic, indeed.


texts: Why does a fixed key not make MACs like CBC-MAC or GMAC into secure hash functions?

texts:
Why does setting the secret key to a fixed, public value not make MACs like CBC-MAC or EMAC into secure unkeyed cryptographic hash functions?

In other words, why is the resulting hash function not 1st pre-image, 2nd pre-image, and collision resistant?

What about HMAC? Still not pre-image and collision resistant?


texts: Proof for exponentiation in modular arithmetic

texts:
If  $e$ is a natural number, then this is true:

$$m^e \bmod\ n = (m\bmod\ n)^e\bmod\ n$$

This is often used when encrypting, especially with RSA, since one can avoid directly calculating $m^e$, which can be a very big number.

However, I haven't been able to find any documentation/proof for this conjecture, can anyone give a source or explain it?


texts: Why this malicious behavior of corrupted sender isn't considered in malicious-secure OT?

texts: I have read some oblivious transfer protocols, and I am confused about why they do not mention the malicious behavior that the corrupted sender may encrypt the wrong message $x_0'$ and $x_1'$ so that the honest receiver will receive the wrong result $x_\sigma'$. I think this totally breaks the correctness of OT and I don't know why the malicious secure OT protocol did not mention it. I know that the committed OT can prevent this behavior, but is this not a malicious behavior that one malicous-secure OT should consider?


texts: Is it secure to encrypt a 1 GB data file with AES-CTR by ECIES?

texts:
I have a file system with share resources over the network (like a shared FTP)

Is it possible to use the client's ECC public key to encrypt the AES key, and then use the AES in CRT mode for the file encryption?  File size can be 1GB to 1TB.


texts: Maximum length of a XEX-encrypted scheme?

texts:
Suppose that:

$\widetilde{E}: \mathcal{K} \times \mathcal{T} \times \mathcal{PT} \rightarrow \mathcal{CT}$ and $\widetilde{D}: \mathcal{K} \times \mathcal{T} \times \mathcal{CT} \rightarrow \mathcal{PT}$.
$\widetilde{E}(K, T, X) = E(K, T) \oplus E(K, X \oplus E(K, T))$ and $\widetilde{D}(K, T, X) = E(K, T) \oplus D(K, X \oplus E(K, T))$ where $K = \{0, 1\}^{k}$, $T = \{0, 1\}^{t}$, and $X = \{0, 1\}^{n}$
$CT_{i} = \widetilde{E}(K, IV \boxplus i, PT_{i})$ and $PT_{i} = \widetilde{D}(K, IV \boxplus i, CT_{i})$.

What is the maximum length data stream that I can encrypt with a given pair of $K$ and $IV$ using this tweakable block cipher scheme and why?


texts: How to use a random 32 byte sequence as a curve25519 public key

texts:
According to the Wikipedia Curve25519 article, Curve25519 "accepts any 32-byte string as a valid public key and does not require validation"

However, I need to provide BouncyCastle with a 33 byte key. I have attempted to simply prepend 0x02 or 0x03, and this sometimes is accepted. However I often get the exception "x value invalid for Curve25519FieldElement" or "Invalid point compression".

Is the wikipedia article incorrect, and e.g. do I need to ensure that the x coordinate does not exceed the Curve25519 group order 2^252 + 27742317777372353535851937790883648493?


texts:
I decrypted a file which was encrypted with OpenSSL and AES-128 with the wrong password. Before I noticed it was the wrong password I removed the original file. Is there a possibility to reproduce the original encrypted file? I know the "wrong" password.

Thanks in advance.

EDIT

The only file I have is the wrong decrypted file. I tried to re-encrypt that file with the used password - the password I decrypted the original file - but that doesn't work. Is there another way to get the original encrypted file?


texts: Should I be using RSA to Encrypt and ECC to Sign?

texts:
I want to combine RSA and ECC. First of all, a particular file is encrypted with the RSA algorithm and then that encrypted data is again encrypted with ECC algorithm.

However, can I use RSA to encrypt and ECC to sign, or do I have it backwards?


texts: Security of a block cipher if double encryption $E_{K_2} \circ E_{K_1}$ is always single encryption $E_{f(K_1,K_2)}$

texts: If there always existed a $k_3$ such that $\operatorname{DES}(k_2, \operatorname{DES}(k_1, M)) = \operatorname{DES}(k_3, M)$,  how would that affect the security of $\operatorname{DES}$?


texts: plaintext and its encrypted version known

texts:
I have a (long) text in two versions, encrypted and plaintext. I think it was encrypted using a substitution cipher method (I'm pretty sure, indeed).

I'm not good in this matter, I know little about it, but I would know if there's a way to know the function/secret used for encrypt that text.
I'm ready to study, anyway :)


texts: are there more efficient methods than HMAC to achieve convergent encryption?

texts:
I’m thinking about the convergent encryption system described in the top answer to this question. However, it seems like preferred modern HMAC algorithms like HMAC-SHA256 (as used in step 2 to create the “key”) are much slower than the actual encryption. Then SHA256 is invoked again on data the size of the plaintext to create the locator.

It seems like the first SHA-256 invocation that’s part of the HMAC step could be replaced by any other transformation of the plaintext which cannot be reversed and which will produce the same output given the same plaintext data, like simply encrypting the data with the “specially-selected HMAC key”. I also read about authenticated encryption and am wondering if I could use the MAC created during e.g. AES256-GCM as the key.

Would either of those approaches allow sidestepping the performance overhead of traditional HMAC methods? The only problem that I could think of is that it may be difficult to come up with an IV if that is required, since all writers would somehow need to use the same one in order for the “locator” to be consistent for all instances of the same input data.

If not, are there any known techniques for reducing the overhead of HMACs (other than reducing the input size)?


texts: For a hash over a finite space without size reduction, is a public permutation sufficient?

texts:
Suppose the application is a Lamport signature scheme.

Is the following a secure hash $\{0,1\}^n \rightarrow \{0,1\}^n$?
$$
H(x) = x \oplus P(x)
$$
where $P$ is a public permutation that permutes an input of length $n$.