texts: Differential privacy and Shamir's scheme

texts:
I have been unable to find any proofs (for my own reference) that demonstrate that Shamir's secret sharing scheme does (or does not) satisfy the definition of $\textbf{differential privacy}$ as provided below:
$\mathbb{D}$ denotes the set of possible databases. $\textbf{Q}$ denotes the set of possible queries on the databases. Let $\textbf{M}$ denote a mechanism such that:
\begin{equation}
    \label{mechanism_definition}
    \textbf{M}: \mathbb{D} \times \textbf{Q} \mapsto \mathbb{R}^p
\end{equation}
A mechanism $\textbf{M}$ as defined above is said to satisfy differential privacy if:
\begin{equation}
    \label{differential_privacy_equation}
    \frac{\mathbb{P}[\textbf{M}(D,q) \in S]}{\mathbb{P}[\textbf{M}(D',q) \in S]} = 1
\end{equation}
$\forall$ D $\in$ $\mathbb{D}$ and $\forall$ q $\in$ $\textbf{Q}$.
$\forall$ S $\subset$ Range ($\textbf{M}$).
This is the reference I used for the definition provided.
I would appreciate some guidance in this regard.


texts:
Is there a secret sharing scheme where secrets can be weighted, and that you need a total weight of $1$ to unlock the secret?

I know that you could, of course, just figure out every subset that has access to the secret and then do a XOR secret sharing scheme, but that isn't very efficient.


texts: how to calculate the non linearity of each element of s box?

texts: I want to learn how to calculate the elementwise noninearity of an sbox. I know how to calculate the ANF, and how to create the s box. Now I wanna learn how to calculate the nonlinearity of s box elements "belement.before n after shuffling elements."


texts: Incorrect solution for Discrete Log Problem when using the Index Calculus algorithm

texts:
The index calculus algorithm can be used for computing discrete logarithms.
The basic idea is that you search for a set of linear independent vectors.
When you solve the corresponding matrix, you find the solutions for the discrete log problem of all the prime factors in your factor base. These can be used to solve the original discrete log problem.

I decided to make an implementation of it just for fun.
However, when solving the corresponding matrix, I sometimes run into solutions for the factors that are incorrect.
Let me show an example. Assume we have generator $g = 5$ and $h=543$ with $p = 2003$. Using the factor base $\mathcal{F} = \{2,3,5,7,11,13\}$, we want to find a solution for $$g^x \equiv h \mod(p)$$

Lets say we find the following relations which are $\mathcal{F}$-smooth:
\begin{align*}
5^{790} &= 3^2 \cdot 11^2 \\
5^{729} &= 2^5 \cdot 5 \cdot 11 \\
5^{1162} &= 3^3 \cdot 5 \cdot 7 \\
5^{919} &= 2^2 \cdot 5 \cdot 7^2 \\
5^{150} &= 2 \cdot 3^2 \cdot 7 \\
5^{953} &= 2 \cdot 5 \cdot 7 \cdot 13
\end{align*}

This leaves us with the following matrix:
$M = $
\begin{pmatrix}
0 & 2 & 0 & 0 & 2 & 0 & 790\\
5 & 0 & 1 & 0 & 1 & 0 & 729\\
0 & 3 & 1 & 1 & 0 & 0 & 1162\\
2 & 0 & 1 & 2 & 0 & 0 & 919\\
1 & 2 & 0 & 1 & 0 & 0 & 150\\
1 & 0 & 1 & 1 & 0 & 1 & 953
\end{pmatrix}

Using Gauss-Jordan Eliminiation, we get the following solutions:
\begin{align}
\log_5(2) &= -93 \equiv 1909 \mod(2002)\\
\log_5(3) &= 60 \\
\log_5(5) &= 859 \\
\log_5(7) &= 123 \\
\log_5(11) &= 335 \\
\log_5(13) &= 64
\end{align}
We can check the only the $\log_5(7)$ is correct.
My question is: how is it possible that the solutions for the factors in the factor base are (mostly) incorrect, although the relations we found are linear independent?


texts: Would Triple DES-X with 7 keys be much slower than standard Triple DES?

texts:
Since a single hardware pass of an XOR with a 64 bit key is very fast, would Triple DES-X using seven 64 bit keys used in the following manner be virtually identical in terms of code size, memory consumption, and execution speed to 3DES?

You have four 128 bit keys and three 64 bit keys.

You take a 128 bit block of plaintext.

You break it into two 64 bit block-halves in the following columnar transposition based fashion.

The bits at even indexes go into one half and the bits at odd indexes go into the other half, so the halves are intermingled.

You take the first 128 bit key and XOR the entire 128 bit block.

You take the first 64 bit key and encrypt each 64 bit half-block with DES independently of each other.

You treat the result as that round's 128 bits of ciphertext and repeat the 128 bit columnar transposition, importantly inter-mixing both half-blocks again based on odd-even indexing.

You take the second 128 bit key and XOR the entire block as one.

You then take the second 64 bit key and DES both 64 bit half-blocks independently.

You then repeat the columnar transposition-XOR-DES process for the third time.

Finally, you XOR the entire 128 bit block with the 7th 128 bit key.

Additionally, would it be significantly stronger?  Would it still suffer from the same block size based vulnerability of DES-X?


texts: Does pseudorandom secret sharing require a central dealer?

texts:
I'm trying to figure out whether pseudorandom secret sharing (as described in this paper) requires a central dealer, i.e. one party who doles out keys to the other players and thus who would be able to generate all the pseudorandom numbers on their own.

I'm new to this, so the paper is almost completely opaque to me, and there doesn't seem to be any dumbed down versions of this technique anywhere on the internet.

The implementation of PRSS in VIFF appears to require a central person to generate everyone's initial keys, but this doesn't seem necessary, i.e. you could make an implementation where everyone generates their own random keys and shares them with the appropriate parties as necessary.

However, VIFF's use of "dealer keys" confuses me, and makes me think that at some point, some party could generate all the pseudorandom numbers on their own. I've tried to read through the code, but I've reached a point where it's just as opaque to me as the aforementioned paper.

Is there anyone who can explain this?


texts: What could be the keylength of a DES encryption?

texts: What could be the keylength of the DES encryption if we have an output of 64 bytes?


texts: Does Shamir Secret Sharing provide integrity?

texts:
Shamir secret sharing splits into t number of shares with a t-threshold. However, I can find no information online if this scheme provide integrity (or authentication for that matter, which I assume it does not).

Can an adversary forge a share? If not, what hard problem is he faced with. Is it due to the share should be indistinguishable from random (psuedorandom)?


texts:
I'm building a website. I have an API which takes 2 parameters: delete_user(user_id, hash).

And there is method to evaluate hash using SHA512:

String hash(String user_id)
{
   String key = "23jfk3jf...343fk";
   return SHA512(user_id + SHA512(key));
}

And the second method to validate:

bool validate(String user_id, String hash)
{
   if(hash(user_id) == hash)
   {
        return true;
   }
   else return false;
}

Every user knows his user_id and the hash value of his user_id.
user_id has length K symbols
the key in hash method has M symbols
hash method is not public to users, but validate method is.

Is it hard for a user to find any pair (String user_id, String hash), for which validate will return true (of course, user_id is not his own account's user_id). Let's say K = 10 and M = 50?


texts: Other than password hashes, are there other uses for non-reversible crypto

texts:
Hashing is useful for checking that an input matches expectations without giving away the stored expected version - so confirming passwords etc.

But are there other use cases? In general, cryptographic storage so data is retrievable seems to be the norm.


texts: Is there an intuitive explanation as to why only the private key can decrypt a message encrypted with the public key?

texts:
I have just learned about using PGP/GPG for email encryption and one thing bugs me:

How is it possible that a message encrypted with somebody's public key can be decrypted only with that person's private key?

This concept of asymmetric encryption is not easy for me to understand. Simply said, I would expect that the process to encrypt with the public key should be unique and therefore be able to be reverted with the same key.

What's the key operation that ensures this is not possible?


texts: Is there any multi-key additive homomorphic encryption scheme based on elliptic curve cryptography? Meaning adding encrypted values encrypted with different public keys and decrypt the total sum with a private key. The keys are points on an elliptic curve.


texts: Can I retrieve a re-hashed (hash) value, for instance by additional hashing?

texts:
I have a double-SHA-256 of some text $$ h_2 = \operatorname{SHA256}(\operatorname{SHA256}(m)).$$ I don't need the plain text ($m$), but somehow I need to get first $$h_1 = \operatorname{SHA256}(m).$$

Can I have it ($h_1$) by keep hashing the second one ($h_2$)?
$$ h_1 = \operatorname{SHA256}(\operatorname{SHA256}(...\operatorname{SHA256}(h_2)...)).$$


texts: Question about discrete logarithm problem

texts:
DSA and ECDSA both are based on discrete logarithm problem (and elliptic curve based DLP)

And ECDSA protocols resembles DSA.

My question is,

Can every protocol based on DLP be changed (substituted) to a protocol that is based on ECDLP?


texts: Can Zk-SNARKs verify the results of turing-complete computations?

texts:
My understanding is that Zk-SNARKs (and zero-knowledge proofs in general) can be used to prove that a polynomial-time computation has a certain output, while keeping one or more of the inputs to that computation hidden.

For example, say you have a string h which is the output of a fixed hash function. If you know an input x which hashes to h, you could use a Zk-SNARK to prove you know x in zero knowledge (i.e. without revealing x). Equivalently, given a verification function like this:

verify(x,h):
    return hash(x) == h

you're essentially proving that you know inputs to verify which make it return true, without revealing all of those inputs.

So, here's my question. Suppose you have a secret poly-time, single-argument function f. Given a public input x and a public output y, could you use a Zk-SNARK to prove in zero knowledge that f(x)=y? I.e., given the function

verify(f,x,y):
    return f(x) == y

could you still construct a proof showing that verify returns true while keeping f secret? The difference between this situation and the above one is that now you're proving something about a verify function that is itself running an arbitrary function, rather than one which simply does some fixed calculations to check things--and this seems like a pretty significant difference to me.

It seems like this should be possible in theory, because if f is poly-time then f(x)=y is still an NP statement (although I may be wrong about that)--but I'm wondering if it's possible in practice with today's Zk-SNARKs.

The way I phrased my question, I guess knowledge of such a function is trivial, because if the prover knew y in advance, they could just define f to return y. So to make things more interesting, you could imagine a situation where the prover commits to f in advance, and the proof is expanded to verify that the f used to compute y matches the commitment.


texts:
Assume an algorithm that encrypts each letter in a string into a different one, using a key, but in such a way that if you were to change a single letter from the clean text, the encrypted text would look completely different.

Also assuming each letter doesn't get encrypted to the same letter.

Here is an example (not generated by an actual algorithm)

Clean:

  Foo Bar Foo Bar

Encrypted:

  GjhetvbawmgYerujkgry

And another example

  Foe Bar Foo Bar

Encrypted, looks completely different from changing just one letter (and maybe even has a different length):

  HjengaieyHgnAuYehkawTGn

Would that be considered a strong algorithm?

My thoughts:

Statistical analysis can't happen (right?) because there is no symmetry in the encryption (for example, the two "o"s in "Foo" turn into different letters).

So how would a cryptanalyst find the key from such an algorithm?

(To clarify, I'm not asking if an algorithm is powerful, just how a cryptanalyst would look at it, assuming he knows the algorithm (and knows the key length) and has the ciphertext)


texts: AES OCB with Argon2 KDF for keyring file encryption

texts:
I've just released a python keyring companion package to encrypt the passwords in a file, available here.

Description

The project is mainly targeted to provide a sufficiently secure storage for plain text passwords (keyring) in a simple portable file, where the default keyring storage implementation of a desktop environment doesn't fit.

Cryptography

The keyring is secured with a keyring password. A raw Argon2(\$argon2id\$v=19\$m=65536,t=15,p=2) hash is generated from the keyring password, which is used as a key for AES encryption of plaintext passwords in OCB mode. The resulting encrypted data is persisted, together with the Argon2 salt, the OCB nonce and the OCB MAC. This value is stored with service/userid reference in a text file (.ini format).

Initially, a static reference value, treated as a plaintext password is stored as well, and this values is used for verification of the keyring password in subsequent accesses.

Attack surface

The static reference value might allow some form of attack, as it encrypts a well known value. Hopefully, the Argon2 hash, combined with the AES encryption raises the effort to break the key sufficiently high.

Conclusion

Is this approach sufficient for establishing privacy of the secured data?


texts: How to generate two different keys out of a single password?

texts:
I'm designing a system in which a password is used both for logging in as well as for encrypting some payload.

To encrypt a payload I derive a key from the password. Very straightforward so far.

Since that encryption should be end to end, the password is not sent to the server, but it is hashed first and then sent to the server. The server then re-hashes that password to store it in the database (for the same reason you hash a password).

It is paramount that the server cannot rebuild the password not the password-derived key that was used to encrypt the payload.

So, my question is about which algorithms to chose for each of these instances.

I'm pretty sure that to hash the password for authentication purposes I want to use Scrypt. I'm aware it hasn't been tested long enough but it seems to be offering the best security these days.

To derive the key from the password, my plan was to use PBKDF2. Reading about it, some people do recommend to use Scrypt instead of PBKDF2 as it's more resilient to GPU attacks. My problem with doing that is that if I use Scrypt for both, auth and key derivation, I could be exposing the key to the server (during authentication).

How should I resolve that problem other than by using two different algorithms?

For the record, for encryption I'm using AES, specifically, AES/GCM/NoPadding, although this is not set in stone.

My implementation is done in Java and currently I'm using Bouncy Castle.


texts: How to calculate the number of Linearly active Sbox

texts:
I cant understand the concept of linearly active sbox. In the case of differential analysis it is more easy to understand the concept of 'active sbox'
Also how the increase in number of (linearly) active sbox improves the security of cipher

If any generic software programs are available to calculate the number of active sboxes, just by giving sbox functioning and permutation pattern?


texts: NIZK Proof of knowledge N of M discrete logarithms (threshold)

texts:
It is well known how to produce a NIZK that curvepoints $aG$ and $aP$ have the same discrete logarithm $a$ with respect to the curvepoints they are multiplied by. There is also a way to prove that a curve point $aG$ has the same discrete logarithm as one of $b_1P$, ..., $b_nP$. I think this is due to Cramer but I first encountered it in Traceable Ring Signatures.

My question is: is there a threshold version of this? That is, given a set of $M$ discrete logarithms, can I prove that I know $N$ of them?


texts: How to encrypt 1-to-1 chat application for dummies

texts:
A bit of a general question from someone who is pretty much a rookie when it comes to cryptography:

So I have an app where users are able to chat with each other 1-to-1 (no group chats). Currently the app stores all messages as plaintext in the db for backup, so that each time a user connects to the chat they are synced with what is in the db. I would like to figure out how to store the messages in the db in a way that they are only readable by either of the participants in the chat.

Could you guys point me in the right direction in terms of what type of encryption to use? Is Public Key Cryptography suitable for this use case?


texts: Why is the number of qubits used in Shor's factoring algorithm so high?

texts:
When preparing the initial state of the algorithm to factor $n$ he computes $q = 2^l$ such that $n^2 \leq q < 2n^2$.

The first register then contains $l$ qubits. Why does this need to be so high. If we take $q=2^m$ such that $n \leq q < 2n$ we have $m$ qubits which is enoug to be able to represent all integers up to $n$.

Why does he take $l$ qubits is about half of that ($m$ qubits) would be enough?


texts:
The paper “Gimli: a cross-platform permutation” contains the following information:

  Occasionally (after rounds 24, 20, 16, etc.) Gimli adds an asymmetric constant to entry 0 of the first row. This constant has many bits set (it is essentially the golden ratio 0x9e3779b9, as used in TEA), and is not close to any of its nontrivial rotations (never fewer than 12 bits different)

What does the term “nontrivial rotation” mean? How to distinguish a “nontrivial” rotation from a “trivial” one?


texts: Collision probability of MD5 over different attacks

texts:
I am researching the collision probability of MD5 and various attacks against it. Can someone help me how to learn the least probability that there will be a collision in a specific attack on MD5?

For example: MD5 has a collision probability of $1 / 2^{64}$ under the Birthday Paradox.  Does this apply to any input given to MD5?

Also, is the output of MD5 uniformly distributed to the randomized input? (If, please provide references.)


texts: How to build a secure AE scheme with generic composition?

texts:
I am actually looking for using a secure Encrypt-Then-MAC AE scheme , and consider using either an existing "ready-to-use" dedicated AEAD mode (GCM, OCB, CCM, EAX, etc ..) or an alternate composed CTR-Then-CMAC scheme (mainly in order to avoid apparent fragility of GHASH as to limit impacts of accidental IV reuse with gcm)

My questions are the following:

If for instance I plan to build a composed CTR-Then-CMAC scheme, I think to process as follows
derive two Authentication / Encryption keys from unique
input key
encrypt plaintext P using CTR mode & input
Initial counter block    (ICB)
lastly  authenticate the  sequence composed of IV, AD and
Ciphertext using CMAC.
Is is correct ?    where / how can we find rules to build   correctly a composed AE    scheme from input "secure"   Encryption & MAC/Authentication modes ?
the only standard which addresses such    AE generic
composition seems to be ISO/IEC 19772:2009 which includes
"Encrypt-Then-Mac" mode beside other AE/AEAD modes; but as such ISO
standard has to be ordered I didn't still get info about content of
"Encrypt-Then-Mac" mode section


texts: How costly is to find millions of large prime numbers for RSA?

texts:
Consider I need to assign a large distinct prime number to each element in a large set. This must be deterministic so the function always gives me the same prime to the same value.

What is the most efficient way to do this (if there is any).
Would this function work if I need to find millions of prime number to assign them to the set elements.

Btw.: With “large prime number”, I mean the one is usually considered for RSA.


texts: In the STS Authentication Protocol, why are the signatures encrypted?

texts:
From Wikipedia:

(1) Alice → Bob : g^x
(2) Alice ← Bob : g^y, E_K(S_B(g^y, g^x))
(3) Alice → Bob : E_K(S_A(g^x, g^y))

I know there should be something I'm missing, but I cannot think of why E_K(...) is used. Isn't the signature sufficient? Even if there was a MITM, having S_B(...) or S_A(...) isn't very useful. What am I missing here?


texts: After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?

texts:
Is the following reasoning correct:

After ECDH with Curve25519, the resulting shared secret will be an EC public key with a bit strength of 128 bits.

This public key would then be hashed (let's say with SHA-2-256) to produce a key of length 256 bits for use in symmetric encryption. This symmetric key would have a bit strength of slightly less than 128 bits (because the hash operation reduces the bit strength very slightly).

Therefore using AES-256 with this 256 bit hash as a symmetric key would be a waste of time, and the 256 bit hash should be truncated to 128 bits and AES-128 used for the purposes of symmetric encryption. AES-128 would be 40% faster than AES-256, and there would be no advantage to using AES-256 over AES-128.


texts:
I have recently started studying lattices. The book that I am following is "Complexity of lattice problem by Shafi Goldwasser and Daniele micciancio" but it is too much inclined towards computational complexity and problems.

Can someone refer a good book from cypto perspectives and easy to understand and grasp the concepts?


texts: Using Permutation polynomial to compute a MAC

texts:
Is the following MAC secure?

For a block $y_i$ in a file, we defined a MAC as follows: $Mac_i:PRF(k,i) \cdot g^{y_i \cdot r_i} \bmod p$.

Where $p$ is a prime number, $g \in \mathbb{G}$,$PRF(k,i)$ is a pseudorandom function whose output is distributed uniformly random over $\mathbb{G}$, $k$ is a $l$ bit key, and $i$ is index of value $y_i$ in the file .

** More importantly, we define a polynomial ring $R[x]$ and $f(x) \leftarrow R[x]$. Where $f(x)$ is a linear permutation polynomial that has the form $ax+b$, where $a,b$ are picked uniformly random from $R$. We define $r_i$ as: $f(x_i)=r_i$ where $x_i \in \textbf{x}$, and  $\textbf{x}$ is a pulbic vector and $R$ is $\mathbb{Z_p}$.

It is clear that if $r_i$ is picked randomly the above Mac would be secure for a file. So when we define a mac for a block at index $i$ in a different file, we change the key $k$ to $k'$. However, here I use a permutation polynomial and by definition, its output is distributed uniformly random in $\mathbb{Z_p}$ and I make the elements in $\textbf{x}$ public (for some computation which is not the focus of this conversation).

So I pick the polynomial,$f$, once for a file, and for each block $i$, I evaluate $f$ at the corresponding value in $\textbf{x}$, so $r_i=f(x_i)$. Note that there are $|R|^2-|R|$ different linear polynomials in the field $R$.

Please let me know if it needs more explanation.


texts:
Let's pretend that all digits of pi are known and arbitrarily long sequences of digits are trivial to get. Further, some mathematician proves that there are no patterns in pi. We could create a stream cipher by grabbing a piece of pi as long as our plaintext and combining the two with some function (such as XOR or modulus addition.) The key would be the starting position in pi.

Would this be equivalent (in terms of security) to a one-time pad? To what sort of attacks would it be vulnerable?


texts:
It appears that in cryptography a lot of definitions are based on the time complexity of various algorithms. For example, a "good" encryption scheme should be resilient against a polynomial adversary. Or, inverting the image of a one-way function should take more than polynomial time.

But what about space complexity?

Why is there hardly any discussion (at least in introductory textbooks) of space complexity?
Maybe there is an encryption scheme out there that can be 'broken' in polynomial time, but only with super-polynomial space. Should that scheme also be considered 'safe'?
Are there any known non-trivial results about the space complexity of some cryptographic primitive? By non-trivial I mean something that isn't an immediate result of $\mathrm{NP}\subseteq \mathrm{PSPACE}$ or something similar...


texts: Can two rc4 encoded messages be XORed and decrypted if encrypted with the same key?

texts:
If I have the following:

E1 = RC4(M1, K);
E2 = RC4(M2, K);

If two different messages M1 and M2 are encrypted with the same key, K, can the key be recovered by doing:

K = E1 XOR E2

I tried XORing the two streams and could not get the key. Does RC4 not work this way?


texts: Computational Complexity Of Breaking Information Theoretic Security

texts: Wikipedia mentions that Shamir's secret sharing(SSS) for example, has information theoretic security. While I understand the concept that the adversary would just not have enough information to break the security, it must also correspond to some computatioal complexity class, shouldn't it? Let's say I'm an adversary and am presented with an instance of SSS. I have unlimited computational powers. Would I find it at least as hard as the Halting problem? Is it easier than that? Which class can be assigned to breaking such information theoretically secure protocols?


texts: Find a polynomial time algorithm for the following problem

texts:
Let $p$ be a prime number and let $c \in \mathbb{Z}_p$ and $e \in (\mathbb{Z}/(p-1))^{\ast}$. Put $c \equiv_p m^e$. Find a polynomial time algorithm that given $p$, $e$, and $c$ will compute $m$.

I have tried but failed, I am looking for a complete solution.


texts: What's the proper way of fitting hash digest to encryption scheme?

texts:
I would like to know what is the proper way of fitting the hash digest to the prime in which the encryption scheme operates. regardless if the bits of the hash digest is larger or smaller than the prime.

I've read that the Cramer-Shoup uses a universal one-way hash function, but didn't state what it is. Wikipedia says its just a property, and  with that I plan on using SHA256. My simulator uses smaller bits for presentation purposes and the larger bits digest of SHA256, I have a problem on how to fit it in. I've read in some forums to use mod on in, is this the proper way ?


texts: can a quantum or classical computer perform "MATRIX factorisation"?

texts:
I know that thanks to Shor's algorithm, integer factorisation is easy on quantum computers, yet hard on classical computers.

But what if I have two MATRICES, A and B, and compute the product N = A * B. Can a quantum computer, or a classical computer, find A and B without brute-forcing all possibilities?

Furthermore, is it possible to test the "divisibility" of N by some matrix M?

This is assuming that the elements of the matrices can only ever be integers (perhaps with some modulus) and the A and B are "prime", defines as: a matrix M is prime if there is no possible set of non-identity matrices that multiply to M.

I'm thinking about whether this could be useable as a quantum-resistant cryptographic accumulator.


texts: Allow everyone to decrypt a message, but don't allow anyone to encrypt it

texts:
I would like to create a software that will be installed on multiple clients. I would like to broadcast an encrypted message to all of those clients. Each client should be able to decrypt the message and react to it. However, noone should be able to create such a message that could be decrypted by those clients.

So, I would like to be the only entity that is able to create the encrypted message. At the same time I would like everyone to be able to decrypt the message I have created. I would also like the message to be sent in encrypted form, so digital signature alone won't suffice.

Is it possible with assymetric cryptography, i.e. RSA or ECC?

I know some people encrypt with private keys and decrypt with public keys, but lots of sources specify this approach as insecure/invalid. So, I would like to know what's the proper, secure and valid approach?

Update: edited to provide more context information, because maybe my generalization was confusing. It's not about the network, but rather I'm trying to think of some software registration key scheme. I would have multiple clients. When someone buys a key, I would send this person an encrypted registration info. His copy of the software would read this encrypted key info, decrypt it, and store on the disk in decrypted form. I would like to prevent converting this decrypted form into encrypted form again to prevent registration key from being stolen by some malicious software. The key would be useless in decrypted form because the software wouldn't accept decrypted key; it would accept only encrypted keys.


texts: Is $f(K, f(K, x))$ a pseudorandom function?

texts:
Given a PRF $f : \{0, 1\}^n \times \{0, 1\}^n \rightarrow \{0, 1\}^n$, is $f(K, f(K, x))$ a PRF, too?

My hunch is to construct a PRP similar to Feistel ciphers but with the property $f(K, f(K, x)) = x$, and disprove the statement with PRP/PRF switching lemma. However, I haven't found a concrete instance with the desired properties above yet.

Can anyone share some hints? Thanks!


texts:
I'm trying to understand how Krack works on GCM. I thought that looking at GCM would be easier since it's a full break and the video shows a tool that is able to decrypt everything.

I see that the IV is resent, but how does that carry forward? Each packet is sent with an IV that is used to encrypt/decrypt that packet, correct? Am I wrong in thinking the IV is generated from the Anonce, Snonce, MACs and PMK?

If a key is known to be all zeros, that should make it easy to decrypt once the IV is known, but if the IV isn't sent with packet and is in fact generated, then how are so many packets decrypted?

Krack doesn't disclose the PMK so generating the IV on your own is out. Shouldn't you be limited to the number of packets that were sent between the nonce reuse? As in, if 5 packets were sent before the nonce was reused then you would only have enough information to try to decrypt the five packets sent after the first use of the nonce and the five packets sent after it was reused.


texts: Ciphertext size of RSA, ELGamal, and EICES encryption

texts: I have to make a choice based on the minimum stored data, so I would like to know which encryption protocol is better in terms of the size of the resulting ciphertext for very short plaintexts (8 to 40 bytes)? RSA? ElGamal? EICES?


texts: Compact encoding of an elliptic curve point

texts:
I'm working on a project with elliptic curve cryptography (ECC), I'm using the secp256k1 library (the one that's used in bitcoin).

My goal is to create the most compact platform-independent representation of an elliptic curve point.

Currently my encoding consists of an x-coordinate, 256 bits wide, encoded in a big-endian form, plus the sign (oddity) bit for the y-coordinate. In order to reconstruct the point I use the curve equation to receive the value for the y^2, and then find the square root. Though calculating square root isn't trivial, this enables to pass only a single bit for y.

Now I'm thinking to get rid of this bit too. I realize that it's just 0.4% of the data, but for casual point (part of some bigger data set) it's usually aligned to the byte boundary, so it's practically around 3%. Anyway, I'd like to see if/how this is possible.

The idea is that for y there's a solution for (roughly) half values of x, so I thought about using this fact. So that if, for example, there's a solution for the encoded x then even y is selected. Otherwise there should be some transformation for x, and then odd y is selected.

Is there a way to quickly calculate the "counter-part" of x, i.e. some unique transformation from x which will give the quadratic residue for y to x which will not, and vice-versa?


texts: XSL on serpent and rijndael - which is most affected?

texts:
So I've often looked at serpent and thought it was a very strong contender in AES. Not so long ago I was looking for evidence as to why it didn't beat rijndael. So far, the closest I've got answering that is this:

  The 32 rounds means that Serpent has a higher security margin than Rijndael; however, Rijndael with 10 rounds is faster and easier to implement for small blocks. Hence, Rijndael was selected as the winner in the AES competition.

Which is from the wikipedia article and is marked citation needed. So further down the page I came across this other interesting piece of information:

  The XSL attack, if effective, would weaken Serpent (though not as much as it would weaken Rijndael, which became AES). However, many cryptanalysts believe that once implementation considerations are taken into account the XSL attack would be more expensive than a brute force attack.

Also citation needed. So my question is now - to what extent is this true? Is Serpent more resistant to XSL attacks? Given that XSL works by representing a cipher as a system of equations, isn't it then only a matter of finding an efficient way to solve a particular set of equations? I.e. isn't the very fact an algorithm can be represented as a set of equations the key issue, or are there certain sets of equations that are provably harder to solve?

(I'm really interested in working out which has the better security margin, but given these statements I think the first step for me is to clarify the XSL issue).


texts:
In a previous question, I read

... for $b$-bit security meaning $O(2^b)$ work for an attacker to break the system...

While in Katz's Introduction to modern Cryptography, I read:

The key-generation algorithm $\text{Gen}$ takes as input $1^n$ (i.e., the security parameter written in unary) and outputs a key $k$".

What is the difference between security parameter and $b$-bit security?
Edit: Can I have an example for the McEliece cryptosystem?


texts: CCA-attack is possible in RSA, but how the decryption key $d$ is known to anyone

texts: CCA-attack is possible in text-book RSA, but how the decryption key $d$ is known to anyone, as it is kept secret with receiver.


texts: Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

texts:
NIST specified SHA-2 hash functions with truncated output. Those hashes use different initialization values than SHA-256 or SHA-512. SHA-224 is based on SHA-256. SHA-384, SHA-512/224 and SHA-512/256 are all based on SHA-512.

Although I have seen loose comments on why truncated SHA-2 functions use different initial values, I haven't seen any strong reasoning. The only thing that I can formally find is a quote from RFC 3874: "A 224-bit One-way Hash Function: SHA-224", section "1.1. Usage Considerations:

  The use of
     a different initial value ensures that a truncated SHA-256 message
     digest value cannot be mistaken for a SHA-224 message digest value
     computed on the same data.

But that quote doesn't list any specific attacks nor is it part of a security review of SHA-2.

Can anybody explain which attacks are prevented by choosing different initial values for the SHA-2 variants?

I'm specifically looking for answers that indicate how the initial values help mitigate the attack. More importantly, I'm looking for authoritative answers, that is: answers that can point to a security evaluation or proof of SHA-2 on this subject.


texts: How many 12 bit integers output are required to reverse the Mersenne Twister?

texts:
I am creating a web app that applies Python's random algorithm (Mersenne Twister) to generate random 12-bit integers. I am concerned as to how a user can predict future results by recording the needed number of sequence using API calls

import random
def rand12bits():
    return random.randint(0, 4095)

How many of these outputs do i need to predict the future sequence?

I am aware that with enough (624) observed outputs of 32 bit integers, it can be reversed. But in this case, the RNG is only giving off 12 bit integers. Am I missing something? Pardon me for my naivity I am new at this.


texts: Clarification on polynomial used in Rijndael MixColumns implementation

texts:
I'm seeing the fundamental function in open source code for Rijndael MixColumns implementation. (Picture below)
If i translate the 8'h1b correctly, it is represent the polynomial of $x^4+x^3+x+1$.

However looking at the wikipedia explanation, the multiplied modulo is $x^4+1$.
May i know how to link them together? Anything I interpret wrongly?


texts: Vulnerabilities of AES method that uses MD5 to create the key

texts:
Are there security vulnerabilities given the would a user be able to access the original text and the encrypted text with AES using an MD5 as a key?

In other words, if the user had both the original and encrypted text, is it possible for the user to encrypt and decrypt their own text or an altered version of the site's text?

I am specifically wondering about this based on the security of the MD5 hash.

Full Code:

class AESCipher:

def __init__(self, key):
    self.key = md5(key.encode('utf8')).hexdigest()

def encrypt(self, raw):
    raw = pad(raw)
    iv = Random.new().read(AES.block_size)
    cipher = AES.new(self.key, AES.MODE_CBC, iv)
    return b64encode(iv + cipher.encrypt(raw))

def decrypt(self, enc):
    enc = b64decode(enc)
    iv = enc[:16]
    cipher = AES.new(self.key, AES.MODE_CBC, iv)
    return unpad(cipher.decrypt(enc[16:])).decode('utf8')


texts:
The following problem needs to be solved:

Person A will be guessing the number that Person B has in mind.
Only Person B can confirm that the answer provided by Person A is correct.
Person A can not be sure if Person B is fair

Is there any cryptograhpic way to achieve something like this:

A third party will generate a random value X which both Person A and Person B are able to see in an encrypted form
Only once Person A has guessed value X, it should be possible for Person A and Person B to decrypt value X.

All ideas and suggestions are welcome on how to achieve this. Thank you!


texts: How to compute an identity function on encrypted vector by using a third party?

texts:
I want to compute an identity function over encrypted vector on a third party. For example, F(x) = [a1,a2,..,an] where x is a tag. However, i do not want the third party to fetch over the whole dataset to found the needed Vector.

So, is there is any encryption scheme that can do this ?


texts:
I have two questions about OAEP for RSA.

How are the number of bits to pad with 0 chosen? For example, if I'm sending a 255 byte message with RSA-2048 I have 8 unused bits (1 byte). Should I split the remainder bits evenly so I pad with 4 zeroes and my $r$ is 4 random bits, or do I pick the number of bits to pad randomly?
Does it matter if the hash functions $G$ and $H$ are the same (e.g. if both are SHA-256)?

Variables are in reference to the ones in the diagram found in the Wikipedia article “Optimal asymmetric encryption padding”.

Bonus question: What's the proper technique for expanding and shrinking data using hash functions? Could I use the hash as a seed for a secure PRNG and then generate $n$ random bits, or is that wrong?


texts:
I have very vey basic skills in cryptography, it's hard for me to explain clearly my problem so I will start with an example. Estimote beacons have a security function called secure UUID, once activated the beacon will change it's UUID randomly and autonomously every 10 min. At any time the server can decrypt the generated UUID to identify the beacon that generated it.

So to summarize, a value changes randomly and it's possible to decrypt it at any time to identify its origin.

I suppose that each beacon has a key and use a function to re-encrypt the last generated UUID and the server use the same function and key to decrypt it ...

I want to understand how this work, did someone have an idea ?


texts: Security implications of plaintext-padding in an AEAD-scheme

texts:
Let's say I have a secure AEAD-scheme like ChaCha20/HMAC and my encrypted blobs need to match a fixed size:

Is it OK to apply some padding to my plaintext to match the block-size?

Can I use any reversible padding or should it provide some special properties?

The required ciphertext properties are:

privacy
integrity
indistinguishability from random data


texts: split up sha256 hash and compare indiv block results

texts:
We have a h/w accelerator in our SoC and it can do sha256. The restrictions are it's input descriptors (which defines the input packet and len) must not straddle 64K boundary. When it does we can split the descriptors into two. However the total number of descriptors can be max of 64. This means 64K * 64 = 4MB seems to be max sha256 input block.

However i want to calculate sha256sum of a 12MB block

So is it possible to split sha256sum hash into multiple operations and somehow verify it back (i.e.)

hash(12MB) = x;
hash(4MB) = a; hash(4-8MB) = b; hash(8-12MB) = c;

Is there any way to compare

x = "some method of" (a,b,c)


texts:
I have seen in the Imitation Game that the Germans reset the Enigma at midnight sharp, and then they start messaging by sending the weather report in the morning.

But the device made by Alan Turing, the Christopher, sometimes only took a few minutes to decode Enigma.

How did the German receiver know the settings of the machine? I thought that they may be sending the next day's setting at midnight, but if they were compromised once, the enemy would know all the next day's settings too.

So, how did they do it?


texts: What advantages does Keccak/SHA-3 have over BLAKE2?

texts: Keccak/SHA-3 is new NIST standard for cryptographic hash functions.  However, it is much slower than BLAKE2 in software implementations.  Does Keccak have compensating advantages?


texts: RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?

texts:
Why go through the trouble of using the HMAC_DRBG process, instead of simply hashing [message | private key] to calculate $k$ for deterministic ECDSA?

If the resulting $k$ or the signature is invalid, then a known byte value can be appended to the input, and re-hashed, until an acceptable result is achieved:
k=h([message|privateKey|0x00 … 0x00])

As many 0x00 bytes as the number of iterations it takes.

Am I missing an inherent weakness here?

Edit: If the hash function output length is smaller than the curve order, multiple hash outputs (produced by appending a known byte, similar to what was described above) can be concatenated as necessary:
k=[ h([message|privateKey]) | h([message|privateKey|0x00]) ... ]
Once you have enough output, you can then truncate it to match the curve order bit length.

And if the resulting $k$ or the signature is no good, then restart with the known byte appended:
k=[ h([message|privateKey|0x00]) | h([message|privateKey|0x00 0x00]) ... ]

And so on, until an acceptable $k$ is produced.


texts:
Is the parity of the permutation of the set $\{0,1\}^{128}$, defined by AES encryption for a certain fixed key, dependent on this key?

DES, and any pure Feistel cipher, has even parity for any key. That's less clear for AES, and of no practical importance since parity of an arbitrary permutation can not be determined until $2^{128}-2$ correspondences are known, which is infeasible. That would however be a concern in the context of this comment, considering a reduced AES variant.


texts: Security of key schedule that only XORs a key with constants

texts:
Suppose that:

$MK \in \{0, 1\}^{n}$ and the main key of a block cipher.
$RK_{r} \in \{0, 1\}^{n}$ and is the $r$th round key.
$RC_{r} \in \{0, 1\}^{n}$ and is the $r$th round constant.
$RK_{r} = MK \oplus RC_{r}$

What's the security of this key schedule. I'm imagining that it is not very strong.


texts: Find first two blocks of plaintext given a final plaintext block, the IV and ciphertext for CBC?

texts:
I have the following:

complete ciphertext;
iv;
last block of plaintext including the padding which is 04040404.

The encryption was made using AES-CBC-256. I can find the intermediate block by XOR-ing C2 with P3
I cannot use padding oracle because there is no server to validate padding. I didn't find any help about plaintext attack for 14 rounds, only for 4.
Is there any way to find the rest of plaintext (P1, P2) or the key for (C2 ⊕ P3, C3)?


texts: Find encryption algorithm knowing input, output and secret

texts:
Today on my PC I found some old backups; they contain also some pictures I encrypted years ago with a smartphone running Windows Mobile but I don't remember the application I used to cipher them.

I'm quite lucky, because I found a picture on the backup both in original and encrypted version. Is there any way of finding the algorithm/application to decrypt them knowing:

The original "plain" file (es. MyPicture.jpg, 7176 bytes)
The encrypted file (es. MyPicture.jpg.pmf, 7176 bytes, same size of the original)
The secret password I used to encrypt them (it's a 10 characters string)

I also tried to search on Google for the PMF extension but unfortunately I didn't find any helpful information.


texts: Is there a cryptographic method to add noise to a plaintext instead of actually encrypting it?

texts:
I'm looking for a cryptographic technique that instead of permuting a cleartext, would add noise to the cleartext to obfuscate the true text among a bunch of garbage.  For example,  a list of 10 numbers would be combined with a list of 90 random ones with the goal of making the true set of numbers difficult to recover.

I need an attacker to believe that the message is not encrypted. I'm trying to obfuscate a set of GPS coordinates that need to be submitted to a third party but the original route needs to be recoverable with only a key.

Is there a principled way to do this?  One idea is to use a secure PRNG to generate the 'noise' and, assuming there is no collisions, regenerate the noise on the receiver side and filter to decrypt.  Any pointers to other techniques would be appreciated.


texts: Is there a standard way to extend the output of a hash?

texts:
Say I have a hash function, a state-of-the-art hash function that we would all approve of that produces a fixed number of bits (n) as output. (I'll call it HASH.)

Is there are a standard way to produce a different number of bits from this building block? (I'd prefer it if HASH is treated as a black-box component that can't be modified internally.)

If I wanted less than n, I could just use as many bits from the output I want, ignoring the rest. (I think SHA-224 does this internally.) But what if I want more than n?

Or to put it another way, can I call (say) SHA256 sixteen times and produce something that's just as good (other than for speed) as a hypothetical SHA4096 would be?


texts:
I am currently working on a secure messaging website and I had been using RSA 2048 for encryption, decryption and signing of messages but I found it to be EXTREMELY LAGGY so i've moved to 1024.

I did a timing test and these are my results (this was a test of generating a private key from the same string in cryptico.js):

2048 | 6403ms (6 seconds)
1024 | 515ms (0.5 seconds)
 896 | 89ms (0.08 seconds)

I would like to know if if 896 or 1024 are un-secure for use with messaging and what the best key size would be?


texts:
About the Diffie-Hellman key exchange, I have a question related to the key space, as far as I know the key space is of course all the possible keys to be used, for instance, say that $p$ and $\alpha$ are the large prime and primitive root respectively so the key is $K=\alpha^{xy}\pmod{p} $ for secret $a$ and $b$. Now, according to this, I'd say that the key space is the set $\mathbb{Z}_p$, which sounds good to me.

My problem comes now, since I was just reading about new techniques on key exchange using fractal methods that make a comparison between this new method and DH, it states at some point that "The DH key space for 128 bit is limited by how many primes existed in the finite field of $\mathbb{Z}_p$, where $p$ is the largest prime that can be represented by a 128-bit value", so I got a bit confused about what it really means.


texts: one-pass deterministic authenticated encryption

texts:
suppose there is a router with limited storage but good network connection; it could be a good worker for deterministic authenticated encryption on streams; that means it receives data from another machine, encrypts and sends it back; however, siv algorithms need to calculate iv over the entire plaintext before that iv is usable in the encryption; that is a two-pass algorithm;

there are stream-able mac and encryption algorithms; but the stream does not come back again; and the router has too limited storage to buffer the entire stream; this effectively means the algorithm needs to be one-pass; are there any known solutions to this problem?


texts: How is de-synchronisation of HOTP solved?

texts:
From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong passwords.

Say the user leaves their token with their cat, which decides to generate 200 passwords while rolling around with it. This would likely desynchronise the system such that the user will not be able to login in, even with the look-ahead.

I assume the user would need assistance to reset the system, but what are the actual steps to doing this?

Additionally, what would be a good number for the parameter w? 10? 50? 100?


texts: Does having a hash of the plaintext compromise the ciphertext?

texts: If I have a SHA512 hash of my plaintext, does it weaken or break the encryption of my ciphertext?


texts:
Many elliptic-curve cryptosystems today use GF(p) or GF(2^m).
What if, say, we use big floating numbers with the classical point addition formulas - is a cryptosystem possible to build on that?


texts: How to decrypt SSL data on a considered-to-be-compromised host?

texts: I have a package which I want to encrypt on my machine and send it to another remote machine. If I use asymmetric encryption, I must have the private key on the remote side. However, I don't trust the remote side from messing up with my key and encrypt the data by themselves. How can I prevent this from happening?


texts: The role of IV when AES is used as $PRF$

texts:
We want to use AES as a pseudorandom function. Given a random master key, we want to derive a set of pseudorandom values/keys, e.g say $n$ keys. Then from each of those derived keys, we want to derive a set of pseudorandom values, say $d$.

I think, one way of doing that is to encrypt $1,...,n$ using the master key. This gives us $n$ ciphertext. Then, we use each ciphertext as a key to encrypt $1,...,d$.

Question 1: In the above case, do we need to generate a random IV each time we encrypt a message. Does that mean we have to store all IV?

Question 2: If the answer to the above question is yes, then which PRF  (that requires only one seed and IV) is suitable for the above case? Can we use the hash of each input, i.e. index, as IV?

Note that in the above case, IV does not need to be public.


texts: What are some restrictions when converting Montgomery Curves into Weierstrass Curves?

texts:
I want to represent a Montgomery Curve (curve25519) in Weierstrass form as a personal exercise.

After doing some math and referencing the conversion equation at http://en.wikipedia.org/wiki/Montgomery_curve, several of my terms contain decimals, which I believe is incorrect. Namely,

(3-A^2) / (3*B^2)

is a decimal, when A = 486662 and B = 1 and doing it directly.

Note that (3-A^2) is negative, so I added the modulus to it to make it positive, which then enables the division by 3 properly as shown here, b

Are there restrictions on which Montgomery curves can be converted to Weierstrass curves?


texts: Can a one-way accumulator be used in place of a digital signature?

texts:
Could a one-way accumulator be used in a manner to replace a digital signature? Can it provide a way to:

verify that the data has not been tampered with, and
verify that the message is in fact sent/signed by the one who claims to have?

This paper discusses it, but can it safely and effectively replace DS?


texts: Is it safe to use the same password/secret for both VeraCrypt volume and its HMAC?

texts:
I am trying to script the integrity check of a VeraCrypt volume.
#! /bin/sh

red=$'\e[1;31m'
end=$'\e[0m'

set -e

printf "Please enter password: "

read -s p

if [ -f "/Volumes/Samsung BAR/bar.hmac" ]; then
  printf "\n%s" "Checking integrity..."
  if [ "$(openssl dgst -sha512 -hmac "$p" "/Volumes/Samsung BAR/bar")" != "$(<"/Volumes/Samsung BAR/bar.hmac")" ]; then
    printf "\n%s" "${red}Check failed${end}"
    exit 1
  fi
fi

printf "\n%s\n" "Unlocking VeraCrypt volume..."

veracrypt --text --non-interactive --mount --pim 0 --keyfiles "" --protect-hidden no --password "$p" "/Volumes/Samsung BAR/bar" /Volumes/Backup

declare -a files=(
  "/Users/sunknudsen/.gnupg"
  "/Users/sunknudsen/.ssh"
  "/Users/sunknudsen/Library/Keychains"
)

for file in "${files[@]}"; do
  rsync -axRS --delete "$file" /Volumes/Backup
done

open /Volumes/Backup

printf "${red}Inspect backup and press enter${end}"

read -r answer

veracrypt --text --dismount "/Volumes/Samsung BAR/bar"

echo "Saving HMAC..."

openssl dgst -sha512 -hmac "$p" "/Volumes/Samsung BAR/bar" > "/Volumes/Samsung BAR/bar.hmac"

echo "Done"

Security warning: Using read -s p is vulnerable to process listing leaks so I need to find another way to feed the password to both openssl and veracrypt.


texts: Is there an economic way to check if an eliptic curve point in jacobian coordiate is the same as a compressed point

texts:
On an elliptic curve such as $y^2 = x^3 + b$, we define $a$ compressed point $P = (x, y)$ by it's coordinate $x$ and the parity of the $y$ coordinate. $y$ can be computed using $y = \pm\sqrt{x^3 + b}$ and choosing the right value of $y$ using the parity information.

We also define a point in Jacobian coordinate such as $P = (a, b, z)$ with $x = a / z^2$ and $y = b / z^3$ .

I would like to know if there is a known way to check if 2 points in these two set of coordinates are the same point that is cheap. Computing if the $x$ coordinates are the same is easy by checking if $x * z^2 = a$ .

To check if the $y$ coordinate are the same, the best I can come up with is to compute $y = a * z^{-3}$ and check if it has the same parity as the compressed point. However, it requires an expensive computation of the multiplicative inverse of $z$ to get $z^{-1}$. This seems rather overkill as it compute way more information than required. Only one bit is needed.

I was wondering if there is a known way to check if thee 2 points are the same that do not involve expensive computations such as the finding multiplicative inverse or a quadratic residue to decompress the point.


texts: How can one break a monoalphbetic substitution chipher at pseudorandom text?

texts:
Does anybody know how to break monoalphbetic substitution cipher, if it is applied to some pseudorandom text (for example to some surrogate key filed in a database)?

Let us assume that we have only cipher text, and don't know anything about distribution of different characters appearance probabilities, so frequency analysis doesn't work.
Is there some other approach?

Background: I just need to "encrypt" (not really encrypt, possibility to decrypt is not necessary) key fields in a db, keeping the length of it and avoiding collisions (don't ask why).

And I just cannot google out some encryption algorithm which will satisfy both clauses. Cryptographic hash functions are too long, common encryption algorithms can not guaranty absence of collisions, and actually also basically have a limit of length. So the only solution which I can imagine is a substitution cipher, and I want to know how weak it would be in my case.


texts: GPG vs PGP vs OpenSSH and management of them

texts:
What is the main difference of the three?
Can I use only one of them for everything (e.g. GPG for SSH authentication)

If I encrypt my private key with a pass-phrase, is it strong enough so that if someone steals my laptop or private key, I'm safe?

If not, what about encrypting my private key with the scrypt algorithm?


texts: Searchable Encryption with Substring Search

texts: I want to search substrings in encrypted string. To do that I have read “Implement Rabin-Karp Algorithm” and “Substring-Searchable Symmetric Encryption”. After that, I completed the Rabin-Karp implementation. But, those does not answer for my problem. Rabin-Karp requires both main string for searching substrings and substring to be searched. What I want to do is finding patterns in encrypted strings without decrypt it?


texts: How can you tell the type of encoding being used?

texts:
$2y$05$68LWs2pXiEvhVTacJ9PX/elfa1zq9jCBlv61hEw1pCvAHlaJyeMwW

This hash value is 70 characters long. How can I tell what type of encoding was used to generate it? Also, how many bits does each character hold?


texts:
NIST SP 800-90B offers various tests for estimating entropy.  They also offer an implementation of these tests.  With their program called ea_iid, estimating entropy is very easy.
$ ea_iid random.dat
Calculating baseline statistics...
H_original: 7.884314
H_bitstring: 0.998545
min(H_original, 8 X H_bitstring): 7.884314

** Passed chi square tests

** Passed length of longest repeated substring test

Beginning initial tests...
Beginning permutation tests... these may take some time
** Passed IID permutation tests

So the min-entropy estimation for the source that produced random.dat is 7.88 bits of information per byte.
However, this page calls it USELESS. I'm unable to reproduce the claims made this page --- none of my NIST SP 800-90B programs show even similar output as those displayed by this page.  The output above is an example.  Am I running a totally different version of the programs?


texts:
I'm trying to implement AES CBC MAC splicing attack in Python, the idea is:

given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, N1 ⊕ Tn, N2, ..., Nn) that has the same tag with N (that is because you inserted a block which resets the algorithm).

The idea is quite clear, but I still cannot get the correct tag.

Here is my code (I'm new to Python, sorry):

from Crypto.Cipher import AES
from Crypto.Util.strxor import strxor
from binascii import hexlify
import argparse
import pickle

AES_KEY_SIZE = 16
BLOCK_SIZE = AES.block_size

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("f1", type=str, help="f1")
    parser.add_argument("f2", type=str, help="f2")
    parser.add_argument("tag1", type=str, help="tag1")
    parser.add_argument("tag2", type=str, help="tag2")
    parser.add_argument("k", type=str, help="key")
    args = parser.parse_args()
    with open(args.tag2, "rb") as tag2:
        stored_tag = pickle.load(tag2)
    with open(args.k, mode="rb") as f:
        key = pickle.load(f)
    assert len(key) == AES_KEY_SIZE
    cipher = AES.new(key, AES.MODE_CBC, b'\0' * BLOCK_SIZE)
    with open(args.f2, mode="rb") as f2:
        f2_block1 = f2.read(BLOCK_SIZE)
        b1 = cipher.encrypt(strxor(f2_block1, stored_tag))
        with open(args.f1, mode="rb") as f1:
            file1 = f1.read()
        file2 = f2.read()
        the_rest_of_the_file = file2[BLOCK_SIZE:len(file2)]
        new = open('newfile.file','w')
        s = file1 + b1 + the_rest_of_the_file
        new.write(s)

if __name__=="__main__":
    main()


texts: How do we know a single differential/linear trail dominates the others?

texts:
I have read the proof of AES's resistance against differential cryptanalysis. In the proof the authors show that there is no single differential trail with prop ratio higher than $2^{-300}$ over 8 rounds. I understand that part but it does not prove that there is no differential with prop ratio higher than $2^{1-n} = 2^{-127}$ because we could end up with the same differential using many different trails. I have read in Jon Daemen's dissertation that in a well constructed cipher a single trail should dominate all the other trails. Is it proven for AES that, in fact, no different differential trails combine to give a significantly higher prop ratio of a differential? If yes, how do they prove that? If no, why is AES assumed to be proven resistant against linear and differential cryptanalysis?
Links:
The proof - https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/documents/aes-development/rijndael-ammended.pdf.
The dissertation- https://cs.ru.nl/~joan/papers/JDA_Thesis_1995.pdf


texts: What are alternatives to number theory based crypto?

texts: Quantum crypto,lattice based crypto, Neurocryptography and cellular automata based cryptography are alternatives to number theory based crypto. I need to know what are the other hard problems like Lattice problems and Number theory based problems that can be used for cryptography(For asymmetric crypto).


texts: The site badssl.com provides examples of bad (red icon) and good (green icon) uses of TLS for the purpose of testing TLS implementations. I'm a bit confused by the test called dh-composite. This explanation is given for the test: "This site uses an ephemeral Diffie-Hellman key exchange over a composite group." What exactly is a composite group? How would I test if given parameter set describes a composite group?


texts:
What data is saved in RSA private key in openssl? How to view it?

Wikpedia says these variables are saved.


texts: Usefulness of ability to calculate $m^{p+q}$ with RSA

texts:
I noticed that with only an RSA public key, it is possible/tractable to calculate $m^{p+q} \pmod n$ for any $m$ without knowing $p$ or $q$.  Namely, $m^{p+q} \equiv m^{n+1} \pmod n$.  (This follows from $\phi(n) = n - p - q + 1$ and the order of all multiplicative subgroups $\mod n$ dividing $\phi(n)$.)

Is this useful for anything?


texts:
I have designed an encryption algorithm. The algorithm will probably use CFB mode. The algorithm can encrypt any block size and this does not change the size of the key. There are always about $20$ rounds and the key is always around $128$-bits.

However, the algorithm works much slower when it works on $128$-bits blocks, than on about $32$-bits blocks. What are the block size limitations for a secure cipher? If the key is $128$-bits, can it be encrypted in about $32$-bit blocks? Is it secure?

The only  condition I found is that $n!$ should be greater than $2^{128}$, where $n$ is the block size.


texts: RSA: select $e$ given $n$ and $\varphi(n)$

texts:
I have a question for a course I am doing. In an RSA question, it asks "Is it possible to select $e$ in such a way that it coincides with the corresponding private key $d$? If it is possible, provide a value for such an $e$.

So, this is only part of the question (last part really).

$$n = 22499$$
$$\varphi(n) = 22200$$

How would I go about this? I am completley lost. I have, by luck come across an answer of $149$. $149^2 = 1 \pmod{22200}$. This is because $ed = 1 \pmod{\varphi(n)}$. Is there a method to calculate such a number? [$a^x = 1 \pmod{\varphi(n)}$]


texts: RSA - is it possible to find the modulus from both the private and public exponents?

texts:
Let $e$ be the public exponent (which is equal to $65537$) and $d$ the private exponent. Knowing the values of those two, is it possible to deduce $N$, the modulus, and if yes, how?

Note: the value of $N$ is not known! I also don't need to get the values of $p$ and $q$, but seeing how $d$ is actually calculated makes me think it'd be easy to get them anyway.


texts: Is there a way to prove equality of plaintext that was encrypted using different public keys?

texts:
Imagine if Alice encrypts message to Bob (using public key $P_{bob}$) and then Bob encrypts the same message to Carol (using $P_{carol}$). Is there a way for Bob to prove that:

$P_{carol}$ was indeed used
Message is still the same that Alice passed to Bob.

Note1: Both ciphertexts and public keys are visible for everybody who needs to verify this proof.
Note2: Public keys and messages are new for every encryption so deterministic encryption is ok, but public key cryptography has to be used

It looks similar to this topic, but there only one public key is used:
Is there a public key semantically secure cryptosystem for which one can prove in zero knowledge the equivalence of two plaintexts? (comments from D.W and tylo are very helpful)

Obvious thought that comes to mind is to use commutative encryption, so everybody will be able to check whether $E_{bob}(E_{carol}(M)) == E_{carol}(E_{bob}(M))$ having $E_{carol}(M)$ and $E_{bob}(M)$ and access to $P_{bob}$ and $P_{carol}$. But then only deterministic encryption would work ($E_{bob}$ is encryption using $P_{bob}$).
The other solution that comes to my mind is using ZKP for DH 4-tuple if homomorphic encryption is used (for example El-Gamal - non-interactive proof is described here). So there is a way to prove that ($g$, $h$, $g^r$, $h^r$) is DH 4-tuple (where $h$ is public key, $r$ - random number, $g$ - generator of the group). In our case ciphertexts correspondent to message $M$ are $c_1=(g^{r_1}, M*P_{bob}^{r_1})$ and $c_2=(g^{r_2}, M*P_{carol}^{r_2})$.
If to consider that $r_1=r_2=r$ (i.e. Alice also told Bob $r_1$) we can divide $c_1$ to $c_2$ and receive $(\frac{P_{bob}}{P_{carol}})^r$. Since everybody knows $P_{bob}$ and $P_{carol}$, Bob is able to create ZKP that $(g, (\frac{P_{bob}}{P_{carol}})$, $g^r$, $(\frac{P_{bob}}{P_{carol}})^r)$ is DH 4-tuple. In this way he can proof both statements (I believe :) ) Non interactive proof can be made. Having $c_1$ and $c_2$ Bob does:

selects random $r_3$
calculates $u=g^{r_3}$ and $v=(\frac{P_{bob}}{P_{carol}})^{r_3
}$
Calculates hash $d = H(u || v) $
Calculates $z=d*r+r_3$
Publishes $(u, v, z)$

Everybody is able to verify the proof $(u, v, z)$ doing:

Calculating $d = H(u || v)$
checking that $g^z == (g^r)^d * u$
$(\frac{P_{bob}}{P_{carol}})^z ==({\frac{c_1}{c_2}})^d * v $

Are there any other methods?


texts: Can disjoint distributions be Computationally indistinguishable?

texts:
As mentioned in these notes definition 2

We say that $\{Xn\}_n$ and $\{Yn\}_n$ are computationally indistinguishable if,
for all $\mathsf{nuPPT}$ $D$, there exists a negligible function $ε$ such that for
every $n\in \mathcal{N}$, $|\Pr[t←X_n :D(t)=1]−\Pr[t←Y_n :D(t)=1]|\leq ε(n)$.

However, the definition also states that two disjoint distributions could be computationally indistinguishable. I not sure why that is true. Because if two distributions are disjoint then the $D$ who is given a sample that is either sampled from $X_n$ or $Y_n$ should be able to distinguish them with probability 1? Please let me know what I am missing?


texts: Distinct cleartexts that are invariant under encryption

texts:
I'm really new in this whole cryptography thing. And while I was going through some articles about RSA I stumble upon a really weird thing and it goes like this:

  If $n = pq$ is a RSA modulus, and d is the encryption exponent. There are at least 9 distinct cleartexts m that are invariant under encryption, i.e. $m^d\ ≡\ m\ (mod\ n)$ ?

Why is it at least 9, can it be more ? And is there any proof for this ?

I seem really interesting and I would like to know the answer on this. If anyone can answer it would be so helpful.


texts: What, cryptographically speaking, is a "long message"?

texts:
I have read about long message attacks on some cryptographic hash functions. However, I don't quite understand what is being referred to as a "long message".

Also, do long message attacks only apply for such "long" messages or can they also be used (any exceptions?) with "normal" messages? ("Normal" as opposed to "long", I mean)

Thank you.

EDIT:
Actually, I thought I wanted a general explanation, but I guess it might be better that I specify the source of my misunderstanding. Reading Gauravaram and Kelsey's Cryptanalysis of a class of cryptographic hash functions in trying to understand second-preimage attacks, I came across the generic long message second preimage attack on GOST in Appendix Section E.1 (page 26) and it got me wondering on the meaning (and pertinence) of the so-called "long message" attack.

Hope this clarifies my question better.


texts:
Under the following premise:

I need to generate multiple symmetric keys;
I cannot be sure about the quality of local system RNG;
I already have a strong key K (generated by other means / elsewhere).

Does it make sense to encrypt the output of system RNG with K (or some derivation of it) with the purpose of strengthening generated keys. More generally, can I strengthen the output of the RNG using K?

Clarifications:

Length - let's say that the entropy of K is 128 bit.
Number of keys - multiple, but not numerous (several or dozens, not more).

Second edit:

More clarifications and comment:

Persistent (and secure, as long as the whole system is not compromised) storage is available, so a sequential IV can be implemented.

I am starting to have doubts about the idea that RNG may be flaky while the system is still not compromised, but initially I assumed that RNG quality is not black and white and because it is easy to provide K, generated keys can be strengthened.

Apropos, I can deliver 256 bits K, so I can really just use it as seed for a PRNG and forget about all else. In any way, a compromise on the source of K is total falldown, so this starts to look like a straightforward option.


texts: Is this constant-time comparison secure?

texts:
I was thinking about constant-time comparison and how it differs from "==", when I thought of a simple way that's could be constant-time. Being a beginner in cryptography, I'd like to know if my method is secure. This method is probably insecure, but I'd like to know where it's weak. It's really simple.

Take the two strings to compare, convert them each to a list of numbers (0-255)
Set totalDifference = 0
Take the first number from the first list and subtract it from the first number in the second list. Take this difference and add it to totalDifference.
Do 4. for each character/number in both list.
If totalDifference is 0 after going through each number, then both strings are equal.

Example:
 [1,3,5,9,7,8]
-[1,3,5,5,7,8]
--------------
  0,0,0,4,0,0

0+0+0+4+0+0!=0, so strings not equal

Are there any problems with this constant-time comparison scheme?


texts: Proof of correctness of an ElGamal encryption given a specific public key

texts:
Suppose Alice sends an ElGamal encryption of a value $v$ to Bob (using either the normal or exponential version of ElGamal). E.g. assuming publicly-known  $pk_{BOB} = h$ and a generator $g$, Alice sends $Enc(v,h) = (c_1,c_2) = (g^r, vh^r)$ to Bob. Or for the exponential version, she sends $Enc(v,h) = (c_1,c_2) = (g^r, g^vh^r)$.

Assuming Alice is honest, Bob will be able to correctly decrypt and recover $v$. However, Alice might not perform the encryption correctly (intentionally or not). For example she could use some other public key $h'$ to encrypt $v$, and then Bob would decrypt to some value $v'$. As an example, suppose that the values are supposed to be representing an ASCII character, then the decrypted value $v'$ would be "garbage".

Security model: There is a third-party authority, where Alice must show that she is encrypting legitimate values.

Is there a way to amend the scheme such that either Alice can prove in Zero Knowledge (without revealing $v$) that she encrypted using $h$, or alternatively, Bob to prove in ZK (without revealing his secret key $x$) that decryption failed?


texts:
I have come across "seed" many times, and at each time, it confuses me more and more. I think it has a well-known meaning in cryptography, so what is it?

  They can usually use the  limited number of results stemming from a
  limited number of seed values to defeat security.

  Not only does complex manipulation not help you if you have a limited
  range of seeds, but blindly-chosen complex manipulation can destroy
  the entropy in a good seed!

Those are some parts of an article I was reading, I understand the context, but I'm not sure about "seed".


texts: Finding the private key in Diffie-Hellman

texts:
How do I go about finding the shared private key g^ab, if I know the prime p, primitive root g, and the public keys g^a and g^b?
Assuming that a, b, p and g are all very large numbers (~50 digits), it will not be feasible to exhaustively search for a and b to calculate g^ab.


texts: Does the Richard Sorge cipher still provide good security?

texts: Is the cipher used by soviet spy Richard Sorge still sufficiently secure nowadays?


texts: Apart from bitcoins and altcoins, are there any other virtual currencies (like game currencies, gift cards or coupons) that include cryptography in their algorithm?


texts: Secure multiparty computation of conjunction

texts:
Suppose Alice and Bob each have bits a and b, respectively. How can Alice and Bob compute the function a and b, without revealing their bits to each other?

EDIT: A paper called Solving the Dating Problem with the SENPAI Protocol came out recently.


texts: I know there are key-exchange methods in Cryptography. But in case of Secret-key Steganography, what actually stego-key means and how can we use the key and once used how we exchange that with the receiver?


texts: Authenticated encryption with forged verification key

texts:
Is it part of the (or a common) security model of symmetric authenticated encryption to prevent an adversary from exhibiting a decryption/verification key that makes a given genuine ciphertext verify, yet deciphers differently than it does with the key used to produce that ciphertext?

If not, are some common symmetric authenticated encryption schemes vulnerable to that, and under what hypothesis (known plaintext, chosen plaintext, known genuine encryption key..)?

The question comes in the context of determining if symmetric authenticated encryption followed by signature provides plaintext integrity verifiable by a third party, handed ciphertext, an alleged symmetric key, and ciphertext signature, and knowing the public key.


texts: Determining strength of a crypto algorithm - clarification with the salsa paper

texts:
I am reading through the salsa family paper and on the second page DJB says this -- One can reasonably conjecture, for example, that every function that encrypts data in 0.5 Core-2 cycles/byte is breakable.

Why is this so obvious/easily conjectured? Also, does 0.5 Core-2 cycles/byte mean that the algorithm take 2 cycles to encrypt a byte using 0.5 core? Is there a table or some paper that talks about the timings of algorithms in Core-Cycles/byte? I am guessing this is implementation dependent as well, though the algorithm design also sets lower bound on this.

In the next sentence he says -- One can also conjecture that almost every
function that encrypts data in 5 Core-2 cycles/byte is breakable.

Again, its not obvious to me. Can someone explain these two sentences to me?

Here is a link to the paper


texts: Is a hashing algorithm considered broken if a collision happens under $2^{n/2}$?

texts:
If for example we would find a hash collision for SHA256 with $h(x) = h(x')$ for $x \ne x'$ and $x, \space x' < 128$ bit (meaning both $x$ and $x'$ are smaller than 128 bit), would SHA256 be considered broken?

Is it then always possible to create more collisions in a feasible time or could this hash collision just be considered an "anomaly"?


texts: How to encode messages in $\Bbb Z_p^*$ to be encrypted with ElGamal scheme?

texts:
In ElGamal encryption scheme, in order to achieve IND-CPA security, one must use a group where the DDH problem is assumed to be hard. As this answer suggests, one way to achieve that is the following:

When working in $\Bbb Z^*_p$, let $p$ be a safe prime $p=2q+1$, where $q$ is also prime, let $g$ be a generator of the cyclic subgroup of quadratic residues of order $q$ and restrict the message space to quadratic residues only.

My question is: lets say my given message space is $\Bbb Z_p^*$, where $p$ is a prime, but not a safe prime. How can I embed this message space into one that can be encrypted with ElGamal scheme so that all the properties of ElGamal (IND-CPA security, homomorphicity) still hold?


texts: Metrics for Measuring the Distance of Two Numbers in Cryptography

texts:
Hamming Distance (HD) has been used to measure the distance of two numbers when they are converted into binary representations. e.g., $Ham(1, 2)=2$ as 0001'XOR'0010'='0011' while $Ham(128, 1)$ equals $2$ as well. Here we see HD does not work well as it falsely indicates that the distance between $1$ and $2$ is equal to the distance between $1$ and $128$.
So my question is if there are any other distance measurement methods (or encoding methods) that can deal with this issue?


texts: Efficient calculation of point coordinates with elliptic curves over binary field

texts:
I'm trying to find an efficient algorithm to calculate the $y$ coordinate of a an elliptic curve point given its $x$ coordinate, for elliptic curves over fields of the form $2^m$ with polynomial representation of the field elements.

I had the exact same problem with elliptic curves over prime fields, but it is very simple to solve:

$y^2 = x^2 + ax +b \implies y = \sqrt{x^2 +ax +b}$

With this equation, all we got to do is to calculate the value of the second member, check if the value is a quadratic residue modulo the prime number (using Euler's criterion) then calculate the root, if it exists, using Tonelli-Shanks algorithm.

For binary fields the equation is

$y^2 +xy = x^3 +ax^2 +b$

Fixing the value of $x$, the equation can be reduced to something like

$y^2 +uy  +v = 0$

It is a simple quadratic equation, but I can not solve it with the polynomial arithmetic, since we have $y = \frac{-b \pm\sqrt{b^2 - 4ac}}{2a}$  and multiplying by an even number using this arithmetic results in $0$. Even worst, it would be necessary to divide by the scalar $2$ to find the roots, and there is no such operation defined.

Of course there is brute force, to test all polynomials with degree less than the degree of the reduction polynomial, but it is impractical as soon the the degree gets to high.

I'm new here and I would appreciate some help.


texts:
I'm very new to cryptography, I wanted to know what exactly do I have to do to encrypt a three-letter message using RSA? for example if I wanted to encrypt this message $M= \text{HCP}, p=11 q=13$.
Do I have to change the letters into numbers? ($H = 7, C=2, P=15$) and then encrypt each letter alone? or add/multiply them and encrypt them all at once?


texts: Side channel attack - execution time depends on the size of the key

texts:
In my algorith execution time depends on the size of the key. It is a linear relationship (probably). The larger the key, the longer the algorithm takes to run. I have a code in Python so far.
For example for 3-bit round keys it runs 1 sec and for 128-bit round keys it runs 4 sec (for some number of inputs).
Is this a disqualifying problem?
PS By the way I will precise why it happens. There are simply additions and multiplications. It takes more time to multiply plaintext by bigger number, the same is with adding. What's more there are some equations to solve with euclidean algorithm, where we got for example to solve $2^{128} \cdot c - key^{64} \cdot k = 1$. I don't how $key$ size can affect time of solving that.


texts: I want to implement a FHE scheme based on NTRU, namely the scheme described here https://eprint.iacr.org/2014/039.pdf . How to test the security of my implementation ? Do I have to implement the attacks against NTRU-FHE by myself or there are already some programs that do this?


texts:
With AES-CTR the computation time to encrypt a message of lengh $n$ blocks is $n$ computations of the block cipher.

What is the running time to encrypt a message of $n$ bits using a stream cipher, like Salsa, Snow, trivium or any other stream cipher? How can I (generally) calculate a stream cipher computation cost?


texts:
In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM, AES-GCM-SIV) and Poly1305 which is often used with a ChaCha/Salsa variant.
In the paper they mention that older schemes based on HMAC authentication are not vulnerable against this attack because they provide the key commitment property.
Do CCM with CBC-MAC and EAX with AES-CMAC provide key commitment as well? Or is - for instance - the output size of the MAC constructions too small? If they don't provide full key commitment, are they  susceptible to this attack?


texts: breaking anonymous key exchange protocol

texts:
An anonymous key exchange protocol $P$ is pair of probabilistic machines $(A,B)$ that sends messages to each other and at the end, both $A$ and $B$ will share the same key $k$.

The attacker can see the protocol transcript $T_P$ of $P$, that is, the sequence of messages exchanged between the parties in one execution of $P$.

How can a computationally unbounded attacker break an anonymous key exchange protocol?


texts: Frequency analysis of transposition ciphers

texts:
Can we do frequency analysis of transposition ciphers?

If yes, please tell me the procedure and I would be happy if you provide me with some links related to it.

I heard that it can be done using bi-gram frequency.

I did it for substitution ciphers but am unable to do it for transposition ciphers.


texts: Which symmetric encryption systems, pseudorandom number generators, and hash functions are best suited for reversible computers?

texts:
Reversible computing refers to the type of computing where one minimizes the the amount of data to be deleted usually to save energy (Reversible computing could also thwart side-channel attacks). Energy efficient reversible computers do not exist yet in the free market although some have constructed prototypes and they should become the computers of the future.  In reversible computing, the AND and OR gates are forbidden since they delete data (the AND gate has 2 inputs but 1 output so one bit is necessarily deleted).

With purely reversible computing, only the bijective logic gates are allowed for computation since non-bijective gates delete information. For example, the CNOT $(x,y)\mapsto(x,x\oplus y)$, Toffoli $(x,y,z)\mapsto(x,y,(x\wedge y)\oplus z)$, and Fredkin
$(0,y,z)\mapsto(0,y,z),(1,y,z)\mapsto(1,z,y)$ gates are all reversible gates.

While reversible computing theoretically should save energy, it typically takes more steps to compute something reversibly than it does to perform the same computation irreversibly. However, in symmetric cryptography, one could potentially design cryptosystems such as encryption systems, hash functions, (cryptographic and non-cryptographic) pseudorandom number generators which do not contain any such algorithmic overhead (the only irreversibility that is required in a cryptographic hash function is that unless one wants to keep the hash around forever, one must eventually delete the hash).

1) Are there any symmetric cryptosystems which are specifically designed to be used by reversible computers?

2) Are there any symmetric cryptosystems which were not necessarily designed to be used by reversible computers but which just-so-happen to be reversible?

3) Are there any symmetric cryptosystems which are nearly reversible and which can potentially be modified slightly to become reversible?

Here are some characteristics that one would like in reversible cryptosystem.

-The cryptosystem should ideally be computed using solely reversible gates without any garbage bits, ancilla bits, uncomputation, or irreversible gates.

-The inverses of all parts included in the cryptosystem should be computed in exactly the same way as the forward direction (for example, the inverse $\chi$ in Keccak is computed differently than the forward direction; $\chi$ has algebraic degree 2 while the inverse of $\chi$ has algebraic degree 3 (see page 16 of these slides)).

-The cryptosystem must not require any uncomputing. Uncomputing is an overhead that arises in reversible computing even though irreversible computing does not require any uncomputing.

-The cryptosystem should not use any lookup tables.

-The cryptosystem should not use modular multiplication, finite field multiplication, or finite field inversion at all these operations require uncomputing.


texts:
I'm trying to add the authentication for my One-Time Pad implementation.
I know that to provide Unconditionally Secure Authentication I need to use the One-Time MAC authentication.

But I don't understand why a solution as the following (that's a lot more easy to implement) doesn't provide the same security level :/

ciphertext = ((plaintext || H(plaintext)) XOR OTPKey)

With:
|| = concatenation
H = SHA-2
OTPKey is long enough to encrypt the plaintext and H(plaintext)

Mallory here can't brute force the ciphertext (because of the one-time pad), so he can't get the correct plaintext nor the digest...
Is this right? Can this provide unconditionally secure authentication?

EDIT 1
I know that in practice it's vulnerable to known-plaintext attacks so please, don't consider it in this particular case. I'm interested in Unconditional Security in the sense that both the plaintext and the digest can benefit of the Information-theoretic security provided by One-Time Pad.
I'm interested in passive attacks and not in active ones.
Assume that Mallory here knows only the ciphertext ;-)

EDIT 2
In other words: can I be sure that an attacker can't obtain the plaintext exploiting possible vulnerabilities introduced by the use of a hash function for the digest calculation?

Variant
How about this variant? Can I say that it provides Information-theoretic security for the plaintext AND it is vulnerable against active attacks with complexity of 2^256?
So in this case I can provide a certain level of security against known-plaintext attacks too (even if computational security).

ciphertext = (plaintext XOR OTPKey)
message = (ciphertext || H(ciphertext || K2))

With:
K2 = 32 bytes of random key, NOT correlated with OTPKey

Thank you to everyone :)


texts: How does the possible attack on passwords and salts mentioned in PKCS#5 v2.1 work?

texts:
From PKCS#5 v2.1, 4.1 Salt (page 6, emphasis by me), also in v2.0, RFC 2898:

  In password-based encryption, the party encrypting a message can
  gain    assurance that these benefits are realized simply by selecting
  a    large and sufficiently random salt when deriving an encryption
  key    from a password. A party generating a message authentication
  code can    gain such assurance in a similar fashion.

  The party decrypting a message or verifying a message
  authentication    code, however, cannot be sure that a salt supplied
  by another party    has actually been generated at random. It is
  possible, for instance,    that the salt may have been copied from
  another password-based    operation, in an attempt to exploit
  interactions between multiple    uses of the same key. For instance,
  suppose two legitimate parties    exchange a encrypted message, where
  the encryption key is an 80-bit    key derived from a shared password
  with some salt. An opponent could    take the salt from that
  encryption and provide it to one of the    parties as though it were
  for a 40-bit key. If the party reveals the    result of decryption
  with the 40-bit key, the opponent may be able to    solve for the
  40-bit key. In the case that 40-bit key is the first    half of the
  80-bit key, the opponent can then readily solve for the    remaining
  40 bits of the 80-bit key.

The part I don't really understand is where it saids "If the party reveals the result of decryption with the 40-bit key, ..."

Could I get some clarification of this?


texts:
I would like to provide a public/private keypair to a user, but require that the user obtain an authorizing key before being allowed to use the private key.  I don't want the authorizing party to have the private key -- instead, it should have something like a key-encrypting key that the user can use to decrypt the private key.  (Another way of looking at it: the user has a keypair with a password-encrypted key, but he does not know the password.  When he wants to use the key, the authorizer sends the password so the user can unlock the key.)

I think PKCS#12 offers a way to give the keypair to the user so that he can save it using normal OS facilities: PKCS#12 allows you to package certificates, keys and arbitrary secrets in a file that a security manager knows how to unpack and store.  But I'd like to accomplish all this with a minimum of "copy password here and paste over there," etc.  Ideally, sequence would be:

Setup:

Alice: generate keypair, encrypt private, send key-encryption-key to Bob, save {public, KEK[private]}

Use:

Alice: get {public, KEK[private]} from storage
Alice: authenticate to Bob
Bob: send KEK to Alice
Alice: decrypt private, use keypair

The authenticate/send KEK/decrypt private sequence should be as automatic as possible; ideally, it would look the same as Alice typing a password that would be processed locally to unlock her private key.

I'm aware that Alice could just save KEK or leave private unencrypted, but that's her problem.  The point of the method is to split the single point of failure between Alice and Bob, so that an attacker who wants to read Alice's email would have to compromise both Alice (to get KEK[private]) and Bob (to get KEK)

Does this sound like a canonical use pattern that I'm just not seeing?  Any ideas for a data structure for Alice's information that will work with traditional PKI tools?


texts: Isn't Socialist Millionaires vulnerable if Alice's and Bob's message are picked from a shared list?

texts:
I'm interested in a situation where Alice and Bob each pick cards from a deck of 52, and want to test if they picked the same card without revealing what the card is (a "mental poker" situation).  The protocol that came to mind was "Socialist Millionaires".

But if I'm correctly understanding the writeup of Socialist Millionaires that's currently on Wikipedia, and if that writeup is accurate, then I think that it's possible for Bob to learn Alice's secret message (and vice versa) if they are both picking their secret messages from a shared list, such as the card-drawing scenario.

The trick I thought of is that, after the protocol is finished, Bob has enough information that he can pick different values of his secret and test them.  If they just picked from 52 cards, he just has to test 52 values of his secret message until he gets a "yes they are equal", and then he'll know what Alice has.

Using the notation from the wiki article, the answer to the question of whether $c = P_aP_b^{-1}$ is equivalent to the answer to the question of $x=y$, where $x$ is Alice's secret message and $y$ is Bob's.

The wiki article says

Note that
:\begin{align}
  P_aP_b^{-1} &= \gamma^r \gamma^{-s} = \gamma^{r - s} \\
              &= h^{\alpha\beta(r - s)}
\end{align}

and therefore
:\begin{align}
  c &= \left(Q_aQ_b^{-1}\right)^{\alpha\beta} \\
    &= \left(h^r g^x h^{-s} g^{-y}\right)^{\alpha\beta}
     = \left(h^{r - s} g^{x - y}\right)^{\alpha\beta} \\
    &= \left(h^{r - s} h^{ab(x - y)}\right)^{\alpha\beta}
     = h^{\alpha\beta(r - s)} h^{\alpha\beta ab(x - y)} \\
    &= \left(P_aP_b^{-1}\right) h^{\alpha\beta ab(x - y)}
\end{align}.

Now, it seems to me that Bob knows $c$ from a Diffie-Hellman Key Exchange they did earlier.

$P_a$ and $P_b$ were transmitted in the clear, so Bob can calculate $\left(P_aP_b^{-1}\right)$.

He knows $h^{ab}$ and $h^{\alpha\beta}$ from two other DHKE's they did.  So Bob can raise one to the power of the other and get $h^{ab\alpha\beta}$.

He knows $y$ because that's his secret message.

So if he wants to test against a new secret message ($y'$) offline, all he has to do is find:

\begin{align}
c_1 &= c\left(P_aP_b^{-1}\right)^{-1} \\
   &= h^{ab\alpha\beta(x-y)}
\end{align}

Then find:

\begin{align}
c_2 &= \left(c_1\right)^{y} \\
    &= h^{ab\alpha\beta x}
\end{align}

Now, Bob wants to test if Alice's card was a particular $y'$ that Bob has chosen.  So he calculates:

\begin{align}
c_3 &= c_2^{\left(y'\right)^{-1}} \\
    &= h^{ab\alpha\beta(x-y')}
\end{align}

Finally, he calculates:

\begin{align}
c_4 &= c_3\left(P_aP_b^{-1}\right) \\
    &= \left(P_aP_b^{-1}\right)h^{ab\alpha\beta(x-y')}
\end{align}

And if $c_4 = P_aP_b^{-1}$, then this means that $x=y'$ and Bob has discovered what Alice's card is.  None of these steps involved receiving new secret numbers from Alice or sending anything to Alice, so he can try for as many new $y'$ as he wants.  Alice can't stop him, or even know that he's doing it.

Bob can try for all 52 cards, and he can discover which one was Alice's secret $x$.

Am I right about this?  Is there something I'm missing?


texts: Why doesn't the formula work when checking two ECDSA signatures?

texts:
There are two generated ECDSA signatures

X - Private key

S  = ((Z  + (X * R)) / K) mod n

S` = ((Z` + (X * R`)) / K`) mod n

G - Base point, of order n;

R  = K  * G
R` = K` * G

Why is this formula not working?

C = K - K`

R = R` + (C * G)

Where exactly do I make a mistake?


texts: Given a PRF $F$ , is $G(s) = F_s(1)\|F_s(2)\|\cdots \|F_s(n+1)$ a PRG?

texts:
If $F$ a PRF, and we construct $G$ using $F$ in the following way:
$$G(s) = F_s(1)\|F_s(2)\|\cdots \|F_s(n+1)$$
where $|s|= n$.

Is $G$ then a PRG? If so how can I prove this? If not how can $G(s)$ be distinguished from a random $r$? And what if $n+1 <$ range of $F_s$? or it could be for any $n > |s|$.


texts: What part of an RSA key is referred to by the number of bits?

texts: When we speak about 4096- or 2048-bit RSA keys, what part of the key is this number of bits? The public key comprises both the modulus and the public exponent, and the strength of the key can also be seen as depending on the length of the prime factors. Which of these is the "4096-bit" part?


texts: Basic question on interaction with HSM using PKCS11

texts:
I am a beginner on cryptography, I've been reading about PKCS11 and usage of PKCS11 on HSM's

I understand the concept of HSM,

I read about the HD wallets in bitcoin how keys are hashed and combined and hashed again to form a tree, branch, sub branch private + public key list

my question if I use an HSM that has the PKCS11 interface can I do all these key creation, hashing, combining adding on the hsm without exposing private keys to the host machine ?


texts: HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication

texts: Which algorithm is recommended to use when encoding / decoding JWT web application tokens? Is using HMAC-SHA256 enough or would using HMAC-SHA512 provide more security? And on 64bit machines, is it true that HMAC-SHA512 is faster than HMAC-SHA256?


texts: We have Alice and Bob. The man in the middle can manipulate(remove, add something etc.) A sent from Alice and B sent from Bob, how can he figure out what the common key K(A,B) is, without knowing kpr(a) and kpr(b)? Everything is based on Elliptic Curves.


texts: Clifford Cocks Interview: "Raising numbers to a power with the product as modulus"

texts:
Disclaimer: I'm new to cryptography

Background: Clifford Cocks, the former GCHQ mathemetician and crytologist, gave an interview where he said:

  "My thinking was that you need something that is easy to do, and
  difficult to undo, so I thought of the product of two primes. It's
  essential that you have a one-way function which can only be inverted
  if you know the factors — and raising numbers to a power with the
  product as modulus is something you can unpick only if you know the
  factors."

Question: Does anyone have a very simple example of this?

My (probably wrong) attempt:

$2^2 \times 2^3 = 32$ whose factors are $1,2,4,8,16,32$
$x^{32} = y$
$y$ modulo ?


texts: Let F be a block cipher with 128-bit block length. Consider the following encryption scheme for 256-bit messages: to encrypt message $M=m_1∥m_2$ using key $k$ (where $|m_1|=|m_2|=128$), choose random 128-bit $r$ and compute the ciphertext $r∥F_k(r)\oplus m_1∥F_k(m_1)\oplus m_2$. Is there any strategy that leads to a valid chosen-plaintext attack?


texts: How can a random salt for a hash function work in practice?

texts:
I understand the theory behind the use salts in hash functions, but when I see it  implemented, the implementations always generate the salt on the fly and the salt appears to be different for every hash.

When implementing a salt for users signing into a website, doesn't the salt need to be the same at account creation as the salt used when the user wants to log in?
In implementation, wouldn't the salt be the same every time?
I understand that the salt may be different from user to user (in my example), but when user A signs in on Monday, and again on Friday, wouldn't the salt need to be the same for both those times?


texts: Can machine learning/AI lower the security existing cryptographic protocols similar to quantum computers?

texts:
Initial thinking would be not unless the protocol revealed sensitive local information that could then be analysed by an ML algorithm and applied globally.

local meaning I see messages from Alice and Bob extract some information x,
then apply x to all other users.

Not an expert in ML, this was just initial thoughts.


texts:
I decided to read the original RSA paper A Method for Obtaining Digital Signatures and Public-Key Cryptosystem because of a question I had about RSA (which is not the question I'm about to ask, but may be a question on here at some time) and came across something I had never seen before in any textbook description of RSA (Note: this comes from the beginning of Section VI of the paper).

for any integer (message) $M$ which is relatively prime to $n$,
$M^{\phi(n)} \equiv 1\pmod{n}$

The part I don't recall ever hearing in class, or coming across in a text book, or seeing in any description of RSA I've ever read is that $M$ and $n$ must be relatively prime.
So, I decided to play around with a toy example of RSA to see what would happen. I use $p=13$, $q=31$, $e=7$ and $M=2p=26$ (for completeness: $d=103$, $\phi(n)=360$, $n=403$).
I observed the following using my toy instance of RSA: $M^e\equiv M\pmod{n}$, $M^e\equiv 0\pmod{p}$ and $M^e\equiv M\pmod{q}$.
Do these equivalences hold for all $M,p,q$ when $M$ and $n$ are not relatively prime? How would I prove this? What is the real-world effect of this?