texts:
I got an alert last night to the keywords above and was curious, so took a look at the tor site flagged which is the following one:
http://nsrz5iogimqwgeax3clpp6hvfy6viom2woy7dghgxes4sqk63r7svoqd.onion. Obviously you need TOR to access it or a service like Tor2Web though reachability is spotty.
I'm asking SE because these guys are claiming to offer a cipher strength I've never heard of. I'd like to ask if you think it's even possible.
This question is about the encryption scheme "Blobby" presented on their site and the security claims surrounding it.
The first notation they use is $10^{yM}$ which I didn't get, but just below is an example $10^{41485806}$, which seems obscene with the unit to of the previous number being "operations", which can be inferred from them stating a relative strength of $10^{38}$ for AES-128 which is roughly $2^{128}$.
Now that I've have longer to look at it, it feels less impossible (though still a stretch), I think the key size and password length are important, but I suspect they're using a third mutagen.
The key claim of novelty for this encryption scheme is that both a nearly-arbitrary sized password (20-$2^{12}$ chars) and an arbitrary sized key ($2^{16}$-$\infty$ bit) are necessary for symmetric operation yielding "multi-factor security" with their custom encryption scheme. The precise quote is

Blobby is fundamentally different, the password is used in conjunction with the key, meaning that each is useless without the other, and attacking the key's password won't get you any closer to the message password.

If their claim is solid, would this be quantum resistant?
I have now downloaded the 3 sample files and looked at them, they are clearly encrypted. I've been trying the first sample for over 24hours now with not a whisper of joy.


texts: What security checks do I need for SRP-6a?

texts:
I'm implementing an SRP-6a login system.  What security checks do I need to do?  Note that the modulus is sent to the client at algorithm startup.

Here is the list I have so far.  I'm using the Wikipedia names for the variables.

Verify that $N$ is an appropriate size.
Verify that $N$ is prime.
Verify that $q = \frac{N-1}{2}$ is prime.
Verify that $g$ is a generator of $(\mathbb{Z}/N\mathbb{Z})^\times$ by verifying:

$1 < g < N-1$
$g^q = -1 \pmod N$

Verify that $0 < A < N$.
Verify that $0 < B < N$.
Verify that $u \neq 0$.
The server should not send its proof before the client provides its valid proof.

Regarding the primality checks, what algorithm should I use?  Should I randomize the parameters during the primality check in order to prevent a false server from finding a composite that passes what the client checks?


texts: Bitcoin mining: how is a block header of 80 bytes processed in SHA-256? Isn't it too big?

texts:
The whole process of bitcoin mining was making sense to me until a moment of madness an hour ago, if there are 80 bytes of data to be processed in SHA-256, that's 640 bits of data to be processed in SHA-256.

In this 80 bytes we have: 4 bytes (version), previous block hash (32 bytes), merkle root (32 bytes), time (4 bytes), bits (4 bytes), nonce (4 bytes).

I thought SHA-256 accepted 512 bits of data, so that's 64 bytes of data. And on top of that, I need to add the length of the data to be processed in the last 64 bits of this 512 bits input but 64 bytes is well over the limit.

Then I saw that I would have to create basically two 512 bit input "blocks". The first block holds 512 out of the 640 input, and the second block holds the remaining 128 data bits, one bit to signal the end of the data and then padded up with 0s until the last 64 bits to indicate the length.

Can someone confirm if this is correct, and explain more on how this is done? I'm trying to implement my own SHA-256 module in VHDL since I couldn't find any but having more than a 256 input really makes it more confusing.

What am I missing here? Can someone help clear it up for me?


texts: Authenticated DH, what protocols are secure?

texts: I read about STS + variants being insecure in the SIGMA paper, which then proposes SIGMA as a replacement. Are the SIGMA variants still considered secure or are there some other protocol that's currently recommended to use?


texts: Factorization of RSA modulus using a qubic residue

texts:
Suppose that someone uses RSA with $n = pq$, exponent $3$, also $3$ divides $\varphi(n) = (p-1)(q-1)$ and $2$ different roots $y$ and $z$ of the equation:

$$x \equiv c \ (mod \ n)$$

are known (for some qubic residue $c$).

Then can $p$ and $q$ be effectively calculated using $y$ and $z$ and how ? Thanks in advance !


texts: Is there a perpetual 2-factor-authentication scheme that allows temporary password generation?

texts:
Recall that current forms of two-factor authentication (2FA) rely on:

Something you know, i.e. your password

Something you have, i.e. your one-time password (OTP) generator on a trusted device

The procedure is as follows:

Client sends username (public)
Client sends password (private)
Client sends otp = HashOTP(client_seed, time())
Server looks up salt, salted_password_hash, and seed for username
Server compares HashPW(password, salt) against salted_password_hash
Server compares HashOTP(seed, time()) against otp
Client is authenticated iff all comparisons succeed.

The idea, of course, is that even if all the transmitted information is intercepted by an attacker, the attacker is unable to authenticate because he does not have the client_seed to generate a subsequently valid otp.
So far so good, except that interception of password permanently reduces 2FA to 1FA.
"Permanently" because the user will have no idea his password is compromised, and will therefore have no reason to change it.
So, ironically, not only is otp a "one-time password", but so is password itself. (!)
(Now, at this point, I'm sure some of you are ready to close the question, thinking, "But TLS should have protected the password during transit, and if the client itself is compromised, then the problem is invalid!"
If you're in that camp, well, realize that's not how the world works. A passive keylogger on the client could be secretly recording everything but the actual stolen credentials are likely to stay unused until a while after, when the user is unlikely to notice it. So it makes sense to render any such keylogger useless if possible.)
Given that the user will reuse password without even knowing that his 2FA is really 1FA, a theft of his device is all that stands between him and his account, and he is likely to think he is safe because he has no idea his password might have been compromised.
How, then, can we address this?
Initially I was thinking that the user could type his password into his trusted OTP generator and generate a single one-time password that will authenticate him without ever having to send his actual password.
But now it seems to me the server would need to know the password itself in order for this approach to work. In other words, it defeats the storing of hashed passwords—i.e., a server-side leak will now reduce all users' 2FA to 1FA, instead of a client-side leak.
Basically, it almost seems that 2FA is fundamentally 'single-use': any attacker with read-only access will reduce 2FA to 1FA, and the client and server can remain indefinitely unaware.
But I don't know if this is really the case.
Can we keep the two-factor nature of 2FA even after a client or server data leak, without otherwise weakening the system's security? How (or why not)?


texts: What happens to NORX if the same (key, nonce, header data) triple is reused

texts:
As I understand it, reusing a (key, nonce, header data) triple in NORX leaks

the XOR of the initial common prefix (but this is zero, so only its length is leaked)
the XOR of the first distinct blocks (which is usable by an attacker)

Is this all NORX leaks if misused?


texts: Is there any knapsack-based cryptosystem that has not yet been broken?

texts:
I co-authored and implemented SRVB, an asymmetric cryptosystem, only to eventually realize that it is strongly related to Merkel-Hellman cryptosystem, which has been broken. In order to help me investigate the efficacy of this development I took part of, what are the knapsack inspired attempts of asymmetric cryptosystem?

Thank you in advance.

edit:

SRVB is finally documented in an academic style:

Thank you for your attention!


texts: What does a "real" quantum computer need for cryptanalysis and/or cryptographic attack purposes?

texts:
The cryptographic world has been buzzing the word "quantum" for a while now (even the NSA is currently preparing itself for a post-quantum crypto world) and quantum-related hardware engineering is evolving constantly. For example: the 5-qubit quantum computer created at MIT by using the technique of ion traps succeeded in prime-factorizing 15. Does that mean that since it succesfully managed that, that it is a all-purpose quantum computer which could be used for cryptanalysis and/or cryptographic attacks?

If that's not the case, what exactly would a "real" quantum computer need (think: rough description of expected technical abilities, aka specs) to enable its users to use it for cryptanalysis and/or cryptographic attack purposes? And - ignoring rumours about potentially existing but confidential governmental projects - does any such system already exist today?


texts:
Can anyone explain to me why this is a bad idea? I cannot see anything wrong with it except that key K should be different for MAC and AES.

MAC algorithm consists of letting the MAC of message M
(which consists of message blocks M1,M2,... ,Mn) be the AES encryption with key K of the XOR of all the message blocks.

i.e. MACK(M)=EK(M1 XOR M2 XOR ... XOR Mn)


texts: What are the subsequent inputs to the DES key schedule after round 1?

texts:
I've just been studying the DES crypto algorithm as presented by Christof Paar in his book entitled, Understanding Cryptography as well as his lecture. There is a diagram on page 68 of the text where the key schedule is shown and I understand the following information about it already:

A 64 bit "key" is originally input
That 64 bit key has 8 bits removed from it during the Permuted Choice 1 permutation, making it now a 56 bit key.
The 56 bits output from PC-1 are now split into two subsections, $C_0$ and $D_0$ , each of which are 28 bits.
$C_0$ and $D_0$ each have their respective 28 bits rotated left once if the round is 1,2,9, or 16, otherwise their respective bits are rotated left by 2 bits.
** After the above occurs, the permuted 56 bits gets processed by the Permuted Choice 2 permutation and the output is a 48 bit round key. **

I highlighted item #5 here because this is where my confusion lies and the precursor to my question: Once we have a round key, $k_1$ for example, it is obviously then placed into the $f$ function as input along with the $R_i$. However, after this round completes, the round key $K_i$ is 48 bits but the key schedule transforms appear to take a 56 bit input. Can someone please explain how we get from a round key such as $k_2$ (the subkey for round 2 of the algorithm) to round key $k_3$? Is the original key re-used again for each round transformation or is the previous rounds key used?


texts:
I would like to minimize the encrypted packet size.
Is it possible to derive the IV from a non-repeatable counter?
For example, take a 32 bit counter, hash it with a key (different from the AES key), and then use the result as a 128 bit IV.
The counter will increment on each packet, and not recycle during the lifetime of the key.
Then I could send the 32 bit of the counter, instead of the whole 128 bit IV, and if the transmitter and receiver are in sync, then there is even no need to transmit the counter at all.

Is it a reasonable solution?


texts: Signature verifying against multiple certified public keys?

texts:
I'm wondering if and how the current public key certificate infrastructure is guarded against the following scenario:

Honest Alice obtains Eve's public key certificate Certe, made by honest CA Carol; checks it the usual way; and assumes she knows Eve's public kev Pube.
Alice generates a message M mentioning obligation by Eve, sends it towards Eve, and receives apparently from Eve a signature S; Alice verifies that M, S, and Pube match.
Later, Eve denies having approved M or produced S; suggests that S must be by Frida; and as argument asserts that S also checks against Frida's certified public key.
Alice obtain Frida's public key certificate Certf, made by honest CA Carl; checks it the usual way; and assumes she knows Frida's public key Pubf.
Alice verifies that indeed M, S, and Pubf match!
Pube and Pubf are different, and Alice finds them unremarkable, as well as Certe and Certf; these carry a certification date earlier than the generation of M by Alice; there was no certificate revocation.
Alice obtains other (M, S) pairs attributed to Eve and Frida; they verify against only one of Pube or Pubf, as intended.

Unless I err, that scenario could happen with 2048-bit RSA, usual e=F4=65537, and RSASSA-PSS as signature, assuming Eve and Frida are crooks operating as follows:

Eve and Frida jointly choose two distinct small close primes, say re=101 and rf=103; and jointly generate their respective RSA modulus Ne and Nf with Ne=re⋅p⋅q, Nf=rf⋅p⋅q, 22047<Ne<Nf<22048, p and q large random primes with gcd(p-1,65537)=1=gcd(q-1,65537).
Eve computes her private exponent de=e-1 mod LCM(re-1,p-1,q-1) matching her public key Pube=(Ne,e) with e=65537. Frida does similarly for df matching her public key Pubf=(Nf,e).
Eve and Frida obtain their certificate the normal way; the only caveat is that they avoid CAs that check for small factors in public modulus.
When Eve generates a signature using RSASSA-PSS, she proceeds normally, except that she additionally checks the signature against Pubf: about one signature among rf pass this test! Eve iterates signing until finding a signature for M matching her intention to later attribute the signature to Frida, or not. Frida does similarly.

Update: I asked again there, where questions about policies belong.


texts: Algorithm: How to use x and y mouse movement co-ordinates to generate random data?

texts:
Background:

I'm making a program for fun as a learning exercise. I want to generate some actual random key material (not pseudorandom) from a JavaScript program. For my program is just for encrypting/decrypting plain text letter by letter so I've chosen to use the ASCII printable character set (what characters you can type on a standard US keyboard) which gives 95 possible characters.

I want to capture a users' random mouse movements on screen to capture a long stream of random numbers. I want to use the x & y coordinates from each mouse position out of a possible screen resolution of 1920x1080 pixels and then map them back to a character within the list of possible ASCII characters. Then I can use that character in my key material. Let's say the program captures the following series of x and y coordinates like so:

[478,702]
[503,701]
[581,687]
[633,670]
[691,646]
[757,620]
[814,599]

Question 1:

At this point should I multiply the x and y coordinates to get a better random number, ie 478 x 702 = 335556 and use this number? Because if I just took the x number separately then you might end up with consecutive numbers e.g. 121, 122, 123, 127 as they're moving the mouse in one direction which doesn't look particularly random. Or should I add the numbers together ie 478 + 702 = 1180? Or perhaps alternate between adding and multiplying for each set of coordinates I get to make the random number?

Question 2:

Now what's the best way to map the random number to a character in my list (array) of possible characters? If I've got an array of all the 95 characters [0 - 94] for a zero based array, and lets say my random number is 1180, how do I map that back to a character in my array? Do I loop over the array multiple times until I'm at the 1180th character and now use that character for my key? Essentially this would be like repeating the 95 possible characters in a row up to 1180 characters, then taking the last one. Or maybe you can work this out mathematically?

Or do I create a big 2D array with all the characters repeated horizontally and vertically (like a big grid to match the screen size), then when an x and y mouse coordinate comes in I map it to the x and y indexes in the big 2D array and use that character?

Question 3:

What is the entropy quality of the random numbers generated from the mouse movements? Does mapping it back to the reduced character set reduce the entropy? How can you make the process of capturing random data from the mouse movements better?

Question 4:

If my screen size is 1920x1080 pixels and I pull out an x and y coordinate from that. What is the search space ie $2^x$? how do you work that out?

Many thanks


texts: What is the advantage of an attacker over breaking a 4 digits PIN?

texts:
When a hardware system is protected by a 4 digits password, what is the advantage of the attacker into breaking that system?

Isn't it $10*10*10*10=10^{4}$? If $\frac{1}{10^{4}}$ is the cost of such an attack then is this reasonable computation for the attacker? In my eyes this seems like a simple brute force attack for 4 numbers. I mean is super easy. Isn't it?


texts:
I have an implementation that natively uses the same IV (12 bytes of 0) for all encryption. The key is always a 32 byte SHA-512 hash. I know via this post that I can

deduce the bit-wise XOR of the two plaintexts.
deduce the internal authentication value, and thus modify the ciphertexts without being detected.

How can I achieve either of these?


texts: Finding the largest gap between the x coordinates of all points on an elliptic curve

texts:
Till now all we know is Hasse's theorem, which states that $|\#E(p)-(p+1)| \leq 2\sqrt{p}$, where $\#E(p)$ is the total number of points in $E_p(a,b)$.

Is there any other theorem which defines relation between points on elliptic curve $E_p(a,b)$ ?

I want to find the maximum interval of $x$ co-ordinates between two successive elliptic curve points. For example let us consider the elliptic curve $y^2=x^3+x+1$ mod $5$. This has $8$ points in total. These are $(0,1),(0.4),(2,1),(2,4),(3,1),(3,4),(4,2),(4,3)$. The maximum interval of $x$ co-ordinates in this curve is between $0$ and $2$. I need a generic solution to find the maximum interval of $x$ co-ordinates given $E_p(a,b)$.


texts: Characteristics of an isogeny between super-singular elliptic curves

texts:
I believe I've read this before, but I can't find it despite hours of searching on Google.
I've know the common definition of isogeny in elliptic curves, as $\phi:E_1 \rightarrow E_2$ a nonconstant morphism of curves satisfying $\phi(0)= 0$, however somewhere else I read a really lovely intuitive explanation that basically stated that if a curve $E_1$ is isogenic with curve $E_2$, then, not only will points, such as $p_1$, $q_1$ map to $p_2$, $q_2$ but moreover, the mapping of the point $E_1(p_1+q_1)$ to $E_2$, will result in the same point on $E_2$ as when the points $E_1(p_1)$ & $E_1(q_1)$ are first mapped to $E_2$ and then added on the $E_2$ curve.
I hope this makes sense, am I confusing this or does anyone have a resource that shows this detail?


texts: Asymmetric algorithm to generate compact unique messages that can be validated

texts:
I have a cryptographic problem with the following characteristics:

I need to generate a set of relatively short messages; say 20 bytes in length
The contents of the messages themselves is not important to me as long as they are unique within a certain set.
These messages will be sent to a consumer.
The consumer must be able to (with a certain degree of confidence) verify that the message was generated by the producer - again, the contents themselves are actually not important.
An asymmetric algorithm must be used, so that the private key does not have to be shared with the consumer.

I must emphasise that I'm (obviously) not looking for perfection here - the most important thing is for the consumer to get as much confidence as it can in the identity of the producer using a very small footprint of data, and without needing to hold the private key.

I was thinking something like:

generate a unique message [M] (could just be an integer) within a bounded set
generate a digital signature using a private key e.g. RSA and sign the message [S]
"compress" the signature into a smaller space by taking a hash of it using a well known algorithm that has a smaller footprint e.g. something simple like MD5 [CS]
append the "compressed" signature onto the message e.g. M,CS packing these into the number of bytes available as appropriate
the consumer does the opposite to verify

Am I way off the mark? Is there a well known algorithm to do something like this? If it isn't completely ridiculous then is there a good way to evaluate what the actual chances of brute-forcing this would be?

EDIT

Having just re-read my own posting I've noticed a bit of a fatal flaw here :-) how can I use the public key to verify a signature I've "compressed"? I can't see how that could work, but the rest of my question stands.

Is there another more suitable algorithm to do this that is asymmetrical? Is there even a name for what I'm describing?

EDIT 2

I'll try and add some more detail as to WHY its important that this is attempted.

Essentially this is a backup scheme for when the primary method of validating a message is not available. The primary is a request/response over a secure channel back to the producer. This callback would provide meta-data associated with the message. If this is not available then it would be advantageous to us to have a best-effort validation that the message at least came from the producer in the first place - even if we can't get at any of the meta-data we'd like.

We can't trust the consumers with a shared key, and we have a very limited bandwidth/method of transmitting the messages themselves (the primary lookup occurs over a different channel).


texts: Would exposing a cryptographic hash function's digest (e.g. SHA-3) of RSA private key data compromise the key? If so, what are the possible (cryptanalysis-) vectors for attacking the key if an attacker had knowledge of this hash?


texts: Is AES-GCM length extension attack possible using authenticated decryption?

texts:
I am looking to encrypt a piece of data using AES-GCM with a full 16-byte GCM Tag and send it over the network using UDP. Is it safe to assume using the AEAD nature of AES-GCM that performing authenticated decryption will prevent ciphertext length extension attacks with an implicit length?

In short, I want to determine the length of the ciphertext by looking at the UDP packet size and removing my app specific headers. This avoids the need for an explicit ciphertext length. Explicit length would increase the per-packet overhead, and every byte counts on the network.

Can I derive the length or must I specify it explicitly?

Section 5.3 (Page 44) of https://eprint.iacr.org/2013/144.pdf suggests while the GCM Tag includes length, it is still vulnerable to at least one weakness. But reading that, I'm not left with the impression that adding an explicit length into the AD would make a difference.

(Note: Originally asked this question on security.stackexchange.com, realised it was wrong site so re-posting here)


texts: Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?

texts:
Encrypt-then-Authenticate (EtA) seems to generally be considered the better option, compared to Authenticate-then-Encrypt (AtE) (see this Crypto.SE question, for example). The people writing the RFC for TLS 1.2 seem to have been aware of this, but have chosen to use AtE anyway.

Is there a reason why this is the case? Is this a case of "Someone standardized something at some point and now we're stuck with it for backwards compatibility, even though we know it's bad", or is there a good reason why AtE is better for TLS?

Clarification, because this wasn't very well-written originally: I am referring to the actual encrypted channel after the handshake has finished. It's clear that you have to authenticate the server and perform a key exchange before you can perform any useful form of encryption.


texts: RSA: Is there a way to digitally sign a message without knowing the private key?


texts: How Elliptic-Curve affects the Server Key Exchange parameters

texts:
In Finite Field DHE, the server sends the following parameters in the server key exchange message:
$p$: prime
$g$: group
$g^b$: the server's public DH key

In DHE_RSA (non anonymous DHE), the server signs the parameters. The full parameters according to the specs are:

  ServerKeyExchnage($p$, $g$, $g^b$, sign(hash($\mathit{server\_nonce}$,
  $\mathit{client\_nonce}$,$p$,$g$,$g^b$))

The client sends it ClientKeyExchange which contains the client's public DH key:

  ClientKeyExchange($g^a$)

ECDHE uses Elliptic-Curve and this entails different methods in selecting the key parameters.

1) In terms of TLS message, if the key exchange is Elliptic-Curve not Finit-Field, precisely how this affects the parameters and messages above? What does it changes in terms of the exact parameters the client and server send?

2) In terms of key parameters, does Elliptic-Curve changes the method used by both parties to compute the pre-master-secret? In Finit-Field, the client's pre-master-secret is computed by:

$pms = g^{ab}$

The same for the server:

$pms = g^{ab}$

Since EC does not use $g$, is the pre-master-secret still computed by multiplying the other peer's public ECDHE parametrs in its private ECDHE parameter? I.e:

$pre\_master\_secret_{Server} = ECDHE\_pk _{Client} \times ECDHE\_sk _{Server}$


texts:
The base scenario goes as follows: A program stores some user's confidential data encrypted on their disk. The user is most probably clueless and the disk might get stolen, but these are the classical problems.

Now there's a requirement to allow a sort of remote access without increasing the risk too much. The program gets split into a server and a client parts, each running on a different computer (both belonging to the user). The client part gets the password from the user and the server part gets the encrypted data from the disk. None of the parts is capable of authenticating itself to the other one, as both operate in a possibly compromised environment (so any secret stored in the program is void, but let's assume that the user can enter their password without being snooped).

The server part could send the encrypted data to anyone asking for them, but in comparison to the base scenario, it allows a remote attacker to obtain these data and let their cracking farm work on them. I wonder if there's a better protocol?


texts: Learning elliptic curve cryptography for specific application

texts:
I would like to develop a protocol for specific purpose. This protocol will utilize asymmetric cryptography in which one private key can be paired with numerous public keys: messages encrypted with any of those public keys can be decrypted by that one private key.

That seems to be feasible with elliptic cryptography as per this question and answer.

The obstacle is that, although I am a software engineer, I currently cannot just implement that solution because I do not thoroughly understand it. I do have a basic idea of how asymmetric cryptography works in say SSH and HTTPS. But, in the linked question, all those formulas, equations, expressions and the specific use of verbs "define", "broadcast" etc. make very little sense to me.

Assuming no issues with self-education and tenacity, what would be the quickest pathway to learn the knowledge I need? How to avoid studying branches of cryptography not necessary for what I want to implement? Which resources should I start digging through?


texts: Proving the security of the public key BGV scheme

texts:
The security proof basically comes down to the following based on this paper.
We want to show that two distributions are statistically indistinguishable.
Say we have that $a,a′,x,x′$ are drawn from an ($n$-dimensional) discrete Gaussian distribution $D_{\mathbb{Z}^n,r}$ with standard deviation $r$ and that $b$ is drawn from a discrete Gaussian distribution $D_{\mathbb{Z}^n,r'}$ with standard deviation $r′≥2^{ω(\log n)}r$. I want to show that
$$b\approx b+ax+a′x′$$
Supposedly it is enough to know that the euclidean norm of a vector drawn from $D_{\mathbb{Z}^n,r}$ is less than $r\sqrt{n}$ with probability $1−2^{−n+1}$ and that the statistical difference between two Gaussian distributions with same standard deviation $r$ is proportional to $Δ/r$, where $Δ$ is the distance between their means.
What makes this difficult to me is that $ax$ and $a′x′$ are products of discrete Gaussians, and therefore the distribution is not Gaussian. The difficulty here is maybe proving that they are sub-Gaussian in some way, but I do not know how, or if that is even true.


texts: How to protect a device which has different levels of access to its storage?

texts:
There is a device which has three software running on it, the main purpose is the control of some machinery.

a GUI front-end, running on a single-board computer with easily accessible storage (hard disk or SD card, etc.)
a back-end, running on the same SBC as the above.
a microcontroller which drives the hardware, and communicates solely with the back-end. The messages between #2 and #3 are short, in the range of 10 to at most 50 bytes.

Income is solely made by manufacturing and selling the device itself. However, the majority of the development costs are made up by developing the software #1 and #2.

The threat model is someone making a physical clone of the device, implementing their own version of software #3, and stealing software #1 and #2. For our threat model, for the attacker to read the memory (either volatile or non-volatile) of the microcontroller in #3 is to be considered impossible. Wiretapping the communication between #2 and #3 is to be considered easy.

This looks like a standard case of software protection dongle, with its obvious drawbacks: if it's only "check for the presence of the dongle", even if it's based on sending randomly generated code encrypted by the public key on one end, and decrypting it with the private key on the other end, it's easy to defeat with a single change in a single jump instruction to bypass the "if". Anything more would require very complicated solutions, like executing some code meant to be executed in #1 or #2 in the microcontroller instead.

Instead, I'm considering the following:

The microcontroller, obviously, will hold the private key of an asymmetric encryption.
The commands sent from #2 to #3 will be encrypted by the public key.
The replies (mainly status messages about the states of the controlled machinery) sent from #3 to #2 will be encrypted with the private key.

Does this scheme has critical drawbacks? Are there better alternatives?

I can see the following problems:

It doesn't secure #1 at all. (Maybe it could be done by routing it through #2 but it would make it needlessly complicated)
There are not too many types of messages and the messages are relatively short. Especially replies could be attacked, as the state of the machinery is visible, so by wiretapping one can see what kind of message gets generated in which state of the machinery. Yes, the messages could be padded, but not by orders of magnitude (it would reduce bandwidth), and adding random junk seems to be like a form of security through obscurity.


texts:
I understand how Diffie-Hellman key-exchange works. Mainly, two parties agrees in a prime $p$ and a generator $g$. Then one party selects its private exponenet $x$, computes its public value $g^x \bmod p$. Then, sends it to the second party. The second party chooses a private exponent $y$, then, computes its public value, $g^y \bmod p$ and sends it to the first party. Then, both parties, compute $g^{xy}$ which is the shared secret.

However, in some protocols descriptions, like TLS 1.3, I find them say the client sends "hello message includes Diffie-Hellman public values for the client's preferred groups". What is "group" refers to??


texts: Build a cipher that is secure against message recovery attack but not semantically secure

texts:
I know the definitions of both of the securities (against message recovery and semantic), but I don't know how to actually build a cipher that meets these conditions, I mean, I don't know how to define "let $\mathcal{E} = (E,D)$ where $E(k,m) = \;...$ and you can see that it is secury against MR because of ..., but is not semantically secure because of ..." yet.

I would like to know, at least, how to start building such cipher.

Message recovery attack:

Let $\mathcal{E} = (E,D)$ be a cipher. The challenger chooses a random $m$ from message space $\mathcal{M}$, a random $k$ from key space $\mathcal{K}$, computes a random
$c \xleftarrow[]{\text{R}} E(m,k)$ and sends $c$ to the attacker.

The attacker, then, sends $\hat{m}$ back to the challenger.

The attacker wins the game if $\hat{m} = m$. Let $p$ be the probability $Pr[\hat{m} = m]$.

The advantage of this attacker is $\Big\vert \;  p  - \frac{1}{\Vert \mathcal{M} \Vert} \; \Big\vert$

The cipher is secure against MR attack if this advantage is negligible for all efficient attackers.


texts: Regarding Key Strength with DES and Blowfish

texts:
I had a small discussion with my friend on combining two encryption algorithms based on 64-bit keys.

Say I have a plain text of 64 bits which I want to encrypt. My Key size is 128 bits. I will use the standard DES algorithm with the first 64 bits of the key to encrypt plaintext. With the remaining 64 bits of key, I will apply the Blowfish algorithm on ciphertext that DES produces. Assume this is my “encryption algorithm”.

Now, what I want to know is: will key size is considered as 120 bits (56-bit for DES + 64 bit for Blowfish), or will it be considered as 2 individual key sizes (56 bit and 64 bit) with two different encryption algorithms? As 64 bit keys based algorithms are weak with current computational environments, can cryptanalysis attack or break the security easily?

Personally I believe double-encryption algorithms provide more security on the plain text. But somehow I am not able to convince my friend that combining two weak 64-bit algorithms will provide a double key strength. Please share your thoughts to help me understand.


texts: Who said "32 round Rijndael" in the third AES Conference

texts:
This is a historical question. In the third AES Conference of NIST (AES3), April 13-14, 2000, New York, near the end of the conference, one representative for each of the last 5 candidates sit on a table and people asked questions to them.

One interesting question was;

Except for your proposal for AES, what is your candidate?

As far as I can remember, the representative of Rijndael was the last to answer, was sitting on the right end. The first 3 were simply said The Rijndael. But, the 4. person said I want 32-round Rijndael

Was he Bruce Schneier? See his suggest on his Blog.
What was the choice of the representative of Rijndael?


texts:
I need to know what is exactly DHE_EXPORT cipher suite and why it is still supported by some servers.
Is there any implementation or details about this weak crypto?


texts:
Does anybody know applications of higher reciprocity laws (i.e. the reciprocity laws "higher" than the quadratic one, like the cubic or quartic reciprocity law) in cryptography?

So far I have found this paper that uses the quartic reciprocity law to identify the messages in the Rabin cryptosystem.


texts: How is the key shared in symmetric key cryptography?

texts:
Symmetric key cryptography is an encryption system in which the sender and receiver of a message share a single, common key that is used to encrypt and decrypt the message.

Is the key public or it is secret? How can the sender and the receiver both know the key?


texts: What is the time complexity of the RC4 encryption & decryption algorithms?

texts: I'm trying to figure out what the time complexity of RC4 encryption & decryption algorithms is, in big-O-notation.


texts: Understanding the HAIFA (hash iterative framework) structure

texts: Unfortunately, this structure doesn't even have a full Wikipedia on it. I'm struggling to understand it. There are no Youtube videos, Lectures, or any educational video on it. I want to understand how the structure works, and I don't care about the maths behind the hash iterative framework. I would also like if someone can provide me with an outline to the structure or any useful links to better understand it.


texts: Can we use the authentication tag as Nonce / IV for the next message?

texts:
Let's assume we're in some scenario requiring transfer of large amounts of data. This means we can only use AES-GCM chunk-for-chunk as its maximal size is restricted to a few GiBs. This means we have to define a new nonce (a counter?) for each new chunk.

However each chunk needs to have its authentication tag appended to verify decryption. So I had the idea to use this available ressource for the next decryption to completely avoid those counters.
A bonus of this is that re-ordering attacks are completely impossible as the nonce is authenticated as AD for GCM and hence the previous tag will be used for the next tag, "chaining" the chunks together.

Note: One can also replace the word "chunk" by message and apply the same principle to something like TLS.
Note further: The "0"th authentication tag is a random value prepended to the chunk.

So my question:
Is it actually safe to use the authentication tag of the last message as the nonce for the next one in AES-GCM mode?

For me it looks like it should be safe as the first chunk is standard GCM and every following one is indirectly based on the exact same nonce.

If needed: The first nonce is assumed to be of size 16 bytes and every tag is also assumed to be of size 16 bytes.

What was the inspiration for this question?
An AE scheme (AERO) that actually verifies based on nonces and state. In this case we don't even need state (except for the bytes we just had available i.e. the latest tag). And this would also reduce the possibility of errors based on wrong nonce states (incremented the counter in the wrong way).


texts: What makes lattice-based cryptography quantum-resistant?

texts: As opposed to RSA or elliptic curve cryptography?


texts: Can/Which encryption algorithms be daisy chained to create a cryptographic computational puzzle?

texts:
Goal

Create a computational puzzle that is fast to generate, takes an average computer minutes to solve, doesn't have any exploitable weaknesses, makes use of existing/tested encryption algorithms

Problem

Let's say we have a string: "Prefix: LLLLLLLLLLLLLLLLLLLLLL" where L can be any alphanumeric character, "Prefix: " is a pre-set prefix, and "LLLLLLLLLLLLLLLLLLLLLL" the solution to the puzzle.

Let's pick 3 encryption algorithms (as an example), AES256, Triplefish, Camellia

The puzzle-creator takes "Prefix: LLLLLLLLLLLLLLLLLLLLLL", encrypts it with AES256 using key_AES256, then Triplefish with key_Triplefish, then Camellia with key_Camellia, resulting in a daisy_chained_puzzle

To the puzzle-solver, the puzzle-creator sends daisy_chained_puzzle, key_AES256 with 1-character prefix missing, key_Triplefish with 1-character prefix missing, key_Camellia with 1-character prefix missing

The puzzle-solver exhaustively tries all combinations of those 3 missing characters, and returns the solution once it stumbles onto a decrypted solution with "Prefix: ", and deducts that the solution is the suffix "LLLLLLLLLLLLLLLLLLLLLL"

Worries

Would the provided "Prefix: " provide a weakness that can be exploited?

Would providing the suffix of each key result in a weakness?

Question

Can encryption algorithms be used daisy chained like this to create a simple computational puzzle / which encryption algorithms would be ideal for the task?


texts: Is there an avalanche effect using block cipher modes of operation?

texts:
I am studying cryptography and various block cipher modes of operation.

Suppose I changed one bit in the last block of the message. Wouldn't
that imply no change in all encrypted blocks except for the last one?

At least based on the description of how various modes work (CBC, OFB, etc), I don't see why that wouldn't be the case.

However, if that is true, then the encryption mode lacks the avalanche effect property, doesn't it? A single bit change in any place should completely change the encrypted text.

Could someone correct my observation, or explain why lack of avalanche effect is not dangerous?


texts: Why does RSA 1024 provide lower security level than EC256?

texts: And why do we have to use big numbers for RSA? Is it because of some RSA restrictions like p=q=3 mod 4?


texts:
Sorry for the newby question but would this work: Alice encrypts a message X with John's public key to form Y. Alice then encrypts Y with Bob's public key to form Z. Alice then sends Z to Bob and John.

Would I be correct in assuming that to decrypt Z,  Bob would have to use his private key on Z to get Y.  After this John would have to decrypt Y with his private key to get X?

Thanks


texts: Is this design of client side encryption secure?

texts:
I want to build a secure file storage web application. Users should be sure that server doesn't know how to decrypt files so encryption should take place at client side (i.e. in Javascript) and TLS will be used. Also public key cryptography is required as users should have possibility to send files to each other.

I plan to have encryption process like this:

SymmetricKeyAlgo(file, AssymetricPublicKey)

And decryption is:

SymmetricKeyAlgo(encFile, AssymetricPublicKey(EncryptedAssymetricPrivateKey, SlowS2K(password)))

where AssymetricPublicKey, encFile, EncryptedAssymetricPrivateKey are stored at server and all computations (encryption, decryption, hashing) are performed at client.

Output of AssymetricPublicKey(EncryptedAssymetricPrivateKey, SlowS2K(password)) has a prefix that is used to check whether password is valid. Prefix is fixed and is the same for all messages. It's truncated before supplying output to SymmetricKeyAlgo.

It seems that similar scheme is used by OpenPGP.

I know that there are existing OpenPGP implementations in Javascript but they are very large and not widely-used. I feel that it will be better to use more trustworthy cryptographic primitives supplied by SJCL (AES, PKDF2, key generation). But I haven't found trustworthy asymmetric encryption library.

Is this design right? Or should I use full OpenPGP for my purposes? Is there anything else I should think about?

Edit: Public keys aren't secret and can be sent to anyone. Every user has unique username. When Bob wants to send file to Alice, he sends Alice's username to server, server maps this username to public key and returns it to client. Thus Mallory can't trick Bob to send file to her instead of Alice.


texts: How can I calculate the probability of collisions of a hashing algorithm?

texts:
I'm pulling a “Dave” and I'm designing my own hashing algorithm.
Not that I intend to use it, I'm not certifiable or anything,
I just want the challenge of creating something. I'm not going to get into exactly what I'm doing, because it's probably worthless anyway. I just wanted some advice on how to calculate the chance of collisions.

So, if anybody can enlighten me on how to calculate the probability of collisions happening, I'd greatly appreciate it.


texts: If G is a secure PRG and G' is a function of G, is G' secure?

texts: For example: for secure PRG G if I have a G' s.t. G'(k) = G(k)||0, is G' necessarily secure? This question is not for the above example only but for any other possibilities as well. My thinking is that since G is secure (ADV is negligible and PRG is unpredictable), then no matter what I do with G to make G', G' is secure.


texts: Is allowing both digitalSignature and keyEncipherment certificate usages a bad practice?

texts:
From what I see, many server and client RSA certificates in the real deployments have the "key usage" mask containing both digitalSignature and keyEncipherment.

Isn't this a bad (that is, potentially insecure) practice, given that there's a general guideline to use separate keys for different purposes?

As an example of protocol that appears to freely switch between this two, take TLS 1.2. If the key exchange method, that was negotiated between the client and the server, is ECDHE_RSA, then the digital signature capability of the certificate will be exploited during the handshake; if, on the contrary, the method is plain-RSA, then the key encipherment capability will be used. And these two specific instances are probably still widely used - assuming this after checking which methods have been deprecated by the most popular browser Chrome and which have not.


texts: Multiple AES/ECB encryptions of different data with same key all end with same pattern

texts: We have used "AES/ECB/PKCS5Padding" with a 256 bit key. We encrypt different streams of data (blockwise) with the same key. Each encrypted stream ends with same pattern.  What is the reason for this?


texts: Security of Homomorphic encryption schemes

texts:
Usually for cryptosystems the security is denoted as a $2^n$-bit security such as 256-bit, 1024-bit, 2048-bit etc whereas I came across homomorphic schemes mentioning 80-bit and 96-bit security.

Is this secure enough? Why does it not follow the $2^n$-bit security?


texts: Communication cost of Oblivious Transfer and OT Extension?

texts:
Suppose there exist fixed K set of N-bit strings.
Here, sender and receiver perform 1-out-of-K OT either once or many times.
In the latter case, we may use OT Extension.

What is the order of the communication cost of Single base-OT and OT Extension??

If we do a single 1-out-of-$K$ OT, is the communication cost $O(N)$ or $O(KN)$?
If we do OT extension to invoke  $m$ independent 1-out-of-K OTs, is the communication cost $O(mN)$ or $O(mKN)$?

Best,


texts:
Paillier's scheme assume has message and ciphertext space equal to $\mathbb{Z}_N$ with $N=pq$, that is $N$ is the product of two different primes.

Is there a way to generalise this for $N$ that is the product of many ($>2$) different primes?


texts:
Mainly I'm trying to understand how to correctly create the Key and IV for use with the .NET Implementation of AES (AesManaged class).

This encryption code will be used in conjunction with existing customer records in a database.

Here is the process that I've come up with.  First, get the key from an encrypted web.config and get a byte array using the Rfc2898DeriveBytes class.  The salt is a constant.

public static byte[] GetKey(string key)
{
    var deriveBytes = new Rfc2898DeriveBytes(key, _salt);

    return deriveBytes.GetBytes(32);
}

Next, generate another byte array for the IV given the User's ID and the same salt from above.  This method is essentially the same, but returns an array with 16 bytes instead of 32 (and the input is the User ID, not the key).

public static byte[] GetKey(string text)
{
    var deriveBytes = new Rfc2898DeriveBytes(text, _salt);

    return deriveBytes.GetBytes(16);
}

Given the Key and the IV I use a CryptoStream to encrypt the data:

var aesAlg = new AesManaged();

// Create an encryptor to perform the stream transform.
var encryptor = aesAlg.CreateEncryptor(key, iv);

// ... Code that uses the Crypto Stream

Main question(s):

Is there a better/different class that I should be using instead of Rfc2898DeriveBytes?  It seems funny that the class name references an RFC.
Is the use of a constant salt bad?  I'm doing this so that I don't need to store any additional information on the User record.  Other examples I've seen use a constant IV, but a random Salt.  Are those 2 scenarios essentially the same?


texts: Cryptanalysis in the middle ages -- publications

texts:
Are there any publications, articles or literature discussing cryptanalysis and crypt breaking techniques in the middle-ages?

I have seen various manuals from the middle ages describing various types of encryption, also mentioning that Caesar substitution cipher can be easily broken, but I cannot find any information on algorithms and knowledge they used to do so.

Update:

I've found first description of substitution cipher breaking called unfolding at John Wilkins (1641) Mercury: Or the Secret and Swift Messenger, page 88 and further, chapter XI.: The General rules of unfolding ..., available online: https://archive.org/stream/gu_mercuryorthes00wilk#page/n111


texts:
I use AES both CBC and CBC-MAC to encrypt some stuff. I generate one key for CBC and one different key for CBC-MAC.

Does the second key (for CBC-MAC) need to be secret?
How to join such key with the ciphertext? By contatenating it at the end?


texts: Is there a name for encrypting a decimal number using a one time pad?

texts:
I asked a question somewhere else on stack exchange and had to put something like "using the numerical one time pad the user can create their encrypted message by hand". Is there a better way of saying "numerical one time pad"?

The following is an example of what I'm trying to describe:
key:                                 7 1 6 3 1 3
message:                             0 5 0 9 9 9
ciphertext = (message + key) mod 10: 7 6 6 2 0 2

Most OTP examples use mod 26, and most computer programs use mod 2 (XOR), but I'm trying to describe encrypting a decimal number specifically.


texts: Could a fixed RSA encryption be used instead of a salt to prevent rainbow table attacks?

texts:
It's common to use a salt before hashing a password in order to prevent an attack by rainbow tables.
Would it also work to encrypt the password for instance by RSA encryption - by a permanent RSA private key stored on the server - before hashing?
In other words: $hash = SHA(RSA(password))$
For me this looks secure because rainbow tables wouldn't work with the encrypted cipher $RSA(password)$, would they?
(Side note: Since that RSA private key is not used for encryption at all, it would never have to been replaced...it would just work as a totally deterministic pseudo-random function in this case!)


texts: How can I validate a given Server-Certificate behind a HTTPS-connection?

texts:
I know more or less about how TLS works in principle.

But how can I be sure, that the certificate behind a server's web site (e.g. tele-banking from my bank) has been issued to my bank and not to someone else.

Let's say there is a faked tele-banking portal, to which I get connected accidentally. If they got a certificate issued by a CA, everything works and my data are transmitted to the fake site.

So I would have to check the certificate every time I use the portal.
But how? My bank says:

  The Bank XXX login pages are encrypted and therefore begin with
  "https://". Always check the owner of the security certificate, which
  must be "XXX Bank XXX" with the Internet address is
  highlighted in green color prior logon to your OnlineBanking.

Now, virtually everybody can get a signed certificate with owner="UniCredit Bank Austria" from a CA. Does CA-1 know about other certificates issued by any other CA-2? I cannot imagine that this is the case. But how can I be sure, that the certificate I want to rely on is not a fake?


texts: I'm implementing Shamir's Secret Sharing Scheme, but I've hit a conceptual roadblock.  In Shamir's paper "How To Share A Secret" he creates his shares an a finite field of order p, where p is some prime larger than both the secret and the number of shares.  I understand why this needs to be done to ensure an even distribution of the shares.  However, in nearly every implementation I've seen, GF(256) is used.  I know that this is technically okay, since it is still GF(p^k), but why is this preferable to just using a prime field?  In the prime field, only modular arithmetic is needed, but with GF(256), you end up writing a ton more code and it is much less intuitive.


texts: Is it okay to use a variable-time RSA implementation to verify TLS certificates?

texts:
RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty.

However, TLS certificate validation involves no secrets.  Therefore, I should be able to use a fast variable-time algorithm for this purpose, right?

Is this actually secure, and does anyone actually do this?


texts:
The RSA assumption:

Given a randomly generated RSA modulus $n$, exponent $r$ and a random $z \in \mathbb{Z}_n^{*}$, find $y$ such that $y^r=z$.

The strong RSA assumption:

Given a randomly chosen RSA modulus $n$, and a random $z \in \mathbb{Z}_n^{*}$, find $r>1$ and $y \in \mathbb{Z}_n^{*}$ such that $y^r=z$.

In the strong RSA assumption usually they say that "$r$ may be chosen in a way dependent on $z$, while in the usual RSA assumption $r$ can be chosen in a way independent of $z$".

What is meant by in a way dependent on $z$? How can one achieve such dependancy? I'm very grateful if someone can explain this.

Even by substituting some values to $n$, $z$ etc. would be great and would help me to understand more.

Thanks a lot in advance.


texts: DES 1-bit changes to inputs: why when I change two inputs by only one bit I get predictable results?

texts:
I expected a 1-bit change to two inputs (same key) would provide differences to 50 per cent of the output bits (on average). But this is not the case when I tested it. However, for two 'identical' inputs but with keys different by one bit, the differences 'were' as expected. Why is this so?

Example 1 (same key, two inputs different by only 1 bit)

Key:    0123456789ABCDEF
Input:  0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
Output: 56CC09E7CFDC4CEF56CC09E7CFDC4CEF56CC09E7CFDC4CEF

Key:    0123456789ABCDEF
Input:  1123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
Output: 236617CA247292D156CC09E7CFDC4CEF56CC09E7CFDC4CEF

The two outputs are identical from the 17th character onward.

Example 2: (keys different by 1 bit, inputs identical)

Key:    0123456789ABCDEF
Input:  0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
Output: 56CC09E7CFDC4CEF56CC09E7CFDC4CEF56CC09E7CFDC4CEF

Key:    1123456789ABCDEF
Input:  0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
Output: 472C14ED890C7CB5472C14ED890C7CB5472C14ED890C7CB5

Here the outputs are completely different. As one would expect.


texts: LUKS multiple key slots - what's the intuition?

texts:
LUKS volumes have the ability to allow multiple independently usable passwords, as explained here:
[https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions]

The intuition behind basic encryption with a single key is pretty straightforward.

ciphertext = BIG_FUNCTION(plaintext, key)
plaintext = BIG_FUNCTION^(-1)(ciphertext, key)

Can anyone explain how a LUKS volume can permit independently usable passwords? I'm just looking for the intuition - not necessarily a detailed explanation of how LUKS in particular handles this.


texts: Is there any obstacle if we restrict in Paillier the plaintext values to be drawn from $\mathbb{Z}_N^*$ instead of $\mathbb{Z}_N$ as the original scheme indicates.


texts: Calculate how many possible key pairs exist in RSA

texts:
"Calculate how many possible key pairs exist"
Found these through searching. Not sure if either are correct. I would've assumed the number would be infinite.
phi(n) - 1
phi(n)/2


texts: Hash functions vs Stream Ciphers in terms of Speed

texts:
We know that it's possible to create a hash using a stream cipher (for instance, RC4 or AES in Counter Mode). As stated here: "A Pseudo Random Generator (PRG) and a hash function are both Pseudo Random Functions (PRFs), but they have different security considerations". Whether or not it's advisable to do so, is there a correlation between the way of a hash function being created and its speed? For instance, are cryptographically secure hash functions (such as SHA-1) faster than a hash function created using a stream cipher, or the opposite? Is each case entirely different?

Take this paper as an example. In page 6 you'll see the protocol. As described, the protocol uses a PRG which takes as an input something of size k and produces something of size m. The authors say that they implemented the PRG using AES in Counter Mode. The reason for not using a hash function is because we want the output to vary and sometimes being really big (say 100.000) where when using a hash function the output is fixed (i.e. 160 for SHA-1). For the sake of argument, let's say that the size of the output is not a problem (we use something small like 160) and that we don't take security into consideration.

Which PRG would be faster? A stream cipher (like AES in Counter Mode) or a Hash Function like SHA-1?


texts: What is the use of encoding a hash output?

texts:
In many applications, the MD5 algorithm is used which produces a 128-bit output which is represented as a sequence of 32 hexadecimal digits.
This output is further encoded using a base62 or base64 scheme.

I wanted to understand what is the need for further encoding the hash value.
Why could we not use the same hash value and store it in our databases?

Is it done to reduce space consumption?

Based on my understanding, the MD5 hash output is 16 bytes. When we encode it using the base64 scheme and produce 8 char long string, it will be 8 bytes.


texts:
I need help to understand how RC6 works. Many sites show that the maximum key size of RC6 is 2040 bits (255 Bytes). I can also have 0..255 rounds and 4 times 32bits words in the 128bit block variant or 4 times 64 bits Words in 256 bit variant. For this question assume 20 rounds

If expansion massive S[0,�,2r + 3]  => max = 2*20+3=43 * 4bytes = 172bytes. If it is really possible to have a key consist of up to 255 bytes then array S is too small. Where does my calculation go wrong?

Input: User-supplied b byte key preloaded into the c - word array L[0,�,c-1]

Number r of rounds

Output: w-bit round keys S[0,�,2r + 3]

Procedure:

S[0] = Pw
for i = 1 to 2r + 3 do
    S[i]=S[i-1]+Qw

A=B=i=j=0
v=3 ? max{c, 2r+4}

for s=1 to v do
{
    A=S[i]=(S[i]+A+B)<<ɛ
    B=L[j]=(L[j]+A+B)<<<(A+B)
    i=(i+1) mod (2r+4)
    j=(j+1) mod c
}


texts: How does the process of creating a new secure Elliptic Curve look like?

texts: I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. In this case, how do I go about creating new curves? Are there specific algorithms that Cryptographers / Mathematicians use? Or is it just improvising on similar work?


texts: How are attributes encoded in private keys in Attribute-Based Encryption?

texts:
I understand how private keys are generated from public keys in a setup like Bitcoin (using ECDSA).

I understand that anyone can verify they have the 'correct' private key using a digital signature in this setup.

In either KP-ABE or CP-ABE, how are either attributes or access policies 'encoded' into the secret keys/ciphertext?  Is there a specific algorithm that then allows the owner of the key to prove that that key is generated using those attributes?


texts: Pollard's Rho - Restricting the random function to the exponents

texts: Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, however, that a uniformly random distribution on $\mathbb{Z}/n\mathbb{Z} \times \mathbb{Z}/n\mathbb{Z}$ induces a uniform random distribution on $G$ via the map $(a,b) \mapsto g^ah^b$ where $g^x=h$ is the DLP we aim to solve. So instead of looking for functions on $G$ which behave uniformly random, we might as well restrict ourselves to 'random' functions on $\mathbb{Z}/n\mathbb{Z}$ and proceed as usual with Floyd and the collision detection. However, as far as I can make out nobody has used this so far; is there something I am missing as to why this does not work, or is it simply not useful enough to be used in practice?


texts: a secure system in the perfect sense verifies the definition of perfect security. My question is as follows: There is always a way to check for perfect security by solving the first degree equation by finding k? for example if i have c = (k * m) xor mod7


texts: How to calculate the odds of finding "20" at least three times in a sha256 string?

texts:
For example, what are the odds of this happening:

Can this even be calculated?


texts: Access Structure Secret Sharing -- How to find complement of an access structure?

texts:
I'm looking for the complement definition of an access structure $AS$. I'm lost trying to find the complement of $AS$, $\overline{AS}$. Can someone explain what exactly is happening or provide a source for this?

$P = \{p_1,p_2,p_3,p_4 \}$

$AS =\{\{p_1,p_2,p_4 \}, \{p_1,p_3,p_4\}, \{p_2,p_3\}\}$

$\overline{AS} =\{\{p_1,p_2\}, \{p_1,p_3\}, \{p_1,p_4\}, \{p_2,p_4\}, \{p_3,p_4\}\}$

$t = |\overline{AS}| =5$


texts:
Is there a good reason not to write encrypted data in-place?

From the iOS 10 Security Guide:


texts: Reverse engineering secret key in RSA encryption with the help of signature

texts:
Consider the following:

$i$th message, $m_i$, in its original state.
$i$th message, $M_i$, encrypted message $m_i$ using public key.
Public key, $p$, in a $b$-bit RSA encryption setup. We can access it at all times.
Secret key, $s$.
Signature, signed by $s$. We will denote it as $sg$.

The scenario is such that we are presented with an encrypted message $M$, the public key with which it was encrypted, and the message $m$, which has been decrypted using the secret key and returned to its original state.
We also have a signature, signed as $sg$.

I understand that given simply $m_i$, $M_i$, and $p$, it is not possible to work backwards to obtain $s$. However, would it be possible to work backwards and obtain the secret key $s$ given enough instances of corresponding messages?
Suppose we are given pairs of messages, $(m_1, M_1), (m_2, M_2), \ldots (m_n, M_n)$, then would we get anywhere nearer towards obtaining the secret key (or maybe even increase our chances for a bruteforce search) as we approach a certain $n$? In that case how high an $n$ are we talking about?

Now consider we can vary $n$ to as much as we want. $n \rightarrow \infty$ Essentially, we have been given a frontend for the RSA implementation such that we can give it a message and it will return the encrypted message to us, as many times as we want but will not reveal $s$ (obviously). In this case, will we be able to reverse engineer $s$?

I have recently got to know about asymmetric encryption and these questions are a part of understanding it better, so I would appreciate it if anyone can offer some valuable insights!


texts: Does HMAC provide anything that AEAD does not?

texts:
Alice and Bob have to talk through Eve. (server to device through untrusted third party that relays messages, no TLS available)

Assume a secure key. Out of scope. Example, ECDH key exchange with HKDF.

Each payload has associated data. Time, version, type, etc. Data that is used to get a message to the correct function in Alice or Bob. The transport protocols have none of this in their designs.

Message authentication is important, so HMAC. Message payload encryption is sometimes important so at least occasionally AES-GCM128 on payload. Most of the time the payload data is not confidential. AES-GCM128 AEAD could cover both use cases.

Constrained device. Overhead for nonce, keyid, time, time are noticeable. Compiled size for both algorithms also a factor.

If I need to support AEAD sometimes, is it reasonable to just use AEAD all the time and skip HMAC entirely?
HMAC should be faster, but how much? I’ll need to test this, but suspect the difference might not be huge.
Is there an advantage to HMAC other than speed and being able to debug data that remains in clear text? Only other thing I know is smaller unpadded payload data.
Slightly aside, but does HMAC or AEAD benefit from including their nonces in the hashed / additional data? My replay attack prevention will mostly revolve around server time delivered to device on connection included in each message.


texts: Use of symmetric keys rather than asymmetric keys for transport security

texts:
Alice has an asymmetric key pair and it also has Bob. They want to encrypt traffic between each other. It would be simple to encrypt the traffic with their public keys, but instead they use key pairs to generate symmetric keys, which are then used to encrypt traffic.

Why would you not directly use the asymmetric keys?


texts: How does GRC password generator get 512 bit of secret data?

texts:
I'm trying to understand how GRC password generator can get 512 bit of secret data while encrypting 128-bit of data.

The generator address is located here: https://www.grc.com/passwords.htm
See the "The Techie Details" section at the end of the webpage.

They wrote:

  The result of the combination of the 256-bit Rijndael/AES secret key,
  the unknowable (therefore secret) present value of the 128-bit
  monotonically incrementing counter, and the 128-bit secret
  Initialization Vector (IV) is 512-bits of secret data providing
  extremely high security for the generation of this page's "perfect
  passwords". No one is going to figure out what passwords you have just
  received.

Diagram they provide:

What I tried is

I made a new IV (128-bit):

Buffer([00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00])

A monolitic counter - what is actually encrypted (128-bit):

Buffer([00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01])

An encryption Key (256-bit):
, 32 bytes)

Buffer([00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00])

They XOR the IV with the monolitic counter (or the last encryption result with the monolitic counter, if there is a last result).

They say it gives them 512-bit of secret data. But when I encrypt everything I get 16 bytes (128-bit) of data:

<Buffer ad 86 de 83 23 1c 32 03 a8 6a e3 3b 72 1e aa 9f>

How do they get 512 bit of "secret" data? And how they XOR 512bit of data with 128-bit from the monolitic counter?


texts: Which one is correct probability formula for the same master secret value in identity-based encryption

texts:
Assume two servers $(n=2)$ use the same domain curve parameters and same hash function $H:\{0,1\}^{*} \rightarrow G_{1}$ . Then the hash value for the same identity falls in same result and let it be P by assuming $P \in G_{1}$. Then the probability for the same private key depends on secret value $a,b \leftarrow Z_{q}$ where q is a large prime number and (a) and (b) be the master secret value of two servers. In this scenario, the probability of $(a=b)$ can be $\frac{1}{q}$ or calculated using birthday problem?
In elliptic curve with field order 512 bits, then q=170 bits
According to simple probability
$p(n)=\frac{1}{q}=\frac{1}{2^{170}}$, the probability does not depend on $(n)$.

According to birthday problem,
 $p(n)=1-\frac{q!}{q^{n}(q-n)!}$
substituting value for (n=2) (q=$2^{170}$), then the probability will be 0.1.
Which one is correct?


texts: Messages exchanged between Bob Alice are encrypted safe?

texts:
Can you help me understand the following reasoning?

If Alice sends Bob a message and that message is encrypted with two keys simultaneously: a symmetric key (Ks) and Bob's public key. The symmetric key (Ks) is also sent to Bob, encrypted with the private key of Alice. The conclusion reached from this exchange of messages is that Bob can not be sure that the message was written by Alice but Alice can be sure that only Bob can read.

But how can we reach this conclusion: Bob does not know if it was Alice who wrote if he had to get the public's Alice for the symmetric key (Ks)?


texts: I'm curious on methods of encrypting files using C++

texts: I'm making a personal security tool in C++ and was curious how I would go about encrypting files in C++. If anyone has a method that would be great, and more specifically I was interested in 3DES encryption.


texts: I am supposed to prove that $x = y \mod (pq) \iff x = y \mod p$ and $x = y \mod q$ with $p$ and $q$ are prime numbers. It somewhat sounds reasonable to me, but unfortunately I don't have any clue how to prove it.


texts: Relationship between "Entropy" and "Security" in crypto functions

texts:
There is a lot of confusion between "entropy" and "security" of a cryptographic function.

I like to visualize it as the entropy being the water, and the crypto function being a glass.

So for instance, the maximum security a hash function offers, is only as much as much entropy we add into it.

For example:
If we have an n bits of entropy input and a SHA-512 hash function. The SHA-512 is like a glass that is 512 size but we pour into it n bits of water, it will only have n bits of security.

If n>512 then the glass is full, and the excess water drips out, meaning that every bit of entropy above that is useless, since the attacker will just brute force the glass itself
If n=512, then the same is true
If n<512, then it's easier for the attacker to go through the 2^n permunations insteand of trying 2^512 permutations

And this is easy to understand with a small example, think of a dice roll

It has 2.5849625007 bits of entropy
The entropy is a uniform random number between 1-6

If we hash the random number we won't get 512 bits of security, because if we have 2 attackers:

one will try to brute force the 512 bit hash of the random number
while the other attacker will just go through the 2^512 combinations of the input, which he will find after 2^2.58 ones

So it's obvious that we only have 2.5849625007 bits of security, even though we poured our water into a 512 bit glass.

So the size of the hash function is only a maximum security, provided if the input has minimum that amount of entropy. Otherwise the output has only as much security as the input.

Is this a correct way of interpreting cryptographic security?


texts: How do you break encryption on a message?

texts:
This may seem like a simple question, but I have just started studying cryptography and I can't seem to find any information on this at all. I am trying to write a "simple" encrypted messenger using Java's Cryptography Architecture and Extensions, and I have been studying pentesting on the side, and I was wondering if there was a way that I could test the security of a message I encrypted using any tools (more specifically in Kali.)

This has led me to a more general question that I cannot seem to find an answer to. Google seems to be awash with news about PGP being broken, or the NSA being able to beat encryption, but how exactly are they doing it? Is the assumption that if you have the message, you would also have the hash of the key used to decrypt it, and to decrypt it involves breaking the hash of the key, or is there anything that actually breaks an encrypted message without the key?

Things like John the Ripper seem to only be able to attack password hashes, and I guess you couldn't brute force an entire encrypted message as that could be tens of thousands of characters with an insane number of possible permutations.
Also, would it change anything if you encrypted the message based on a password instead of a cryptographically secure random number? I wanted to try and set up a little cryptographic challenge where the password could be something short so it would not take long to crack, but I can't find any way of testing different password against an encrypted message - even if you know the encryption algorithm?

It may well be that the answer is not a simple tool, but some incredibly complex set of tasks, but at this point, I would just like to know even the general answer so that I can piece together in my mind how this stuff works! Like I say, it is hard to google as all I can find are answers relating to cracking passwords, which I guess is the "sexier" thing to want to try and do, then to try and decrypt a message!

Thanks in advance,
   Chris


texts: Is it possible to derive the midstate of a sha256 hash?

texts:
Let's say I have an unknown string with the known sha256-hash of it. I was wondering if it was possible to now calculate the sha256 of the concatenation of the unknown string and "abc".

(In PHP: hash('sha256', $unknownString .'abc');)

I thought in order to do so "all I need" is to go from the hash that I know back to the midstate of the sha256 algorithm (in most implementations called finalize) and append the data that I want (via, in most implementations called, update) and then call finalize again. Block lengths shouldn't be a problem because the unknown string has a length of 256 bit and my own string has this as well.

Is this possible or by the way sha256 is designed impossible to achieve?

PS: I have no intention in getting the unknown string. I absolutely do not care about the plaintext contents of this.


texts: Computations in extended finite field p^2

texts:
I would like to construct a distortion map from a point $\in \mathbb{F}_p$ to $\mathbb{F}_{p^2}$.
If I have an elliptic curve $Y^2 = X^3 + 1$ over $\mathbb{F}_p$ and a distortion map $\phi(x,y) \rightarrow (\beta x,y)$ that gives a point of the form $\{a+bi : a,b \in \mathbb{F_p}\}$ in $\mathbb{F}_{p^2}$.  Do my computations are the right ones ?

Here is the results of pari/gp :

? p = 821
? q = (p+1)/6
? E = ellinit([0,1]*Mod(1,p));
? until(ellorder(E,P) == q, P = random(E));
? P
%5 = [Mod(277, 821), Mod(137, 821)]

? u = ffgen(p^2, u);
? until(z != 1, z = random(u)^((p^2-1)/3));
? E2 = ellinit([0,1],u);
? elladd(E,P,P)
%9 = [Mod(415, 821), Mod(20, 821)]

elladd(E2,P,P)
%10 = [415, 20]

elladd(E2,P,[z*P[1],P[2]])
%11 = [544*u + 544, 684]

[z*P[1],P[2]]
%12 = [277*u, Mod(137, 821)]

Is the $u$ in pari/gp the $i$ in $a+bi$ ? I consider it as such in my computations.
Here is what I did using the elliptic curve addition algorithm :
For the simple addition P+P over $\mathbb{F}_{821}$, I have the same answer :

$\lambda = \frac{3.277^2}{2.137} = \frac{307}{274} = 307.3 \pmod{821} = 100$
$x_3 = 100^2 - 277 - 277 = 415$
$y_3 = 100.(277-415)-137 = 20$

So I get the same point (415,20) for the case in $\mathbb{F}_{821}$
Then after, with $z = i$, I take $\phi(P) = (277i, 137)$:

$\lambda = \frac{137 - 137}{277i - 277} = 0$
$x_3 = 0 - 277i - 277 = 544 + 544i$
$y_3 = 0.(277 - ((544 + 544i))-137 = 684$

And I get the point $(544 + 544i, 684) \in \mathbb{F}_{821^2}$ which is the right answer following the result of pari/gp.
Do I have any errors in my computations ?


texts: When using CBC-ESSIV for disk encryption, why does the generation of IV require a hash then encryption instead of only one hash?

texts:
The CBC-ESSIV algorithm specifies how to calculate the IV to use for a given key (K) and sector number (S) as the following:

$$\text{IV} = \operatorname{Enc}(\operatorname{Hash}(K) , S)$$

https://en.wikipedia.org/wiki/Disk_encryption_theory#Cipher-block_chaining_(CBC)

This is to ensure that the IV is unpredictable to an attacker.

I am wondering why not simply hash the key followed by the sector number and eliminate the extra computation required by the block encryption:

$$\text{IV} = \operatorname{Hash} (K \mathbin\| S)$$

Would not this be equally secure but more efficient?


texts: How much entropy is lost if 1 character is fixed in HMAC SHA-512?

texts:
We have an entropy source called “Entropy”. We encode this entropy with HMAC-SHA512 using a “Key”. The Key is public, but the Entropy is secret. We are then testing for the HMAC-SHA512 output in order to start with 1.

So, how much entropy is lost in the process, by encoding the secret Entropy with a public Key, and making sure that the output starts with 1?

For example:

Entropy     = random 132 bit integer
Public Key  = Test
HMAC-SHA512 = 1f042a41f2a940c38e64146823abd7926acb9d26cf02ee50f637dd5fb37c60c4d582603abe789138fa51a0496a6840b6e03e9b38d886e6bc6fd337f284a1052f

In our case we would search for a random integer until the HMAC-SHA512 output of it encoded with Test will start with 1 like 1f042a41f…

So in our case the final "not so random number" is:

467315884026680443925332907127019473008

How much entropy is lost in this process?


texts: Existence of 99% successful unbounded adversary against randomized secret key encryption scheme with short keys

texts:
It can be shown that if $E$ is a deterministic encryption with key of length $n$ and messages of length
$l\geq n + 10$ then there exist two messages $m_0$, $m_1$ and a strategy for Eve so that
given an encryption $c = E_{k}(m_b)$ for random $k$ and $b \in \{0, 1\}$, Eve can output
$m_b$ with probability at least $0.99$. (Eve is computationally unbounded)

Proof is shown here (in the last page): http://www.boazbarak.org/cs127/chap01-introduction.pdf

Now, I would like to prove the exact same thing for random encryption algorithms that use, say n, random bits.
The problem is that the set of all possible encryptions of a certain message can be much larger. Let's say $E$'s random bits are $r\gets\{0,1\}^n$ drawn uniformly, then the set $\{E(m;r)\}_{k,r}$ can have size $2^{2n}$ which might be (much) larger than $2^l$ where $l$ is the length of messages.

Comparing to the deterministic proof, it is not hard to show that if we still choose $m_0$ arbitrarily and use the same kind of decision rule for $A$ the adversary, there exists a randomized $E$ and some $m_0$ such that for every $m_1$ the probability for $A$ to be correct is bad. So in order to deal with the randomized case, we must not choose $m_0$ arbitrarily or come up with a new decision rule for $A$.

Our only assumption is that $D_k(E_{k}(m;r))=m$ for all $r,m,k$. (The decryption algorithm cannot "miss")

I was wondering if anyone could offer a useful observation or any hints.


texts:
Based on the NIST submission it looks like the SPHINCS+-256s algorithm comes in at public key sizes of 64 bytes, private key sizes of 128 bytes, and signature sizes of 29,792 bytes.

What I can't seem to locate (or understand from the submission documentation) are implementation details suggesting how to use it.  For that I have the following questions (all specifically for the SPHINCS+-256s algorithms)

How many signatures can you safely get out of it?
Are the signatures one-time use, or can you sign something and have it verified repeatedly without giving up the private key?  (I'm assuming this is the "stateless" aspect, but want to be certain I'm not misunderstanding it.)
Are there any specific caveats involved?

The protocol I'm thinking of implementing with it would be along the lines of:

Publish the public key, signed with a different signature algorithm.
Retain the secret key.
Sign N messages, post signatures and messages publicly for verification.

What I'm trying to avoid would be the one-time signature aspects of most hash-based signature protocols where you sign something, distribute the thing, then post the solution proving you signed it at some later point while simultaneously making it unverifiable to future parties (since you give up the private information in the process of proving the signature belonged to you.)


texts: Help in understanding exactly how lattices used as one way functions for hashing

texts:
I am doing a cryptography course via long distance and we have been given an assignment which is based on lattice-based cryptography. I have spent the majority of the past week sifting through papers and videos in an attempt to build my understanding of the subject, but due to the intensely technical manner in which information on the subject is presented, I have not been able to answer many questions in my mind. Due to the structure of my long distance course I have no access to professors or extensive libraries so my question is one which merely seeks to increase my understanding, please bear with me.

Thus far I have understood that:

Lattices are a collection of regularly ordered points in euclidean space (its terms like this which have caused me to be searching for answers for days)
A lattice may be defined through n vectors called a basis where n = the dimension (for now I am working in dimension 2), and any other basis can be found by applying positive or negative multiples of each vector in the basis to another vector in the basis
Defining a lattice L1 as a set of points allows one to multiply the whole set by some co-efficient which will essentially transform it into a new lattice L2
The determinant of the vectors of the basis essentially tells us the volume (area in 2 dimensions) of the parallelpiped which will be repeated to form the lattice, the lattice points being the vertices.

Having said this, I am now stuck in understanding how I move all of this to cryptography. I am on a question which asks me to compute the output for 3 inputs to a function:

  We will see that q-ary lattices give provably collision-resistent hashing. We choose integers q; a and b. Our hash function (presented by Mikl´os Ajtai in a breakthrough paper in 1996) is a 2-variable function: h(x, y) = ax + by mod q.
  (a) For q = 5; a = 14; b = 13; compute h(17, 8), h(21, 16) and h((17, 8) - (21, 16))

Having found the answers…

h(17, 8) = 14*17 + 13*8 = 342 mod 5 = 2;
h(21, 16) = 14*21 + 13*16 = 502 mod 5 = 2;
h((17, 8)-(21, 16)) -> (h(-4, -8) = 14*-4 + 13*-8 = 160 mod 5 = 0

I believe this means that with the first two points the lattice has been moved by some multiple of 5 plus two, which has displaced it by two and thus formed a new lattice. While in the last case, the lattice has been moved by a multiple of its determinant and thus is the same lattice.

However, I just cannot understand the link to hashing. In an application would the points be the cleartext and the answer modulo 5 the output of the hash function? If so would'nt there be too many collisions as we have already seen two examples of which give the answer 2? How exactly is this linked to the shortest vector problem or short integer solution if they are not the same thing? Are q-ary lattices aonly an attempt to store the basic pattern needed to reproduce the lattice? and if so wouldn't the lattice itself be the cleartext and the basic pattern (given by the basis and the determinant) the answer from the hash function? How exactly would you encrypt a message using a lattice?

I just wish I could find some text which explained this in English rather than symbols… like this http://www.wisdom.weizmann.ac.il/~odedg/COL/cfh.pdf . I really hope I have not repeated any questions through my lack of understanding. Thanks in advance.


texts: How to calculate active s-boxes from branch number?

texts:
If MDS in AES has branch number 5 (so 5 active s-boxes in 2 rounds), wouldn't that mean 4 rounds of AES has $5*2=10$ active s-boxes?

AES paper says it has 25 ($5^2$?) active s-boxes in 4 rounds.

How to calculate minimal active s-boxes from branch number for any given number of rounds?

Edit: J.D. noted that you can't calculate the minimum number of active s-boxes from the branch number of MixColumns, because MixColumns isn't the only operation. So let's assume cipher has full state MDS like SHARK and Khazad.


texts: Is it possible to determine the symmetric encryption method used by output size?

texts:
I'm attempting to identify the method of encryption for a black-box symmetric encryptor that produces blocks of output that are 4 bytes in length (e.g. small inputs fit in 16 bytes, then 20 bytes and 24 bytes as more input characters are added).

It's symmetric encryption and the value is always the same for the same input text. Is it possible to determine which method of encryption is used? I'm assuming it's a block cipher as a result of the blocks of output it produces.


texts: Do all forms of symmetric encryption require multiple pieces of information? (nonce, iv, etc)

texts:
I'm attempting to learn encryption and have a very basic grasp of it, but I have questions.

First, I'm looking to use AES.

I want to take text, encrypt it with AES using a variable-length key, and return encrypted text.  Then I'd like to pass in the encrypted text, the key, and get the original text back.  In other words: a Symmetric cipher.

It seems every AES mode that I can see requires a piece of data for decryption that seems problematic to store.  For instance, EAX has a nonce that needs stored.  CFB has an Initialization Vector (iv) that needs stored.

The way I see it is that I can store the iv in a second location from the encrypted text or I can generate the iv predictably every single time.

Is it considered secure to store the iv or nonce?


texts: Introduction to LLL algorithm applied to linear modular inequalities

texts:
What is the Lenstra–Lenstra–Lovász lattice basis reduction algorithm about?
How is it applied to solve for $x\pmod m$ a system of modular inequalities $(u_i\,x+v_i\bmod m)<w$ for $0\le i<n$?
I'm aware of this related question, but would like something introductory and detached from a Linear Congruential Generator. I understand the notion of basis of a vector space, but would not recognize a lattice or lattice basis should I walk by one.

If a numerical illustration is needed, perhaps consider the PRNG based on a LCG truncated to it's $k$ high bits, modulus $m=2^{k\,n}$, multiplier $a=8\left\lfloor m\,\pi/64\right\rfloor+5$, addend $b=1$, seed term $x_0=x\bmod m$, recurrence $x_{i+1}=a\,x_i+b\bmod m$, output $y_i=\left\lfloor 2^k\,x_i/m\right\rfloor$.
That can be expressed as $(u_i\,x+v_i\bmod m)<w$ as in the question for $w=m/2^k$, $u_i=a^i\bmod m$, $v_0=-w\,y_0\bmod m$, $v_{i+1}=a\,(v_i+w\,y_i)+b-w\,y_{i+1}\bmod n$.


texts:
For a school project, I'm trying to demonstrate a hash collision using Python.
This is the little piece of code that I'm trying to use (based on this answer):

from hashlib import md5
from binascii import hexlify

s1 = b'd131dd02c5e6eec4693d9a0698aff95c2fcab58712467eab4004583eb8fb7f8955ad340609f4b30283e488832571415a085125e8f7cdc99fd91dbdf280373c5bd8823e3156348f5bae6dacd436c919c6dd53e2b487da03fd02396306d248cda0e99f33420f577ee8ce54b67080a80d1ec69821bcb6a8839396f9652b6ff72a70'

h1 = md5(hexlify(s1))
print(h1.hexdigest())

This, however returns a completely wrong md5 hash of 9fe9cb63decce991b7783d9b783ee73f (expected: 79054025255fb1a26e4bc422aef54eb4).

My question is, what causes this error and how can I solve this?


texts: tweakable block cipher and ideal block cipher

texts: Can the set of block ciphers obtained from a tweakable block cipher (using distinct tweaks) be considered as the set of ideal block ciphers ?


texts: How can we add real values using GF field?

texts:
In GF($2^4$) usinfg primitive polynomial g(x) = $x^4 + x^3 +1$,
2+3 = 1 since 010 + 011 = 001,

2 + 2 = 0

Is there any encoding to get 2 + 3 = 5 and 2 + 2 = 4 in GF.


texts:
I have two questions regarding to statistical distance in distributions.

1: If $Z$ is uniform random variable over $N$ consecutive integers and
$m < N$ then $Z$ mod $m$ has statistical distance at most $m/N$ from the uniform
distribution over $[m]$ ($[m] = {0,1,2,...m-1}$). How this statement is true based on the definition of statistical distance

2: For independent random variables $X_1, X_2, Y_1, Y_2$ the distance between
the joint distributions $(X_1, X_2)$ and $(Y_1, Y_2)$ is at most the sum of statistical distances of $X_1$ from $Y_1$ and $X_2$ from $Y_2$. Similarly, if these variables are group elements in $G$, the statistical distance between $X_1$ ·$X_2$ and $Y_1$ ·$Y_2$ is no greater than the sum of statistical distances of $X_1$ from $Y_1$ and $X_2$ from $Y_2$. How can we prove this statement?

These questions are a part of the RSA accumulator paper by Dan Boneh et al.
Thank you for your help.


texts:
I have been thinking lately about a block cipher which takes a block of bits and arranges them in a square matrix.  Then defining transforms on submatrices of the square matrix to scramble the bits.  The key would be a sequence of bits, which identify specific transformations to apply to the submatrices.  To unscramble the block simply reverse the order in which you execute the inverse of the transformations.  Has anyone else done any research along these lines?

For example:
Given a matrix of 100 x 100 bits. Divide the matrix into overlapping submatrices.

Define the following operation codes:

00 - rotate each sub-matrix clockwise by 90 degrees.
01 - flip each sub-matrix about it's left to right downward sloping diagonal.
10 - flip each sub-matrix about it's let to right upward sloping diagonal.
11 - rotate each sub-matrix counterclockwise by 90 degrees.

Thus a 1024 bit random number would be a mini program for executing these transformations.  Each transformation is invertible and the sequence could be processed in reverse order.

In many ways, it is like scrambling a Rubic's cube.  And I know that there are algorithmic solutions for solving Rubic's cubes.  But if you don't know the colors of each square I wonder if such algorithms would be much help.

I know that such an algorithm might be more memory intensive and possibly much slower than existing encryption algorithms, but if high throughput were not a primary consideration could such a cipher be deemed secure?


texts:
What practical group signature schemes are out there ? By practical, I mean it's efficient enough to be used in a medium-to-large scale real-world application with possibly thousands-to-millions of users.

For example, I've found BBS signatures which seem to yield short signatures, but are they used in any real world application nowadays ? How fast is signing/verification with that scheme ?


texts: What should the nonce value be for client-side encryption?

texts:
I am using the following chacha20poly1305 Rust library to encrypt some data in a desktop application. The user provides the key, which never leaves their device, to locally encrypt some data, and then the encrypted data is sent to a server for backup purposes.
This library requires a nonce in order to encrypt the data, and I am not sure what this value should be. Ideally, the user could recover this encrypted data with their key alone. However, in order to decrypt any data, the nonce is also required. Hard-coding some nonce in the application feels odd, but if I randomly generate a nonce, the user will be required to remember this nonce along with their provided key in order to recover the encrypted data.


texts: How to encrypt with elliptic curve cryptography (ECC)?

texts:
I need to ask this, as I am not allowed to comment and don't quite understand an existing answer because I don't have a cryptography background and never looked into how ECC works.

Why can't you encrypt a message with a public key generated via ECC?
How can two peers Alice and Bob agree on shared secret (symmetric key), both of which having elliptic-curve-based public-private key pairs?
Could schemes be based on a plain Diffie-Helmann key exchange, where you use the other's public key as authentication (signing messages)?


texts:
I have $N=p\cdot q$ and the following system where I know $A,B,C,D, k$:
$$A = B \cdot q^k \pmod N$$
and
$$C = D \cdot p^k \pmod N$$
Is there an easy way to recover $p$ and $q$?


texts: Is it possible to construct a PRNG where the output numbers have a certain distribution of hamming weights?

texts:
I am in need of a non-uniform random number generator where each n-bit output has a hamming weight with a certain binomial distribution.

For example, I would like a non-uniform PRNG which generates 32-bit outputs with a hamming weight whose binomial distribution is n=32, p=0.1. For instance, 0xFF should be output with significantly less probability than 0x200, which in turn should have the same probability as 0x1.

Perhaps I can modify the output of a PRNG like xorshift or a LFSR to accomodate for this? I thought about rejection sampling the output, but the distribution of hamming weights for a uniform PRNG does not necessarily envelope a given binominal distribution with a variable parameter p, especially when p << 0.5.

I am not concerned about the cryptographic quality of the output. However, I am working on a 8 bit microcontroller with 2 KB SRAM, so memory and speed are both my primary concern. In the most naive case, I would just generate an array of random numbers and convert each element to 0 and 1 given a threshold probability, and finally convert this resulting array of 0's and 1's to an integer. But I would really, really like to avoid this memory overhead of an n-element array.


texts: Practical quantum attacks on SHA256 MAC and HMAC

texts:
Is SHA256 MAC (or HMAC) vulnerable to any quantum attacks?

Game setup:

The attacker's goal is to produce a valid MAC to be accepted by other devices in the ecosystem.  The ecosystem consists of many devices with a shared secret key (named "key).  The attacker can query an oracle with messages and get MACs.  The oracle only accepts 32 byte messages.  Oracle queries are rate limited to 10ms.  Can the attacker find "key" so that he can produce valid MACs faster than any classical attack.

MAC = H(message[32] | key[32])


texts: Should I assume that all exponent syntax in the description of a Diffie-Hellman-based protocol implies modding?

texts:
I am examining the SPAKE2+ protocol introduced in Chapter 9 of a paper called The Twin Diffie-Hellman Problem and Applications. I noticing the use of a lot of syntax that looks like exponents. I am just becoming familiar with the mathematics behind the Diffie-Hellman protocol so forgive my ignorance, but does this imply the use of a modulus or are the exponents literally meant to be exponents alone?

A diagram of the protocol itself is pasted below for convenience:


texts: Challenge - Response protocol - how to incorporate client randomness

texts:
I am designing a challenge-response protocol to enable a client to authenticate to a server.  The client has a private key, and a certificate (issued by a trusted CA).  At this point in the protocol, the server knows who the client claims to be, but wants to prove it.  My first attempt was:

$C ← S : r_S$

$C → S : S_C (r_S)$

where:

$r_S$ is a random challenge generated by $S$ (the server).
$S_C(r_S)$ is a signature of the challenge, signed with $C$'s (the Client's) private key.

The problem with that, is that the private-key + certificate may be used for other purposes than identifying the client to the server.  (For example, authorizing invoice payments.)  A compromised server could send the client the hash of an invoice payment authorization, and get back the necessary signature to authorize it.

Next attempt:

$C ← S : r_S$

$C → S : r_C, S_C (H(r_S | r_C))$

where:

$r_C$ is a random nonce generated by $C$.
H is a suitable cryptographic hash function
other terms are as above

Is this secure?  Specifically, can a compromised server use such a scheme to calculate $S_C(V)$ for some predetermined value $V$?

In particular,

would it be safer to put $r_C$ first in the concatenation?
and is simple concatenation good enough, or do I need to do something like calculate $\text{HMAC}_K(r_S|r_C)$ using a hardcoded key $K$ or even $\text{HMAC}_{r_C}(r_S)$ (using $r_C$ as the key to the HMAC)?


texts: Symmetric vs non-symmetric pairing based crypto

texts:
I am trying to find a comparison of how different pairing-friendly elliptic curves perform (in terms of security) in real world applications;

I am using PBC library, and it has type A curves and type D curves (also , i am having hard time understanding how pairing types depend on underlying curve types, and which of them have been broken/ or are considered insecure at the moment;

Type A

Type D

At first glance, there are 3 types of pairings, type 1(symmetric), type 2 (g1!=g2, g2->g1) and type 3; i understand that different algorithms require pairings to be either of type1 or type2 or type3;

I would also like to know more about why some algorithms are limited to certain pairing types.
Any references would be greatly welcome


texts: Why is SubtleCrypto API generating different signature for same data?

texts:
I am trying to generate key pairs using SubtleCrypto API in javascript and then using the same to sign some data using ECDSA algorithm. Documentation for the same can be found at this link.
https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/sign
An implementation of the same API can be found at this link.
https://github.com/diafygi/webcrypto-examples/

Now the problem I am facing is the signature produced by the API is different for the same private key and data, which should never be the case.

    var gprivateKeyobject = null;
var gpublicKeyobject = null;
var gsignature =null;

window.crypto.subtle.generateKey(
    {
        name: "ECDSA",
        namedCurve: "P-256",
    },
    true, //whether the key is extractable (i.e. can be used in exportKey)
    ["sign", "verify"] //can be any combination of "sign" and "verify"
)
.then(function(key){
    //returns a keypair object
    gprivateKeyobject = key.privateKey;
    gpublicKeyobject = key.publicKey;
    console.log('keys generated');
})
.catch(function(err){
    console.error(err);
});

var str = "hello test 1233";
var buf = new ArrayBuffer(str.length*2); // 2 bytes for each char
  var bufView = new Uint16Array(buf);
  for (var i=0, strLen=str.length; i < strLen; i++)
  {
    bufView[i] = str.charCodeAt(i);
  }
   console.log(bufView);

function sign()
{

window.crypto.subtle.sign(
    {
        name: "ECDSA",
        hash: {name: "SHA-256"}, //can be "SHA-1", "SHA-256", "SHA-384", or "SHA-512"
    },
    gprivateKeyobject, //from generateKey or importKey above
    bufView //ArrayBuffer of data you want to sign
)
.then(function(signature){
    //returns an ArrayBuffer containing the signature
    //console.log(bufView);
    console.log(signature);
    console.log(String.fromCharCode.apply(null, new Uint8Array(signature)));

})
.catch(function(err){
    console.error(err);
});

}

my console showing different signatures produced at consecutive calls to the function sign(which implies that private key and data to be signed must not have changed)


texts:
I can't get my head around  Pollard’s Rho Method for solving discrate log problem

I have read in a book:

  The basic idea is to pseudorandomly generate group elements of the
  form α^i · β^j

So,what are i and j

  We continue until we obtain a collision of two elements, i.e., until
  we have
  α^i1 · β^j1 = α^i2 · β^j2

Why does finding a collision mean that we have solved the problem??

I understand Pollard’s Rho Method for factorization ,but I can't see how it's similar to Pollard’s Rho Method for solving discrate log