texts:
I am really confused and need help on this problem related to TOTP as specified in RFC6238 here: https://tools.ietf.org/html/rfc6238#section-1.2.

So I am now given a task to implement the RFC6238 to generate a 10-digit TOTP password, which will be used in a POST request later on. The sample input and output for the TOTP is supposed to be like this:

Sample Input:

  Shared key: "ninja@example.comHDECHALLENGE003" (without double quotes)

  Hash function used: HMAC-SHA-512

  T0 = 0, Timestep = 30 seconds (as per specified in RFC6238)

  Expected TOTP of 10 digits

Sample Output:

  Successful TOTP generated: 1773133250, for time of Mon, 17 Mar 2014 15:20:51 GMT

  base64 encoded POST Authorization username/password request: bmluamFAZXhhbXBsZS5jb206MTc3MzEzMzI1MA==

  (I have decoded the sample POST authorization to be 'ninja@example.com:1773133250' hence why I can say that the sample TOTP output is 1773133250)

Now the problem that I have is after attempting to make my own script according to the rfc6238 specification I cannot get the same output for the sample input as above. I then tried using other available online TOTP modules that area available online (mostly in Python), to find that they generate the same output as the script that I have created. Finally, I then tried to outright copy and run the Java code given in the example of RFC6238 and came up with the same result as my script, i.e.:

Attempted input:

  Hex Encoded seed for HMAC512: "6E696E6A61406578616D706C652E636F6D4844454348414C4C454E4745303033" + "6E696E6A61406578616D706C652E636F6D4844454348414C4C454E4745303033";

  Time inputted is 1395069651L, representing the time received in sample output

Result of attempt (same output from custom script, other Python modules, and the Java implementation given in RFC6238 documentation):

  Generated TOTP: 0490867067

I am really confused now as I believe that I have followed the instructions given by the task, and even used the actual RFC given Java code to only then find that they are not generating the same ouput as the one given in the task. I have then contacted the provider of the task to know if there is any bug, but they say that it is already correct.

Perhaps I am missing something here, such as the way the task provider actually encrypts the shared key? I am very new to this and any knowledge on any caveats such as different key encryptions resulting in different TOTP would be really appreciated.

Really appreciate any help related to this, and to give me better understanding on this TOTP manner! Thank you :)


texts: Guess the number of characteristics in differential cryptanalysis

texts: I am doing some research on differential cryptanalysis for my master thesis. I analyzed some toy ciphers like the one in the popular tutorial about differential and linear cryptanalysis from heys Link. I need a guess on the lower bound of the number of characteristics which could be found on a complete search for all characteristics, when attacking the last round key. Lets assume we use the cipher from the heys tutorial. There are 5 subkeys and 4 encryption rounds. The block size is 16 bits. There could be $2^{16} -1$ different differences in the last round. If we look to the round before (round 3), the number of possibilities depend on the number of active sboxes. And this is the point where I got stuck. Can somebody help me?


texts:
As I understand, during TLS handshake phase, it is not legal for an endpoint to send its own handshake messages till the time it processes its peer's entire flight of messages completely. E.g. although a server is able to compute master secret after seeing client_key_exchange,

it cannot send its own change_cipher_spec and then finished messages

until it has processed client's finished message.

Why did the designers of TLS (say v1.2 and prior) disallow the possibility

of handshake messages flowing in parallel in both directions?


texts: What exactly are an untrusted memory and a trusted CPU?

texts:
In the use of SGX and Oblivious RAM. There sometimes exist the notions untrusted memory and trusted processor.
What are the intuitions of those?

Can memory easily be hacked by adversaries? What about CPU?


texts: Is there a public-key cryptography method that enables public keys to be much smaller than private keys?

texts: Does a public key cryptography method that enables the public key to be orders of magnitude smaller than the private key exist?


texts: How can I combine Quorum and Zero Knowledge Range Proofs

texts:
I have 20 years of experience at java JEE coding, and 10 years in devops as well,
but no experience with blockchains, or the Go language.

I want to setup a cluster of Quorum blockchain nodes, including the features
provided in ING bank's zkproofs project. I want to be able to complete transactions where a Prover and Verifier can interact. The Github project provides zero knowledge range proofs
and zero knowledge set membership.

I don't think I'll have much problem bringing up Quorum, but the documentation in the github project https://github.com/ing-bank/zkproofs is limited! How can I come to understand how to put the zkrp code with the Quorum nodes, to realize an integrated system? Any tutorials that would help out there somewhere?


texts: May an adversary be fooled by a random-looking input that in reality is fixed?

texts:
I want to prove the EUF-CMA-security of a signature scheme. It is a variation on an established scheme, therefore I would ideally like to reduce the new-scheme-security to the old-scheme-security.
the (very abstract) construction
Let the old scheme be called S and let k denote a number. In S, k is fixed, say k=5. Imagine the new scheme N is identical, only with k becoming random and secret (because it is now related to the key material). So, k=5 is in theory still possible but may just as well be 1,2,3, .. and k=5 is just as likely as k = any other number.
One needs to know k to verify the signature, and k acts similar to a symmetric key. The setting is a group where you want to identify an individual sender but still share symmetric keys.
the reduction attempt
An adversary may query oracles for different values of k and the challenger can simply draw them randomly.
However, in the challenge setting, it may obviously not know k, which is secret.
Now, it would be easy to reduce the security of one scheme to the other if the adversary were to be tricked into outputting a signature for k=5. Then the security of N can be reduced to the security of S.
The adversary can not tell from the key material or the signatures or the verification equation that k=5 (because everything still appears random), except if it can break the DLog assumption.
So the questions are:

An adversary can easily check whether k=5 or k!=5 in the challenge setting by attempting to verify a signature using k=5. Would an adversary realize that it is not interacting with the
scheme but with a "simulation" if it finds out that k=5 in the challenge setting? (In which case, as far as I understand, it would not
output a signature but break off the game.) Or is 5 a good a number as any, from the perspective of the adversary?
I can not play the game differently for different adversaries, depending on whether they compute k or not, because I know nothing about how A works - correct? (See Katz, Lindell, Introduction to Modern Cryptography, pg.59) Or could I play differently for "DLog-Breakers" and "DLog-Ignorants"?


texts: Attack on key exchange with authentication

texts: Suppose the honest parties - Alice and Bob - exchange public key in person/via telephone so that attacker can only eavesdrop on the line. Alice has hashed the public key using a collision resistance hash function $H$ before telling it to Bob. Bob will encrypt a random $k$ using $key = H(pk)$ and read it ($E_{H(pk)}(k)$) off to Alice for the authenticated scheme. Later on they both communicate through the internet where the attacker can act as a Man-in-the-Middle attacker. Is this scheme secure? As far as I can see, the attacker can't do anything since he can't either obtain $pk$ (as they use a CRH function) or key $k$(attacker doesn't have secret key from Alice)


texts:
I am using CryptSignMessage to sign a string/file. Is using RSASha1 insecure?

I know Sha1 is broken as a hashing algorithm, but does that also mean that using it for signing with RSA is broken?


texts: Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?

texts:
A recent paper by Göloğlu, Granger, McGuire, and Zumbrägel: Solving a 6120-bit DLP on a Desktop Computer seems to "demonstrate a practical DLP break in the finite field of $2^{6120}$ elements, using just a single core-month". They credit a 2012 paper by Antoine Joux: Faster index calculus for the medium prime case. Application to 1175-bit and 1425-bit finite field for paving the way they explore. In 2013 Joux published A new index calculus algorithm with complexity $L(1/4+o(1))$ in very small characteristic, and very recently announced he "is able to compute discrete logarithms in $GF(2^{6168})=GF({(2^{257})}^{24})$ using less than 550 CPU.hours". It seems the field (pun intended) of DLP in $GF(2^n)$ is in ebullition.

Current French official recommendations (section 2.2.1.3), updated June 2012, do distance themselves from schemes based on the DLP in $GF(2^n)$, but only mildly. If such scheme is used, the requirement is that $n\ge 2048$ bits up to year 2030, and $n\ge 3072$ bit afterwards, with subgroups of order a multiple of a prime of at least 200 bits. It is recommended to prefer a scheme not based on the DLP in $GF(2^n)$, and if one is used, that the order of the subgroup is prime.

How do the progress reported in the above papers translate into actual breaks for schemes proposed for cryptographic use, based on arithmetic in $GF(2^n)$, and conforming to the quoted recommendations? What are such schemes?

Note: related to this old question; and even closer to this recent one, except that I am not only interested in pairing-based schemes, but also more mundane things like a DSA analog over $GF(2^{4099})$, if there can be such a thing.


texts: What's the alternative should PKI collapse?

texts:
Premises - please check it and critique if necessary:

If factoring the products of large numbers suddenly becomes simple, PKI goes up in smoke.

Is this correct?

If it is correct, it seems to me that the only alternative is a return to shared secret schemes… is there anything serious out there that still relies on shared secret (and not in a hybrid fashion like SSL)?


texts: Sweet32: Can a single 8 byte block session ID be exploited by this vulnerability?

texts:
Im currently developing a authentication scheme. The authentication scheme will use a 64 bit encryption to encrypt its session ID.

Here is how the authentication system will work:

For each session, a 32 bit static session ID (one for each user, randomized for each login), and a 32 bit per-request session ID (one for each link on website, randomized for each new request) will be concatenated. This will be encrypted with DES or 3DES for n rounds, with different keys for each round. Also, I will randomize so sometimes the static ID is put first, sometimes the per-request ID is put first.

These session IDs will also be stored in database on server-side.

The reason I need to encrypt the session, instead of just randomizing the whole session ID and just sending it verbatim, is because I want to have a ability to invalidate ALL per-request sessions tied to the static session ID, if any attempt is made to submit a session that is either expired or invalid for some reason.

Eg, even if the sessions are deleted from the database because they are expired, I want to find every session still in database that is related (having same static session ID), and be able to delete them aswell, if any attempt is to submit a expired session ID.

Now you wonder, why so short session IDs. This is because some of these session IDs will be used as one-time passwords that is manually entered. With hex, this will result in 16 characters to be entered, and having longer blocks will of course result in a tedious typing for the users.

Now to the question: Will this scheme be vulnerable by sweet32? What I understand from the sweet32 papers, ciphers relying on a single block without any CBC or something will be safe right?

Or is it something I have misunderstood from Sweet32 vulnerability?


texts:
I have 2 messages which have been encrypted using the same pad. I know that if i xor these 2 messages together the key falls out. I am confused in how to figure out what the 2 messages are from the combined xor of the two. How do I go about decoding the 2 messages?

I am aware of crib dragging, but I don't know how to figure out which message the crib belongs to.

Note: the key(pad) used is a random sequence

Links to or Concrete examples of how to implement a solution would be really helpful.


texts: I need to use encryption software from PSpice for my SPICE model. In a user guide on page 71 they claim to use a "16-bit DES encryption algorithm". According to the wiki DES is using a 64-bit key. How is it possible to use 16-bit key instead of 64(56)-bit key? Or "16-bit" describes something else?


texts: Pohlig Hellman and small subgroup attacks

texts:
While studying Curve25519 I read about the small subgroup attack in chapter 3. So far i know, that you need a point with a small subgroup to do such an attack. Curve25519 has a basepoint with prime order, therefore it is resistent. My question is: How does such a small subgroup attack work? Can you give me an example?
Now I'm a bit confused, too. I know the Pohling Hellman attack. You can use this attack, when the order of the field of the elliptic curve is not prime ( you can use it with a prime field, too, but it is not useful ). How it works: Be $E$ an elliptic curve over $F_p$. Be $p = f_1 \cdot f_2 \cdot ... \cdot f_n$ the factorization. Be $xP = Q$ the discrete logarithm. Now you can use the Chinese remainder theorem to solve the following system of equations: $x \cdot (p/f_1)P = (p/f_1)Q$, $x \cdot (p/f_2)P = (p/f_2)Q$, ... , $x \cdot (p/f_n)P = (p/f_n)Q$. So this can be used to calculate the private key by just knowing the public key. My question: I think those two attacks are related. But I don't understand how. Can you explain this to me?


texts: What weaknesses in Hash_DRBG did NIST find and fix?

texts:
Matthew Green states in the Practical Kleptography presentation (video, at about 12:15) that Hash_DRBG (from SP800-90A) as originally proposed by NSA had potentially exploitable flaws or bugs and that NIST fixed it.

I've been unable to find how. This VCAT report only states that it was contributed by NSA and NIST "provided substantial comments".

Does anyone know how Hash_DRBG was broken and what fixes were made?


texts: I am formulating a simulation based proof, but I'm not sure how much power I can give the simulator. For example if a simulator needs to simulate the output of a symmetric key encryption algorithm then it can just pick a random string of the same length and use that to simulate the output. Would it be possible though to give the simulator a random symmetric key encryption (SKE) algorithm with the same sized output and use that to simulate the value too? Surely these outputs would be indistinguishable too? So the simulator essentially sets up a different SKE scheme and uses that to simulate the original SKE scheme. Is this permitted in simulation based proofs?


texts: Is there a way to sign a message so that any subset can be verified?

texts:
I would like to know if there's a scheme that can allow something like the following:

Alice signs a message $M$ with signature $S$ and gives it to Bob and Mallory.
Bob can present any subset of $M$, along with $S$, to Victor, who can verify that the subset matches $M$.
If Mallory changes some bits of $M$, then sends a subset of the bits to Victor, Victor can know that the message has been tampered with. (Of course, Mallory should not be able to construct a valid signature that would allow her tampered-with bits to be verified).

For example, say

Alice's message $M$ is $100100$, and the signature is $101$.
Bob will send Victor $M[0]=1, M[4]=0, signature=101$, and Victor will verify that those bits match $M$.
Mallory will send Victor $M[0]=1, M[4]=1, signature=101$ (this is malicious, since $M[4]$ does not equal $1$ in $M$). Victor will notice this and refuse to verify.

Does a scheme like this exist?
I think that there are somewhat naive solutions (for example, perhaps the signature could consist of several sub-signatures: each bit and its index in $M$ are signed, and the results are concatenated), but I am hoping for something where the signature is short relative to the size of the message.


texts: hash function for elliptic curve co-ordinates

texts:
Is there any hash function which takes the co-ordinates of an elliptic curve $E_p(a,b)$ as input and gives an integer value i.e.

$h(.) : \{(x,y) \in E_p(a,b)\} \rightarrow \mathbb{Z}$


texts: Is it Ok in practice to rely only on the first 64 bits of a scrypt hash in this scenario?

texts:
I’m in a situation where I need to perform authentication against a large set of exactly 8 bytes longs passwords (with however full choice of encoding from the user and even custom encoding support): more exactly 15,000,000,000 passwords corresponding to the same numbers of unsorted hash which should be used on a public custom blockchain (with however no lookup services).
Due to the public nature of the process, the plan is to only keep the first 8 bytes of each scrypt hash without salt (yes salting is not used) in order to reduce storage. So hash sizes would have the same length as passwords.
If a single collision is found against only one of those passwords it’s game over (since there’s no randomnization generation in the process each inputs will always match a specific hash).
Result
The sets of passwords are changed every 2 years so there would be no benefit from finding a collision on no longer valid data.
Additionally, it’s a modified version of scrypt designed to take way more times longer than the original. The results still give the same hashing characteristics than original scrypt but with differents hashs than plain scrypt given the same data. The algorithms itself has been audited by a third party professional as being sound both on paper and rust implementation.
This also gives the benefit of being both initially gpu and asic resistant (an implementation could still be designed but the money required would outweigh the reward/damage obtained in this scenario).
Question
This situation sounds risky, but I think the probability is still low for being secure in practice. Though I recognize I’ve no idea on what would be the lookup time on a such large table built from the valid hash lists.
So from a pure performance standpoint, is it correct to assume no collisions can be found using cpu (including those without any support for simd instructions) only methods on a reasonable timespan in practice?
The reference generic implementation used performs a Hash every 5 seconds on a Skylake cpu (and it was optimized with code coverage but is not simd outside using the 128 bits Builtin type). An attacker would have to cope with such low speed if he/she want to brute force (it’s also possible to create a naïve and far slower implementation).


texts: a possibly stronger type of attack on identity-based encryption

texts:
What is known about the security of identity-based encryption schemes against attacks that involve seeing multiple ciphertexts and then receiving the private keys corresponding to some of those ciphertexts?

For example, is it known that feasible adversaries will have a negligible (in the security parameter $k$) probability of succeeding in the following, for IND-CCA2 IBE schemes?

Challenger generates $\:\langle$pub,msk$\rangle\:$ and then gives $\:$pub$\:$ to $\mathcal{A}$
$\mathcal{A}$ outputs a list of $\:(2\hspace{-0.03 in}\cdot\hspace{-0.03 in}k)\hspace{-0.01 in}+\hspace{-0.02 in}1\:$ distinct IDs
Challenger chooses $\:x\in \{0,\hspace{-0.04 in}1\}^k\:$ uniformly
Challenger computes $\:(2\hspace{-0.03 in}\cdot\hspace{-0.03 in}k)\hspace{-0.01 in}+\hspace{-0.02 in}1\:$ Shamir shares of $x$ so that one needs $\:k\hspace{-0.03 in}+\hspace{-0.04 in}1\:$ of them to recover $x$
Challenger encrypts those shares using $\:$pub$\:$ and the corresponding IDs from the list provided by $\mathcal{A}$
Challenger gives the resulting list of ciphertexts to $\mathcal{A}$
$\mathcal{A}$ outputs a list of $k$ IDs
Challenger uses $\:\langle$pub,msk$\rangle\:$ to extract the private decryption keys for those IDs
Challenger gives the corresponding list of private decryption keys to $\mathcal{A}$
$\mathcal{A}$ outputs $y$
$\mathcal{A}$ succeeds if and only if $y = x$


texts: Example of product cipher more secure than its components

texts:
Can anyone give me an example of a product cipher which more secure than its components.
Here is how the explanation should proceed.

There is cipher C1 which can be attacked with the technique A1, and cipher C2 which can be attacked with the technique A2, but the product of the two, C1C2 can not be attacked with A1, A2 or the combination of the two.


texts: Why does P1363 require RW signature with $0 ≤ s < n/2$?

texts:
I'm using an older copy of P1363 Public Key Cryptography was used below. It may (or may not) reflect the current state of affairs.

P1363 has the following requirement in section 8.2.8 IFSP-RW, p. 45:

  Output: The signature, which is an integer $s$ such that $0 ≤ s < n/2$

8.2.5 IFVP-RSA1 (p. 43) does not have the same requirement; but 8.2.6 IFSP-RSA2 (p. 44) does have the requirement.

Bernstein does not appear to discuss the requirement in RSA signatures and Rabin–Williams signatures: the state of the art.

What's the purpose of the restricted range on the signature? What threat does the requirement address?


texts: Attackability of one-time MAC when using block mode

texts:
Consider an encrypted message m which is encrypted with AES-CBC, so in addition to the message there is an IV supplied initially. If I understand correctly the IV and afterwards the prior ciphertext is used, because if wasn't used, a listening attacker could gather information about the secret key s.
We want to add a authentication code (MAC) to the package, however we are quite limited with the amount of bytes we have for the MAC.

Our initial idea was to use s to generate a MAC of length s/2. If this would be used on more than one package could the attacker gain information from it? As far as I understand it's the same problem as using a one-time-pad again and again.

If this is a problem would a possible solution to this be to XOR the message with the IV (or prior ciphertexts) and then generate the MAC with s?

If this doesn't solve the problem, is there any other authentication mechanism we could use, where we can decide the length of the authentication code.

Note: we already spent thoughts on the security of short MACs and don't think it's a problem in our particular scenario.


texts: Dual system encryption:New Techniques for Dual System Encryption and Fully Secure HIBE with Short Ciphertexts

texts:
In the paper New Techniques for Dual System Encryption and
Fully Secure HIBE with Short Ciphertexts from Waters and Lewko, how can the elements $R_3$ and $R'_3$ be eliminated in the decryption algorithm?


texts: Is there a reference that prove that the AES Key Schedule generate random looking round keys?

texts: Starting from uniformly random generated AES master key, is there a reference that prove that an specific roundkey can be considered as uniformly random generated as well ?


texts: My attempt of combining socialist millionaire and Diffie-Hellman. Is it any good?

texts:
I've come up with an algorithm to solve the socialist millionaire problem, but I'm not sure if the algorithm is secure. I wasn't able to find any flaw in it, but it seems too simple to be secure, so I'm posting it here. Here's how it would work together with Diffie Hellman to prevent man in the middle attacks:

Alice and Bob have a pair of numbers, the generator g and the modulus P, these numbers are similar to those used in Diffie-Hellman
They also have a secret number X - Alice has X1, Bob has X2, this number could be derived from a pre-shared password using a hash or PBKDF2
Bob generates his private exponent Eb and sends Alice Yb=g^Eb mod P
Bob calculates Zb=Yb^X2 mod P and sends it to Alice
Alice calculates Z=Yb^X1 mod P and check if Z equals Zb, which means that X1 equals X2 and that she got keys from Bob (and not Eve)
Alice generates her private exponent Ea, and calculates Ya=g^Ea mod P
Alice calculates Za = Ya^X1 mod P
Alice calculates a symmetric key S=Yb^Ea mod P and uses that key to encrypt a message for Bob
Alice sends Ya, Za and the encrypted message to Bob
Bob calculates Z = Ya^X2 mod P and checks if Z equals Za which means that the message came from Alice (not Eve). If this check fails, the message came from Eve, and Bob can ignore it
Bob calculates S = Ya^Eb and uses that as a symmetric key to decrypt the message he got from Alice

If Eve tries to do a man-in-the-middle attack, she would try to give her Y key to Alice and Bob, but she wouldn't be able to create valid Z, because she doesn't know X, so her keys would get rejected.

I haven't been able to find a flaw in this algorithm, so I'm asking you to tell me if it's good? Assume that everything is done properly - P, E and X are big enough, Y!=1 and Z!=1 and g is a primitive root modulo P.

It looks too simple and I haven't found anyone else using something similar to this, so I want to ask if anyone can find a security flaw in this.

Can a malicious third party generate valid Y and Z without knowing X? Can this be used together with Diffie-Hellman to prevent man-in-the-middle attacks?


texts:
Take a hash function $H$.

There will be pairs of messages of the same length $M,M'$ for which $M\ne M',H(M)=H(M')$.

Let $P(x)$ be a function counts the number of $1$s in $x$. $d=P(M\oplus M')$, or in words, $d$ is the number of bits where $M$ and $M'$ differ.

Let $T(H)$ be the minimum value of $d$ for $H$. This is the metric. It does not say anything about how hard it is to actually find these colliding messages, only that a certain minimum number of bits must change to produce a collision.

Is this metric actually useful? Is it okay for $T(H)$ to be small, as long as actually finding such a collision is infeasible, or does a small $T(H)$ imply $H$ is weak?

Are there bounds on $T(H)$ for any of the popular hash functions? (SHA2 family, SHA3 family, BLAKE2 and its variants)


texts: Private Set Intersection Polynomial Computation

texts:
I am trying to implement the protocol mentioned in Section 3.4 of “Efficient Robust Private Set Intersection” in Java.

In the Second Step, the Client computes a polynomial of degree $n$ over the finite field.

For $C=\{1,2\}$, will the Polynomial be $x^2-3x+2$?

Can the polynomial have negative coefficients over the finite field? If yes, how do I encrypt the negative coefficients using Additive ElGamal?


texts: Should I use self generated or predefined RFC 7919 DH groups?

texts:
On a wiki page, archived by now, Mozilla switched from recommending self generated DH groups to the ones predefinded in RFC 7919.
The recommendation was accompanied by the statement

These groups are audited and may be more resistant to attacks than
ones randomly generated.

Unfortunately, this – often cited – statement comes without any reasoning as to why these groups need an audit to be more resistant. A specification of how probable "may" is, is missing, too.
Can you explain why one should prefer RFC 7919 groups over self generated ones? What might be the reasoning behind this change? How likely is it that a self generated group is worse than one of the predefined ones? In particular, I am wondering because predefined keys are so much more likely to be precomputated by someone.
Edit: The parameters are assumed to be generated with (a recent version of) OpenSSL which is ubiquitous in publications about TLS setup: openssl dhparam 2048 which generates safe primes (p = 2 q + 1).
I am asking this question more for academic interest than for an actual real world application.
There is another question which gives some insight into the topic but it is focused on the question if 1024-bit parameters are enough while this question is about using self generated random DH groups or pregenerated ones.


texts: Prove that H(s) = G(!s) is a CPRNG if G(s) is one

texts:
Given a cryptographic pseudo-random number generator $G$, prove that $H$ with $H(s) = G(!s)$ is also a cryptographic pseudo-random number generator. Here $s$ is a binary string; $!s$ is its complement.

For this we have to prove the two properties of a cryptographic pseudo-random number generator: the expansion and the pseudo-randomness.

The expansion is trivial to prove, because that's the same for $H$ and $G$. How can we prove that it is also cryptographically pseudo-random?


texts: Deterministic Encryption - Generating IV from password key

texts:
I need to encrypt file and directory names/paths but I need the encryption to be deterministic. I need to sync the local files with a cloud storage provider so I can't use probabilistic encryption.
Know that you should not use a static IV when encrypting text, would this be an acceptable work around:

Run passphrase through scrypt and store resulting output
Take the resulting output from scrypt and hash it (using MD5 for example)
Take the first 16 bytes of the hash and use it as the IV to encrypt the directory and file name

There is one thing to note that is really important here: The salt used for scrypt is hard coded most of the time. This is a local application that doesn't require a login and the users must be able decrypt the files on multiple computers so I'm unable to store the salts in a database like usual. The users can specify their own salt, but usually it will be hard coded for the application.
The only other thing I can think of:

Use probabilistic encryption
Read the directory/file structure from the cloud service provider and local directory
Map all the encrypted cloud provider names with their decrypted values
Map all the encrypted local names with their decrypted values
Sync based on the mappings found above

The only issue with that is that it is time consuming and really difficult to implement when using different cloud service providers.


texts: Choosing between simple Hash and HKDF to derive the second key used for MAC

texts:
I have an encrypt function that takes a single encryption key and encrypts data but also incorporates an HMAC. So I need to derive a second key from the encryption key to use it for HMAC.

You recommend using a simple hash like sha256 or HKDF for driving the second key and why?

Which one is better and why?

But I am not stringent about these details, and if simple hash has no serious flaw I will use it because it seems much simpler.


texts: If the order of g is a prime number, is Pollard-rho the best?

texts:
If the bit size is 128 bits, I know that BSGS is not possible due to memory issues.

I know that the complexity of Pollard-rho for 128 bits is 2^64.

and I know that it is not possible to do 2 ^ 64 operations on a typical computer.

Is there any other way? do solve 128bit ECDLP when ord(G)=prime number


texts: Is there a group of prime order which could fit the CT-Computational Diffie-Hellman assumption?

texts:
I'm trying to choose a group that is hard under the Chosen-Target Computational Diffie-Hellman assumption, according to the definition in this paper, in order to implement the oblivious transfer scheme defined in the top box on page 10(=406).
The (intimidating, to me) CT-CDH assumption is defined as follows (page 7=403):

Let $\mathbb{G}_q$ be a group of prime order $q$, $g$ be a generator of $\mathbb{G}_q$, $x\in \mathbb{Z}^*_q$. Let $H_1 : \{0, 1\}^∗ \rightarrow \mathbb{G}_q$ be a cryptographic hash function. The adversary $A$ is given input $(q, g, g^x, H_1)$ and two oracles: target oracle $TG(\cdot)$ that returns a random element $w_i \in \mathbb{G}_q$ at the $i$-th query and helper oracle $HG(\cdot)$ that returns $(\cdot)^x$. Let $q_T$ and $q_H$ be the number of queries $A$ made to the target oracle and helper oracle respectively.
Assumption: The probability that $A$ outputs $k$ pairs $((v_1, j_1), (v_2, j_2), \dots, (v_k, j_k))$, where $v_i = (w_{j_i})^x$ for $i \in \{1, 2, \dots , k\}$, $q_H \lt k \leq q_T$, is negligible.

It should be noted that this assumption is equivalent to the standard Computational Diffie-Hellman assumption when $q_T=1$, according to this paper.
Can anyone give an example of a group that fits the bill? I tried $\mathbb{Z}^*_q$ for a prime $q$ under multiplication, but that's of order $q-1$, which is clearly not prime. However, the complexity analysis on page 12 of the paper is in terms of modular exponentiations.
Additionally (I can make a new question for this, if scolded), how would one implement the $(D_j)^{a_j^{-1}}$ operation in step 5 of the protocol? I can't figure out if it's equivalent to the discrete log problem.


texts: Is an HMAC based on a second-preimage resistant hash function always unforgeable?

texts: If hash function is collision-resistant, then its associated HMAC is always unforgeable.  But suppose that a hash function is only second-preimage resistant, not necessarily collision-resistant.  Then my question is, its associated HMAC always unforgeable?


texts: Advantages of round function as a good PRNG

texts:
If round function in block cipher is a good PRNG, does it have any advantages? Can we expect better faster diffusion or confusion? Does it make sense to design algorithms in such a way that the round functions will be the best possible random number generators?
Usually round functions are not good PRNG, but if they are, should we expect a better quality cipher then? Or maybe it doesn't matter, the only advantage is that we can use smaller amount of rounds (assuming they are also cryptographically secure)?


texts: Verify membership of an item within a set while obscuring the number of elements in the set?

texts:
I'm wondering whether it is possible to achieve the following scenario:

Say you have a set of names {Alice, Bob, Jake}. To verify that the name 'Bob' exists in the set, you can simply compare 'Bob' against each element of the set and discover that one of the entries in the set does indeed match the name 'Bob'.

I need a way to verify membership of, say, 'Bob' in the set, but without exposing the number of elements in the set.

Is there some transformation that can be done on the set {Alice, Bob, Jake} so that the resulting entity can be used to verify the independent membership of any and all of 'Alice', 'Bob', and 'Jake' within the set, but at the same time the resulting entity does not allow one to view the total number of elements that the set comprises?

Thanks a lot


texts: Why is the slide attack called a generic attack if it depends on each round being the same?

texts: From reading the answers on this website, a generic attack is one that works on all block ciphers (e.g., brute force). The slide attack does not work if the round functions are different, whether they are using different round keys, using different round constants, or are different functions altogether. Yet, I see that the slide attack is called a generic attack. Why?


texts: Is the following 4 digits code generator secure and non-deterministic?

texts:
In a C# WCF service, I need to send a 4 digits code by SMS to validate a user account/password. For security reasons, the code has to be non-deterministic (so that a malicious user/hacker should not be able predict what the next code will be).

I use the following code :

protected string Generate4DigitsCode()
{
    RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
    byte[] bytes = new byte[4];
    rng.GetBytes(bytes);
    return string.Format("{0:D4}", BitConverter.ToUInt32(bytes, 0) % 10000);
}

I am especially worried by the modulo operation, which probably focus on the lowest bytes. Would it be better to do a integer division ?


texts:
I am currently stuck at an exercise for my Cryptography Class in University which is:

Alice wants to send a message $M = (M_1,M_2) =$ "Pay Bob \$100 from bank accout $12345$" to her bank (encrypted). Therefore she picks a random Initial Value ($IV$) coded $(IV, M_1, M_2)$ in 8-bit-ASCII, encrypts this and gets the Chiffre $C = (IV,C_1,C_2)$ which she sends to her bank.

Eve intercepts $C$ from Alice and wants to change it to $C'=(IV',C_1',C_2')$ with $M' =$ "Pay Eve \$500 from bank account $12345$"

Give a valid $C'$ for $M'$ if Alice uses AES in Counter Mode
Give a valid $C'$ for $M'$ if Alice uses AES in CBC-Mode

The $IV$ is transferred with the messsage so Eve is able to change it anyway.

Maybe one of you can explain how to do this I don't have any Idea.


texts: What is the length of the SHA-1 message digest and how is RSASSA-PSS used for verification?

texts:
I am a newbie to cryptography and SHA-1.

Currently I am configuring a SHA-1 hash function which takes default length as 128 bits. Is it okay to configure it this way, since I see in most cases SHA-1 uses 160 bits? So what is the most common length used for SHA-1 hashes?

I read in many places that RSASSA-PSS is used for signature verification?
I assume message digest or hashed value or signature all refer to output hashed value of SHA-1.

How do I use the RSASSA-PSS function to verify the signature? Should I pass it the message digest value and expect that the plain text should match the initial input given to the SHA-1 function?


texts: How does SSL secure the initial handshake?

texts: I'm reading the SSL specs, and it seems that the initial handshake has no authenticity protection at all. What is to prevent, say, an attacker from overwriting the "available ciphers" list with one that is full of broken, or even null, ciphers? Is there some sort of defense for this, or is this fundamentally unsolvable because the handshake part by definition cannot itself be authenticated (which leads to infinite regress)? Is there a way to anonymously authenticate the initial, non-authenticated part of an SSL connection?


texts: Calculate number of chips to solve bit commitment using hash function

texts:
I have a problem that I don't know how to solve

Assume that H is a cryptographic hash function with output size 80 bits. Assume that ABC123 is a specifically designed line of hardware chips for computing H. where ABC123  can create 10000 hash values a second. This product line is the best, fastest and affordable, in the market, priced at 1000$. Consider the following Bit-Commitment protocol which is used for applications in betting in football matches.

A create R1 and R2 as 2 random binary strings with length 48 bits and 40 bits, respectively
A send host B: M = H(R1 || R2 || b) || R1
To announce bit b, A send host B: (R2, b) (b is a bit, 0 or 1, that A choose indicate that a football team win or lose, for simplify)
B check validity by re-hashing H(R1 || R2 || b) and comparing with the value received from step 2

Question: how much money the host B has to invest in order to correctly guess b in 5 minutes?

Thank you very much. Any help is appreciated!


texts:
Am I right with this assumption about the general idea of public key and private key?

The sender encrypts the data with a symmetric key. After that, he encrypts (using RSA algorithm) this symmetric key with the public asymmetric key of the receiver.
The receiver decrypts with his private asymmetric key, and gets the symmetric key used by the sender. With this key, he decrypts the data.

How does the sender know the public asymmetric key of the receiver?
2 options:

Diffie Hellman.
Digital certificate PKI, by querying a CA.

Is this right?


texts: Laplace mechanism from Exponential mechanism in Differential Privacy

texts:
In McSherry and Talwar's paper which introduces the exponential mechanism for differential privacy, they say that the Laplace mechanism can be captured by choosing the score function as $q(d,r) = - |f(d) - r|$ in the exponential mechanism.

However, choosing such a score function creates the following mechanism (assuming a uniform base measure $\mu$):

$$ \mathcal{E}^\epsilon_q(d) := \text{choose $r$ with probability $\propto e^{\frac{- \epsilon |f(d) - r|}{2 \Delta q}}$} $$

whereas the Laplace mechanism is defined as:

$$ \mathcal{L}(d) := \text{choose $r$ with probability $\propto e^{\frac{- \epsilon |f(d) - r|}{\Delta f}}$} $$

As I think that $\Delta q$ and $\Delta f$ are equal for this choice of function $q$, it seems that those two mechanisms are different. Where did I make a mistake ?


texts: Tamarin-prover issue on a basic Diffie-Hellman Exchange

texts:
I am starting Tamarin-Prover and I have a little issue of understanding.
Here is a basic exemple of my issue :
First Code :
theory test
begin

builtins : asymmetric-crypto, diffie-hellman

rule Register_pk:
    [Fr(~ltkA)]-->[!Ltk($A, ~ltkA), !Pk($A, pk(~ltkA)), Out(pk(~ltkA))]

rule C1:
    [Fr(~x)]
    -->[C1($C, ~x), Out(<$C, 'g'^~x)>]

rule S1:
    let pubkeyC = 'g'^x in
    [Fr(~y), In(<C, pubkeyC)>]
    --[ Secret($S, C, pubkeyC^~y)]->
    [S1($S, ~y, pubkeyC)]

lemma Secret_dh:
"
    All S C dh_secret #i. Secret(S, C, dh_secret)@#i ==> not( Ex #k. K(dh_secret)@#k)
"
end

after a : tamarin-prover --prove test.spthy the lemma is verified
Then I only change the lemma into :
Second Code :
lemma Secret_dh:
exists-trace
"
    All S C dh_secret #i. Secret(S, C, dh_secret)@#i ==> Ex #k. K(dh_secret)@#k
"

And after a : tamarin-prover --prove test.spthy the lemma is verified too. And I find this completly abnormal ..
Thanks for your help .. And have a good day.


texts: How can encryption software accept password lengths which are not one of the AES key lengths?

texts:
AES comes with key sizes of 128, 192, and 256 bit.

But in Truecrypt or other crypto software we can use passwords of different length, even less than 128 bit or more than 256 bit.

How is this possible?


texts: Understanding double hash and 0 block prepending to mitigate length extension attacks

texts:
So, reading the chapter about hash functions from the book "Applied Cryptography". There's a point where, as a conclusion, the construction:

SHA-X(SHA-X(0^b || m))

Saying:

  Prepending the message with a block of zeros makes it so that, unless something unusual happens, the first block input to the inner hash function im hd is different than the input to the outer hash function.

The thing is I don't quite get it.

Forgetting about the prepending of a block of 0's to the inner hash function, let's state that it's clear that:

  If we find a collision for the output of the inner hash function, then we get a collision for the output of the outer hash function.

So, how is it different prepending a block of all 0's to the message to mitigate length extension attack?

If I have the messages:

m=m1..mk
m'=m1..mk,mk+1

When prepending a block of 0's to both of them as input for the inner hash function will give us the same "problematic" situation we have with length extension attacks. We will have a partial message collision up to

0b||m1..mk

And then we have mk+1 "to play" and be able to generate a length extension attack...

I'm aware that there's obviously something wrong with my reasoning, so I'm hoping someone can give me a hand and point out what it is.


texts: Interpretation of (NIST) Non Overlapping Template Matching Test

texts:
Regarding the Non-Overlapping Template test, this test normally gives us a bunch of p-values (148 values). I would like to ask that how do we interpret those values into a single p-value for presenting in an academic report. I have seen many papers illustrate as only a single p-value. For example,

Cao et.al, Phys.Rev X 6, 2016

In this work the p-value of Non-Overlapping Template test is shown as a single value. I have tried using fisher method to combine all of the p-values but by it's characteristic, the p-value after a combination drops exponentially.
Is there any simple way to interpret ?

Thank you in advance.


texts: How to find a primitive cube root of unity

texts:
I would like some help to understand how to compute a distortion map and the result of a pairing.

I know that with this equation :
$E : y^2 = x^3 + 1$ over some $\mathbb{F}_p$  we have a distortion map $\phi(x,y) = (\beta x, y)$.
I know that I need to find a primitive cube root of unity $\beta$ such that $\beta^3 = 1$ and it will give me a point in $\mathbb{F}_{p^2}$ with the form $a+bi$ with $ a,b \in \mathbb{F_p}$
But I don't know how to compute this $\beta$.
Could you explain to me how to compute $\beta$ with a small example.

The paper "Pairings for Beginners" shows this example, how does he find $24i+29$ ?

Thank you for your answers


texts:
I am developing an application that will need to store a very large volume of hashed data per user for which I want to ensure I am doing everything possible to maximize security.  At this point I believe I will be utilizing SHA3-512 + randomized salts over a yet-to-be determined number of iterations.

Is there a standard application level accreditation that exists to verify the security of my data encryption methodology, or is FIPS the only prevailing authority on encryption standards?


texts:
This may be a dumb question so please forgive me if so, but is a hash function considered one-way even if you have half of an xor'd value?

For example say I have the values R and C, both are randomly generated and the same length as the output of the hashing function H, but while R is known C should not be given only R and h below:

h = H(C⊕R)

Is there any scenario in which you could determine C from h and R or which might reduce the difficulty of brute forcing C in this format to a level you would have to worry about?


texts: Why Distance-128 relation in Plain texts is reflected in Cipher texts

texts:
The two text having relation as "\x10\x11" → "\x90\x91" (80+10) will have relation after encryption/decryption also in RC4. Following code clearly describes the problem I am mentioning.

 from Crypto.Cipher import ARC4
 key = '12345678'
 obj1 = ARC4.new(key)
 obj2 = ARC4.new(key)
 d1= obj1.decrypt('\x01\x02\x03\x04\x05\x06')
 d2= obj2.decrypt('\x81\x82\x83\x84\x85\x86')

 p1='';p2=''
 for i in d1:
     if ord(i)>=128: p1+=chr(ord(i)-128)
     else: p1+=chr(ord(i))

 for i in d2:
     if ord(i)>=128: p2+= chr(ord(i)-128)
     else: p2+=chr(ord(i))
 print p1==p2

output: True

I mean if i have two ciphers that are related with (0x80) 128-distance, I get some relation in decrypted outputs. I tried it many times and got the same replation with respect to the ciphers’ characters related as +-7F. What is the reason behind it?


texts: Given a Message and Decryption Key, is it possible to find the Cipher in RSA?

texts:
This is a slight reversal from the norm but...

Suppose Alice wants to ensure that everyone knows that a message will be from her. Instead of giving out the encryption key, she broadcasts the decryption key, and encrypts her messages privately. She doesn't care that anybody can read her messages, only that someone can't imitate her.

So if I want to imitate Alice, and all I have is a decryption key and the message, is it possible to fake a message from Alice?

Edit: so to clarify, we'll assume a literate message is valid. We'll also add the constraint that the attacker wants to mimic a specific Message (M), not just any message, or previous messages will do.


texts: Breaking a Mersenne-twister RNG with unsequential outputs

texts:
Pardon me for this newbie-ish question. I'm still a novice in cryptography . I have an application that outputs random numbers from 0 - 12 (endpoints inclusive) unsequentially (some outputs are thrown off) using the mersenne twister algorithm and i would like to break and predict its seed in Python but i don't know what to program?

Once again please pardon my little knowledge in this space.


texts: Secure instant messaging protocol and implementation for an anonymous end-to-end chat?

texts:
all is said in the title but I will go further.
First question :
I searched here and I found Tox to be the most powerful protocol. It uses Curve25519, XSalsa20 and Poly1305. They seem to be good algorithm but I think I will replace XSalsa20 for a ChaCha20-Poly1305 combination.
What are you think about that ?
Second question :
For the implementation this is my first thougth :
A ask for a secure communication to the Server which register the channel on his DataBase and cipher it with A's symmetric key. When B ask to connect on the channel, the server will send the request to A with his public key, A will cipher symmetric key of the channel (unknown by the server) and send to B back. The server will finally add B to the DataBase of the channel. If B want to send a message he need to cipher it with one of the symmetrical key and send the coded text to the server wich will decipher the DataBase with the key and send to every ip addresses. A will decode with the other symmetric key.
I know it's unclear, if you have any questions feel free to ask them, I want to know if you got better idea. The problem of my system is that the server will keep ip addresses of the channel's owner and the user (while he connect to the server) until all the users are connected. But I don't think it's possible to do it without that.


texts: Proving that a point on elliptic curve is smaller than half of group's order

texts:
Let's say I have an elliptic curve where generator $G_1$ has prime order $q$. Let's also say I have committed to a point $A_1 = a \cdot G_1$. Could I use the scheme below to prove that $a < \frac{q}{2}$?

Suppose the order of the curve is $2q$ (the order is even) and there is another generator $G_2$ such that $G_1 = 2 \cdot G_2$. The order of the group for this generator is then the same as the order of the curve ($2q$). To prove that $a < \frac{q}{2}$:

I compute $A_2 = (4a - 1) \cdot G_2$ and send it to the verifier.
The verifier can then check whether $\frac{A_2+G_2}{2} = A_1$, and if so, accept my proof.

The thinking is that points generated by $G_1$ are equal to points generated by $G_2$ only for even multiples of $G_2$. So, unless $A_2+G_2$ is even, it won't match a point in $G_1$. And then, the checking equation becomes:

$$
\frac{(4a - 1) \cdot G_2 + G_2}{2} = 2a \cdot G_2 = a \cdot G_1
$$

I don't think I need to worry about overflow here since the division should take care of that.

The biggest thing I'm not sure about is how division by 2 would work on an elliptic curve of even order:

What would happen if we try to compute $\frac{3 \cdot G_2}{2}$ - would the result be undefined?
What would happen if we try to divide a "negative" point by 2? For example: $\frac{-2 \cdot G_2}{2} = -1 \cdot G_2$ and at the same time $\frac{-2 \cdot G_2}{2} = \frac{(2q-2) \cdot G_2}{2} = (q - 1) \cdot G_2$. But $q - 1 \neq -1 \bmod 2q$.

I must be missing something here.


texts: How secure is passing a MAC to Python's random.seed before using random.choice to generate a MAC?

texts:
I'd like to use Python's random.choice seeded with a HMAC-SHA1 tag to generate a MAC encoded in a variable set of chars.

import random, hmac, hashlib, string

SECRET = 'something secret'
MESSAGE = 'some message'
MAC_CHARS = string.ascii_letters + string.digits
MAC_LEN = 10

random.seed(hmac.new(SECRET, MESSAGE, hashlib.sha256).digest())
mac = ''.join([random.choice(MAC_CHARS) for _ in xrange(MAC_LEN)])
random.seed()  # resets seed from /dev/random

Are the properties of the mac variable at equivalent to that of an HMAC tag?


texts:
Is GMW (How to play ANY mental game) protocol different from Secret Sharing??
If so, how is it different from Secret sharing?


texts: Can I perform a division of two integers homomorphically using ElGamal?

texts:
How can I perform a division of two integers homomorphically?
(Simplifying assumptions can be made if needed, that is, I am fine with dividing numbers that are whole and the result will be whole as well, e.g., simple divisions such as 4 divided by 2 are fine)

Given two ElGamal ciphertexts:
$$ C_1 = (C^{1}_{1}, C^2_1) $$
$$ C_2 = (C^{1}_{2}, C^2_2) $$

I can multiply them homomorphically as follows:
$$ C_r = (C^{1}_{1} \cdot C^{1}_{2} ,C^2_1 \cdot C^2_2) $$

The following does not seem to work to achieve division though:
$$ C_r = (C^{1}_{1} \div C^{1}_{2} ,C^2_1 \div C^2_2) $$


texts: Implementations of GCM with 64-bit cipher

texts:
The paper The Galois/Counter Mode of Operation (GCM) describes mainly the 128-bit case, for use with 128-bit block ciphers such as AES. AES-GCM test vectors are available from NIST.

The paper also describes GCM for 64-bit block ciphers. My question is, has anyone actually implemented GCM for a 64-bit block cipher, and/or published test vectors?


texts:
Is cryptography so specialized that taking a survey class is a waste of time?
I'm not the type of person who can do logs in my head or has a deep mathematical aptitude, but cryptography is certainly very interesting. But I wonder if I'll scratch the surface and realize quite quickly that there are very few who can participate in the greater conversations.


texts: AES key schedule. Does it use a KDF to generate the round keys?

texts:
So for each round in AES a different key is used, and as I saw the keys are created form a master key.

My question is how these round keys are generated.

Are they created via a Key Derivation Function as the session keys, or its something else ?


texts: How do I enable AES-NI (hardware acceleration) for Node.js crypto on Linux?

texts:
I wrote a basic function to test the speed of the AES-256-CBC mode of the Node.js built-in crypto functions.  These functions use OpenSSL, so they should support AES-NI, but when I correctly enable AES-NI and do a command-line test of OpenSSL the encryption speed is ~350MB/s on OpenSSL and only ~100MB/s on Node.js Crypto.

I used this answer to enable OpenSSL AES-NI in the command line and ran it as follows:

openssl speed -evp aes-256-cbc

My question is, how do I make the speed of the Node.js crypto functions for AES match that of OpenSSL run in the command line?  I suspect the reason is failure to use AES-NI


texts:
I'm going to try and eventually factor RSA-100, but my current QS needs a lot of improvement, so I'm going to try and switch over to the MPQS.

I'm a bit confused as to how the MPQS works, which is correct:

1) Use the QS polynomial to generate X/Y pairs, then sieve with the "new" polynomial
2) Use the "new" polynomial to generate X/Y pairs, and also sieve with this polynomial

And generating the polynomials, I'm not sure which is correct:

1) A must be a square, B^2 - n must be a multiple of A so that B^2 - n = AC
2) A must be a square multiplied by a factor in the factor base, everything else as in (1) being the same


texts:
I used AES256-CBC to SSH to a remote server. Recently, it stopped working with the following message:

no matching cipher found: client aes256-cbc server
aes128-ctr,aes256-ctr,arcfour256,arcfour,3des-cbc

When I used AES256-CTR as a cipher to SSH to the server, it worked as expected.

I read this article which outlines the following:

  CBC (Cipher-block chaining)
   Encryption parallelizable: No
   Decryption parallelizable: Yes

  CTR (Counter)
   Encryption parallelizable: Yes
   Decryption parallelizable: Yes

Is “Encryption parallelization” necessary in SSH?

Any other advantages of AES256-CTR over AES256-CBC used in SSH except being more robust against padding oracle attacks?


texts: Why is double hashing universal hash function still a universal hash function?

texts:
Here is the definition of universal hash function for $h \in H$ (family of universal hash function)

$$\forall x, y \in U x \neq y : Pr_{h \in H}[h(x) = h(y)] \leq \frac{1}{m}$$

Double hashing is the following

$$h_a , h_b \in H$$

$$h_i(x, m) = (h_a(x) + i \times h_b(x)) \mod m $$

Is there a proof that shows that double hashing two universal functions with arbitrary $i$ will produce another universal function?

If

$$ k = (h_a(x) + h_b(x))$$

Can't we say that there is $k + 1$ more ways of collision?

$$ 5 = 0 + 5, 1 + 4, 2 + 3, 3 + 2, 4 + 1, 5 + 0 $$


texts: Why do I need to add the original salt to each hash iteration of a password?

texts:
I understand it is important to hash passwords over multiple iterations to make things harder for an attacker. I have read numerous times that when processing these iterations, it is critical to hash not only the result of the previous hashing, but also append the original salt each time.

In other words, I think I need to not do this:

var hash = sha512(salt + password);
for (i = 0; i < 1000; i++) {
    hash = sha512(hash);
}

And instead, I can do this:

var hash = sha512(salt + password);
for (i = 0; i < 1000; i++) {
    hash = sha512(salt + hash);
}

My question is regarding the math here. Why does my bad example above make things easier for an attacker? I've heard that it would increase the likelihood of collisions but I am not understanding why.

 reposted from https://stackoverflow.com/questions/21003216/why-do-i-need-to-add-the-original-salt-to-each-hash-iteration-of-a-password


texts: ChaCha20: is this a potentially safe way of using nonce derived from private key if the key/nonce pair is never reused, for a given plaintext?

texts:
Note: I realize in ChaCha20 the nonce should be random and unique each time follow certain constraints but am trying to determine whether there could be a safe way to use it just once if other constraints were in place as follows:

Could the nonce be entirely deterministic and derived from the key so long as the key is only used exclusively once for a distinct plaintext (akin to the one-time-pad). I realize this is risky if the key/nonce pair is re-used on a different plaintext, but wouldn't it be as safe as the one-time-pad if the pair is never reused on a different plaintext message?

Related questions: Does ChaCha20 counter actually increment through iterations?

What happens if a nonce is reused in ChaCha20-Poly1305?

Can I reuse a nonce to retransmit the same packet using ChaCha20-Poly1305?

In other words, if a user wanted to only retain a 256-bit key using ChaCha20 and not have to retain the random nonce, could the nonce, for example, be derived from the leading 12 bytes (i.e 96 bits) of the 32-byte (256-bit) key, provided that they are both never re-used to encrypt a different message than the original one?

[Update: Another further constraint to this scenario, the 'nonce' is NOT made public and the algorithm is running locally on the user's device, such as in a cold storage or internet-gapped environment, even though the resulting ciphertext may later be shared online]

Example secret key and deterministic nonce:

secret key: ba665a007182e68a40aa23c781ed8dcd23b0e3673c7067a9df9cdad13b1d4880

determinisitic nonce based on leading 24-hex of 64-hex key: ba665a007182e68a40aa23c7

plaintext: 68656c6c6f

resulting chacha20 ciphertext:702da4b13e682d4b840b19cde305583b415765f936

Are there any known attacks given the above constraints or can it be considered secure (provided again the key & nonce are never reused on a different plaintext)?

''' ChaCha20 code from https://github.com/ph4r05/py-chacha20poly1305 '''

import os

from chacha20poly1305 import ChaCha20Poly1305
input_hex=str(input('paste 64 hex priv key without 0x pad'))
input_bytes = bytes.fromhex(input_hex)

private_key = input_bytes #os.urandom(32) # equal to 256 bits or 32 bytes
print('private key bytes:',private_key)
cip = ChaCha20Poly1305(private_key)
format_plain=input('paste plaint text data to encrypt')
plain=bytes.fromhex(format_plain)
nonce = os.urandom(12) # Random nonce that is equal to 96 bits or 12 bytes
print("nonce:",bytes(nonce).hex())
ciphertext = cip.encrypt(nonce,plain)
print('ciphertext with random nonce:',bytes(ciphertext).hex())
plaintext = cip.decrypt(nonce, ciphertext)
print('plaintext:',bytearray(plaintext).hex())

### DETERMINISTIC NONCE BELOW DERIVED FROM PRIVATE KEY (Just for reference)

private_key1 = private_key
print('private key1:',bytes(private_key).hex())
cip1 = ChaCha20Poly1305(private_key)

nonce = private_key1[:12] # nonce derived from leading 12 bytes of priv key
print("determinisitic nonce:",bytes(nonce).hex())
ciphertext1 = cip1.encrypt(nonce, plain)
print('ciphertext1 with determ nonce:',bytes(ciphertext1).hex())
plaintext1 = cip1.decrypt(nonce, ciphertext1)
print('plaintext1:',bytearray(plaintext1).hex())


texts:
I know that WEP uses stream cipher encryption. The key stream = RC4(IV, K).

My question is:
The shared symmetric key is the same for all users? Or each user has it's own symmetric key.
Also, how can a user get this key?


texts:
I'm searching for a (preferably simple) explanation of the Cheon-Kim-Kim-Song scheme for fully homomorphic encryption.

All I did find so far is the original paper, which is rather difficult to understand for me. (Link: https://eprint.iacr.org/2016/421.pdf)

Anything is appreciated (text, videos, powerpoints etc.). Thanks for your help.


texts: Is AES-Keywrap (NIST SP 800-38F) quantum-safe?

texts:
Having looked at the paper "Breaking Symmetric Cryptosystems using Quantum Period Finding", I'm unsure as to whether the AES-Keywrap as defined by NIST SP 800-38F is safe against the described attack or not.

I also came up empty handed on google.

Does anyone have any information on this?


texts: Question about discrete log - why can one attacker not solve for g but two colluders can?

texts:
I'm reading about the broadcast encryption described in Fiat and Naor's paper, I screen grabbed the relevant part below.
My question is essentially:

If there's a secret:

$g^{abc}$ $mod$  $A$ (where $A=PQ$ (both sufficiently large primes))

why is it that one user who knows:

$g^d$ $mod$ $A$, $a$, $b$, $c$, $d$, and $A$

could not calculate $g^{abc}$ $mod$ $A$ but when you add a second user who know $g^e$ $mod$ $A$, and $e$, they can then collude to calculate $g^{abc}$ $mod$ $A$ ?

Context is provided below.

The full paper can be found here

The paper states that one user not in the privileged set could not calculate the secret, but two colluding users could (and so they rate the scheme 1-resilient).


texts:
I recently started learning cryptography. I have learned some basic stuff. I'm  also started learning about pc security, so I was wondering how do hackers use cryptography for bypassing antivirus software?  I don't have some deep understanding on how Antivirus software works but I know that every Antivirus has base of signatures, so when we scan exe file it actually compares signature of exe with signatures in it's own base, and if it matches, Antivirus will identify exe as malware. So by applying some cryptographic algorithm on exe file, they change signature of exe, so antivirus can't detect it as malware, right? But concretely, how do they apply cryptograpyic algorithm on exe file? I saw only in my book how plaintext is crypted. There is no information about crypting exe files there (or I didn't see it). I use book "Applied Cryptography, Bruce Schneier". Maybe this was stupid question but don't blame me, I'm amateur :) If there is some book covering this matter, please suggest it to me, I will be grateful.
Thanks in advance


texts: Multiple private keys for single public key

texts:
I am currently working in security in mobile ad-hoc networks.

I have several clusters, and I want to send some data encrypted with its public key, from the cluster head to the cluster members. I assume that each member has its own private key so it can decrypt the data.

I ask about how to get a single public key and multiple private keys for this public key?

What is the solution for this case?


texts: Using HMAC as a nonce with AES-CTR encrypt-and-MAC

texts:
Suppose I use the following encrypt-and-MAC construction:

$E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where:
$k_1$ and $k_2$ are 256-bit keys
$n$ is a nonce
$m$ is an arbitrary-length message.

What security losses occur if I use the MAC as the nonce? (i.e. $n = \text{HMAC-SHA256}(k_2, m)$, but truncated to the appropriate length)  Are there any other disadvantages to this scheme compared with typical authenticated encryption, e.g. AES-GCM?
Clearly, this scheme is distinguishable under chosen plaintext attack, since the same plaintexts always encrypt to the same ciphertexts.  This is acceptable in my application, but I'm interested to know if there are other problems.


texts: What is the ideal system for an encryption scheme? For a pseudorandom permutation the ideal one is a random permutation, for a pseudorandom function the ideal one is a random function. For an encryption scheme do we have a well known application describing an ideal system for an encryption? Maybe the one-time pad?


texts: Why is AES-SIV not used, but AESKW, AKW1?

texts:
I'm trying to investigate different key wrapping algorithms for my implementation. I've noticed that AES-SIV is very rarely implemented by most of open source libraries. Most of them implements key wrap from RFC 3394.

It's a bit weird, as AES-SIV has many nice properties and (maybe I'm wrong) seems like best choice for key wrapping in most cases. So I wonder if I haven't missed something. Are there any known weaknesses of AES-SIV?


texts: What's the GCM-SHA 256 of a TLS protocol?

texts:
If we read the Google line information about how the cypher the https communication, it reads:

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

I understand it's using ECDHE to exchange keys, using ECDSA as digital signature and making the symmetric encryption with AES algorithm, using 128 bit keys. I don't know though what the GCM_SHA256 means. What is that?


texts:
I have calculated the average number of operations in 1 round of SHA-256 as follows:

Additions: 9.25
Bitwise Rotations: 9
Bitwise Shifts: 1.5
Bitwise AND: 5
Bitwise XOR: 10

I have certain proposals that save the following number of operations in one SHA256 evaluation (i.e. 64 rounds) for Bitcoin mining:

Additions: 24
Bitwise Rotations: 12
Bitwise Shifts: 6
Bitwise AND: 0
Bitwise XOR: 12

My question is, how can I represent the above savings in terms of SHA256 rounds?

Do I just consider the additions? So that the saved operations above are equivalent to 24/9.25 = 2.5946 SHA-256 rounds per evaluation?


texts: Offline anonymous electronic money systems and their cryptographical base

texts: What anonymous offline electronic money systems exist and what are they based on? I know only one currently - eCash, based on RSA blind signatures.


texts: What RC4 key value will completely invert $S$ after initial permutation?

texts: What RC4 key value will completely invert $S$ after the initial permutation, so that $S[0] = 255, S[1] = 254, …, S[254] = 1, S[255] = 0$?


texts: Why does entropy halve during its extraction?

texts:
It is common to use cryptographic hash functions to extract randomness from entropy sources.  One of the quantitative criteria for this is that if 2n bits of entropy are put through a hash, n bits of uniformly distributed random numbers can be extracted.

Why is this?  Where do the other n bits of entropy go?  Perhaps naively, but if we adopt a water analogy, why can we only get 1 litre of water entropy out of a store that we've put 2 litres into?  Is it possible to explain this without complex algebra?  It seems counter intuitive that we can't get all the entropy out that was put into the hash function.

The scenario  that vexes me is what if we chained hash functions for the hell of it.  One cryptographic hash feeding the next.  If we start at the top of the pile and input 16 bits of entropy, the available entropy would half passing through each hash.  After passing through 5 hash functions, there would be <1 bit of entropy left.  I can't fathom how that could be.

I can't find the original reference to n 2n, but there are many instances of this formula scattered throughout the literature.  BUT.  I have a counter example where this is not the case.  The Quantis TRNG manages to output 75% of available entropy via matrix multiplication.  And I think that I've seen this technique used in other TRNGs.  It's simple compression of the raw entropy stream.  Both hash functions and matrix multiplication is essentially similar, so what's going on?


texts: Meaning of $\operatorname{UOWH}(k; u_1, u_2)$

texts: I do not understand the format used in Shoup's "Using Hash Functions as a Hedge against Chosen Ciphertext Attack (page 8 of the PDF) for universal one way hash functions (UOWH). What are $k$, $u_1$ and $u_2$ in $\operatorname{UOWH}(k; u_1, u_2)$?


texts: Evaluate the time of Paillier decryption

texts: If I have 4 kilobytes of Paillier encrypted data, how can I know the time needed to decrypt it?


texts:
A signature scheme has three algorithms (Kgen, Sign, Ver), Kgen is necessarily randomized
and Ver is ususally determinstic. Show that it is without loss of generality to restrict
the signing algorithm Sign to be deterministic. That is, show that given any secure
signature scheme (Kgen, Sign, Ver) with a randomized signing algorithm, one can turn
it into another secure signature scheme (Kgen'
, Sign'
, Ver'
) with a deterministic signing
algorithm. Write down your design rationale.

Hint: Use a PRF

Hint:You need to use Sign, your goal is that given an arbitrary randomized signing algorithm Sign, with Kgen and Ver.
turn them into another signature scheme (Kgen', Sign', Ver'), so that, Sign' is deterministic.

How in the hell does this make sense?? How do I take something random use and use it to make something deterministic. PLEASE HELP


texts: Is there any application for ZKP that prove that "I know the pre-image of Hash function"

texts:
I'm looking for any applications that using ZKP to prove that "I know the pre-image for Hash function".
As far as I know, POUR operation in Zcash uses this concept but I can't find any evidence of it.
Can someone tell me that any applications?


texts:
I am trying to devise an encryption scheme such that an adversary can win the following game with probability at most $1/2 + \epsilon$.

Adversary gives challenger two plaintext messages $m_1$ and $m_0$
Challenger chooses one the two at random and encrypts it and gives adversary the cipher
Adversary determines which of the two messages was chosen.

The key space has to be smaller than the message space.

Any ideas?


texts:
Sometimes, websites and scientific papers that introduce and/or handle cryptographic algorithms also provide speed-analysis and tables comparing the individual performance of cryptographic implementations. I would like to do the same, but I'm not sure how to calculate the “cycles”.

I have this data:

processor clock frequency: 2,1 ghz
message length: 16 byte
Speed: 4,3 Mbytes/s

How can I calculate “cycles” and “cycles per byte” from that data?


texts: BIP32 Extended Key to EC Private and Public Key Pair

texts:
We are working on an application in Android using Java. In our project, we used to generate EC key pairs (of size 384 bits) using SpongyCastle - an old Android version of Bouncy Castle.

The problem we face is users losing their phones or private keys. Since we are not the only ones facing this problem, I took to the Internet for some reading.

It turns out that (please correct me if I'm wrong) a lot of crypto currencies apparently use seed phrases/mnemonics (as described in BIP39) to generate a seed from which they in turn generate extended keys (as described in BIP32). The algorithms used will always generate the same extended keys for the same seed (which is, I'd guess, why they're called deterministic).

I managed to find some microlibraries by Nova Crypto. I am now able to generate seed phrases, seeds, and extended keys.

My question is threefold:

Nova Crypto seems to be a guy like you and me. Since you should never write your own crypto, I probably should not use them.Are there peer-reviewed, secure libraries for the BIP-standards?
If I can use the libraries, how can I derive EC 384 bit key pairs from my extended keys? Is there a way to do this, or is the concept entirely different?
Are seed phrases secure (enough)? Are the keys generated out of these seeds as secure as the keys I generated using SpongyCastle?


texts:
I'm trying to perform a chosen-ciphertext attack against an RSA oracle.
I have $c$ as the ciphertext I want to decrypt, $e$ and $n$.
I already know that I could choose a number $r$, compute $r^e \cdot c$, make the oracle decrypt, and return $r\cdot m$.
The problem is that this particular oracle checks if $m \bmod mo = 0$ where $m$ is the decrypted ciphertext I sent and $mo$ is the original message which I'm trying to get. If it's equal to $0$ (like $rn$) it won't print $m$ so I can't use that attack.
I don't really know what to do.
$n$ is pretty big (1024bit) so I can't factorize it. Maybe there is a small adjustment to the mentioned attack, but I'm really stuck. If anybody could give me a hint I would really love it.


texts: Can POS devices really generate random numbers?

texts:
I am doing an implementation of a system designed by a payment company and I am a little skeptical about the way they have designed the end to end cryptography.

The system is as follows:

There are three parties in the data exchange

Sending party (A)
Switching party (B)
Receiving party (C)

Party (A) is a POS device having a very little computing power.
Party (B) is the payment company
Party (C) is an authorizing institution

On the POS device, biometric data is captured and POS device have a public key of (B). The POS device will generate a random 128-bit key and encrypt data using this key and then again encrypt the entire dataset with public key of (B) and send it to (B).

Party (B) also maintains symmetric keys for party (A) and (C). Once it has data from party (A) it decrypts it and then encrypts the data set using symmetric key of party (c) and sends it.

Party (C) will use its key to decrypt the data first and then uses 128-bit key received from dataset to decrypt the remaining data.

My concerns on this methodology is: Can POS devices really generate a random number?


texts: Can elliptic curve cryptography encrypt with public key and decrypt with private key like RSA?

texts:
I know that RSA can be used for both, encryption and signature.
What about EC? I know about ECDSA/EdDSA, but to my knowledge it can only be used to sign.
I also know about ECDH, but it is a key agreement protocol.
Is there some elliptic curve based public key encryption algorithm?


texts:
I am new to ECC. I am confused about what the embedding degree in an elliptic curve group represents and what is the impact of its values on the curve and security (small values or large values?)

What does the following mean:

  The elliptic curve group used has a 160-bit group order, the base field size is 512-bit, the embedding degree is 2


texts: If classical ciphers are used with compressed plaintext, how much does it make frequency analysis attack harder?

texts:
Classical ciphers, such as the Vigenère cipher, are weak and no longer used. They can be broken by using frequency analysis, which is a well-known fact.
However, frequency analysis often depends on the number of captured ciphertexts and/or their duplication. What if the ciphertext was compressed by an algorithm such as Huffman encoding，zlib, or lzma before encrypting the plaintext? For better security, assume there is no constant header, magic number, or any identifier in the plaintext.
How much more difficult does compression make attack by frequency analysis?


texts:
For a public one-way function $f()$, we can use zero proof to prove I know some secret $x$, such that the output of $x$ is a specific number $y$.

However, in zcash, I need to prove that I have some secret $x$, then $cm$ which is the commitment result of $x$ is a leaf in Merkle tree. Here, $cm$ is not a specific number and it is secret.

How should I prove this statement? I cannot figure out the circuit structure and the process using ZK-snark.


texts: How to decrypt a text which is ciphered same length key?

texts:
I have ten piece of ciphered texts. I know that they ciphered with a same-length key. Any idea how I can decrypt the ciphertexts? What kind of algorithms should I use? What are the points of taking care of 'XORing' these texts with each other and space character?
(text ciphered with the asymmetric key)
should we use the frequency analysis?


texts: Ensuring integrity of a client side script

texts:
I want a script that is running on the client to compute a collision resistant hash and send it to a server. I need to ensure that the script which performs this hash is not altered in any malicious way. Is there any protocol that exists which can ensure that the client script that calculates the hash has not been altered.

I have an idea whereby the script sends back an HMAC signature of itself, but on second thoughts, this would not stop an attacker from fooling the server if the code is altered.


texts: Is the number still a CSPRN if we only allow an interval from a CSPRNG?

texts:
tr -dc 0-9 < /dev/urandom | fold -w 3 | awk '$0>=100 && $0<=200'

What this line does:

/dev/urandom (Linux) is proven to be a CSPRNG, that is not a question
the "tr -dc 0-9 < /dev/urandom | fold -w 3" outputs 3 digit long numbers from /dev/urandom, ex.: 630, 418, 037, 992, 186, etc.

The question: we need numbers only in an interval, but we need those numbers to be cryptographically secure pseudo random numbers. We use the following: awk '$0>=100 && $0<=200' to only allow numbers (x) inside a given interval (100 <= x <= 200). Are these numbers (limited due to the interval) still considered as cryptographically secure pseudo random numbers?


texts: What is the most secure encryption algorithm that keeps the entropy the same or even lowers it?

texts:
On top of my mind comes caesar cipher, but that is not really secure

so what is the most secure encryption algorithm that doesn't affect entropy or even lowers it?

I know this might not be as secure as normal encryptions, but I'm asking about what is the most secure among these types of encryptions?

basically I have a series of bytes, and I want to encrypt them in a way that a machine that only checks the entropy to detect encryption gets bypassed. so basically this encryption doesn't affect the entropy, or even better if possible, lowers it.

I thought maybe I can just replace each byte with another, but was wondering is there any better method? keep in mind that security is my second priority and keeping or lowering entropy is my number one priority


texts:
I was thinking of doing symmetric encryption using just hashing and simple XOR encryption. It would work as:

Alice and Bob share a symmetric key
Alice manages to send an (authenticated) IV to Bob
Bob and Alice both combine the IV with the symmetric key and use it to seed a PRNG
the output of the PRNG is hashed (SHA256)
whenever a message needs to be sent, the data is XORed with the hashed PRNG output

Are there any serious issues with this approach? If indeed there aren't any, why would one use a SHA256/AES combo with 2 points of failure instead of just relying on the existence of one way functions like SHA256? Why use AES at all?


texts: Can I serve data for user without the ability to access them? Which functions for the user remain?

texts:
My Problem

I want to serve sesible data for users as a webservice that is accessed by the user via the browser.

Restrictions:

I may not be able to technically acces the data of the user
Data is accessable for one or several users, number may change over time. Who has acces to the data is decided by one user for his data. He/she may add or remove other users.
The user should be able to get his/her data anytime

Ideas

Encryt the data at my server with a key, only known by the user.

Restriction 1 and 2 is fulfilled, if the user share the key
Once the user forgets/lost the key, restriction 3 does not hold...

Data is stored encrypted at the users client, I only provide a nice user interface and the tools to encrypt or decrypt the data.

Restriction 1 holds
Restriction 2 and 3 are highly dependent on the ability of the users to cooperate and to backup their data...

Questions

Do you have any ideas to improve one of ideas mentioned?
Do you have complete other ideas to solve the problem by fulfilling the restrictions?


texts: Can ECDSA signatures be safely made "deterministic"?

texts:
Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message and key are the same. For some applications, a "constant" signature may be desirable.

It seems to me that there would be no harm in implementing "constant" ECDSA by setting the "random" k value to be the x-coordinate of the message hash z (converted to a curve point in some arbitrary fashion) multiplied by the private key. Obviously the method translates back to DSA.

This scheme might be useful for implementations that do not have access to a source of random numbers.

Are there any problems with this?
Is there a faster way of generating a suitable k than a point multiplication?


texts: Can an ephemeral RSA key give forward secrecy?

texts:
Suppose party A generates an ephemeral RSA key and sends the public key to B.  Party B then generates a symmetric key, encrypts it with Party A's public key and sends the Ciphertext to Party A.  Party A then decrypts the key that party B sent.  Parties A and B then use the key that B generated to encrypt data.

Does that meet the definition of Perfect Forward Secrecy?  If so does that mean that RSA could still be used in a protocol like TLS and meet the new Perfect Forward Secrecy requirement?


texts: Is there a known authoritative source for the ANSI C header files for PKCS#11 Cryptoki? Specifically, I am having trouble locating pkcs11.h, pkcs11t.h, and pkcs11f.h for v2.30 and v2.40. Are there known MD5 or SHA hashes for these files?


texts: For a given plaintext-ciphertext pair, how many valid AES keys are there?

texts:
For $PT\in \mathbb{M}$ and $CT\in \mathbb{C}$, let $\mathbb{F}=\{f|f:\mathbb{M}\rightarrow\mathbb{C}\}$ be the collection of all functions from $\mathbb{M}$ to $\mathbb{C}$. Then AES encryption under key $k$ is one of these functions, say $f_k$, such that $f_k(PT)=CT$. Then,

Is there any key $k'$ such that $k\neq k'$, but $f_k(PT)=f_{k'}(PT)$?
If so then is there any fixed cardinality of such sets of keys?


texts: Relations between RSA and Generalized Diffie-Hellman (GDH), factoring and GDH

texts:
Definition: (The generalized Diffie-Hellman problem)
Let $n=pq$ for two large primes $p,q$. Given $x, x^a, x^b,n$, find $x^{ab}\pmod{n}$.

(1) Is there a known reduction from the GDH problem to the RSA problem (i.e. finding $m$ from $m^e\pmod{n}$)?
(2) Is there a known reduction from the GDH problem to integer factorization?
(That is, given an oracle which solves the second problem mentioned in (1)/(2), can you find an efficient algorithm which solves the GDH problem?)
Side-notes:

There is of course a reduction from GDH to DLOG, but I do not know of a reduction from DLOG to integer factorization or to the RSA problem.

It is known that the RSA problem limited to $e=2$ (i.e. finding square roots modulo $p$) can be reduced to integer factorization, but this is a non-interesting case. For a general $e$, AFAIK such reduction is not known.

Also, I am just as interested to hear about DH instead of GDH. (The DH problem is the same as GDH, but with a prime $p$ instead of semiprime $n$.)


texts: Is using HMAC signature as a long-term password secure?

texts:
I'm considering implementing an authentication service without storing users' passwords/hash.

I want to use a key derivation function with a corresponding username and a master secret key to calculate the password of the user(user is actually a service). Then deliver the derived password to each user(service).

Something like using HMAC(secret_master_key, username) or PBKDF2(HMAC(secret_master_key, username)) as the long-term password for user. Or maybe some other algorithm should be more suitable for this scenario?

Is this way secure cryptographically? Thanks in advance.


texts: RC4 , Is it possible to find the key if we know the plaintext and ciphertext?

texts: Is it possible to find the key if we know the plaintext and ciphertext with RC4. How should I write the algorithm?


texts: Applying Chinese RemainderTheorem and Paillier Homomorphic encryption

texts:
I'm trying to optimize the decryption process for Paillier Homomorphic Encryption (PHE) using the Chinese Remainder Theorem (CRT). However, I want to check if there's a different way of applying CRT to PHE apart from the traditional approach and still get the same result or a faster result since there's a simpler variant for the PHE as stated here in Wikipedia.

Recall that,

=(^   ^2 ).   ,   = ^.^   ^2,   =()=(−1)(−1)

=[((^ ^2 ))]^(−1) ,   =()^(−1)   = [(−1)(−1)]^(−1)

                    =(^   ^2 ).

                =(^((−1)(−1))   ^2 ). [[(−1)(−1)]^(−1)   ]

                    =  [(^((−1))   ^2 ).(−1)^(−1)  ]

                    =  [(^((−1))   ^2 ).(−1)^(−1)  ]

Let = (−1)^(−1)         and       = (−1)^(−1)

                    =  [(^((−1))   ^2 )]

                    =  [(^((−1))   ^2 )]

 = CRT(, )

 =  [(^(−1)   ^2 )   ]  +  [(^(−1)   ^2 )   ]

  = (^   ^2 ).

Implementing the above steps in python gave me an inconsistent decryption result.

Is this proof correct, and if not, can anyone please explain as to why it's not correct and how to make it correct?


texts: Are variable-length crypto hash functions still susceptible to collisions?

texts:
I just recently learned that the SHA-3 finalist Keccak allows for variable length output. As the only answer to this question states, "[it] need to have an output length at least equal to the input length," which I understand just fine. However, I'm curious if this guarantees against collisions.

Is there any work done to show or prove collision resistance gained by increasing digest length? If so, how dependent is this resistance on the hash function itself? (I'm guessing the answer to this is "highly" or "entirely".)
What are the other benefits of allowing variable and arbitrary length output?

If the math on these points is still fuzzy, is variable length output just based on the intuition that "larger problem space = harder to attack"?

Note my crypto and math expertise is very low, so please add a 'for dummies' section to any answer you write and I thank you in advance.


texts: Are tags longer than 128 bit possible for AES-256-CCM and AES-256-GCM?

texts:
I have an existing application that uses AES-256-CBC for encrypting data blocks, and HMAC-SHA-256 on the plaintext for eliminating duplicate data blocks.

For performance reasons, I would like to move to AES-256-CCM and using the resulting authentication tag instead of the SHA-256 .

However, this algorithm is designed to generate a 128 bit tag. This is more prone to hash collisions than HMAC-SHA-256. 128 bits doesn't seem to be sufficiently future proof to ensure collision safety for a system potentially storing enormous numbers of blocks.

Is there a way to extend the tags of AES-256-CCM or AES-256-GCM to have 256 bits strength?

Edit: What I'm try to accomplish is to encrypt a set of objects which are eventually stored in Amazon S3 in a content addressed way, that is, the key of the object should be a hash of the plaintext . People with access to my Amazon S3 bucket should not be able to be able to decrypt the data, nor should the scheme allow checking whether a specific known plaintext exists or not in the bucket. That is why the current scheme is HMAC-SHA256 on the plaintext to choose a key for the object, and then encrypting the object using AES-256-CBC with a unique and unpredictable IV.

AES-256-CBC and HMAC-SHA256 are rather slow, and thus I had the idea to use some form of fast authenticated encryption.


texts: Verifier choose a random challenge to send to prover

texts:
Could anyone explain me why the verifier in Honest verifier zero-knowledge Simulator, has to choose a random challenge to send to prover?

I have not understood well. Thank you in advance.


texts:
I am a newbie to this area. I have a program that uses a custom algorithm to encrypt a message. I can encrypt it as many times as I want, but using the same key. I have couple of questions so that I can improve my algorithm.

My program support multiple passes. How many iterations of these passes my program should do? Is there any ideal number in the crypto world? I have read a little about three pass protocol. Does that apply in this case?
Any issues or trade-offs can you think of with this type of approach?

-Alex


texts: What does a repeated byte between two XORed hexadecimal ciphers mean?

texts:
I have two different hexadecimal strings (of same length) that I think are encoded plain text strings.

Out of curiosity I XORed them and I found a single hex byte repeated for the length of the two hex strings.

Does it mean anything about the key or the algorithm used to encode the two original strings?

Thank you in advance for your help. :)

EDIT:

Here is an example:

String1: 12345678
String2: b294f6d8
XOR: a0a0a0a0

And I think I may know part of the plain text.


texts: Does double hashing increase resistant against first preimage attacks?

texts:
Let's take Bitcoin as an example. Bitcoin uses SHA256, which can be vulnerable to collision and preimage attacks - although this is extremely unlikely to happen in the near-future.

However, let's say an evil genius figures out how to compromise Bitcoin by developing a way to perform a first preimage attack against SHA256 (in other words, he finds an input that hashes to a specific output; i.e., given y, he finds an x such that h(x) = y). But Bitcoin uses double hashing, rather than just hashing once.

Therefore, my question is this: does double-hashing increase the resistance of SHA256 against a first preimage attack?


texts: Public key on Server Key Exchange Generation vs Public key on Server's Certificate

texts:
To understand the distinction between TLS 1.2 and TLS 1.3. I am stuck in the past understanding for TLS and the current reference I am studying:

As I know certificate goes with owner's public key, and its public key is used for key exchange between client and server to generate long-term pre-shared key.

But I feel confused with this understanding when I look into the phase Server Key Exchange Generation in TLS 1.2.

It says public key derived from server for key exchange is not the attached one but the new one derived from random number $2^{256} -1$ as private key.

Which one is right? I have heard about both in different references.
Also it makes me breed another question about prevention from man-in-middle-attack via certificate as follows:

If a user's browser is tampered with spoofed DNS resolver which returns fake server's IP address that serves same host name of website with the certificate fetched from real website. How the browser verifies the integrity if the TLS handshake uses two different key pairs in certificate verification and key exchange?


texts: Key expiration policy for 3DES / TDES / Triple DES

texts:
I have a system that signs plain text messages using a message authentication code (MAC) encrypted with 3-key Triple DES. The short message is used on connection to establish a session key, so it would take an attacker a long time to compile a lot of plaintext / MAC examples.

I need to establish a key expiration policy that says "keys shall be changed at interval X" to  maintain security. What is a reasonable time limit considering only the cryptographic threats?

From the reading that I have done, I expect that a brute-force attack (Lucks attack, ref. rfc4772, effective 108 bits) is not practical within the lifetime of the system (30 years) and is not a threat that requires periodic changing of keys. Is this true?
There seem to be some attacks that benefit from compiling a lot of plaintext / ciphertext examples. A reasonable key policy would be to change the key before enough examples could be collected. What is a reasonable limit, considering the known attacks on Triple DES? Something I read (edit: http://tools.ietf.org/html/rfc4772) suggested 2^32 blocks was such a limit.


texts: Cracking a Shift Cipher that uses an Unknown Deterministic Scheduling Algorithm

texts:
Consider a shift cipher that has the following encryption scheme:

The plaintext contains lowercase characters and spaces, is composed of English text, and is length 500. Thus, the message (and ciphertext) space is $\{\text{space}, a, b, ..., z\}^{500}$.
There is a key $K$ of len $t$ (between 1 and 24), which is a sequence of numbers between 0 and 26. That is, $K = k[0],k[1],...,k[t-1]$.
Each character in the ciphertext, $c[i]$ is the result of $m[i]$ shifted by $k[j(i)]$. That is, each character is the result of shifting the corresponding character in the plaintext by one of the key elements. The key element is determined by an undisclosed deterministic, non key based scheduling algorithm, $j(i)$. For example, if $j(i) = i \bmod t$, then this encryption scheme reduces to the standard vigenere cipher.

Assume the attacker has never seen any previous ciphertexts using the particular scheduling function $j(i)$.

There are two methods for plaintext generation.

In the first case, the plaintext is randomly chosen from 1 of 5 fixed plaintexts that are also known to the attacker. In this case, the following can be used to determine which one was used to produce the ciphertext. Recover the "key stream" that would be used in the encyption for each candidate plaintext, by determining the number of positions each message character would need to be shifted to produce the corresponding character in the ciphertext. For the true message, this can only contain at most $t$ unique values, which is less than the maximum 27. For any other message, we would expect the number of unique shifts amounts to be 27.

In the second case, the plaintext is generated as a space-separate sequence of words that are randomly chosen from a small 40 word dictionary of English words. In this case the only ideas I have so far is to exploit to the fact that a space occurs a relatively fixed interval, and also cribs can be used since we know the words that are used.

The cipher description is given in full detail here.


texts: Can pbkdf2 be used with a fixed salt to give a deterministic slow hash?

texts:
I need a password hashing function that is deterministic. Correlation attacks are not a concern. The same password must produce the same hash. I just want to protect the password against dictionary and brute force attacks in the event that the hash is leaked.

Is there a well known way to do this? Would fixing the salt of bcrypt/PBKDF2/scrypt be enough?


texts: Is this a proper key-exchange implementation?

texts:
I've been trying to implement Diffie Hellman key exchange so far from my own understandings (I know I could just stick with SSL/TLS, but I want to understand it in depth more), so I created this basic server<->client key exchange:

Generator and modulus are constants, thus same all the time
Generator is 3
Modulus is a 2048bit prime number

Step 1:
  1. Client connects to a server, asks for key exchange
  2. Server generates random 2048bit exponent
  3. Server rises generator to this exponent
  4. Server does modulo on result with 2048bit modulus
  5. Server sends result of modulo operation unencrypted to client

Step 2:
  1. Client receives result from server unencrypted in form of hex number
  2. Client generates random 2048bit exponent
  3. Client rises generator to this exponent
  5. Client sends this number to server unencrypted back
  6. Client rises server's number to client's exponent and does modulo op.
  7. Client remembers result as secret key (2048bit)
  8. Server receives this number, and rises it to it's own exponent and does modulo op.
  9. Server remembers result as secret key (2048bit)

Step3:
  1. Both client and server do SHA256 on secret key and get 256bit integer
  2. This 256bit key is used as private key for further AES/CBC/PKCS5 communication

So my questions are:

Can exponent be random number just like it is now or it should be a prime too?
Is using dynamic modulus and generator better idea?
Is there anything to improve this key exchange or are there any flaws?
Is using SHA256 a proper way to generate 256bit key for AES/CBC?

Edit: purpose of this key exchange is for JSON messaging between server and client and end-to-end encryption in VoIP between clients (it's all for self-educational purpose, I know I could stick with WebRTC/DTLS or any already existing protocol!)


texts: What is the evaluation step in an HE scheme?

texts:
I quote:

By homomorphic encryption, we mean the family of encryption schemes
being able to perform homomorphic operations on ciphertexts, without
decrypting them. The first time someone introduced such a notion goes
back to 1978, when Rivest, Adleman and Dertouzos [RAD78] described the
privacy homomorphisms. An homomorphic encryption scheme, as
traditional encryption schemes, has a key generation, an encryption
and a decryption algorithm, and it has an additional algorithm called
evaluation.

Key generation
Encryption
Decryption
Evaluation

How could one explain to someone with zero background on cryptography, what the evaluation step entails ?


texts: Diffie-Hellman key exchange protocol with finite field GF(2^5)

texts:
In a Diffie-Hellman key exchange protocol, the system parameters are given as
follows: finite field $GF(2^5)$ defined with irreducible polynomial $f(x) = x^5 + x^2 + 1$ and
primitive element $\alpha= x$ in the field.

Suppose that Alice selected random number $a = 5$ and Bob selected $b = 6$, show the steps
performed by Alice and Bob to obtain their shared key. What is the key?

For Alice:

$α^a = α^5 = x^5 = (x^2 + 1)$

For Bob:

$α^b = α^6 = x*x^5 = x(x^2 + 1) = x^3 + x$

Shared Key For Alice:

$α^{ab} = (x^2 + 1)^b = (x^2 + 1)^6\ldots$

Shared Key For Bob:

$α^{ab} = (x^3 + x)^a = (x^3 + x)^5\ldots$

The answer is $x^4 + x$ but I'm not sure how to simplify to this answer from both sides either Alice or Bob which should have the same shared Key


texts: AES - Non-linearity hinders differential cryptoanalysis

texts: Can you explain me, in simple terms if possible (I'm not a mathematician :( ), why the non-linearity introduced by the AES s-boxes hinder the differential cryptoanalysis ?


texts: Understanding the elliptic curve equation by example

texts:
I'm trying to follow this tutorial and wonder how the author get the list of points in the elliptic curve. For example, why when you input x=1 you'll get y=7 in point (1,7) and (1,16)?

on intuitive level, I'll do:

x=1, 1^3+1+1 mod 23

= 3mod23 = 3 so why we get (1,7) & (1,16).