texts: reduces the coefficients of a modulo 3 on NTRU

texts:
i'm still don't understand about 'reduces the coefficients of a modulo 3' on NTRU tutorial

  $a = f*e = 3 - 7X - 10X^2 - 11X^3 + 10X^4 + 7X^5 + 6X^6 + 7X^7 + 5X^8 - 3X^9 -7X^{10}  \pmod{32}.$
  Note that when Bob reduces the coefficients of $f*e \bmod{32}$, he chooses values lying between -15 and 16, not between 0 and 31. It
  is very important that he choose the coefficients in this way.

  Next Bob reduces the coefficients of a modulo 3 to get
  $b = a = - X - X^2 + X^3 + X^4 + X^5 + X^7 - X^8 - X^{10} \pmod{3}$.

how can you get polynomial $a \bmod{3}$ is : $- X - X^2 + X^3 + X^4 + X^5 + X^7 - X^8 - X^{10}$?
what i know on 'polynomial $a \bmod{3}$' means every coefficient mod 3, so coefficient on $-X^8$ should be $2$ ($2X^8$) not $-1$ ($-X^8$), because $5 \bmod 3 = 2$?


texts:
I'm reading about the linear cryptanalysis of an SPN and I have some questions about the practicality of this. The example I'm looking at is from 3.3.3 of Stinson's Book and I believe the same example is given in these notes  (pg.13 for the diagram)
First, a question of practicality. The SPN is comprised of many independent S-boxes. In both Stinson's book and the notes we seem to have the linear approximation for each S-box (in consideration). How would one get this information in practice? It seems like an attacker would need to know both the input and output of each S-box in order to get the linear approximation. But in the attacks, the only information known is the plaintext-ciphertext pairs. So, for instance how does one get that $S_{2}^1$ can be approximated by $U_5^1\oplus U_7^1 \oplus U_8^1 \oplus V_6^1$?
Here, the $U^1$'s are in the inputs into the 1st round S-boxes and the $V^1$'s are the outputs.
Second, you would need to know for instance that $S_2^2$ feeds into $S_2^3$ and $S_2^3$. Wouldn't this require knowledge of the permutation used by the SPN? If so, how does an attacker get this knowledge.
Lastly, how does these linear approximations allows us to get any of the subkey bits. I do not find the explanations clear enough. Does anybody have a reference that explains this clearly?


texts:
I wasn't sure where else to ask this so I will ask it here.

I work for a company that uses a rather old piece of tooling and we use customized software to control it.  We hired a guy to code the controller for us, and it works fine, however, we caught him stealing and fired him.  After we fired him, we found out that he's coded in a check that is comparing an encrypted file to the serial number of the machine so we can't use the code on any other machine on the floor(we have ten of these things).  I looked at the code in hopper, and it appears that this is simply the serial number AES encrypted somehow.  Knowing this, would it be possible to reverse engineer the file so that we can create this file for each of the machines?


texts: Commiting to a linear relation over a finite field

texts:
Suppose I have some finite field $k$. I am wondering if there exists a way to commit to a linear relation $a_1x_1 + a_2x_2 + \cdots + a_mx_m = b$ over $k$ , such that I can later reveal that a certain $m-$tuple $(c_1,\cdots ,c_m)$ satisfies $a_1c_1+\cdots a_mc_m = b$, but without revealing the coeficients $a_1 , \cdots , a_m$?

If it helps you can assume that the finite field is of prime order, but if you know a way to do this in an arbitrary finite field that would be even better.


texts: Generate random number which should depend on key

texts:
i want to generate random number for example from [1..100]. The algorithm which would generates random number should work similarly like a "Linear congruential generator", like this:

$X_{n+1}≡(aX_n + c)\ (mod\ m)$

Where:
$c$ - increment should be something like 98979817
$a$ - should be used for security and should be great number
$X_n$ - initial number

However, I can't use this formula because my $m\ (mod m)$ is 100 so it's $m < c$ and $m < a$. While it should be $m > c$ and $m > a$.

Maybe there is something similar which is more secure than this?


texts: Coin flipping with limited communication between participants

texts:
Alice and Bob want to play a coin flipping game. Alice wins if the coin flips head.

They choose to trust a independent third party that generates a random beacon (such as NIST). There is no communication only before the random beacon is generated. After it is generated, there may be communication.

Alice has a message known only to her.
The result is the first bit of hash(message, beacon).

Alice and Bob may not be able to communicate before the random
beacon is generated.
The result can't be changed when at least one person knows the
result.

With (2) we avoid the situation where Alice reads the random beacon then changes the message to yield a different result that favors her.

One solution may be having the message hash timestamped by another third party (not the one of the random beacon) to a time before the random beacon is generated. Alice then can't change the message retroactively. I see two problems with this solution:

Alice may generate several messages and timestamp them before the
random beacon is generated. Then, after the random beacon is
generated, she can choose the message that yield the result that
favors her.
How can we prove that the timestamp was generated before the
random beacon?

Is there a crypto solution to this problem? Is this a common and studied problem in cryptography, please can you point me to some literature that describes and solves this problem?


texts:
Are there any "good" ways to get a permutation from a password/pass-phrase?

If one, for example, wanted to get a permutation of letters from a password, how might one do that in a smart way? I would be interested in a way that from one password word would generate a given number, for example 7, permutations for use in an Enigma machine.

I understand that if the password is password one could simply make the alphabet

paswordbcefghijklmnqtuvxyz
so that the permutation would send
a to p to w to o to etc.

But this doesn't seem like a very smart choice. It would obviously be nice if the permutation generated is very different for two very similar passwords.

What are better ways of doing this?

Edit: This does not need to be implementable mechanically.


texts: Taking $n-1$ bits from hash function will also be hash function?

texts:
If $\mathcal{H}=\left(\text{Gen},H\right)$ is a collision resistant hash family does $\mathcal{W}=\left(\text{Gen},W\right)$ where $W_{s}\left(x\right)$ denote the $n-1$ left most bits of $H_{s}\left(x\right)$ is also collision resistant hash family?

Im thinking that $\mathcal{H}$ would not be collision resistant hash family but I cant find an exact counter example of $x \neq x'$ such that $W_{s}\left(x\right) = W_{s}\left(x'\right)$.
My guess was to prove using induction that we can deduce $k$ bits and still consided to be a collision resistant hash function, even if $k=n-1$ which will lead us to a function with image of 1 bit and that obviously wont be valid hash function.


texts: Can I use different IVs when encrypting identical plaintexts with identical keys with AES-CTR?

texts:
I would like to use AES-CTR to encrypt the same plaintext with the same key more than once (on different machines). I'm wondering whether I should try to use the same IV each time, or whether it's safe to use a random IV for different instances of the same plaintext. Using the same IV would require a deterministic method for IV selection, which poses its own problems.
I've seen very good explanations of why one shouldn't re-use a key/IV pair when encrypting different plaintexts using AES in CTR mode. (https://crypto.stackexchange.com/a/2993/83956)
I'm wondering whether encrypting the same plaintext twice with the same key but a different IV opens you to a similar attack. As I understand it, this would provide an attacker with
$C_1 = P \oplus F(K, IV_1)$
$C_2 = P \oplus F(K, IV_2)$
...which means:
$C_1 \oplus C_2 = F(K, IV_1) \oplus F(K, IV_2)$
...which doesn't look useful to me, but that depends on $F$ which I'm not familiar with.
Context: I have a system which requires a password and secret key together in order to log in. In a web client, I would like to save the secret key in local storage for convenience. I understand it is bad practice to leave secrets unencrypted in local storage, so I'm encrypting it with AES-CTR using a key generated from the user's password. The encrypted key will never be transmitted—only decrypted using the password for login purposes. They key is compressed before encryption, so any guesses at the password cannot be validated by attempting to decrypt the secret key. All guesses produce valid-looking secret keys, so an attacker would still have to use actual login attempts to brute force anything.


texts: Can I decrypt the message having it encrypted with different keys?

texts:
I have some encrypted binary data I want to decrypt. I know nothing about it, but I can get it encrypted with as many different (random, unknown) symmetric keys as I want. The keys are long enough to not get repeated. Something like this:

$A_1 = Data ⊕ Key_1\\
A_2 = Data ⊕ Key_2\\
A_3 = Data ⊕ Key_3\\
…\\
A_n = Data ⊕ Key_n$

Is it possible to get $Data$ just having the $A$s?

Thanks


texts: How can I use eulers totient and the chinese remainder theorem for modular exponentiation?

texts:
I'm trying to implement modular exponentiation in Java using Lagrange and the Chinese remainder theorem.

The example we've been given is:

  Let $N = 55 = 5 · 11$ and suppose we want to compute $27^{37} \pmod N$.

He doesn't give us the answer, but says:

  The most efficient way to do it is is using Lagrange's theorem, a few multiplications modulo 5 and 11 and CRT to combine both results.

Using Lagrange / Euler totient I get $\varphi(N) = 40$, which it seems I'm supposed to use calculate the congruences needed for putting into the Chinese remainder theorem.

I know I can calculate the congruences using the Extended Euclidean algorithm, but the answers need to be reduced or the run time will still be unfeasible (maybe not in this case, but for the 1024 bit numbers I'm working with, this is a huge problem).

I know they can be reduced, from a document I found while researching this,  which states:

  $$a^k \equiv a ^ { k \pmod{\varphi(n)}} \pmod n.$$

I've tried and tried and tried to follow how he does the reduction but I just don't get it. He also doesn't mention what $m$ is when he says $k = m · \varphi(n) + k'$.

As you can probably gather, my math is not so hot, so if possible maybe give a "for dummies" answer.

The example given – Let $N = 55 = 5 · 11$ and suppose we want to compute $27^{37} \pmod N$ – is not homework, so if anyone could step me through it, in particular the reductions to get to the simplified Chinese remainder theorem congruences, I would be VERY grateful.

I originally placed this question on Stack Overflow.


texts:
We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition?

Is a cipher broken if you can get the key faster than brute-force? Or is there another definition for "broken"? Because if you have a 128-bit key and it takes $2^{126.5}$ operations to break it, I wouldn't call that broken, for that I find broken a bit of a strong word.

I did find this for an asymmetric key and the quote:

  An asymmetric authentication scheme is considered to be broken if an attacker with access to the verification key can generate any valid cipher text, even if he can convince you to sign arbitrary other plain texts.

...which isn't really applicable to symmetric keys. It is a perfect answer for asymmetric encryption but I'm looking for something more general or I could make a distinction between symmetric and asymmetric but then I would still like to know, when is a symmetric encryption scheme deemed broken?


texts: Is it possible to have multiple RSA private keys?

texts:
I just did some math:

Pick $p$ and $q$ distinct primes;
Calculate $N=p\cdot q$;
Calculate Euler`s totient => $\phi=(p-1)\cdot(q-1)$;
Pick an $e$ (public key), coprime with $\phi$;
Calculate $d$ (private key) which is equal to $e^{-1} \bmod \phi$.

And figured out that $d$ (private key) can be multi-valued:

$$d = (\phi * k + 1) / e$$

This $k$ lets calculate a lot of different $d$`s. And are all of them correct private keys?

Where did I go wrong?


texts: State recovery of Micalli-Schnorr random number generator modulo a prime

texts:
Let $p$ be a public prime of $n$ bits. Define the sequence $x_i=z_{i-1}^e \bmod p$, where $z_i$ is the $k$ high-order bits of $x_i$, and $r_i$ the remaining $n-k$ bits of $x_i$ (thus $z_i=\Big\lfloor\frac{x_i}{2^{n-k}}\Big\rfloor$ and $r_i=x_i\bmod2^{n-k}$).
Suppose $k>\max(2n/e, s)$, for some security parameter $s$ and $e$ is public with $\gcd(e,p-1)=1$.

I'm looking for an efficient algorithm to recover $x_0$ from the sequence $r_0, r_1, \ldots r_n$, or to predict remaining terms in the sequence.


texts: Create self signed certificate from modulus, private and public exponents of RSA

texts:
I have the values of RSA public exponent $e$, the secret exponent $d$ and the modulus $n$.

How can I create (for example using openssl) a self-signed certificate using the RSA  key $(n,d), (n,e)$? Is it even possible?

Second question: Is it possible to get the factors of $n$ from $(n,d), (n,e)$?


texts: How to generate a certificate/PEM from specific plain text keys?

texts:
Is there a way to generate a certificate with a pre-stablished public/private plaint text keys?

Explaning: I generated some keys on a web site for development propurses, but now one of the parties requires it on a X509 certificate...

Sample keys can be generated here: http://travistidwell.com/jsencrypt/demo/


texts: Strength of MD5 in finding duplicate files

texts: Why are there a lot of duplicate file finder applications which are using MD5 Algorithm? What is the strength of MD5 in terms of searching duplicate files in hard disk or flash driver or any other storage device?


texts: How can I prove that ElGamal encryption in $\mathbb{Z}_p^*$ with OAEP padding is ind-CPA secure?

texts: How I can prove that ElGamal encryption in $\mathbb{Z}_p^*$ with Optimal Asymmetric Encryption Padding (OAEP) is IND-CPA secure?


texts: Effitiently sampling the error (noise) distribution in ring-LWE

texts:
In LPR12, page 4 is described a ring-LWE encryption in which we are working in a ring $R = \mathbb{Z}[x]/(x^n + 1)$ for a $n$ a power of 2. The public key is of the form $(a, b= a\cdot s + e)$ where $s$ is a secret key and $e$ a "small" element sampled form an error distribution. This is then generalized to other cyclotomic polynomials in LPR13.

I am trying to understand how to (efficiently) implement a sampler for e. As it is described, the distribution for $e$ is a discrete (or discretized) Gaussian but in a bit scaled and screwed space. Probably the easiest way to see it is as in CIV16, page 3 where they describe it by a linear transformation of a gauss sample. But implementing it in this way as a matrix multiplication seems inefficient. On the other hand, in papers like RVMCV14 it seems to me that there is no mentioning of any transformation.

I am asking what implementation would be preferred here? Actually I would be more than satisfied with an answer for when $R = \mathbb{Z}[x]/(x^n + 1)$ and $n$ is a power of 2.


texts: Encrypt-then-MAC Confidentiality, Integrity and Authenticity

texts:
Does Encrypt-then-MAC provide equal confidentiality, integrity and authenticity as other constructs such as EAX?
If yes, how do I go about using it?

My current understanding is:

E = encrypt(plaintext)
H = hash(E)
output(H || E)

Is that correct?


texts: Identification of correct plaintext after decryption in Rabin cryptosystem

texts: In the Rabin cryptosystem, decrypting a message can produce four different outputs, of which only one is the correct plaintext.  How can one know which of the outputs is the correct one?


texts: AES - which cipher is the safest one out there and what are the best practices for creating and storing the key

texts:
I just started to learn cryptography. I've read a ton of articles but couldn't find a book or a course that is based on this subject (and also is not outdated).

Therefore I have a few questions (some of them were asked before but there's no specific answer).

Also i must specify that all my questions are related to aes in PHP:

First question is what is the best way to create a completely random and unique key? So far I've made this little code that is (in my opinion) an overkill (and I guess it ads no extra security and randomness to the key since it is only 32 bytes in the end anyways) but still here it is:

$length = 32;
$hash = hash('sha512', microtime(true) . random_bytes(2) . chr(rand(0, 255)) . openssl_random_pseudo_bytes($length));
if((strlen($hash) / 2) > $length){
    $x = rand($length / rand(1, $length), strlen($hash) - $length);
    $key = substr($hash, $x, $length);
} else{
    $key = substr($hash, 0, $length);
}

The cipher that I'm using is: aes-256-gcm. Is there a better cipher that I could use (a more secure one that has a longer key maybe)?

Also why does aes-256-gcm accept a longer than 32 bytes key but on decryption it just ignores anything above the first 32 bytes of that key?

Finally what is the best way to store the key for later usage (keeping in mind that I'm using php/mysql - I am aware of the fact that storing the key in the same database where you store the ciphertext/iv/tag is purely insane).

PS: I do NOT use any of these lines in any project, those are just me trying to learn.


texts: Is a subset of a random set still random?

texts:
Suppose you have an infinite list of random bytes, and you select the first N bytes that correspond to printable ASCII characters. Is this list of N bytes still as secure (e.g. for the purpose of a crypto secret or salt) as accepting all of the bytes (printable ASCII or otherwise)?

I am basically asking whether this code has any cryptographical weakness:

https://github.com/opscode/cookbooks/blob/master/openssl/libraries/secure_password.rb#L26

(Assuming that the output of OpenSSL::Random.random_bytes(1) is indeed random.)


texts: Trading Chosen-Ciphertext-Protection for Double encryption

texts:
Straight to the point: I'm trying to implement double encryption using two cipher suites. One (#1) of them is a stream cipher without any checksum/authentication guarantee, the other (#2) is an AEAD algorithm (AES-OCB).

On blog.cryptographyengineering.com, it says:

  The ugly [of multiple encryption]

  ...

  3) Plaintext distribution issues. Maurer showed one more interesting result, which is that in a cascade of ciphers, the entire construction is guaranteed to be as secure as the first cipher, but not necessarily any stronger. This is because the first cipher may introduce certain patterns into its output that can assist the attacker in breaking the second layer of encipherment. Maurer even provides a (very contrived) counterexample in which this happens.

First, my code encrypted using #2 first, then #1, so that the whole ciphertext had a checksum. Then I noticed how bad my idea was: The attacker would just have to crack #2, then the rest is easy.

Are there any disadvantages of encrypting with #1 and then #2?

#1 and #2 don't use the same password, I've omitted KDFs for simplicity.


texts: Strategies for securing public key storage on software

texts:
I´m kind of new in this so I apologize in advance for any noob mistakes (feel free to point it out)

We are developing a licensing mechanism on our software, and  I would like some advice.

The software is installed on premises on the client, good old .Net application. We are planning on using the Portable.Licensing framework, basically, it provides an easy way to generate signed license files, the license file contain all the info the software needs to enable and disable usage and features.
To do that, we must generate and use a pair of private/public keys.

As you all may know, we use the private key (and password) to sign the file and the public key to validate the file in the software. A web server would be responsible for creating and delivering these license files to the clients.

So, on my web server we need to have our private key and password. That´s ok and under control.

The question is the public key management, how can I store and secure it on my software in order to guarantee that it will not be replaced?

I am aware that if I put it on the compiled assembly, even if I sign my assembly as well, there is a possibility to crack it. We can always make it more difficult by obfuscating the assembly, but I don´t know if that´s enough.

How would you guys approach this scenario, what´s the best practice?
Any input is much appreciated.

Thanks.


texts:
I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact been formulated? As an example, we could just take the pairing

$\mathbb{Z}_p\times \mathbb{Z}_p\to \mathbb{Z}_p,\;\; (x,y)\mapsto xy,$

where the group is the additive subgroup of $\mathbb{Z}_p$. Clearly, this would not be terribly useful for cryptographic applications, since picking any nonzero $a\in \mathbb{Z}_p$ as a generator, we can trivially solve the discrete logatithm problem in this additive group. Hence any standard formulation of Diffie-Hellman can be solved as $c$ from $ca$ can be solved just by multiplying with the inverse of $a$, which is efficiently computable. How do we differentiate between ''good'' and ''bad'' groups?


texts:
What are diffrences between tweak and nonce?

I only know that nonce is used only once but tweak can be used for more than one time.but still by this diffrence I can't diffrentiate tweak and nonce


texts: If the plaintext contains the key used to encrypt the ciphertext, is the ciphertext easier to decrypt?

texts:
I have a symmetric key which can be used to encrypt plaintext and decrypt the resulting ciphertext.
I use it to encrypt a plaintext which is a copy of the aforementioned key.
My adversary gets a copy of the resulting ciphertext.

Assuming my adversary knows that the plaintext is a copy of the key,
is there a way they can guess my key more easily than if the plaintext wasn't the key?

Note: I am new to cryptography so if there is a flaw in my question I will be happy to clarify.


texts: BGV KeyGen-- Can a maliciously-generated secret-shared key break security (e.g. SPDZ)?

texts:
I was (re)reading the paper "Practical Covertly Secure MPC for Dishonest Majority–or: Breaking the SPDZ Limits".

One of the key points in this paper is that they present a covertly secure BGV key generation protocol (Protocol B1, p15). The public key is revealed, but the secret key is full-threshold secret-shared among the parties.

They achieve covert security by generating multiple keys, and then opening all-but-one (provably) at random and checking that the parameters were generated correctly.

I understand why this is necessary with the $\epsilon_{i, j}$. If the error parameters are too small, then the underlying lattice problem is not hard enough. But it seems this could be fixed by each party adding an error that is large enough for the lattice problem to be hard. Then the security would be satisfied even if $n-1$ parties submit 0 as their error value. And in the honest case the error would be more than necessary, but definitely within the tolerable amount since BGV supports a lot of (homomorphic) ciphertext additions without the ciphertexts stopping to be decryptable.

Why is it necessary to check the $s_{i, j}$ and $b_{i,j}$? Is there an attack that an adversary controlling up to $n-1$ parties could do where they pick bad $s_{i, j}$ or incorrectly compute $b_{i, j}$ such that they can decrypt ciphertexts without collaborating with the honest players? Or in other words, why is this protocol not secure against malicious adversaries?


texts:
Suppose we have the following crypto system: $P = C = K =
\{0, 1, . . . , n − 1\}$, $E_k(x) = (x + k) \bmod n$ and $D_k(y) = (y − k) \bmod n$. Prove that the crytosystem has perfect secrecy. Perfect secrecy means that the ciphertext does not leak any information about the plaintext (i.e., $P(X = x) = P(X = x \mid Y = y)$).


texts:
I have concerns regarding truncated SHA-256 hashes in an application I am building at the moment:

Nomenclature

secret - the full 256-bit SHA-256 result of hashing 16 random bytes
public - a unique identifier for an object.
hash - the output of SHA-256(secret || - || public)
prefix - the first 8 characters (32-bit) of hex encoded hash.

Scenario

secret is generated once and remains constant throughout the lifecycle of the scenario.It is not known to the attacker

Identifiers for all objects (publics) are known to the attacker.

prefix will be the base for further computation and information retrieval for a given object.
The first 4 bytes (32 bit) of hash have to be sufficient for that.

It is important that a potential attacker cannot generate a valid prefix for a given public.

Concerns

The attacker's utopia is to find secret so they can generate a valid hash for every object.
This is unrealistic to brute force (computation would take forever).

However, because only the first 32 bit of hash matter, is there a mechanic / cryptographic attribute, that makes it feasible for the attacker to guess / compute a valid secret that would allow them to generate prefix values for given publics?

Example

secret = 'af8b81c94d68...' (256-bit)
public = '123456'
hash = 'fe13c815ab44...' (256-bit)
prefix = hash[0...8] = 'fe13c815'

Can the attacker guess secret such that they would end up with a valid prefix?

Can the attacker use that guessed, validated secret and compute prefix values for different publics?


texts: Value of S and r in Fiat-Shamir Protocol

texts:
In the book Cryptography and Network Security by Forouzan,in chapter 14, Fiat-Shamir protocol, its mentioned that two large prime numbers p and q are chosen and kept secret. However n=p*q is made public. Then the claimant chooses s which lies between 1 and n-1(exclusive)........

Now here is the doubt: exclusive means he author wants to say that s belongs to the set (1,n-1) with no other restrictions on it.
However, on internet, I have seen sites mentioning that s belongs to the set [1,n-1] but s must be co-prime with n. Now it is equivalent to say that s belongs to the set (1,n-1) since they have mentioned that s must be co-prime with n, so there is absolutely no way 1 and n-1 will be chosen. However the book doesn't mention anything like s must be co-prime with n.
So I am confused with the rules applied in selecting s

Again r, the random number selected by claimant: the book mentions that it must be between 1 and n-1. So , I am confused whether its set is (1,n-1) or [1,n-1].


texts: Question about hiding commitment scheme for integers

texts:
Given a generic group $\mathbb{G}$ of an unknown order (such as a $3000$-bit RSA group) and a randomly generated element $g \in \mathbb{G}$, is the commitment scheme $\mathrm{Com}(x)= g^x$ not considered to be a computationally hiding scheme for sufficiently large (say, $128$-bit) integers?
I thought it was computationally hiding since retrieving $x$ from $\mathrm{Com}(x)$ would mean solving the discrete log problem. But it seems it is not considered to be computationally hiding in the literature, which seems confusing to me.


texts: Is there any functional encryption scheme whose key generation circuit is in NC1?

texts: To my best of knowledge, I have kown there exists randomized encoding scheme whose encoding circuit is in $NC^1$, fully homomorphic encryption scheme whose decryption circuit is in $NC^1$, and functional encryption scheme for $NC^1$ functions. Now I'm curious about is there any functional encryption scheme whose key generation circuit is in $NC^1$ ?


texts: Suggestions for improving encrypt-then-mac flow

texts:
I have a large piece of data I want to encrypt, and I have a key master_key.

Rather than encrypt the data directly with master_key, I generate a random key item_key, split it in two parts, and encrypt the data with the first half, and use the second half as an auth key in generating an authentication hash with HMAC.

I then encrypt item_key with master_key. This way, if the user were to change their master_key, I would only need to rewrite the item_key, and not the large piece of data.

So the end result of the overall encryption is:

the ciphertext
the authentication hash (or tag) of the ciphertext <- HMAC(ciphertext, auth key)
encrypted item_key

What I overlooked however is that I am generating two ciphertexts here, one of the encrypted data, and one of the encrypted key. But, I only have one auth hash. This is a flaw as I go on to decrypt the encrypted item key using the split master_key without checking its authenticity. I do however check the authenticity of the ciphertext, but that's not as useful.

My challenge now is to use the pieces that I already have to fix this problem. This means I don't want to introduce new keys.

To fix this flaw, I would need to generate an auth hash/tag for both the data ciphertext, and the item key ciphertext. The problem is, I don't have another secret authentication key to spare.

Possible solutions:

Do not generate an auth hash for the ciphertext, and instead generate an auth hash only for the encrypted item key, since that is what is being encrypted with the master key. The application promises to never decrypt the actual data ciphertext without first authenticating and decrypting the item key. Will I be roasted by the security community for doing this, even if it's theoretically safe? Is it "bad style"?
Derive from the master key an encryption key and an auth key using a PBKDF2 with a small iteration count (less than 3000). I would use this auth key to generate an auth hash for every encrypted item key. (The item key would then be used the same way explained in the beginning: split in half, one half used as encryption key, the other as auth key for the data).

I prefer to go with option 1. Does this sound reasonable? Or are there any other solutions I may be overlooking?

Note: AES-GCM would seem to solve this problem easily, as I do not need auth keys, but I cannot use this method since the platforms I intend to support do not provide native support for this algorithm.


texts:
This is probably one of those embarrassingly simple questions, but here goes.  Consider the following two constructs:

CSPRNG made out of a block cipher (AES) with a counter such as

CSPRNG made out of a secure hash function with a counter (Java SecureRandom's SHA1PRNG) such as

The common denominator is the provision of a counter.  What's the point of the counter as you could simply do state' = F(state) once you have state established?  So the state would be the seed alone, and it would be iteratively processed to produce the random stream. What does the counter bring to the party?


texts: How does authentication work differently between asymmetric and symmetric cryptography?

texts:
Must Bob and Alice establish a 'connection' before a symmetric or asymmetric encryption scheme is secure? If so, is there ever some expected plaintext whose decryption authenticates the users?

In addition, could anyone recommend a good introductory book or paper on cryptography for a beginner like me?   Thank you very much.


texts: Any benefit to encrypting IV and MAC in a mode like AES-GCM or ChaChaPoly?

texts:
Would there be any benefit to symmetrically encrypting the IV and MAC in an AEAD mode of operation? More specifically would this prevent someone from exploiting the accidental use of a duplicate IV with the same key? Normally with most AEAD modes (and XOR-based stream ciphers) same IV + same key + different message = bad.

Example: let's say you have AES-GCM with a 64-bit IV and a 64-bit MAC / authentication tag. Now let's say after encrypting with AES-GCM you take the IV and MAC together and encrypt both with AES (using the same key or a derived key) in ECB mode (one 128-bit block) and send AES(IV|MAC) instead of sending the IV and MAC. Then at decrypt you AES decrypt that block and then run GCM with decryption and authentication check as usual.

If you duplicate an IV with a different message, the AES(IV|MAC) result will be different and since the IV and MAC are not visible in plaintext they can't be used by the attacker... right? (Obviously if both message and IV are identical the attacker can see that there was a duplicate of the same message, but that doesn't help them attack authentication for other messages.)

Other than costing a little bit of extra CPU does this help security? Am I missing something? This feels too simple to be novel.


texts:
I'm having trouble finding info in the docs about how to solve a system of congruences. The closest I can find is 'matsolvemod' in here: http://pari.math.u-bordeaux.fr/dochtml/html.stable/Vectors,_matrices,_linear_algebra_and_sets.html

but I'm not sure if that's exactly what it's used for because I don't really understand where the M parameter comes in with a system of congruences. Is there a function for solving a system of linear equations of the form:

x = a1 (mod b1)
x = a2 (mod b2)
...
x = an (mod bn)

(or even for just 2 or 3 congruences is fine)

EDIT: Okay, I've tried just using the algorithm and basic arithmetic instead of finding a function to do it for me automatically but am receiving an error:


texts: What is the time complexity of computing a cryptographic hash function/random oracle?

texts: I'm wondering what's the computational complexity of computing a hash function/random oracle when doing complexity analysis. For example, what's the computational complexity of computing $H(b\|r)$? where $b$ is a bit and $r$ is a random string of length of security parameter $\lambda$. If $b$ is a string (i.e., a string message), what's the computational complexity? In my opinion, we can just take it as taking $poly(\lambda)$ time, but can we take it as computing in constant time? say, $O(1)$?


texts:
So I was wondering about some alternative attack scenario which I thought of when I started to understand KDF's .
So lets say you have a cipher like AES and a strong KDF . And the legit user uses a 30 character strong Password :

30-char Pass ---> KDF ( slow stuff : argon2,scrypt ) ----> AES256

And normally the attacker would have to start at the beginning with brute force and then passing through the KDF which slowes him down very much and then finally checking if the final bit string is accepted by AES to decrypt the ciphertext .

But I the attacker knows that the legit user uses a very strong Pasword and a decent KDF , would it not be more efficient to just bypass the KDF and brute force the AES bits directly ( takes longer , but much less slowdown ) like :

wordlist ---> Some random 256 hash ( sha256 ) -----> AES256

With that method the attacker could brutefoce every possible AES key and the length would not even matter . But It would be very difficult because of all the possibilities .

How likely is such a Scenario ? And is it even worth doing so ?


texts: Is it safe to use single-block AES for mutual authentication?

texts:
I read the question Symmetric mutual authentication with client using a derived secret and its answer which, if I'm not mistaken, assert that it should be safe to use the proposed protocol for mutual authentication between a client A and a server B as follows:

At commissioning, each client A gets a unique identifier $i_A$ and a derived key $k_A$ which is generated from the secret $s$ by HMAC($s$, $i_A$).
To authenticate B, A sends $i_A$ and a random nonce $c_A$ to B.
B calculates the expected derived key $k_A'$ = HMAC($s$, $i_A$) and replies with $r_B$ = HMAC($k_A'$, $c_A$) as well as a random nonce $c_B$.
A can now authenticate B by comparing $r_B$ to HMAC($k_A$, $c_A$).
To enable authentication of A with B, A sends $r_A$ = HMAC($k_A$, $c_B$) to B.
Now B can authenticate A by comparing $r_A$ to HMAC($k_A'$, $c_B$).

Now I would like to use a single-block AES128 for the HMAC calculation in this scheme such that every message item (namely, $i_A$, $c_A$, $r_B$, $c_B$, and $r_A$) between A and B is exactly 128 bits long and the AES128 is used in ECB mode.

Given this answer to a question about AES Message Authentication Vulnerability, I think this should be safe?


texts:
I am pretty new to cryptography and I have been studying up on TOTP (Time Based OTP) and while I have learnt how the computation works, I'm unable to figure out why using TOTP makes a system more secure.

Here's what I have understood. TOTP is used for 2FA, so the first factor would be your username and password. This as we know is not very secure in itself and hence we use the second factor, here the OTP.

So with TOTP, there is a secret key that both the server and the client have. So my question is that if an attacker has gained access to this secret, would he not be able to generate the OTP just as easily as the client software on my system because HOTP(key,counter) will remain the same for all? So to ensure TOTP is helpful, I have to make sure that the secret key with the client is safe? Let's say I'm making a software that is to be used by the public which uses TOTP based authentication. So will I be attaching a different secret to each of the clients and maintaining a database on the server end to match the secret server side?

If not, what's a safe way to have the same secret on both client and the server in this case?


texts: k(k-1)/2: Combinations and the Birthday bound

texts:
Disclaimer: I'm new to cryptography.

Background: I'm reading Cryptography Engineering by Ferguson, Schneier, and Kohno, where, in Chapter 2, the authors write this:

Question: What is $k(k-1)/2$ called? It seems related to an arithmetic sequence $a_n = a_1 + (n-1)d$ and some kind of combination (my notes below), but I can't place it.


texts:
I cite from Fundamentals of Computer Security (Chapter 7 on Digital Signature, Paragraph 7.3 on RSA Signatures, page 289):

  Multiple uses of the RSA Signature scheme tend to weaken it. The way out is to make subsequent signatures dependent on those previously generated.

Why is this?
Does it affect also the RSA Encryption scheme, or is it a weakness that comes from the knowledge of the message (and therefore affects only Signature schemes)?


texts: AES: Is it safe to encrypt same cleartext with same key but with million diferent IV?

texts:
The encryption mode that I am using is CBC. Algorithm is AES and the key size is 128bit.
I will be encrypting a 36 byte string over 1.3 million times with the same key but with a random IV.

My question, as the title states, is it possible to reverse engineer the key for 1.3 million cypher texts without knowing the key nor the IV but with the knowledge that all the clear texts are the same.

From experience I know, it would not be easily possible to decrypt the first block without the right IV but how would the security of the rest of the block be impacted ?

Edit:

Situation 2: will knowing some portion of the clear text make it easier to guess the key ? Suppose the data is padded using PKCS7 specifications effectively making, lets say, the last 12 bytes of the clear text to be "0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c" as the string is 36 byte long.

An easy solution would be to fill the last 12 bytes with pseudorandom data. However, I am interested in knowing the consequences of not following such an approach.


texts: RSA keys finding when messages are known

texts:
I have this situation, where, in a game, people send messages to each other (game moves etc...) These messages need to be encrypted, and should only be readable by the destination person. I am using RSA for this, but, recently I got a doubt. Is it possible that, if the message is one of n possible messages, can somebody with access to the encrypted one, guess the keys used? (Both public and private).

We use keys to ensure the source and destination. So, we encrypt twice, every message. Once with sender's private key, and with receiver's public key on top of it. So, it is doubly secure, and repudiation is avoided. We use RSA only, for both. Is this bad, if the attacker knows the message to be 1 out of n.

NOTE: If this is a problem, using a random number as a field in the message, and xoring the message first with it, and sending, would that solve the problem. This makes, encrypted message essentially random, for the attacker. But for person with keys, it still allows nicely to be decrypted.

Another question about encryption, does ElGamal encryption have similar issues? I plan to use both in the game app.


texts: Deterministic generation of RSA keys for IPFS / OrbitDB

texts:
I am in the process of working on a decentralized application using IPFS and OrbitDB. IPFS uses 2048 bit RSA keys for the Node runtime peer-id and secp256k1 for read/write access in OrbitDB. For secp256k1 there exists a method for deterministically generating keys (bip39 mnemonic phrase).

Let's say I take an existing RSA implementation and replace the RNG with a seeded RNG which is seeded with the mnemonic phrase from above. Assuming I didn't roll my own implementation, aside from swapping out the RNG, how secure would this be? Are there any obvious flaws with this approach?


texts: Associative but NOT Commutative Reducing Function Construction with Existing Hash Function(s)

texts:
Is it possible to construct a binary reducing function based on any existing cryptographic hash function satisfying the associative property but not the commutative property? So formally:

Using an existing hashing function
$h: \mathbb{B}^* \rightarrow \mathbb{B}^k $
to construct
$R: \mathbb{B}^* \times \mathbb{B}^* \rightarrow \mathbb{B}^{k'}$
so that

$R(R(a,b),c) = R(a,R(b,c))$, for all $a, b, c \in \mathbb{B}^*$ (associativity)
$R(a,b) \neq R(b,a)$, for some $a, b \in \mathbb{B}^*$ (non-commutativity)
$R$ is as secure as $h$ in sense of

pre-image resistance, applied to both arguments, and concatenated
second pre-image resistance, applied to both arguments, and concatenated
collision resistance, applied to both arguments, and concatenated
additionally, it should be as hard to find $a, b \in \mathbb{B}^*, a \neq b$ that $R(a,b) = R(b,a)$ as to find $a, b \in \mathbb{B}^*, a \neq b$ that $h(a)=h(b)$, except the case* where $b = R(a,a)$

where:

$\mathbb{B} = \{0, 1\}$, a bit
$k, k' \in \mathbb{Z}^+$, the output length of the hash and reducing functions

also, if needed, more than one base hashing function $h$ could be used.

Background

The purpose of this construction is to allow the calculation of a collective hash value of an ordered list that can be carried out with arbitrary combinations in any order of the reducing function. So the ultimate goal is to construct a function $H: (\mathbb{B}^*)^* \rightarrow \mathbb{B}^k$ that could be calculated by independent multiple steps.

*the reason to make an exception in the last property is that giving the application, it makes perfect sense that $H(\{a,a,a\})$ gives the same result regardless of how you calculate it (credit goes to poncho; refer to his answer).

This question is quite similar to Associative standard cryptographic hash function, but not exactly the same. This answer might be useful: https://crypto.stackexchange.com/a/17936/19959


texts:
1: I have a HTTPS server and I added hooks in RSA decryption procedure to dump error RSA input(client key exchange).

2: I get some RSA input that I couldn't check padding successfully(It's usual) and I try to decrypt manually and find some interesting RSA plaintext like this:

3: It's obvious that the plaintext is padded artificially and I want to know whether it is a attack or a known padding mode.


texts:
I'm working to implement AES (128/256 - either) on one of the RISCV ISA processors & later improve performance by introducing a custom instruction in RISCV ISA.

I'm a crypto newbie and plan to use the
NIST test vectors to validate this C code.

I need to know the below things

1) Is there a link wherein i can find implementation of AES using standard C library ?

2) Do i have to use some hashing scheme along with AES ?  If yes, which one ?

3) Is it a good idea to validate my AES C code  with the NIST test vectors

4) Do you recommend using a encryption library instead ? If so where can i find it ?


texts: Why am I getting a wrong output when implementing Feige-Fiat-Shamir ID protocol?

texts:
I am trying to implement the Feige-Fiat-Shamir identification protocol. I've read another posting here on this site and I tried to adapt - however the end results always fail to match. Maybe because aim doing Feige-Fiat-Shamir and not Fiat-Shamir? To get to the bottom of my problem, I therefore decided to post my own question.

Preparation:

N is given:

77

s are given:

s1 = 5, s2 = 12, s3 = 37

Compute v:v = (s^2) % n

v1 = v2, v2 = 58, v3 = 37

Now the round:

Select random r between 1 and n - 1 and s = 1, -1:

r = 12, s= 1

Calculate x:

x = (r^2) * s % n = 67

Choose a either 0 or 1:

a1 = 1, a2 = 0, a3 = 0

Calculate y:

y = (r * s^a) % n = 60

Now ,if y^2 equals (x * v^e) % n then it's accepted. However in my case

y^2 mod n = 58
(x * v^e) % n = 19

19+58 = 77, but I know that y^2 mod n should be 19 as well.
Or that 58-19 should be N, which isn’t the case either.

Question:

Why don't these numbers match? What am I doing wrong here? Is it maybe because Feige-Fiat-Shamir is y2 = ±xva1 · ·van modN ? So if 58+19 = 77 or 58-19 = 77 the protocol works?


texts: sequential composition of honest verifier zero knowledge proof

texts:
Is honest verifier zero knowledge closed under sequential composition?
My guess is that since the verifier has to throw random challenges, they cannot adapt their challenge from the transcripts of a prior HVZK and thus cannot learn any additional information?


texts: MPC and Secret Sharing in not Fully-Connected Network

texts:
I have an interest in applications of MPC and Secret Sharing.
My point of view is from fields of distributed computing and Game Theory.

I want to generalize some results to arbitrary network topologies. I couldn't find any results on MPC in not fully-connected networks.

Is anyone familiar with such works?


texts: Random numbers used for ECC Diffie-Hellman

texts:
As the first step for generating a secret DH key a uniformly distributed random number $k$ must be generated, which is used to calculate the $k$-th exponent of the basepoint $A$. Depending on the group order $n$, $k$ can be between $1 \ldots n-1$ .

The binary representation length of the group order is 32 Bytes in my case, but not all bits of those $32 \cdot 8=256$  bits are used, since the group order is slightly smaller than the prime $p$, and also $p$ is smaller than $2^{256}-1$ . Therefore if I generate a 32 Byte random number $k$ , sometimes it is larger than $n$. When this happens, is it allowed to take the modulo $n$ of this number to get a new randon number

$k' = k \,\, mod \,\, n$

and use that instead? I was told to do it in that way.

First I was tempted to confirm that, but then I see that the upper end of the intervall $1 \ldots 2^{256}-1$, namely $n \ldots 2^{256}-1$ is mapped back into $1 \ldots 2^{256}-1-n$ . And therefore the distribution of random numbers for the target interval is not uniform anymore, since each representative within the interval $1 \ldots 2^{2561}-1-n$ is double-weighted - one time from the original interval and another time from the mapped back interval, so the odds for this interval are doubled as compared to numbers outside the interval. And what to do with $k'=0$, when $k=n$ ?

The other option would be to generate a random number exaktly between 1 and n-1.

Since I'm not 100% sure but this was a tip from a really experienced crypto-programmer I'm wavered between the two options...


texts: Merkle tree H(RBIT(X) ⊕ Y) instead of H(X || Y)

texts:
I was reading Can XOR be used in a Merkle Tree instead of concatenation? and had the idea of reversing bits for either X or Y before the XOR combiner, to indicate the order. So instead of H(X ⊕ Y) we could use H(RBIT(X) ⊕ Y) (or H(X ⊕ RBIT(Y))).

The cost of both RBIT and XOR instructions are negligible on most modern CPUs compared to an additional hashing round, performance would (almost) double...

Assuming also that X and Y are mutually independent (which is the case in many constructions where the leafs of the merkle tree are pseudo-randomly generated, or randomized), would this make a secure combiner? Why (not)?


texts: Regarding application of ring signatures

texts:
The wikipedia page of Ring Signature states:

Another application, also described in the original paper, is for
deniable signatures. Here the sender and the recipient of a message
form a group for the ring signature, then the signature is valid to
the recipient, but anyone else will be unsure whether the recipient or
the sender was the actual signer. Thus, such a signature is
convincing, but cannot be transferred beyond its intended recipient.

Can someone please explain the practical application of this concept? I can not make any sense of it? In what scenario it could be useful?


texts: How to perform Shamir Secret Sharing with a Tabula Recta?

texts:
In this post, a couple comments suggested that a tabula recta could be used to perform Shamir Secret Sharing.  I'm specifically interested in this statement:

  you could just have a table of all 100 inverses mod 101

If this simply means a 10x10 table, that's no problem.  That's smaller than a regular tabula recta.  But even if it's 100x100, I am still interested in how this would work.


texts: Relation between Zoom id,password and join URL

texts:
We all are using zoom application for joining/hosting meetings in this corona virus period. As we create a meeting, a new id, password and a url is generated. Some real examples follow-

  Id: 83500199576
    Pwd: 0Wnim6
    URL: us02web.zoom.us/j/83500199576?pwd=NVhJV0ExejMwcDQ2MV0wUlFxdnBWZz09

  Id: 86043075733
    Pwd: 1ubfpn
    URL: us02web.zoom.us/j/86043075733?pwd=S0h3aXhxY2hkVHU1MnVwRHAyNUlPdz09

Firstly it is trivial that the first bit of the url is the id itself, but i cant make out anything about the ?pwd= bit. Perhaps it is hashed but I don't know much about it.

If this relation is found out it would make life much easier. It also doesn't violate any privacy stuff since the user can join a meeting either he has id-pwd or the url or both.

I found this thread on the official zoom website but it doesn't help much.

I assure you that the zoom stuff given above is not working now and was created and terminated just for this question. If you want more examples, you can also do this.


texts: Difference between public coin and common coin?

texts:
What is the difference between public coin and a common coin?

I often see both appearing in the literature, but I cannot explain myself, whether they are the same concept or not.


texts: Has there been any cryptanalysis of AES under a non-uniformly distributed key?

texts:
The standard security property demanded of a blockcipher is that it be a pseudo-random permutation; i.e., given a uniformly random key, the blockcipher should be computationally indistinguishable from a random permutation under a chosen-plaintext or chosen-ciphertext attack.

However, what if the key is randomly selected from a non-uniform distribution? Has there been any research in analyzing the security of AES (or any other well-known blockcipher, for that matter) when the key is instead chosen from some other distribution? Clearly low-entropy distributions would permit brute-force attacks, but it seems there's a pretty big gulf between keys for which brute-force attacks are infeasible and uniformly distributed keys.

My question is motivated by the observation that encryption keys are frequently derived from passwords or other low-entropy sources by hashing them (perhaps with a salt, which itself may or may not fall into the hands of an attacker). The hashing may expand the key to the required length and deter brute-force attacks, but cannot introduce entropy into the result. (Edit: My question isn't about scenario in particular, it's just an example of when a non-uniform key distribution could happen in practice.)

I am aware that there has been work on related-key attacks, but to my knowledge the results aren't directly applicable to this question.


texts:
Original thread: Why hash the message before signing it with RSA?

Please correct the diagram below so I can better understand how certificates are created and signed by a third party CA:

https://imgur.com/a/g4F0zKw

The CSR (which contains the RSA public key, Subject Name (CN), etc) is hashed+padded then encrypted by the third party CA. Then the same original CSR (or just "certificate") is then combined together with the certificate signature to produce the digitally signed SSL certificate?

Added comment 2018-05-26:

Thanks for the response, I appreciate you taking the time to discuss this.

  "The signature of the CSR - which is also signed - is by the private key that is part of the key pair of which the public key is within the CSR. This signature value is verified and disposed."
  How does the CSR signing work? Does it use SHA to hash the CSR contents and then encrypt the hash using a temporary private key that was created by the web server during the CSR generation?

How does the CSR signature verification work? Does the CA decrypt the encrypted hash value of the CSR and then verify that the hash values are identical, at which point the CSR signature is verified and disposed of?

  "It is not possible to encrypt with a private key because anybody can "decrypt" with the public key; the private key is used for RSA modular exponentiation though."

When does RSA modular exponentiation occur (when calculating the padding)?

Here is a revised diagram for your review:


texts:
I'm a newbie to cryptography and I have been wondering about the possibility of using Chameleon hashes as symmetric encryption keys. Here is my scenario and my thought process:

Let us consider a server with multiple resource constrained clients (for example fitness band). I want each client to have a unique and secure symmetric encryption key to communicate with the server and I want them to dynamically be able to refresh their keys with the least amount of communication over the unsecure channel.

Let us assume I have a fully trusted gateway (which I assume is secure) between the client and server that can find Chameleon collisions for me. The client has a value $m1$ (for example its UUID) and the server stores another value $m2$ (its UUID for example). The gateway knows these two UUIDs ($m1$ and $m2$). It generates 2 random numbers using a CSPRNG: $rand_1$, $rand_2$ and one time Pads it with the $m1$ and $m2$. Gateway shares $rand_1$ to client and $rand_2$ to server. So new value $m1'$ for client will be $m1 \oplus rand_1$ and new value $m2'$ for the server will be $m2 \oplus rand_2$. The gateway also generates two more random nummbers $r_1, r_2$ using CSPRNG such that $\text{CHAM}(m1',hashkey,r1) = \text{CHAM}(m2',hashkey,r2) =$ shared new encryption key between client and server.  Gateway also shares $r_1$ with client and $r_2$ with servers so that the client and server can calculate the keys and use it going forward.

Since Chameleon hashes are collision resistant, this will give me unique keys for each client. An attacker cannot guess the encryption keys even if he knows the UUIDs since we are 1) XORing with a random number for entropy  2) using $r_1$ in our hash function during every refresh. I am not sure about the entropy of the resulting hash to know if the keys will be totally random but I read that the resulting hash of two different messages is uniformly distributed for a given random number $r$ ($\text{CHAM}(m1, hashkey, r$) and $\text{CHAM}(m_2, hash key, r)$.

I am not sure what security properties and requirements of a secure encryption key will stop us from using resulting chameleon hashes a bad choice for dynamic  symmetric encryption key generation. I would really appreciate if someone can help me with this.


texts: How does ECDHE_RSA key exchange mechanism work?

texts:
Using Wireshark, I found these data exchanged with google.com over TLS:

Client Hello

possible cipher suites and possible curve types (eg. secp256r1) sent

Server Hello

cipher suite selected

Certificate

RSA certificate signatures exchanged, etc. (hopefully, not important for me)

Client Key Exchange, Change Cipher Spec, Hello Request

ECDHE pubkey sent to server

New Session Ticket, Change Cipher Spec, Hello Request, Application Data

session ticket received, etc. (hopefully, not important for me)

Ok, and now my question: What I learned, I need curve equation, random point on it and the finite field size (for modulo operation) in order to apply ECC.

The only thing I found was the pubkey of size 520 bits, which should represent:

1st 8 bits - base 16 prefix
next 256 bits - X coordinate of the "random point"
last 256 bits - Y coordinate of the "random point"

Ok, I have the point, but what about the curve equation and the field size?

Does the curve secp256r1 define only one specific curve? (I suppose not, so where/how is it defined?)

What is and where to find the size of the field? (Or is there only one size for given standard? ...don't think so.)

Thank you for Your answer.

PS: This is how I understood the topic, if I'm wrong, please, correct me. :)


texts: test vectors for 3DES seem to in fact be testing DES - not 3DES

texts: NIST SP 800-20 Appendix A has what presumably are supposed to be test vectors for 3DES except almost all of the test vectors utilize 8-byte keys and not the 24-byte keys that 3DES is supposed to have. See, for example, table's A.2, A.3, A.4, A.8 and A.10. So what's the point? These test vectors don't seem like they're testing what they ought to be testing.


texts: Zero knowledge proof of Paillier cryptosystem

texts:
I have read the paper recently and I am curious about part 3. According to part 3, Bob sends a zero-knowledge proof such that $c_B=b\times_{E}c_A+_E E_A(\beta')$. Then Alice should first decrypt the ciphertext $c_B$ and check whether the equation $g^{D_A(c_B)}=(g^b)^a·g^{\beta'}$ holds.
Now, assume once the verification failed, Alice's secret $a$ and the noise $\beta'$ would be published. Alice claims that Bob cheated in the protocol, which means others could also verify the correctness of Bob's proof based on the public information and messages between Alice and Bob. I find it's difficult to do that since others could not decrypt the ciphertext $c_B$ without decryption key $D_A$ and also they don't have the knowledge of Bob's secret $b$. Is there any good idea to do that?


texts: What is the difference between verifying the hash value (MAC) and security provided by authenticated encryption?

texts:
I read this post Difference between MAC and Authenticated Encryption? but I'm still confusing the difference.

Seems like MAC can guarantee both integrity and authenticity (tbh I dont know the difference of integrity and authenticity).

What is the difference of MAC and AE?
Is AE using MAC?


texts: Why is DDH not hard over $\mathbb{Z}^*_p$?

texts: Why is Diffie-Hellman key exchange not hard over $\mathbb{Z}^{*}_p$?


texts: Compression function is not collision resistant but Merkle-Damgard is collision resistant

texts: Is it possible that you can still have a collision resistance in Merkle-Damgard even if the compression function has a collision?


texts: what can attackers do between two end hosts

texts:
I have one question that I couldn't come up with a nice solution.

So let's have this analogy, I have a box full of money and I want to deliver to this my friend. Here if we think of a potential attacker there are two possible ways, first the attacker would be between us , so called postman or he could pretend like he is the recipient.

This being the case, what are the properties of both type of attackers?

For the first attacker in the role of the postman, he could simply observe, modify or block the delivery of the box(message in cryptography). And my question here is what could he do if he disguises as a receiver unlik the postman attacker?

and what other kind of attacks could these both attacker types do?


texts:
Let $H: \{0,1\}^*\to \{0,1\}^n$ be the random oracle. A "cover"-triple is a triple $(m_1,m_2,m_3)$ such that
$$\bigwedge_{i=1}^n \left( \left(H(m_1)_i=H(m_2)_i\right) \vee \left(H(m_1)_i=H(m_3)_i\right)\right)=1, $$
where $H(\cdot)_i$ denotes the $i$ bit of the output.

What is the probability that $(m_1,m_2,m_3)$ is a "cover"-triple for random $m_1,m_2,m_3$?

How am I suppose to find the $\Pr[(m_1,m_2,m_3)]$? I believe that the space I am suppose to consider is $\{0,1\}^n$ since by the definition of "cover"-triple we have $H(m_j)$ where $j=1,2,3$.


texts: What operations are used in symmetric cryptography and why?

texts:
In continuation to Why are bitwise rotations used in cryptography?: what other operations are commonly used in symmetric cryptography? Are there particular operations on numbers that are good for building ciphers? Do common ciphers tend to use the same basic building blocks?

Some similar questions:

Why Addition Mod 32?
What exactly is addition modulo $2^{32}$ in cryptography?


texts:
I have mainly referred to this question. Definitely in case of using a salt, IV has a use of adding randomisation to each and every key. But isn't it redundant in case of using an IV to use a salt? (Like in case of referring to PBE with AES in CBC mode.)

(This is because in my understanding using the salt will make it not feasible to use rainbow tables or likes for brute force for each and every possible salt, and IV will further add randomisation to each and every message... But in case of using IV there will be randomisation in each and every message, so rainbow tables will not be feasible then also without using a salt.)


texts: Why is counter mode encryption with a 16-byte cipher block not broken?

texts:
We determine a system IND-CPA secure when an adversary has a negligible advantage after any feasible amount of queries.

AES256-GCM uses a 128bit block cipher.

We know that the distinguishability from random of counter mode encryption follows the birthday bound.

If we encrypt a stream of static data, with counter mode encryption we will never see a repeated cipher text block.

A purely random oracle will have repeats. The probability of this happening follows the birthday bound, eg after $2^{64}$ blocks we expect a repeat with probability of about a half. This would give an attacker an advantage of one half with $2^{64}$ queries, which is completely insecure.

If we assume a negligible advantage of $10^{-9}$, we reach that after about $2^{54}$ blocks. This means we should limit the maximum amount of blocks encrypted under a single key to $2^{54}$ blocks right?

This is way less than the advertised $2^{32}$ invocations of $2^{32}$ block chunks in NIST SP 800-38D.

Why don’t we see any recommendations of limiting the use of AES256-GCM dependent on its security parameter due to this attack on the counter mode encryption?


texts: Let $G$ be a PRG. Are the following $G'$ constructions based on $G$ necessarily PRGs?

texts:
$G$ is a PRG where $|G(s)| > 2 \cdot |s|$.

$G'(s) = G(s0^{|s|})$.
$G'(s) = G(s_1...s_{n/2})$, where $s = s_1...s_n$.

My question here is whether my own proposed solutions are correct and do make sense.


texts:
Suppose I have the message $m_1 = \sf{i\ like\ dogs}$.

Suppose its one-time pad encryption with key $k$ is a given hexadecimal string of 22 characters.

How would I encrypt a message $m_2 = \sf{i\ like\ cats}$ with the same key $k$?

I was given a similar question (but with different messages). Firstly I observed that the hexadecimal ciphertext had twice the character count than the message, so I thought each message character was mapped to a hexadecimal string of 2 characters.

My problem is that I don't know how would the $\oplus$ of the one-time pad work in this situation (as the message is not binary), so I couldn't guess the key. Any idea on how this should work?


texts:
Consider the following variants of the CSIDH squaring problem.
P1. Given $sE, E$ where $s$ is a random ideal class and $E$ is a random curve (reachable from initial $E_0$), find $s^2E$
P2. Given $sE_0$ where $s$ is a random ideal class and $E_0:y^2=x^3+x$ is a fixed initial curve, find $s^2E_0$.
Of course, there's also the decisional variant:
DP1. Given $sE,tE,E$ where $E$ is a random curve as above and $s,t$ are either i.i.d. sample of ideal class or $s^2=t$, decide which.
DP2. Given $sE_0,tE_0$ where $E_0:y^2=x^3+x$ and $s,t$ are either i.i.d. sample of ideal class or $s^2=t$, decide which.
What do we know about the hardness of (D)P1 compared to (D)P2? Are they even comparable?
I would also like to stress that, for another equivalent problem called the inverse problem stated in P3, fixing the base curve to $E_0$ would weakens P3 to P4 as easy as finding a quadratic twist. However, computing quadratic twists would only reduce (D)P2 to itself. So it is not so obvious whether the hardness of (D)P2 is weaken.
P3. Given $sE,E$ find $s^{-1}E$.
P4. Given $sE_0$ find $s^{-1}E_0$.


texts: How to calculate the communication cost of messages and signatures?

texts:
It is mentionned here that this message–signature tuple {PIDi, mi, Ti, σi} has this size:
40 + 20 × 3 + 8 = 104 bytes.
Can someone explain to me how this was calculated?


texts: Can I apply "encrypt with public key and decrypt with private key concept" using ECC certificate?

texts:
If Alice wants to send encrypted message to Bob, she can use Bob's public key to encrypt the plain message. Once Bob reliably gets encrypted message, he can decrypt it with his private key. In this process, Bob will never have to know anything about Alice (assuming message is not tampered). In other words, Alice does not need her own public/private key pair. Further this process can be easily achieved by Bob's RSA certificate and Alice does not have to have any RSA certificate. I also understand that this is following asymmetric algorithm (i.e. using PKI).

How does this encryption and decryption process change if Bob has ECC certificate only?

I have reviewed Integrated Encryption Scheme (https://en.wikipedia.org/wiki/Integrated_Encryption_Scheme). As far as I can tell, both DLIES and ECIES seem to suggest deriving a key (using key agreement protocol), then encrypt and decrypt messages using that key, which is essentially a symmetric algorithm.

Does not this mean both Alice and Bob need each other's ECC public key?
If so, this process appears to differ when RSA certificate is used. Am I correct?
Does this mean Alice now needs her own ECC certificate because she needs to send her public key to Bob along with encrypted message so that Bob can successfully decrypt it using Alice's public key and his private key?


texts:
I'm configuring a PKI infrastructure with an offline root CA and several issuing CAs. Among other topics, I'm struggling to decide how the revokation of an Issuing CA certificate works.

My Root CA will issue CRL once a year, and as far as I know, a machine with a CRL cached won't download a new CRL until the current one expires. But, what happens if let's say, the current CRL expires in November 2016, but the Root CA revoke an Issuing CA certificate in January 2016? Does this mean that a machine will trust the Issuing CA certificate until November 2016 although it's been already revoked by the Root CA? Is there a way to force the update of the cached CRL?

Thank you!


texts: Why does NIST want 112-bit security from 128-bit key size for lightweight cryptography?

texts:
In NIST's Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process document it is stated that:

3.1 AEAD (Authenticated Encryption with Associated Data) Requirements
An AEAD algorithm shall not specify key lengths that are smaller than 128 bits. Cryptanalytic
attacks on the AEAD algorithm shall require at least $\mathbf{2^{112}}$ computations on a classical computer in a single-key setting. If a key size larger than 128 bits is supported, it is recommended that at least one recommended parameter set has a key size of 256 bits, and that its resistance against cryptanalytical attacks is at least $\mathbf{2^{224}}$ computations on a classical computer in a single-key setting (The bolds are mine!)

Why does the NIST require 112-bit security from at least a 128-bit key on AEAD?
From the security perspective, they should require 128-security. Any attack that reduces 128-bit security can lead to more attacks. What is the rationale behind this requirement?

And similarly for the hash functions;

3.2 Hash Function Requirements
Cryptanalytic attacks on the hash function shall require at least $\mathbf{2^{112}}$ computations on a classical computer. The hash function shall not specify output sizes that are smaller than 256 bits. (The bolds are mine!)

From the values, we can hint that they consider the collision resistance. Similar questions;

Why does NIST require 112-bit security from 256-bit hash functions?
What is the rationale behind this requirement?


texts: How to prove the pseudorandomness of CryptoPAn

texts:
in my cryptography course, we are learning about pseudo randomness and the prefix-preserving function known as CryptoPAn invented in 2002. It is said that the scheme is highly insecure. So in that case, i am leaning towards disproving the pseudorandomness of cryptoPAn. But i am struggling to put it into words.
for your kind information, this is crpytopan : https://handwiki.org/wiki/Crypto-PAn


texts: IND-CPA secure RSA padding with a partial homomorphic property

texts:
A while ago, I asked for an IND-CCA1 secure padding for RSA that still allows for the multiplicative homomorphic property of RSA and got no answers (yet).

Now I've seen fgrieu's answer about standard RSA being deterministic and (only?) this weak version having the homomorphism. Not this reminded me again and made me formulate this (weaker) question out of curiosity:

Is there an RSA padding such that the padded scheme is IND-CPA secure and exhibits a partial homomorphic property?


texts: What does it mean when 1 bit goes into an s-box but two (or more) come out?

texts: I am trying to understand how bits are spread in the PRESENT cipher. The bits that enter the permutation of PRESENT return to their original position after only three rounds. But I am told that in fact the S-boxes also affect how they spread. Specifically, when one bit enters the S-box, two or more come out. I cannot understand this as I see four going in and four coming out. A short numerical example using the PRESENT S-box would be much appreciated.


texts: show that G' is not a secure PRG even if G is

texts:
Hello I'm trying to show that the function G'(s) = G(s) || G(G(s)) is not a secure PRG even if G is.

My first question is that in this case, how do I know what G is doing? Just wondering because in previous question it's been specified as a length-doubling / tripling G, but in this case I'm assuming that G is returning λ+L length string.

I know that if G is a secure PRG then L-G-prg-real and L-G-prg-rand must be indistinguishable, and that I am trying to design an attack which shows that L-G'-prg-real and L-G'-preg-rand are distinguishable. I've written G'-prg-real and G'-prg-rand like so:

L-G'-prg-real:
Query():
s <- {0,1}^λ
x := G(s)
y := G(s)
z := G(y)
return x || z

L-G'-prg-rand:
Query():
z := {0,1}^(λ+L)
x := {0,1}^(λ+2L)
return z||x

So now I'm trying to design an attack A such that when I connect it to L-G'-prg-real and L-G'-prg-rand I can distinguish between the two to prove that G' is not a secure PRG, but I'm not really getting anywhere with my current process:

I feel that I should be targeting the second half of the returned string (z), since X = G(s) in G', and we know G is a secure PRG so X is secure. In G' Y=G(s), which is used to compute Z=G(Y), Shouldn't Z just be a random string of length λ+2L since it goes through G twice?

thanks,


texts: Why should one prefer Salsa20 over ChaCha?

texts:
We are all aware of Google's approach to introduce ChaCha/Poly1305 as TLS cipher suite. The rationale seems clear: ChaCha is newer and seems to provide better security (and maybe speed?) gained from the experiences of the design of Salsa20.

But in his "recent" paper McBits: fast constant-time code-based cryptography (basically code-based ECIES) Bernstein (the inventor of Salsa20 and ChaCha), Chou and Schwabe used Salsa20 as standard primitive for McBits and not ChaCha.

So what are the reasons to prefer Salsa20 over ChaCha?


texts:
SHA-1, SHA-2, and the standardized version of SHA-3 are all sequential.  This is impractical for hashing very large files distributed across machines.  Any sequential hash can be straightforwardly converted into an efficiently parallelized hash using Merkle trees, but then I lose the standardization, and this is undesirable if the hash is to be used for long term authenticated storage.

Question: Is there an officially standardized tree-based (parallelizable) hash?

The most important property of the tree-based hash for my purposes is that for any partition of the input string, each portion can be reduced down to $O(\log n)$ intermediate space in parallel such that the intermediate values can be combined into the final hash, with at most a constant factor overhead over a sequential hash.


texts: Is my protocol that uses hybrid cryptography and AES-GCM secure?

texts:
I'm having a lot of trouble trying to understand how to implement AES-GCM.

My usecase: Person A sent me a file with a gauranteed unique name. I want to be assured it was from person A, and that no one saw the contents, and that it wasn't tampered with.

I figured that I would do the following:

Person A would give me a public key offline to which only they have the private key
Person A would encrypt the file with AES-GCM. They would then encrypt the AES-GCM key+nonce+aad with their private key. They would then send me two files: the cipher and the encrypted key+nonce+aad combo.
I would decrypt the key+nonce+aad with their public key, then I would decrypt the AES-GCM cipher using those values.

I figured that I would use these values:

Key: random
Nonce: file name
AAD: file name

I know this is probably a terrible way to do things. It seems overly complicated to me, but I'm not sure how else to achieve my usecase. I have no idea if these are the right values to use for the encryption/decryption, and I have no idea what should be kept secret and what shouldn't be kept secret.

Any guidance would be greatly appreciated. If it helps, it looks like the GSM encryption/decryption will happen in Python.


texts: Is it feasible to use combination of ABE schemes for encrypting the data?

texts:
I have a peculiar requirement for preserving the shared log files. For example I have 1000 records which belong to different organizations as listed below and all the logs are present in a single CSV file.

1-100 records --> ORG-A;
101-200 records --> ORG-B;
.
.
901-1000 records --> ORG-Z;

In the initial set 1-100 records the data should be decrypted only by ORGANZATION-A users, out of those 100 records, few records are accessible by Administrators and other 90 records are accessible by normal users (basically  users with particular role can access some set of records among those 100 records).

I am trying to solve the above problem using combination of ABE schemes viz., KP-ABE and CP-ABE schemes:

Encryption

Basically I would encrypt each of record fields 1-100 using CP-ABE scheme (ciphertext policy). I choose CP-ABE because it  allows RBAC (role based access control) policies to be embedded into the cipher text.
I would encrypt the records 1-100 again using tags related to organization using KP-ABE scheme. This means that only users of particular organization can decrypt the records.

Decryption

Use private keys associated with KP-ABE scheme first and then CP-ABE scheme to access the data.

I am still learning how to use ABE schemes in real world. I will be happy if someone can validate my thoughts in solving the problem related shared-logs along with RBAC policies.


texts: I'm trying to understand how the AES S-Boxes are calculated. I understand how the multiplicative inverse is calculated over $GF(2^8)$, but I'm confused by the description of the affine transformation. I haven't been able to Google a good explanation of how the S-Box values are calculated. Can someone explain how this works, starting after the calculation of the multiplicative inverse?


texts: What does the $\|$ operation mean in cryptographic notation?

texts:
I am studying elliptic curves problems, which also includes study of related protocols such as ECIES. The problem is that I don't understand the notation $\|$. What does this operation mean?

Some stuff is mentioned on Wikipedia's Integration Encryption Scheme article, but this algorithm is better explained in the book Guide to Elliptic Curves. This operation is mentioned in Alice's 3rd step:

$$ k_E \| k_M = \operatorname{KDF}(S \| S_1) $$


texts: Is this approach to generating a "random" number from a sha512 hash effective?

texts:
I'm looking to run a small raffle but i'd like people to be able to verify that the number chosen was fair. I know some sites use a "Provably Fair" system to achieve this where user input is combined with a secret string which is then hashed to determine the winner. Once the secret string is released, participants can verify using the hash that the correct winner was chosen.

From a sha512 hash a "random" number from 0-n (n varies in length but is 255 at most) should be generated to determine the winner. This is what I thought up:

Creating an array of n length and inserting pairs of characters that can appear in a sha hash. If n was 255 for example, the array would have: array('aa','ab','ac'...'fd','fe','ff'...'97','98','99'). Basically it'd have every combination of two characters using a-f and 0-9.

It'd then look at the first two characters of the hash and use array_search to see if that pair exists in the array. If it does, it's index is the number picked, otherwise it moves over to the next pair of characters and searches those. In the rare scenario it doesn't find a match it'll continually hash itself and use the new hash returned to continue the search.

$values = array('a','b','c','d','e','f','0','1','2','3','4','5','6','7','8','9');
    $numbers = array();
$ENTRANTS = 100;
    $rand =  md5(uniqid(rand(), true));
$hash = hash('sha512',$rand);

$values_index = 0;
    $current = $values[$values_index];
$options = 0;
    while ($options < $ENTRANTS){
     $remaining = ($ENTRANTS - $options > 15)? 16: $ENTRANTS-$options;
     for ($n=0; $n < $remaining ;$n++){
      array_push($numbers, $current . $values[$n]);
      $options++;
    }

    $values_index++;
     $current = $values[$values_index];
}

$outcomes = array();
    $winning = null;
$i = 0;

while (empty($winning)){

    while ($i+1 < 64 && empty($winning)){
        $combo = $hash[$i] . $hash[$i+1];
      $number = array_search($combo,$numbers);
        if ($number !== false){
       $winning = $number;
        }

        $i++;
    }

    if (!empty($winning)){
      echo "
" . print_r($numbers,true) . "
";
      echo $hash . "
" . $winning;
     }
     else {
      echo "re-hashing" . "
";
      $hash = hash("sha512",$hash);
      $i = 0;
    }
}

This is working when tested but I'm unsure if it is effectively generating a random number. Are the characters in a sha512 hash for the most part evenly and unpredictably distributed? If you can see any issues with this or have any advice on how it could be improved please let me know!


texts: The ECC private key is generated with 0x00 at the beginning.(prefix)

texts:
I created a private key using the prime256v1 curve.
My purpose is to get a 32 byte private key.
However, the private key is preceded by 0x00, resulting in 33 bytes.
Why is this happening?
The only space I can use is 32 bytes.


texts: Will changing the RSA Padding in OpenSSL cause issues?

texts: I'm currently looking at changing the padding type from one of the Oracle Padding attacks to a secure one. Would this break data already encrypted using the old method?


texts:
As far as I know finding second preimage of a hash function is almost as hard as finding preimage. But I want to know that is there any way to finding second pseudo preimage faster than brute force? I mean ,for example, in MD5 for a given $h$ (hash) we have  $MD5(IV_1 , P_1) = h $.is there any way to find $(IV_2 , P_2)$ such that $$  MD5(IV_2 , P_2) = MD5(IV_1 , P_1) = h$$ in time complexity less than $2^{128}$?
Also if the answer of question is YES please tell me that if I change the $IV$ , is it possible to modify $P$ to get same hash  in time complexity less than $2^{128}$?


texts: AES-GCM Hash sub key parameter in Intel's IPsec library

texts:
I am trying to use Intel's optimized AES-128-GCM implementation (from the Intel white paper “Fast Multi-buffer IPsec Implementations on Intel Architecture Processors”, you can find the code here).

The aesni_precomp_* functions take an argument described as the “Hash sub key”. I have researched the role of the “sub key” a bit but I can not fathom what value I should pass in as the “Hash sub key”.

How do I get this nebulous “Hash sub key”?


texts:
I have a 64 bit plain-text that i want to encrypt using AES. But to use AES for 64 bit plain text

i can either add padding bits to it
or use AES in CTR stream mode.

My question is

which approach is more efficient?

Is there any other scheme that i can use to encrypt 64 bit data and is as secure as AES.


texts: Is using a broken SHA-1 for password hashing secure?

texts: Recently the hashing collision issue of SHA-1 was discovered. Identical hash values for 2 separate PDF files were generated. Does that make SHA-1 any unsafe for using it only for password hashing?. The probability of two different password to match is still negligible, right?


texts: Is this paper's technique for factoring RSA 2048 with noisy qubits realistic?

texts:
A paper titled How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits has just come out which proposes a technique to factor RSA keys with moduli up to 2048 bits with a design whose assumptions they stress are realistic. What are the implications of this new research?

The abstract of the paper, which lists some of the assumptions:

  We significantly reduce the cost of factoring integers and computing discrete logarithms over finite fields on a quantum computer by combining techniques from Griffiths-Niu 1996, Zalka 2006, Fowler 2012, Eker-Hstad 2017, Eker 2017, Eker 2018, Gidney-Fowler 2019, Gidney 2019. We estimate the approximate cost of our construction using plausible physical assumptions for large-scale superconducting qubit platforms: a planar grid of qubits with nearest-neighbor connectivity, a characteristic physical gate error rate of $10^{−3}$, a surface code cycle time of 1 microsecond, and a reaction time of 10 micro-seconds. We account for factors that are normally ignored such as noise, the need to make repeated attempts, and the spacetime layout of the computation. When factoring 2048 bit RSA integers, our construction's spacetime volume is a hundredfold less than comparable estimates from earlier works (Fowler et al. 2012, Gheorghiu et al. 2019). In the abstract circuit model (which ignores overheads from distillation, routing, and error correction) our construction uses $3n+0.002n\lg n$ logical qubits, $0.3n^3+0.0005n^3\lg n$ Toffolis, and $500n^2+n^2\lg n$ measurement depth to factor $n$-bit RSA integers. We quantify the cryptographic implications of our work, both for RSA and for schemes based on the DLP in finite fields.

How feasible would it be to design a quantum computer with these properties? 20 million qubits is obviously significantly more than any general purpose quantum computer has right now, but the paper also points out that the qubits only need nearest neighbor connectivity, which is much simpler.


texts: Does absence of second pre-image resistance infer absence of pre-image resistance?

texts:
Talking about hash functions, I know the hierarchy is as follows:

Pre-image resistance
Second pre-image resistance
Collision resistance

Where each property implies the one before it so 2nd pre-image resistance implies pre-image resistance.. But is this also true the other way around?

Can we infer from the absence of second pre-image resistance, that there would also be the absence of pre-image resistance?


texts: Complexity of arithmetic in a finite field?

texts: I am wondering what the complexities are of adding/subtracting and muliplying/dividing numbers in a finite field $\mathbb{F}_q$. I need it to understand an article I am reading.


texts: Can a homomorphic encryption scheme be made CCA2 Secure?

texts:
Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure?
From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 security. So, if we use the regular method to convert a CPA secure scheme to CCA2 secure scheme (using a hash of the message and a random value), will it still preserve its homomorphic property?
Please correct me if my understanding is wrong.


texts:
Basic question about XOR and entropy - given a set $S$ of pseudo-random numbers in the range $[0,b]$, will XORing them produce a new pseudo-random number in $[0,b]$ or will the operation decrease the entropy? In the case that some numbers in $S$ not being random. e.g. selected according to some deterministic process - how does this effect the randomness of the XORed result? Would also appreciate links to any relevant math/crypto lit about these kind of problems.

Thanks so much!


texts: Challenge-response based on public-key decryption, why send public key

texts:
Quoting the handbook of applied cryptography, chapter 10.3.3 (i):

Identification based on PK decryption and witness. Consider the following protocol:

$A \leftarrow B: h(r), B, P_A(r,B)$
$A \rightarrow B: r$

(Before “2.”, $A$ verifies that $r' = r$ and $B' = B$)

My questions are:

Why is $B$ needed in the encrypted part and in the plan part? I understand that $h(r)$ is sent as a witness to prevent $A$ from becoming a decryption oracle to $B$. But why is the public key sent? What purpose the verification $B = B'$ serve?

If $B$ has to be sent, could $h(B)$ be sent instead in the encrypted portion (or in both)?


texts:
I have 7 ciphertexts that have been XORed with the same key. I'm writing a program to figure out what the plaintexts are and possibly maybe recover the key.
I have managed to convert the HEX ciphertexts (1-7) into binary and XOR each ciphertext with each other:

C1 XOR (C2...C7)
C2 XOR (C3...C7)
C3 XOR (C4...C7)
C4 XOR (C5...C7)
C5 XOR (C6...C7)
C6 XOR C7

Which in return I get a stream for each operation S(1...21) for which I converted back to HEX.
After getting the streams, I'm not sure what to do next. Knowing that after I XORed the ciphertexts together, I have removed the key from the equation and I am left with m1 XOR m2. But I'm not sure how to use this stream to my advantage as an attacker to recover the messages.
I have even attempted trying something simple on paper but I just don't quite understand it.


texts:
some times when see a problem like : if some G is a PRG then G' is also a PRG.
we prove this by reduction in the following way:
we assume there is a Distinguisher A for G' and we construct distinguisher D for G. and then we prove that the probability that D returns 1 is negligible using out assumption about A.
my questions is : shouldn't we also need to prove that D we constructed works as a real distinguisher for the specific G?


texts: Does failure of indistinguishability of encryptions imply lack of CPA-security?

texts:
Suppose we have an encryption scheme that fails the indistinguishability of encryptions test. That is, given messages $m_0, m_1$ and a ciphertext $c_b = Enc_k(m_b)$, where $b \in \{0, 1\}$, the distinguisher $D$ can extrapolate which message was encrypted. Here $D$ has the advantage of knowledge of what the messages are.

In CPA test however, after observing a set of (plaintext, ciphertext) pairs we are presented with a previously unobserved ciphertext. Our task here is not to distinguish (there is nothing to distinguish from...) but rather to decipher.

My question is, does failure of indistinguishability of encryptions imply lack of CPA-security?


texts: Is there any function that does not suffers birthday problem?

texts: I am eager to know that if there is any function that does not suffer birthday problem and how to prove it formally that the function is not suffering the birthday problem.


texts: In Feistel-Network, there would be a wire-crossing at the end (for the next round). Which insufficiency would occur, if the wire crossing would be omitted?


texts: Why is knowing M not enough to break Blum Blum Shub?

texts:
In Blum Blum Shub, the generator is $x_{n+1}={x_n}^2 \mod M$ where $M=p \cdot q$, $p \in \mathbb P$, and $q \in \mathbb P$. Supposedly, knowing $p$ and $q$ is enough to break the system. But if I know M, I can calculate the next number in the sequence, so there is no need to know the two factors. Why isn't that sufficient?

Update: Since I wasn't think all those times I read about BBS, just ignore the part about directly calculating the next number. Instead, why would knowing the period provide an attacker with any additional information?


texts: Is signing a hash instead of the full data considered secure?

texts:
I reference object in some of my code in hashes. The signature is itself is another object separate from the one I am signing (for obvious reason). I consider simpler to simply sign the reference to my object (its hash), but I wonder if it is considered secure.
Here's a more complete explanation:

A: Is the data object to be hash then signed
H: Is hash(a), the reference to A
S: Is the signature object which contain H and sign(H)
S and A are sent on the network so A can be verified with its signature


texts: One-time pad mistake in the transmission?

texts:
I have a question which arised by analyzing the one-time pad cipher. I encrypt a binary sequence $a_1,a_2,..,a_N$ using a one-time pad with key sequence $k_1,k_2,k_3,...$, so I send $a_1+k_1, a_2+k_2,\dotsc,a_n+k_N$.

Now I make mistake and instead of sending the above sequence I transmit $a_1+k_2,...,a_N+k_{N+1}$. Assuming now that you know that I made this error and that my message makes sense, can you find the message?

Remark: Using a one-time pad means I encipher a message as $b_1b_2\dots b_N$ where $b_j\equiv a_j+k_j \pmod q$ where $q$ is the size of the alphabet, in our case $q=2$.


texts: Possible ways to crack simple hand ciphers?

texts:
We had a quiz in class today where we had to break the ciphertext with the key given, but not the algorithm. Suffice to say that I wasn't able to decrypt it within the allotted time of 12 mins and will probably get a 0% score on the quiz.

So, I was just wondering if there are some kind of standard techniques that are followed when decrypting a simple substitution ciphertext.


texts:
What is the state of the art way when implementing a scheme challenging a party to prove they have access to certain data?

What I'm looking for something along the lines of

Give them (id-some-data, random-data, my public-key).
Request to return the signature of (some-data xor random-data) with my-public-key.
Give them (id-some-data, random-data).
Request to return hash(random-data + some-data)

So basically I'd like to verify if the other party has access to the requested data and prevent them from precalculating the proof of it.

What is the correct name for such schemes in the crypto world?

What would be the theoretical difference between the two schemes above? (other than probably higher "security" of the PubPriv key scheme compared to the hash functions available).

P.S.: I do know better than to implement own crypto ;) The above are just examples to explain what I'm looking for.


texts: Attack MD5 with limited input and partial information

texts:
If I know that MD5 input is limited to a character set. can I find any information on the input based on the output?
example:
input consists of 16 character from list of [1,2,3,4,5].
question:
based on the md5 output is there any way to find out information about the input? I.e. which character was at the beginning or that the input mostly consists of a particular character?


texts: Why is DES secure against differential cryptanalysis

texts:
I was wondering, why DES is secure against Differential Attacks. Some of the S-Boxes have a very bad Differential Uniformity, only one has a DU of 4, 3 have a DU of 6 and the others are much worse.

So is it because of the few good S-Boxes or because of DES uses 8 different S-Boxes?


texts: Is the Keccak family of sponge constructions the same as SHA-3?

texts: I can't seem to come across a clear and to the point answer. Is SHA-3 in the same situation as ElGamal and DSA, where it is modified slightly, or is the original Keccak submission the exact same as NIST standardized SHA-3?


texts: Can you explain what is whitelisting in TLS False Start

texts:
In TLS clinet false start mechanism, the standard says the following:

  The symmetric cipher defined by the cipher suite negotiated in this
  handshake has been whitelisted for use with False Start according to
  the Security Considerations in Section 5.1.
  Reference: rfc7918

Can you explain to me with more details about white listing the ciphers? Is it a list of allowed ciphers stored at the client side? How is this different from the client's ciphersuite list?


texts: Determine Encryption Used by Examining File Headers?

texts:
I have an encryption problem that I hope you might be able to help me with.

I have a bunch of encrypted files.  Some of them were encrypted with mdecrypt.rijndael-256 in PHP and some were encrypted with mdecrypt.tripledes.  A database used to exist that mapped the filename of each encrypted file to the appropriate encryption algorithm used for that file.  That database has long been wiped from the server and now I only have the encrypted files that are either AES or 3DES.  So my question is, is it possible to determine which algorithm was use to encrypt each file by examining a header or something?  An added bonus would be if you could provide a example of how to determine the algorithm using a php script (although that's secondary and I can probably figure that out if I know what to look for).

Thanks.


texts: Skein or Keccak stream cipher construction

texts:
I am wondering if using Skein or the Keccak hash algorithm in this construction (as a stream cipher) is secure:

$H$ = Keccak or Skein hash with a 256 bit output
$K$ = The main 256 bit random key, pre-shared between sender and receiver
$K_M$ = A secondary 256 bit random key for creating the MAC, pre-shared between sender and receiver
$IV$ = A per message 256 bit random initialization vector, sent in the clear with the ciphertext and MAC
$i$ = counter starting at 0 for each message which increments by 1 every 256 bit block
$K_i$ = 256 bit block of the generated key for encrypting the corresponding 256 bit block of the plaintext $P_i$
$P_i$ = 256 bit block of the plaintext. The final plaintext block would be padded to the right with 0 bits, thus the
final concatenated plaintext is a multiple of 256 bits and disguises the true plaintext length.
$C_i$ = 256 bit block of ciphertext
$|$ = concatenation
⊕ = XOR

Encryption:

$K_i$ = $H$($K$ | $IV$ | $i$)
$C_i$ = $K_i$ ⊕ $P_i$

MAC:

$H$($K_M$ | $IV$ | $C_i$ ... $C_n$)

I hope I explained that clearly.

My other question:

Is there a particular attack on using the same key for encryption and MAC?


texts: Is my pseudo-random initialization vector secure?

texts:
How can I know if I am generating a secure pseudorandom initialization vector?

Currently I am planning to generate a pseudo-random initialization Vector using current date and time - is this secure enough?

If the answer depends on the block cipher and mode of operation, I am using OFB mode with AES.


texts: Differences between “NewHope” and “NewHope-simple”

texts:
The well-known paper described a key exchange (KE) scheme named  "NewHope" on USENIX 2016. The authors then proposed  "NewHope-Simple" - a PKE/KEM scheme. They also submitted "NewHope for NIST" -  variation of "NewHope-Simple" to the NIST PQC competition. Can anyone summarize:

Differences between "NewHope" and "NewHope-Simple" (Focus on the rationale, not only compare KE with KEM).
Differences between "NewHope for NIST" and "NewHope-Simple".


texts: I couldn't find any answer providing a high-level overview on what Pedersen commitments are or what they are used for.


texts: Can you tell me why doing scalar multiplication of a point on a Elliptic curve over a finite field gets to a point at infinity?

texts:
I am reading Programming Bitcoin. The author said:

  Another property of scalar multiplication is that at a certain multiple, we get to the point at infinity (remember, the point at infinity is the additive identity or $0$). If we imagine a point $G$ and scalar-multiply until we get the point at infinity.

He doesn't explain why. So I don't understand why. I would like you to give me a plain explanation, without a serious mathematical proof, if that could be possible.


texts:
I am assuming that 2-key 3DES is equivalent to 2DES. I know the key size is 2x56 = 112 bits.

Is this key size the same as the keyspace? e.g. Would the keyspace be 112 bits ($2^{112}$)?


texts: AES vs Blowfish taking key-length into account

texts: I understand that Blowfish is getting old, but is still a secure algorithm, and that AES is very popular, and is recommended by most people.  My question is, how do the two compare when a 256-bit key is used for AES, and a 448-bit key (the maximum according to the standard) is used for Blowfish?  Would Blowfish with a 448-bit key be more resistant to brute-force attacks? Are there any other considerations? (let's assume that we already agree that 256-bit keys are sufficiently resistent to brute-forcing).


texts: Constructing of 16x16 Involutory Binary Matrices of Branch Number 7

texts:
In the PDF  “Algebraic Construction of 16×16 Binary Matrices of Branch Number 7 with One Fixed Point”, it was given that:

Matrix 1h = 1 0 0 0
            0 1 0 0
            0 0 1 0
            0 0 0 1

Matrix 2h = 0 0 0 1
            1 0 0 1
            0 1 0 0
            0 0 1 0

Matrix 4h = 0 0 1 0
            0 0 1 1
            1 0 0 1
            0 1 0 0

Matrix Fh = 1 1 1 1
            1 0 0 0
            1 1 0 0
            1 1 1 0

What are the values of 3h, 5h, 7h, Ah, Eh?