texts:
In CBC mode, the XOR operation is used to combine the previous encrypted block with the current plaintext, to be used as the block to encrypt. Apart from other known disadvantages inherent to the mode itself, usage of XOR creates a collision vulnerability, where if there's a collision in the output, and the plaintext block can be known or guessed, then another plaintext block can be exposed, as noted in this answer: https://crypto.stackexchange.com/a/14325

This is due to the fact that from $E_k(P_i\oplus C_{i-1}) = E_k(P_j\oplus C_{j-1})$, it is immediately obvious that $P_i\oplus C_{i-1} = P_j\oplus C_{j-1}$, and due to the properties of XOR, we have that $P_j = P_i\oplus(C_{i-1}\oplus C_{j-1})$, therefore by XORing the ciphertexts that precede the collision and the guessed/known block, we can obtain the other plaintext block.

Of course, many other operations have that same problem (modular addition or subtraction, for example). Is there any other operation or function that can replace XOR, to make CBC mode not be vulnerable to this flaw?

Edit: To make the question clearer, I'd like to know of a reversible operation/function $\circ$ that takes $P_i$ and $C_{i-1}$ as input, and for which it's computationally infeasible to find $x$ such that $P_i\circ C_{i-1} = x\circ C_{j-1}$ when $P_i$, $C_{i-1}$ and $C_{j-1}$ are known. I guess that some cipher function $F_k(p)$ for which $k$ and $p$ are both the same width where $k = C_{i-1} || secret$ and $p = P_i$ would fit that purpose, but are there other simpler choices?

And while I'm here, is CTR mode safe against this kind of flaw?


texts: RSA - Why should we sign hash rather than raw content?

texts:
Apart from obvious performance considerations, is there any mathematical or crypto reasons that imply that we sign a hash rather than a raw content ?

I read that it was because the hash must fit in the modulo size, but on the reverse when one encrypt with a public key RSA, the "size" doesn't seem to be a problem (ex: I never heard something like "we can't encrypt a file bigger than 256 bytes using a RSA public key").

Apart from performance/optimization, why don't we sign raw byte x509 certificate rather than hash ?


texts: Is Mega.nz encryption vulnerable to brute force cracking by quantum computers?

texts:
I am interested in Mega.nz cloud storage.
It is using end-to-end encryption.
It says that it uses AES-128 to encrypt files
And there are more details in their white paper
But I saw that quantum computers could be dangerous for AES-128:

Grover's algorithm allows brute-forcing an n-bit key in $\mathcal{O}(2^{n/2})$ time instead of the $\mathcal{O}(2^n)$ time required by classical computers. Therefore, an 128-bit AES key could be brute-forced in $O(2^{64})$ time by a sufficiently powerful quantum computer that can do Grover's algorithm with 128+ qubits for $2^{64}$ time.

So, my question is: could the encrypted files be decrypted by quantum computers?


texts: Shamir's Secret Sharing vs. Asmuth-Bloom scheme

texts:
I need to make use of a secret sharing scheme and I don't really know how to decide which one to use, Shamir's or Asmuth-Bloom (using CRT).

The complexity for recovering the secret seems to be linear in both cases and both schemes are perfectly secure.

Can anyone give arguments why we should opt for one over the other?


texts:
Can someone confirm that SSLv2, SSLv3, and TLS have the same Handshake process (ClientHello/ServerHello, ..., ClientKeyExchange ...)?

If not, can you tell me the main differences between theses three protocols?

I am asking this because, as you can see in the image below, I can see ClientMasterKey (SSLv2) instead of ClientKeyExhange(TLS1.2).
ClientKeyExhange must contains the Premaster secret, and I have never seen ClientMasterKey in handshake process.


texts: Lets say that I am using 128 bit HMAC. How many operations are needed to find a "non secure" message. Is a birthday attack possible?


texts: Maximum Distance Separable (MDS) Matrices are used for providing diffusion in a cipher. How to test the strength (with respect to cryptographic properties) of an MDS matrix used in a cipher?


texts: What is keyId in Signal Protocol JavaScript library?

texts:
I'm trying to implement the Signal Protocol JavaScript library for a school project. On this page, the generatePreKey function takes as parameter a keyId. I can't find what that is in the specifications. Can somebody tell me where do I have to get it from or if it's just a random number I have to generate myself?
KeyHelper.generatePreKey(keyId).then(function(preKey) {
    store.storePreKey(preKey.keyId, preKey.keyPair);
});


texts:
What is the difference between Google's API-Key, OAuth Client ID and AWS Secure Token Service?

Are they are all just providing delegation tokens, except they are from different companies? Is there a bigger difference between them?


texts: Simplified ECC non-point public key example, how it works

texts:
I know that ECC public key is in fact point on curve calculated by $(x,y) = k \times G$ , while $k$ is random and $G$ is the base point, it performs "Point addition" which involves some math behind.

However, in many ECC examples, take this as example:

domain parameters $(p, q, g)$ and private/public key pair $(b, g^b \bmod p)$

The generation of the public key is simplified to power of base point $g^b$, yet it works perfectly well for the example. Im puzzled by how a $(x,y)$ 2-dimensional public key can be reduced to 1-dimensional and still work?


texts: Some Question about Security Proof of authenticated identity-based encryption

texts:
In authenticated identity-based encryption by Benn Lynn, in proof of security, I have a little difficulties in understanding.
In key extraction queries,if attacker request for guessed ID, then B fails. I think this is because B cannot generate private key for guessed ID.
 When attacker challenges messages M0,M1 and two identities, if identities are not guessed ID, then B fails.In this scenario, I think B cannot encrypt for guessed ID as it does not know private key. However, here, it fails when identities are not guessed ID.
Please guide me correct thinking.


texts:
In this paper (Section 2.3.1, Pg.5), I came across the left_encode and right_encode functions, and I have some questions about the functions:

What is meant by the base256 encoding of an integer?
Do $x_1,x_2,\ldots,x_n$ all contain the same bytes, or do they contain different bytes split across them?
Does enc8 effectively mean little-endian?
After theenc8 bytes are concatenated, are they transformed back into a number or binary or...?


texts: Is non-adaptive CPA strictly weaker than standard CPA security?

texts:
Today during a cryptography lecture an interesting question came up: Whether non-adaptive CPA security is equivalent to adaptive (FtG / LOR) CPA security.

Now for a short description of what this CPA1 / non-adaptive definition means:

The challenger generates a key $k\gets \operatorname{Gen}(1^n)$
The stateful adversary $\mathcal A$ is initially run on $1^n$ with access to $\operatorname{Enc}_k(\cdot)$ and outputs two equal-length messages $(m_0,m_1)$
A bit $b$ is chosen uniformly at random and $c_b=\operatorname{Enc}_k(m_b)$ is computed
The adversary $\mathcal A$ is resumed / run on $c_b$ and $1^n$ but not given access to $\operatorname{Enc}_k$ and has to output a bit $b'$
$\mathcal A$ wins iff $b=b'$

You may recognize this definition to be the standard Find-Then-Guess CPA definition with access to the encryption oracle removed after the challenge messages are output. So the adversary can use the encryption oracle to find the challenge messages but can't use it on any function of the challenge ciphertext.

So:
Is there an encryption scheme that is CPA1 but not CPA secure?

Intuitively it feels like this definition is weaker because encryption queries cannot depend on the challenge ciphertext but I currently see no way to exploit this such that CPA1 security is still preserved.

I know this is true for CCA because we know NM-CCA1 $\implies$ IND-CCA1 and IND-CCA2 $\implies$ NM-CCA2 but NM-CCA1 $\implies$ NM-CCA2 doesn't hold.
I also know that CPA1 security is stronger than eavesdropping security because deterministic schemes can be broken by querying the encryption oracle before the challenge query.


texts: How RSA-OAEP decrypt a Symmetric Key message?

texts: In an RSA-OAEP encrypted symmetric Key (AES for example) message. The message is then decrypted by the other party when R is a Random Number That other party doesn't know about. so How it can retrieve back the key when it's XORed with A Hash (hash1) That it doesn't know. I don't think that output of Hash2 helps with anything. Right?


texts: What is SHA-256 in Conjunctive Normal Form?

texts: What is the conjunctive normal form (CNF) representation of $\text{SHA-256}(m)=h$, where $m$ is of fixed (or bounded) size and $h$ is 256 bit?


texts: AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

texts:
Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense.
Context: I'm doing some crypto as a service for embedded devices. Users of this service don't have access to any key. They're only able to tell the device "use the key <index> to encrypt/decrypt this".
According to the NIST (Chapter 7.2), when decrypting a cipher using AES GCM, if the tag is wrong, the cipher should not be returned :

if they are identical, then the plaintext is returned; otherwise, FAIL is returned

This raises two questions.
First: how bad is it to return the wrong plaintext anyway? (but still returning an error, it would be up to the user to check it). Is there any mathematical reason for that? Could an attacker somehow leak the key by trying to decrypt forged ciphers?
Second: if the answer to the first question happens to be "it doesn't matter whether you return the wrong plain or not" then this is not an issue anymore. But otherwise: our AES driver is written in C, how can we prevent the cipher from being returned in case the tag is wrong? As far as I understand, to compute the tag the decryption process must be done entirely. The thing is the destination buffer of the decrypted cipher is a shared memory a potential attacker could have access to. Having a temporary buffer to store the resulting plaintext in order to compute the tag is not considered as it would not fit the device memory.


texts: How to understand "homomorphically decrypting" in bootstrapping?

texts:
I come across the following explanation of bootstrapping in this tutorial:

  Once the “noise” in a ciphertext grows too large it is no longer able to be decrypted properly. Bootstrapping solves this problem. It does so by homomorphically decrypting the ciphertext, performing a single computation on it, and then recrypting under a different public key.

What is the meaning of homomorphically decrypting? Does it mean decrypt to the plaintext first then recrypt again?


texts:
I'm new to DDH.
Reading this survey, I noticed that DDH is (believed to be) hard in many groups, but most of them are prime-order groups (the only one that is not is the cyclic subgroup of order $(p-1)(q-1)$ of the group of integers modulo $N = pq$).
My question is about the hardness of DDH in this specific composite-order group:

  Let $q$ be a prime such that $p = 4q+1$ is a prime. Is DDH hard in the subgroup of order $2q$ of $\Bbb Z_{p}^\ast$?

Note about this group: My algebra background is fairly basic and I don't even know if this group is guaranteed to exist, and if so, if it guaranteed to be cyclic.


texts:
So if I want to encrypt all the files in a folder with AES (same password) I take each file and generate the key schedule using PBKDF2. As the PBKDF2 algorithm takes in a salt then this salt should change (and thus the keyschedule) for each new file being encrypted. Now if I want to decrypt then I load the plaintext salt and generate the different key schedule for each ciphertext file.

Is this correct? If so the problem I'm seeing is that the recommended number of iterations to make the encryption more secure (0.5 seconds e.g.) will considerably slow down the encryption process as each file requires a lengthy key derivation procedure. Is this just a necessary part of a secure encryption process?

Thanks!


texts: What is difference between Zero Knowledge proof and Zero Knowledge Proof of Knowledge?

texts:
In a zero knowledge proof, a prover interactively proves to a verifier that an NP statement is true. If the language is an NP complete language and if the prover runs in poly time, the only way a prover could make such a proof is when it has a witness. So, when a prover provides a ZK proof for an NP complete statement, the prover is proving he has knowledge of a satisfying witness.

So, what is a Zero knowledge proof of knowledge? How is it different from Zero knowledge?


texts: RSA encryption and decryption not resulting to the correct result?

texts:
I'm having a hard time creating a functioning RSA algorithm for some reason even though I have all the steps right (or at least I think I do). So I have the following :

I picked prime numbers, $p$ and $q$ as:

$$p = 13691$$
$$q = 29387$$

I picked $n$ as $p \cdot q$
$$n = 402337417$$

So
$$\phi(n) = 402294340$$

I picked a random $e$ between $1$ and $\phi(n)$
$e = 46117$

My message was
$M=3$

I got $d$ by the Extended Euclidean Algorithm as the following:
$d= 7795$

When I do the encryption using $M^e \,\text{mod}\, n$ I get: $c= 399797630$

When I do the decryption using $C^d \,\text{mod}\, n$, I get $243069037$, which is not $M = 3$?

Any idea what can be the reason behind this? My guess is that $d$ is incorrect.


texts: Enforced complete decryption in pki schema

texts:
I want to use PKI to encrypt a message. How this generally done is to PKI encrypt an AES key and then encrypt the message. The problem(in my case) with this method is that you can also ask someone to just decrypt the key.
The reason this is a problem is because I want to encrypt something and give a package to person A that then can give it to person B but person A should not learn it's content.
Now I can do a block-wise PKI encryption and each block add the hash/MAC of the previously encrypted block. The most important information would be the last block (the first block(s) contains contact information in case of malicious use of the data, I want to make sure person B gets this info, so partial decryption must be impossible)
My question is, is there already an existing scheme that supports this?


texts: Plaintext formation for checking avalanche effect

texts:
I have developed an encryption algorithm. Now i want to check avalanche effect by making one bit change in plaintext and observing how many bits are changing in ciphertext. But my doubt is "what is one bit change in plaintext" say for e.g
if plaintext P1= 11223344 then do we mean one bit change as
             P2= 11229344


texts: Is my password entropy calculation correct?

texts:
I have a password with a prescribed format:

111 + (2 Random lowercase letters) + (random digit)

As you can see, it starts with a fixed value of 111, followed by two random lower case letters, and then lastly a random digit. Now, I would like to calculate the password entropy. To do so, I am calculating:

Fixed value 111  $\rightarrow \log_2(1) = 0\text{ bits}$
Two random lowercase letters $\rightarrow \log_2(26)\times2 = 9.4\text{ bits}$
One random digit $\rightarrow \log_2(10) = 3.3\text{ bits}$

This results in a total password entropy of $0 + 9.4 + 3.3 \text{ bits} = 12.7\text{ bits}$

Is this approach to calculate the password entropy correct, or am I missing something somewhere?


texts: How to pad a 448 bit message for SHA256?

texts:
I recently implemented a very simple SHA256 hashing program in C++, since the SHA256 hash function's block size is 512 bits or 64 bytes, and messages less than that size have to be padded as per the FIPS standard, I implemented a padding function following their exact rules.

$(K+1+L) = 448 \mod 512 $ , where $K$ is the number of $0$ bits that should be appended after the $1$ bit, previously appended to the message.

I was testing my code with test vectors that I received from this website : https://www.di-mgt.com.au/sha_testvectors.html

and unfortunately it failed for the test vector of 448 bits:
abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq
but worked well for the previous test vectors.
Here is a simple snippet of C++ code that I made which is responsible for padding, obviously, there is an algorithmic flaw in it out of my misunderstanding!

int blocks = 0;
if (len % 64) // len is the message length
{
    blocks = (len + (64 - (len % 64))) / 64;
}
else
{
    // I realized (the hard way) that messages that are of size 512 bits or its multiples have an additional block that contains padding info and they run through the compression function.
    blocks = (len / 64) + 1;
}
unsigned char *s = (unsigned char *)calloc(blocks * 64, sizeof(unsigned char)); // Internal storage for the message with padding.
for (int i = 0; i < len; i++)
{
    s[i] = m[i]; // m is the message passed to the function, that has to be hashed.
}
int K = 0;
uint64_t L = len * 8;
uint64_t size = L;

K = (448 - L - 1) % 512;
if (K < 0)
{
    K += 512;
}

s[len] = 0b10000000; // or 0x80
K -= 7;
for (int i = 0; i < (K / 8); i++)
{
    s[i + len + 1] = 0; // The zero bytes...
}
    // Append the length of the message as a 64 bit big endian integer
for (int i = 0; i < 8; i++)
{
    s[blocks * 64 - 1 - i] = (unsigned char)(((uint64_t)size & (uint64_t)(0xff << i * 8)) >> 8 * i);
}

I would like to create a padding method that conforms to the FIPS standard for any bit length whatsoever...
I realize that with a message of length 448 bits, my padding will overflow to the other block.
Should the other block be padded in the same way a message would be padded?
What changes should I make in the algorithm to fit all message lengths?


texts: Again on discrete gaussians over lattices

texts:
Define
$$\rho_{s,c}(x) = exp(-\pi \cdot \frac{\|x - c\|^2}{s^2})$$
and
$$\rho_{s,c}(L) = \sum_{x \in L} \rho_{s,c}(x)$$

Then Discrete Gaussian over $L$ with center $c$ and standard deviation $s$ is the following distribution over lattice points: probability of $v \in L$ equals:

$$ \mathbb{P}[v] = \frac{\rho_{s,c}(v)}{\rho_{s,c}(L)}$$

Some questions about this distribution:

What are the properties? For instance, is it true that the sum of two discrete gaussians is equal to (stat. close to) another discrete gaussian (as in usual multivariate gaussians)?
Why discrete gaussians? It is known that this distribution is NOT statistically close to usual normal with rounding. But when somebody start giving a motivation behind discrete gaussians, they usually refer to the fact that USUAL multivariate gaussian is statistically close to uniform modulo small parallelopipeds. But what makes discrete gaussian so attractive? Are there any properties that it "inherits" from usual gaussian?

Is it possible to replace discrete gaussian with another spherical-symmetric "factorable" distribution, maybe something like multivariate binomial over "big enough" support? What would be broken? Would it leak some information about basis?


texts: How to prove that a commitment hides the decryption of an ElGamal ciphertext?

texts:
I've decided to remove a previous unanswered question of mine and break it down into smaller pieces so it's not such a loaded question.

For this question I need to prove that I've committed to a number, and that same number is the plaintext of some ElGamal ciphertext, without opening the commitment or decrypting the ciphertext. I have a start, as in I know a proof that is supposed to work, but I need some help.

Definitions

I have standard ElGamal encryption wherein plaintext $v$ is encrypted as $u$ as follows: $$E(v)=u=(y_{1},y_{2})=(\alpha^{r},v\beta^{r}) \mod p$$ where $p$ is a safe prime $p=2q+1$, $q$ is also a large prime, and $r \in _{R}\mathbb{Z}_{p}$.

I also have a commitment scheme that is very similar to Pedersen commitment, called Fujisaki-Okamoto commitment. Given large safe primes $p^{\prime}$ and $q$, $N=p^{\prime}q$; public elements $g$ and $h$ are both generators in $G$, a large cyclic subgroup of $\mathbb{Z}^{*}_{N}$ (such that $\log_{g}h$ and $\log_{h}g$ are intractable). I commit to $v$ with $$C=g^{v}h^{r^{\prime}}\mod N$$ where $r^{\prime} \in _{R}\mathbb{Z}_{N}$.

Problem

I need to prove that $v$ is encrypted in $u$ and committed in $C$. My understanding based on what I'm trying to implement is that I need to prove knowledge of $v$, $r$, and $r^{\prime}$ such that $$y_{1}=\alpha^{r} \mod p$$ $$y_{2}=v\beta^{r} \mod p$$ $$ C=g^{v}h^{r^{\prime}} \mod N$$

I know that Markus Stadler has a proof of verifiable encryption of discrete logarithms in Publicly Verifiable Secret Sharing §3.3. This uses a double discrete logarithm proof to show that a ciphertext $u=(y_{1},y_{2})$ encrypts the discrete logarithm of a public element $V=g^v$. The protocol I am trying to implement says this proof will work, but it does not tell me how to use it in this context, just that I can. It seems straightforward to me except for two things, which I've listed in order of importance:

I don't just have some public element $V=g^v$. I have a public element $C=g^{v}h^{r^{\prime}}=Vh^{r^{\prime}}$. This product, obviously vital to the commitment scheme, seems to make it so that I can't use Stadler's PVSS scheme. But the paper insists that it works, so I'm obviously just missing something.
In Stadler's paper he defines ElGamal encryption as $(\alpha^{r},v^{-1}\beta^{r})$ rather than $(\alpha^{r},v\beta^{r})$. I've never seen it done this way and the protocol I'm implementing does it the normal way. But Stadler's proof seems to depend on that modular inverse. Can I use this proof without changing the encryption scheme?


texts: How strong is XOR encryption of 256 bit plain text with 256 bit key?

texts: I was wondering if we take just 256 bits of plain text and simply XOR  every bit with a 256 bit key, how strong can it be ?


texts: How secure is Argon2ID with minimal parameters?

texts:
I am trying to make the login page faster by using low ram

$hash = sodium_crypto_pwhash_str($password.$MAC, 1, 10240);

My question is that I dont like login page taking too long to process like one second and if I make it faster by using minimum parameters does it make it insecure? I am using a very long MAC to make it harder to brute force but extremely fast.

Average time 0.0001368522644043 ms


texts:
I want to make a Diffie Hellman key exchange code using Python, but I'm afraid of just randomly picking $g$.

I read on the answer of Thomas Pornin to this question How does one calculate a primitive root for Diffie-Hellman?, that if you use a strong prime, then every number on the group (except $1$ and $p-1$) would have an order of either $p-1$ or $\frac{p-1}{2}$, but I can't find anywhere online a list of big strong primes to use. Anyone knows where can I find one?

Edit: thanks for the generous help of fgrieu I realized I am looking for safe primes, and not strong primes.


texts: What are the exceptions to Kerckhoffs's principle?

texts:
Kerckhoffs's principle:  A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

Yet the following are three exceptions:-

NSA Suite A cryptographic algorithms.  There is an answer here that implies that the Suite B algorithms are broken therefore can be published so that the NSA can listen in on Suite B users. And by not publishing Suite A, no one knows for sure instead relying on security through obscurity.
Banks holding my money.  They haven't published a security architecture diagram of their network, and probably wouldn't tell me over the phone how they've implemented AES.  Perhaps they use ECB mode or even their own Barclay's mode. Banks are civilian organisations, not military like example 1.  They're regulated yes, but (even redacted)  security reports are not published.
Windows' Cryptography API.  This is used by some people and they unknowingly might be using the dodgy  Dual_EC_DRBG, or something even more decrepit.  There is no code audit available to prove any particular mode of operation or algorithm. This particular API could easily be published to assuage users fears without revealing the rest of Windows' internals.

It seems to me that whilst Kerckhoff sounds plausible, many organisations ignore it.  And get away with it.  What are the real world exceptions or rules? Does it for example only apply to amateur cryptography?


texts: How should I address message size limits in RSA encryption?

texts:
I am making an end-to-end encryption software program in Java using RSA. I am using BigIntegers and its number theory methods. (I know this is a very slow approach, but I just want to learn to the concept of encryption through this). I have a lot of questions, feel free to only answer as many as you'd like.
I have most of the encryption done already but I have questions about the size limitations of RSA and its technical details.
Say I generate primes p and q for my RSA which are of bit length 256 and 257.
According to my intuition on the number theory behind it (using modulus) and a lot of test cases, I should be able to safely encrypt and decrypt any number with bit lengths L < 513 (256+257) without losing information. Is this correct and will work 100% of the time? Also if L happens to be a 5-bit number, its encrypted version will still be around ~512 bits long?

I want to abstract my BigInteger (Java class) encryption to encrypting any byte[] of data. My plan is to split the byte[] into 512-bit (64-byte) chunks and encrypt those chunks by converting them to a BigInteger and then encrypting them. Is this a good idea? How is it done in industry?

Should I make the bit length of p and q smaller/larger and make the encryption chunks size smaller/larger to optimize performance?

Also, after I encrypt a number, the encrypted version ranges anywhere between 0 and 512 bits. How should I added padding to this byte[], in order to keep them of uniform size, for easy decrypting? Should I just add 0's to the most significant bit side and pad until it is always 512 bits?

Thank you so much for the help in advance!


texts: What are the differences between plain and encrypted private keys?

texts:
It seems like there are different kind of private key formats, namely:

PKCS#5 plain private key
PKCS#8 plain private key
PKCS#5 encrypted private key
PKCS#8 encrypted private key

I have seen these names of keys thrown around in articles and answers I read while searching.
What're the differences between these keys formats? Which one should I know I should use?
And is the encrypted private key actually more secure than the plain version of private key?


texts: Why need mapping to slots to embed bytes in AES-homomorphic encryption?

texts:
The encoding of each AES bytes $_$ is using CRT(Chinese remainder theorem). It means that there is an aggregate plaintext $H$ such that:

$H \mod F_0 =_0(MappingData[0])$
$H \mod F_1 =_1(MappingData[1])$

...
$H \mod F_{15} =_{15}(MappingData[15])$

It uses the $MappingData$ to map between $GF(2^8)$ representation and representation relative to the slot polynomials $GF(2^{16})$ (or bigger).
Since each $_$ is an element of $GF(2^8)$, embedded into a slot of bigger $GF(2^{16})$, why do we need to map them instead of just putting them into the slots?

Furthermore, if there is a mapping $H(X) \rightarrow H(X^i)$ and the elements in the slots rotate, will the position of $MappingData[i]$ inside a byte $_j$ unchanged?

Like

$H \mod F_0 =_5(MappingData[0])$
$H \mod F_1 =_6(MappingData[1])$

...
$H \mod F_{15} =_4(MappingData[15])$


texts: Is it secure to use so many iterations of AES-CBC as a KDF so that it's slow even using AES-NI?

texts:
Note: This is not the same as Multiple iterations of AES for key derivation?.

Almost everyone has AES-NI nowadays - when building a cryptographic application, is is possible to leverage this to create a kdf that is about as slow for the attacker to attempt a single key on a single CPU as it is for the user to derive one key?

Also, is it possible to feed the last block of AES-CBC as the key of the next round of encryption over the rest of the ciphertext to make it memory-hard, and avoid encrypt-one-block-at-a-time-many-times attacks, as the entire ciphertext needs to be in memory?

Essentially, key derivation would work something like this, just a lot more times:


texts: Is $F'_k(x) = F_k(x) \oplus k$ a pseudo random function?

texts:
Let $F_k$ be a pseudo random function.
Is $F'_k(x) = F_k(x) \oplus k$ necessarily a pseudo random function?

I think that it is a PRF, but I just can't find a reduction that works with it.


texts: Are post-quantum cryptographic ciphers *also* secure if the P=NP conjecture holds true?

texts:
First of all, I only understand the P versus NP debate on a rather shallow level as I am not a computer scientist. So perhaps the answer to the question is straightforward but if not, I would be interested to know more.
I believe the consensus amongst computer scientists, complexity theorists, and programmers today is inclined more towards P $\neq$ NP than the equality. Nonetheless, I also find that the Internet is rife with doomsday pictures if

the P = NP conjecture were indeed proven true, or/and
large scale quantum computers (running Shor's algorithm) do become a reality.

To tackle the 2nd problem, the field of post-quantum cryptography has been developing ciphers that are resistant to cryptanalysis by Shor's algorithm and variants. However, I have not been able to find any convincing answer to the question: Do the post-quantum ciphers also address the 1st problem?
As such, I checked the elementary description of a few ciphers, e.g., the McEliece cryptosystem, which is explored under the banner of post-quantum cryptography. Some of them are apparently based on NP-hard problems (such as the shortest vector problem) which mean that these ciphers won't become vulnerable (even in theory) even if the P =NP conjecture holds true. But is that the also case with all current as well as future post-quantum cryptographic mechanisms?


texts: What's the main difference between Pohlig-Hellman and RSA?

texts:
Both Pohlig-Hellman and RSA perform encryption and decryption by exponentiation modulo some integer ($p$ prime for PH, $n$ composite for RSA). They both use a key $e$ as the exponent to encrypt a message. They both use the inverse element of key $e$ to decrypt. In both, the encryption key $e$ can be a randomly chosen integer coprime with $p-1=\phi(p)$ (for PH) or $\phi(n)$ (for RSA).

So what's the main difference between Pohlig-Hellman and RSA?

Note: The question has been edited for accuracy and more standard notations.


texts: For two LUKS volumes made with the same password, can stealing the encryption key from one volume allow access to the other?

texts:
A running computer has two LUKS volumes that were made with the same password. One volume is open (key is in RAM), the other is closed.

If the running computer is stolen, is the closed volume safe?

If sha256 is broken, is the closed volume safe?


texts: Cryptographic notation in X3DH Key Agreement Protocol

texts:
Can someone please explain the below paragraphs from section 2.2 in The X3DH Key Agreement Protocol? Please try to explain the whole paragraphs.

1st paragraph:
I want to understand how the DH function is working? How is it calculating the shared secret key using public keys?

  DH(PK1, PK2) represents a byte sequence which is the shared secret
  output from an Elliptic Curve Diffie-Hellman function involving the
  key pairs represented by public keys PK1 and PK2. The Elliptic Curve
  Diffie-Hellman function will be either the X25519 or X448 function
  from [1], depending on the curve parameter.

2nd paragraph: In the first point $F$ is used to identify the type of curve, right? What is the secret key material here? What is the use of HKDF info?

  KDF(KM) represents 32 bytes of output from the HKDF algorithm [3] with
  inputs:

  1) HKDF input key material = F || KM, where KM is an input byte sequence containing secret key material, and F is a byte sequence
  containing 32 0xFF bytes if curve is X25519, and 57 0xFF bytes if
  curve is X448. F is used for cryptographic domain separation with
  XEdDSA [2].

  2) HKDF salt = A zero-filled byte sequence with length equal to the hash output length.

  3) HKDF info = The info parameter from Section 2.1.


texts: Why is H(k || m || k) secure against birthday attack?

texts:
I don't know if my opinion is correct. I think that H(k || m || k) (I mean using Merkle and Damgard algorithm where k is a secret key shared by two parties and m is the message sent) is a good keyed hash function with respect to birthday attack because:

if the attacker finds another message m' different from m such that h(m') = h(m) this doesn't guarantee that the prefix of m' is equal to the prefix of m, so with high probability H(k || m' || k) will be very different from H(k || m || k).
if the attacker wants to append extra bits to H(k || m || k) and compute another step of Merkle and Damgard algorithm he/she can't because he/she doesn't know the last block (that is the key), he/she only knows message blocks sent during the communication.
if the attacker finds with birthday attack a message m' such that h(m') = h(k || m || k), he/she cannot verify if that authentication tag is correct because he/she doesn't know the key k. So the attacker to find a message m' such that h(m') = h(k || m || k) generates all possible hashes (considering the rule of birthday bound) in order to find the same value of H(k || m || k).

I'm not sure about this statements, above all the third.
Can anyone confirm me the correctness of this statements and eventually explain me possible mistakes? Thanks!


texts: I just need to know is it correct to classify the RSASSAPSS scheme and sha[256 | 512 | 1]WithRSAEncryption all under RSA signature?


texts: if using cbc+hmac dealing with small size of data(less than 128bit) , will it cause any problem?

texts: if use AES-cbc,HMAC-SHA256, and there is some txt needed to be enc, and I divide this txt into small packages with variable length, then enc them. some of these package can be less than 128bit. Is this still secure? will it cause any problem?


texts: Double hashing can surely provide more security than only one layer of hashing but does that necessarily mean it is more collision resistant? This question in a more mathematical form: If $H$ is a collision resistant hash function, is $H\circ H\colon\;x\mapsto H(H(x))$ still collision resistant?


texts:
I've been reading up on Argon2 (and, to a lesser extent, other recent password hashers). I'm trying to understand why it won the competition versus the other finalists, like Catena, Lyra2, Makwa or Yescrypt.

Unfortunately, I don't see much technical discussion on the competition's website. It does link to the mailing list archives, but I can't find the actual mailing list there (although I haven't tried the NNTP option, since I don't have an NNTP client) due to some broken links. I'm unclear if that's a temporary problem, or a permanent one.

I have two closely-related questions, either of which I would be grateful for insight on:

I've been proceeding under the belief that PHC is a well-regarded and competently run competition that is considered to have advanced the state of the art in password hashing. Was there any notable controversy surrounding it, e.g. serious concerns with the panel, submission or winner selection processes?
What were the key factors that led to Argon2 being declared the winner by the PHC panel, compared to the other finalists?


texts: How to obtain 256-bit security from Ed25519?

texts:
It is said that breaking Ed25519 has similar difficulty to breaking RSA with ~3000-bit keys" 1

When using RSA, I prefer 4096-bit keys, but I would like to use Ed25519.

If I wanted to double the security level - similar to RSA with ~6000 bits - what are my options?

Do we have to wait for a new standard to be published?

Could we easily hack libsodium/nacl in the mean time?


texts: Forgery against signature using RSAES-PKCS1-v1_5 padding

texts:
I wonder what is the security of RSAES-PKCS1-v1_5 under chosen-plaintext attack, in the context of signature verification.

Notations. Let $(N,d)$ be an RSA signing key, and $(N,e)$ the corresponding verification key, with no assumption on $e$ (in particular, I don't assume $e=3$ and consider the general case $e=2^{16}+1$). Let $n$ be the bit-size of $N$.

More specifically, assume that one produces a signature $s$ for a short message $m$ using RSAES-PKCS1-v1_5 padding (bad practice):
$$
s = pad(m)^d \bmod{N},
$$
where

pad(m) = 00 || 02 || R || 00 || m

and R contains 8 or more nonzero bytes to make $pad(m)$ as long as the byte-length of $N$. (Note: unlike RSASSA-PKCS1-v1_5, the bytes in R are not fixed to FF.) Also here, the message is not hashed.

I wonder whether universal forgery is possible with only oracle access to the verification oracle $O(s)$, which returns $m$ if $s^e \bmod{N}$ corresponds to a valid padded message, and returns an error otherwise.

In an answer, Thomas Pornin writes that this "type 2" padding yields a weak signature scheme due to malleability of modular exponentiation. I understand that "type 1" (RSASSA-PKCS1-v1_5) is for digital signatures and "type 2" (RSAES-PKCS1-v1_5) for encryption, yet I don't see how malleability can be applied here to break the security.

Side question. In another answer poncho wrote that if $x^3 = h \bmod{2^{k}}$, then $y^3 = h \bmod{2^{k+1}}$ for $y=x$ or $y=x+2^k$. Hence here, given a target message $m$, is it easy to construct $s'$ such that $s'^e = m \bmod{2^{n+1}}$ for $n$-bit $N$. Which means that there exists $t$ such that $s'^e = m + t\cdot 2^{n+1}$. The integers $s'$ and $t$ are easily, but can they be leveraged to deduce $s$ such that $s^e = m \bmod{N}$?


texts: Sites to find crypto intermediate values

texts:
Does anyone know of any sites where intermediate values of multiple crypto algorithms (not just the famous ones), including hashes, can be found? I don't just mean intermediate values of encrypting. I'm also looking for intermediate values of the key generation algorithms as well. Hopefully, the initial values can be changed, or at least are not just strings of 0's, since many algorithms use little endian notation, which doesn't appear in strings of 0's.

The previous sentence means:

The mars cipher works with little endian values. In ibms's test vectors, the values are 0000000000000.... so when I input my key into mars, I get {0,0,0,...,0}. Fine.

Now if the test vector were 1234..., now what happens? If there are intermediate values for the key/encrypt/decrypt algorithms, I would know if the test vector were already in little endian, or if I have to change it to ... 34 12?


texts: The security of data traffic over both SSTP & SSL

texts:
Suppose you're connected to a VPN server via an SSTP VPN, and then you're trying to sign in to your webmail account that is already secured with an SSL certificate, e.g. hushmail.com.

However, it seems your original data traffic is double-encrypted by both SSTP & SSL. Now suppose that for any reason your SSTP connection is hijacked and decrypted by a third party, e.g. the attacker stole your SSTP password or your SSTP-signed certificate is a fake one.

My question is: does the ability to decrypt the SSTP traffic pose any threat to the security of your email communication? I mean, does this hijacking of SSTP lead to decrypting the SSL traffic of your email?


texts: Security proof in pairing based cryptography

texts:
Let :

$G_{0}$ and $G_{1}$ be two multiplicative cyclic groups of prime order $p$,  $g$ be a generator of $G_{0}$ and $e$ be a bilinear map,

$e : G_0 \times G_0 → G_1$

and let $_{1} = ^{_{1}} $, $ _{2} = ^{_{2}} $ , ... , $ _{}= ^{_{}} $;
$ =^{(+)/} $

such that $\alpha, \beta, r, s_{1}, s_{2}, ..., s_{n} \in Z_{p}$

Given $s_{x} \in Z_{p}$ ($x \neq i, i=1, ..., n$), and knowing $e\left( C_{1}, D\right), e\left( C_{2}, D\right), ..., e\left( C_{n}, D\right)$. I would like to know if it is possible to compute the value of $e(C_{x},D)$ and/or $D$.

Secret elements: $D$, $e(C_{x},D)$.

Public elements: $_{1}$, $_{2}$, ..., $_{n}$, $_{x}$, $e(C_{1},D)$, $e(C_{2},D)$, ..., $e(C_{n},D)$.

If it is not possible, how to prove that?


texts:
i'm new to cryptography so i feel sorry for this newbie question!
Can anyone tell me how Vigenère work with sorted order?
For example i have this in my book:

LADY(KEY)
3124(SORTED ORDER)
312431243(REPEATED KEY)
PLAINTEXT(PLAINTEXT)
SMCMOUGBW(CIPHERTEXT)

Can you tell me how we get this number(3124) and ciphertext from this key(LADY)?


texts: How can I create a stream cipher from a block cipher?

texts: Assuming $k$ is the key (128 bit) and $m$ is the message (128 bit), how can I use the block cipher $blockenc(k,m)$ to make a stream cipher which can produce quintillion pseudo-random bits?


texts:
I read a Shamir secret sharing notes where it mentioned the security flaws of PSS(Proactive Security Sharing) when only one server is responsible for generating $h(x)$.
To give the question a bit context, I try to rephrase the scheme it mentioned as follows:

Consider a (n, t) Shamir secret sharing scheme with the following form
$$f(x)=a_{t-1}x^{t-1}+a_{t-2}x^{t-2}+\cdots+a_1x+s$$
To prevent an adversary from compromising $t$ servers over time, we need to periodically invoke PSS to refresh $s_i(i\in N_t)$. We ask a server to periodically generate a random function
$$h(x)=b_{t-1}x^{t-1}+b_{t-2}x^{t-2}+\cdots+b_1x$$
and calculate $h(i), i\in N_t$, it then sends $h(i)$ to i-th server and ask it to update its secret according to:
$$s'_i=s_i+h(i)$$
After every server updates its secret, PSS completes.

The notes claim that this scheme has security flaws.
Here is what it says:

However, this extension has a severe security flaw.
In cases where t > 2, it is not enough to let only one server select h(x): if the server that picks h(x) is compromised during PSS, then the adversary may know the relationship between new shares and old shares.
More precisely, the knowledge of h(x) may enable the adversary to figure out si from si', even if si has been deleted.
For example, consider a (5,3) sharing. Assume that server 1 (who selects h(x)) is compromised before PSS, and server 3 after.
The adversary knows shares s1 (s1'), s2, and s3'.
Moreover, the adversary can find out s2' from s2 (s2' = f'(2) = f(2) + h(2) = s2 + h(2)).
Then, the adversary has s1', s2', and s3', and consequently, s, even though less than 3 servers are compromised from the start of a PSS to the end of the next PSS.

My question is:
Why would the adversary know s2, given that it has only compromised server1 and server3?


texts: How to use confidential production keys on a website?

texts:
I am implementing a payment gateway on my personal website. I am using a web builder software with adequate knowledge of HTML and googled knowledge of javascript on a need basis.
So, my payment gateway tells me to put this code on my website:
<input id="Key1" name="Key1" type="hidden" value="llsejjtoewe4">
<input id="Key2" name="Key2" type="hidden" value="628347832752">

(dummy values pasted here)
But then it says that these should be kept highly confidential.
When I uploaded my website, I can see that the visitors can see the source of the page which clearly shows these keys and the <script> code that follows. Is it how it's supposed to be? Kindly guide me.
Note that the code also contains encryption methods down the road so the transmission of data is okay.
Sorry if it is the wrong forum.


texts: mutual authentication with pre-shared key

texts:
A and B share two secrete keys: [keyA] and [keyB].
A sends this to B.
AUTH_A = prf(KeyA, ID_A)
B sends this to A.
AUTH_B = prf(KeyB, ID_B)
Does above scheme provide mutual authentication?
I think so because prf is just a key hashed function, as only A and B know the secret key, attacker cannot forge the message or learn the keyA or keyB from the messages.
When B received AUTH_A, it can calculate  prf(KeyA, ID_A) and compare it to AUTH_A to verify A's identity.
Do I miss any key concept or important consideration?


texts: How can I control the output of a hash function to output to specific data according to similarity?

texts:
I do not know if the question lies exactly in that field but I'll give it a try unless rejection.

I want to study methods of applying LSH functions to feet in a specific area of digest values. Briefly i would like to control the results of hash functions such as "similar" inputs (similarity is defined by an LSH algorithm given a distance metric – i.e:hamming distance) fall to a specific value. That is, I want to control the output of LSH to result in a specific range of values.


texts: Usage of the nth-root function in cryptography

texts:
Having offered a fast integer nth-root algorithm to a bigint library that is also used for cryptography I was asked if it does its work in constant time, so I took a look at the literature to see how other programmers solved that problem and found—nothing.

That leads to the question: is there any cryptographic algorithm out there—and in use— that needs an integer nth-root function?

EDIT: "integer nth-root function" here means a plain, vanilla truncating nth-root function $k = \lfloor m^{1/n} \rfloor$ with the restrictions $\{k, m, n\} \in \mathbb{Z} $ and $n > 0$.


texts: How should I define order according to domain parameters in elliptic curve pairing groups?


texts: RSA - are we able to encrypt into any possible ciphertext in $Z_n$ given a specific key?

texts:
Given a public key $(e,n)$, if we are free to choose the plaintext does that mean we are able to generate any possible ciphertext in $Z_n$ ?

Because if we were given $e$ we can say that the decryption key is $e^{-1} = k \mod n$ and then choose the ciphertext we wish to generate, say $c$,  perform $c^k$ and that shows that any ciphertext is "reachable" via encryption given a specific key and some plaintext?

Is that correct?

Edit: The question is theoretical so we assume we know both the public and the private key.


texts:
First off, I know hashes are 1 way. There are an infinite number of inputs that can result in the same hash output. Why can't we take a hash and convert it to an equivalent string that can be hashed back to the original hash output?

eg:

string: "Hello World"
hashed: a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e

unhash: "rtjwwm689phrw96kvo48rm64unc8oetb5kmrjiuh7h8huhi6dde5n5"
        (a real string that gives the same hash as "Hello World")
hashed: a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e

...


texts: Why is it that in DSA, the order of the subgroup, $q$, is chosen such that it divides $p - 1$?

texts:
Consider the DSA key generation:

A large prime $p$ is chosen;
A smaller modulus $q$ is chosen such that $p - 1$ is a multiple of $q$;
A generator $g$ s.t. $\operatorname{ord}_p(g) = q$ is chosen.

My question is -- why do we require that $p - 1$ be a multiple of $q$?  Is there any underlying mathematics I'm missing?  Thanks.


texts: Which is the better way of generating a salt string?

texts:
Using T-SQL as per the snippets below, which method is superior (or is it a tie)?
 -- method 1: DIY
 SET @Salt = ''
 WHILE LEN(@Salt) < 72
 BEGIN
   SET @Salt = @Salt + CHAR(CONVERT(INT, Floor(RAND() * (126.0 - 33 + 1) + 33)))
 END

 -- method 2: concatenating 2 GUIDs
 SET @Salt = CONVERT(VARCHAR(36), NEWID()) + CONVERT(VARCHAR(36), NEWID())```


texts: Proving correctness of a decryption of a homomorphically summed ciphertext?

texts:
I would like to take some additively homomorphic cryptosystem - don't care much which one for now - and encrypt a series of numbers with it. I would then like to (in public) take these numbers, add them together, decrypt the sum and convince everyone that I did it correctly.

This may seem pointless because I myself encrypted those numbers to begin with, but I'm thinking about voting applications where in reality the party who encrypted the numbers is not the same as the party decrypting the sum, and the numbers being summed/decrypted are all on a public bulletin board.

I know voting is a well studied problem in the literature, but so far none of the papers I've read have been doing it in quite the same way I'm interested in, so I see this as a good opportunity to go exploring.

So far I understand that with a regular Paillier encryption, to prove a correct decryption you can just reveal the randomness, however this does not work if you have added together ciphertexts. Exponential ElGamal would probably work for my use case, but I'm not sure if it lets me do what I need either ... plus I'm uncertain how fast a normal computer can actually brute force discrete log in a message space of say a few hundred million possibilities. I know it's perfectly possible but there's a gap between "possible" and "fast enough to be usable" and I'm unclear how to calculate this out short of just implementing it myself and trying it empirically.


texts: Both can be used to verify the integrity of a message. Assuming you have the needed primitives available to you (i.e. the code space of needing both a cipher and a hash function isn't prohibitive), is there any reason to prefer one over an other? In practice HMAC seems to be much more widely used, is that a result of cryptographic, or social reasons?


texts: About the irreducible test for a polynomial over $GF(2^m)$ (its coefficients belong to $GF(2^m)$)

texts:
For the Miller-Rabin probabilistic primality test, we can apply it to test a big number whether a probably prime number or not. Does there exist a method to test a higher-degree polynomial over $GF(2^m)$ whether it is an irreducible polynomial or not? Note that the coefficients of the polynomial belong to $GF(2^m)$.

This problem has been solved. Thanks the help from kelalaka.


texts:
I'm not a cryptography expert, but this seems like it falls into this area.

Imagine I want to design an election system (senate race for example) where I send the exact same ballot of 100 candidates to every voter. Each voter selects their preferences (can vote for multiple candidates, including 0 or all). Each voter then communicates back to the ballot tallying system some information privately computed from their preferences (any algorithm allowed, including random values).

The ballot tallying system knows what each voter communicated back and from that, it should be able to determine approximate preferences across a large number of voters, but should not be able to determine anything about the preference of any individual voter. This should be true, even if there are multiple rounds of voting with different ballots: ie: it shouldn't be possible to determine party affiliation of the individual voter.

Is this possible to construct? Is there studied research on something like this?


texts:
Let $f_a : S \to R$ is a family of functions indexed by $a\in P$.
Consider the assumption that $(a, f_a(x))$ is indistinguishable from uniform, over the distribution of $a\leftarrow U$ (uniform) and $x\leftarrow D$ (some efficiently sampleable distribution).
Is this assumption equivalent to, for all but a negligible fraction of $a$, $f_a(x)$ is indistinguishable from uniform over the distribution of $x$?
I'm inclined to think they are. But I'm not very sure and would like a proof.
EDIT: to make this more clear. Let $A$ be a random variable with uniform distribution $U$ over $P$, and $X$ be an independent random variable with some efficiently sampleable distribution $D$ over $S$. Also, let $Y$ be an independent uniformly random variable over the codomain $R$.
The 1st assumption says for any polynomial-time distinguisher $M$, consider the random variable $M(A, f_A(X))$ and $M(A, Y)$, then
$$
  |Pr[M(A, f_A(X))=1] - Pr[M(A, Y)=1]| \le negl.
$$
The 2nd assumption says, there exists a subset $Q \subseteq P$ with $1-|Q|/|P|$ negligible, such that for any $a \in Q$, for any polynomial-time distinguisher $N$,
$$
|Pr[N(f_a(X)) = 1] - Pr[N(Y)=1]| \le negl.
$$


texts: Why is it a security problem that two RSA moduli are not co-prime?

texts:
I found this security problem, for example:

Alice has an RSA public key: $e = 37$ and $\phi$ (totient, $N_A = (pa-1)(qa-1)$) is $55$, so the key is $(37, 55)$.
Bob has an RSA public key: $e = 37$ and $\phi$ (totient, $N_B$ = $(p_B-1) (q_B-1)$) is $77$, so the key is $(37, 77)$.

So I see that $\gcd(55, 77)$ is $11$. But what does it mean for the security issues?

It sounds like it is then much simpler factorize the totient. But how? I can see that $55 = 11 \times 5$ and $77 = 11 \times 7$ also without calculating the gcd. Even when dealing with big numbers (say 2048 bits), what does it help me with to find a gcd not equal 1? $N_A$ could be a multiplication of 100 different prime numbers and of course it will have commonalities with some other totient values (say $N_b$), but the commonality may not be the whole $p$ or $q$.

Say:

Na = (pa-1)*(qa-1) = (a*b*c*d*e*f)*(g*j*i*k)
Nb = (pb-1)*(qb-1) = (l*m*n*e*f)*(r*g*u*v*w*x*y*z)

so the gcd of Na and Nb is e*f*g. Where does it help me to find the initial pa, qa, pb, qb?


texts:
Are there any strong manual (i.e. performed only by pen and paper) ciphers for practical use?

It should be:

no less strong than modern cryptography algorithms used in computers,
at least relatively fast/easy to encrypt/decrypt with just a pen and paper (say, no more than 10 minutes per character),
key should be memorable (i.e. it shouldn't be a 256 random character string, because it's nearly impossible for an ordinary human to memorize it and remember for a long time).
not necessary, but if possible, it should be quantum resistant.

I believe that latest progress in mathematics and cryptography made all this possible, but we are just unaware of it, as it stands in the "shadow" of easily accessible and powerful computer cryptography. So, cryptography experts, please enlighten us, lay people.


texts: Signature and Timestamp for Long Term Document Archival Question

texts:
I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity.

As far as I understand, I need to timestamp the signature in order to ensure it remains valid even after certificate expiration.

Let's say I use a trustworthy TSA. From what I understand they sign the timestamp with they own signature.

Now, let's suppose the original TSA bankrupts or is compromised and its certificates revoked. Will my document remain readable without warnings?


texts:
I read that the Encrypt-then-MAC paradigm is provably secure.

From what I understand, when using for example AES for encryption and HMAC_SHA256 for MAC generation (and the keys $K_1 \neq K_2$), this means the following:

$ciphertext = AES_{K_1}\{plaintext\}$
$mac = HMAC\_SHA256_{K_2}\{ciphertext\}$
send: $ciphertext \;\|\; mac$

I have two questions regarding this construction:

Does it negatively affect security to calculate a hash value of the ciphertext before MAC calculation? Like exchanging step $2.$ with this: $HMAC\_SHA256_{K_2}\{SHA256(ciphertext)\}$.
What security properties are offered by this construction in general -- because I don't understand, what about this construction is provably secure.


texts: Symmetric Key Encryption with the key a seed

texts:
Would it be feasible to give two parties a seed to generate random numbers? So that when they want to send data to each other they send the correction on the random number generated?

The random number generated: 110001
Data you want to send: 101010
Correction you send(with 1 good and 0 false): 100100

Obviously, this could only work in a small group (with trusted members) and the seed would need to be stored safely. Other than this could this system actually have a use?


texts: Can an attacker exploit the nonuniform distribution of letters in a diceware password to improve a brute force search?

texts:
I use some diceware pass phrases in some places but I have one question that I can't find the answer to.

Let's say I roll the dice and get $N$ words with a total of $M$ letters and that I don't put spaces in between the words.

An attacker wishing to brute force my secret could have to try $7776^N$ times to break it as a diceware pass phrase OR $26^M$ to break it as a "normal" password (assuming I get only words with letters).

But the attacker trying to break it as a normal password could assume that it is made up of English words and then they'd know that some letters and combinations of letters are more common.

So my $M$ letters will not have the entropy of letters selected at random but some lower entropy.

My question is, what $M$ do I need to make up the same entropy as the $N$ words?


texts: Using HMAC SHA256 to protect payment files in local trusted network

texts: in a project that I am working on we have been tasked with eliminating PGP while providing sufficient security to protect payment files only within the Company's trusted network.  We arrived at HMAC SHA256.  Assuming that we can keep the key private and refresh the (128 bit) key annually,  can someone comment on how difficult it would be to compute the key if an attacker got the plaintext and the hash?  The files on average are about 2mb in size.


texts: Example of not computationally indistinguishable

texts:
All the examples that I see for proving that two distributions are not computationally indistinguishable involve a pattern: choose a Distinguisher $D(\cdot)$ such that $D(x)$ is $1$ if $x$ satisfies some certain properties.
For example, consider the distribution $X$ such that it contains all the binary strings in $\{0,1\}^k$ such that they end with 1 and distribution $Y$ uniformly spread over all strings in $\{0,1\}^k$. Now I can choose my distinguisher to be $D(x) = 1$, if $x$ ends with $1$.
However, if there is no such pattern in our distributions, how can we prove that the given distributions are (not) computationally indistinguishable?


texts: How would a side channel attack be carried out in a real life situation?

texts: How would a timing attack against AES be carried out in a real situation? You could not guess the key from the processor's power usage after the plaintext is encrypted, right? And what would you need for this scenario? How long would it take? And if side channel leakage is really such a big deal, why is AES still used for the encryption of classified data?


texts: Why ElGamal signature is insecure with nonrandom k?

texts:
In ElGamal signature scheme like:

Keygen:
$\beta:=\alpha^a\bmod p$ where $\alpha$ and $p$ are large prime numbers. Public key is $(p,\alpha,\beta)$ and secret key is $a$.

Sign:
Choosing random $k$ such that $\gcd(k,p-1)=1$, calculating $r:=a^k\bmod p$ and $s:=k^{-1}\cdot(m-a\,r)\bmod(p-1)$; then we send $(m,r,s)$

Verify:
Calculating $v_1:=\beta^r\cdot r^s\bmod p$ and $v_2:=\alpha^m\bmod p$; then if $v_1$ and $v_2$ are equal the signature verifies.

In the booklet I'm reading for cryptography course it is said that if $k$ is non-random this signature scheme is insecure. What's the reason?


texts: Which PRNG security requirements do I need for key generation

texts:
Do I need to worry about "predictability" an an allegedly secure CSPRNG if I am just using it to generate key material from time to time?

Suppose that for some odd reason, I am less trustful today than I was last week of SecRandomCopyBytes() in OS X and iOS and of CryptGenRandom() in Windows. If I am using this for occasional key generation instead of for the basis of a stream, can I get away with just de-biasing them?

What we're doing…

I have an application which occasionally needs to create AES keys, HMAC keys, and IVs for CBC mode.  Most of the AES/HMAC key pairs are used for single records, and so a new set of keys need to be generated when a new record is created. When the database is first created a set of very high value master keys are created.

Extra measures for the very high value keys…

Currently, for the master key pairs, we already don't fully trust the operating system provided RNG, and so we actually request 256-bytes of data from that RNG and then hash that down to 512 bits using SHA512.  (The first 256 bits are used as an AES key and the second 256 bits are for an HMAC key.)

The intent here is that if there is some unknown (to us) bias in OSs CSPRNG, then grabbing more of those bytes than we need and then hashing them down should wash away any bias that could be hidden in those. (Larger bias, we hope, would have already been detected.)

For all of the other keys, we just the OSs CSPRNG directly.

How many keys, how fast…

Under normal usage, two 32 byte keys will be generated at nearly the same time (AES and HMAC keys, along with a 16 byte IV and a 16 byte item identifier), when a single item is added to the database. But on data import or conversion a few thousand items may be created within a second.

And restating my question in light of the application…

Given the way that I'm using the outputs of that RNGs, do I need to take additional measures (such as XORing against an additional and independent RNG)? Or should I only be worrying about bias in the RNGs?

A second question is whether the de-biasing measure I've described makes sense.

Update: What passes for my threat model (tin-foil hat mode)

I am acknowledging the non-neglible possibility that 'CryptGenRandom()' and 'SecGetRandomBytes()' may have been "adjusted" by the NSA to be weaker in a way only known to the NSA. Certainly some of the users of our application may well consider that "non-neglible" (I no longer put much stock in my own intuitions about what they NSA would or wouldn't do given an opportunity.)

But I also assume that any such adjustment would have to be very subtle. And I imagine that such subtle mischief would have to be.

Biasing the output (e.g., making each 16 bytes actually be a hash of only 8 random bytes) of the CSPRNGs, or
Making their output easier to predict from other output (e.g., not reseeding as often as claimed and using a weakened PRNG internally)

Note, I am not considering a targeted attack against my application or an individual user of it. Just a generically tampered with CSPRNG to potentially weaken all crypto that has come to depend on those CSPRNGs.

Given my use of the CSPRNG (low volume, typically for an individual key at a time), I am asking whether I can ignore the second (prediction) kind of sabotage.

Update 2:

After doing a bit more homework, I see that my two distinct security properties actually follow from one property, and so my question isn't fully coherent, although I believe that it can be made coherent by defining bias as predictability based on zero prior output.

The accepted answer of "use a KDF" seems correct. The scheme we do use is a KDF, but one of our own devising. I'll be looking at better reviewed, developed KDFs. Note that I'm not looking for a password based KDF. I'm looking for entirely random keys that are not derived from user input.


texts: Shamir's Secret Sharing of modular inverse

texts: Given a secret $K \bmod q$ which is shared among entities $E_1,…,E_n$ using polynomial Shamir's Secret Sharing, how can the inverse of $k$ be shared without revealing $k$ and $k^{-1}$?


texts: RSA: Is it possible to recover the plaintext given that we have the ciphertext and the public key?

texts:
The $N$ and ciphertext are huge number that is more than 600 digits long.

I'm trying to find the prime factors of $N$ in order to get $p$ and $q$. Using $p$ and $q$ I can get $\phi(n)$. And using $\phi(n)$ and the public key I would be able to calculate the private key.

So, my question is if it is possible to recover the plaintext given that we have ciphertext and the public key?

If so, is it computationally feasible?


texts: Brute-force attack given multiple hash prefixes

texts:
(Context: I'm auditing some code which I suspect to be insecure, but I'd
like to be able to quantify this.)

Suppose you have a 56-bit secret key ($secret), and suppose you have revealed the following information to untrusted parties:

$salt – An easily discovered string
$prefix – The first 32-bits from sha1($secret + $salt)

Based on a previous
question, an attacker could perform an offline attack using ($salt,$prefix) as a sieve to narrow the list of possible $candidates.  This sieve would reduce the number of candidates from $2^{56}$ to $2^{(56-32)}=2^{24}$.

Now suppose you reveal multiple variations of ($salt,$prefix) (all based on the same $secret).  The attacker now has multiple sieves; if applied iteratively, each sieve would further narrow the list of possible $candidates.

I'd like to understand how quickly $candidates will filter down to the true $secret.  For example, if you have two prefixes, how many
$candidates should be left?  If you have three prefixes, how many
should be left?


texts: $t$-out-of-$n$ Secret Sharing over $\Bbb Z_2$?

texts:
Is it possible to construct a $t$-out-of-$n$ secret sharing scheme over $\Bbb Z_2$?

Shamir Secret Sharing allows for an arbitrary threshold $t$ and an arbitrary number of participants $n$, but requires the field to have at least $n$ elements. Is there a similar construction that works over $\Bbb Z_2$?

Addendum

One approach could be to use Shamir SS over the finite field $\Bbb F_{2^{\log n}}$. Then, to share $x\in\Bbb Z_2$, this value is first embedded in this field and then it can be secret shared. However, this has an (apparently) innecessary overhead (even though it could be amortized if we share more than value)


texts: How we can said a crypto system have perfect secrecy?

texts:
For example: I have 3 plaintexts ($a$, $b$, $c$) and 4 keys ($K_1$, $K_2$, $K_3$, $K_4$), making a table map to the cipher text, key as row and plaintext as column

$\begin{matrix}
\ \ \ \ \ \ \ \ \ \ \ \ a\ \ \ \ b\ \ \ \ c\\
\\
K_1\ \ \ \ \ \ \ A\ \ \ C\ \ \ B\\
K_2\ \ \ \ \ \ \ B\ \ \ A\ \ \ C\\
K_3\ \ \ \ \ \ \ B\ \ \ C\ \ \ A\\
K_4\ \ \ \ \ \ \ C\ \ \ A\ \ \ B\\
\end{matrix}$

This is not a perfect secrecy system, because if we know cipher text not $B$, then plaintext confirm not $b$. to avoid this, we need distribute cipher text at least each $A$, $B$, $C$ in each column… am I correct?


texts:
Suppose that messages transmitted over SSL are modified as follows:

  the message is splitted in blocks, $B_1, ..., B_m$ (each with at most $2^{14}$ bytes)
  for each block $B_i$ we do:

  we apply a MAC to the block $B_i$ resulting in $X_i$
  we encrypt $X_i$ with a symmetric cryptosystem in mode CBC resulting $Y_i$
  we add a SSl header resulting in $Z_i$
  we transmit $Z_i$ through a TCP segment

  The encryption of the first block $X_i$ is done in this way:

  we divide $X_1$ in 64 ori 128 block, $X_1=x_1^1....x_1^{l_1}$
  we generate $Y_1 = y_1^1..y_1^{l_1}$, where $y_1^1=e_K(x_1 \oplus y_0)$, $y_0$ is an initialization vector and $y_1^j=e_K(x_1^j \oplus
> y_1^{j-1})$ for any $j>1$

  The encryption for the rest of blocks $X_i = x_i^l...x_i^{l_i}$ is
  done as  with $X_1$, but with the distinction that $y_0$ is chosen as
  being  $y_{i-1}^{l_i - 1}$

  (a) Show that if an intruder that has access to the blocks $Y_1$ and
  $X_2$, but not to $X_1$ can decide if a particular sub-block $x_1^j$
  coincides or not with a message $x^*$ (of the same length) chosen by
  the intruder. (c) How can we improve the protocol to prevent the
  attack shown on (a).

This is just some random problem that I found in my book. I am interested in the solution for the point (a). I have tried to reverse engineer the algorithm given the fact that I know $X_2 = x_2^1...x_2^{l_2}$ and $Y_1$ I have everything I need in order to perform a decryption, but that seems to be wrong. How would you tackle this kind of problem?


texts: does re-encrypting the same value with multiple keys reduce security

texts:
I found myself wondering today, how much security is lost if you take a plaintext - assume that its content, including any metadata is unknown to an attacker, for example it may be random data - and encrypt it with multiple keys (not chained) and give all resulting ciphertexts to an attacker, how much higher is the probability of an attacker discovering the plaintext, vs only having a single ciphertext.

An example:

Take plaintext $P_1$ and encrypt it with $K_1$, and send the resulting ciphertext $C_1$ to attacker $A_1$.

In addition: take the same plaintext $P_1$ and, and encrypt it with $K_1$, giving $C_1$. Then take $P_1$ and encrypt it with $K_2$ giving $C_2$, then $K_n$ giving $C_n$ and send all $n$ ciphertexts to attacker $A_2$.

How much more likely is attacker $A_2$ to discover the value of $P_1$, than $A_1$?


texts: Does key-length recommendation provided by NIST consider quantum computer?

texts:
Here we can see the suggested key-length by NIST in a few decades:
https://www.keylength.com/en/4/#Biblio10

Does this consider quantum-computer?


texts: A clarification about OTR shared secrets - how long need they be secret?

texts:
A quick question on confirmation/authentication with the OTR protocol.

OTR shared secrets/Q&A when used to authenticate your partner in conversation, am I correct my understanding that they DO NOT need to remain secret after the initial key exchange has finished?

An example of how this might be important, say, Alice asks Bob, who was Best man at Carol's wedding; this is not per se secret, but if Bob can answer quicker than the NSA can, once the NSA figures out who Dave's best man was when he married Carol, is this information useful to them in going back?

My understanding is that it is not and that the shared secret need only be shared at the instant that the key exchange is being done.

Or; if Alice had a function, f(x) that did some computations on x, and could be sure that Bob could do these computations (and/or figure out what the function was) before Eve does; etc.

Responses are much appreciated.
Regards
NTP


texts: RSA: Given (e,c,d) is possible to solve?

texts:
is it possible to solve RSA without n?

I know e, c and d


texts: Why does image size increase after steganography?

texts:
I am working on a steganography technique. Sometimes I need to send my steganographed images online to my friends but in the process the image gets compressed destroying all the data. I found ways to surpass it by using Google Drive or simply mailing them to the destination. But still I am not able to find a reason as why the size of the image increases (nearly to 30%) after the steganography.

Technique used is

Read a character from a file.
Convert that character to a string of binary bits (from its ASCII)
To make it a 6bit binary string, pad it with appropriate 0s
Read two consecutive pixels from an image (left to right)
Impose the first three bits of the binary string onto the LSBit of
RGB of first pixel (first bit on LSBit of R, second bit on G and third bit on B).
Repeat 5 for the next pixel
Repeat from 1


texts: How could I verify that a contract was actually sent to me from the client as soon as the contract is received?

texts:
with the information provided - what would be the best solution - something like document management program like IBM Filenet ? or trusted timestamping?

If I want to store electronic contracts for clients over a long period of time. I need to make sure that those files are not readable by anyone other than the client until the client retrieves them at a later time. But, I do need to be able to verify that a contract was actually sent to me from the client as soon as the contract is received. How could this be done? what would the client do, and what algorithms would they use? What would I do, and what algorithms would I use?


texts: May I use Random Oracle for Inversed Look-up?

texts:
Consider there is a protocol in real world calling a random oracle $\mathcal{H}$ for a priavte input $k$. Then in the ideal world, after the calling of $r \leftarrow \mathcal{H}(k)$ by a honest party, can the simulator extract $k$ from $r$, if the behavior of $\mathcal{H}$ is as follows:

When $k$ is new, record $(k, r \leftarrow_R \{0,1\}^\lambda)$ in the inner storage and then return $r$;
When $k$ has been asked (by checking the inner storage), return the corresponding $r$.

I envisage to extract $k$ from $r$ also by checking the inner storage, but is it a correct usage of random oracle?


texts:
The content I ask in this question is in the following picture in [GPV08][1]. I do not understand the proof of the first claim in $\bf Lemma$ 5.2.  In the proof, which reprensents the uniform distribution over $\mathbb{Z}_{q}^{n}$ and which represents $\bf{u=Ae} \mod q$.

Could someone explain it to me? Thanks!

[GPV08] Craig Gentry, Chris Peikert, Vinod Vaikuntanathan, [How to use a short basis: trapdoors for hard lattices and new cryptographic constructions][1], August 25, 2008.


texts: Does the relationship between plaintext and ciphertext moduli affect the security of BGV/BV SwHE?

texts:
The SwHE schemes due to Brakerski and Vaikuntanathan (BV) and Brakerski-Gentry-Vaikuntanathan (BGV) have common concept in which the message bit is put in the least significant bit of the ciphertext.
Let $t, q\in \mathbb{Z}$ be moduli that determine the plaintext and ciphertext space, respectively.
The BV and BGV scheme require $t$ and $q$ to be co-prime.

Let

$\mathbf{s} \in \mathbb{Z}_q^n $: a secret key sampled from a key distribution
$\mathbf{e} \in \mathbb{Z}_q $: an error sampled from an error distribution
$\mathbf{a} \in \mathbb{Z}_q^n $: a random vector sampled from $\mathbb{Z}_q^n$ uniformly at random.
$m \in \mathbb{Z}_t $: a message.

Then,
$$
(\mathbf{a}, b):=(\mathbf{a}, \langle \mathbf{a},\mathbf{s} \rangle + t\cdot e + m) \in \mathbb{Z}^n \times \mathbb{Z}
$$
is a symmetric encryption of $m$.
Decryption works by computing
$((b - \langle \mathbf{a}, \mathbf{s} \rangle) \mod q )\mod t$.

Is this plaintext and ciphertext space relationship ($t$ and $q$ are co-prime) needed for the security?
What happens if $q$ is divisible by $t$?
I understand that modulus switching does not work, so it affects the correctness at least.
What about the security?


texts: Non interactive Zero Knowledge Proof for Satisfiability of Pairing Product Equations

texts:
In the paper "Simulation-Sound NIZK Proofs for a Practical Language and
Constant Size Group Signatures" from Groth, the section 6 describes a NIZK proof for pairing product equations.

I only know the basics in the domain of zero knowledge proofs and I saw some basic algorithm. What I would like to know is if there is a way to implement the prover and verifier algorithm ? By using some already existing implmentation like the Schnorr one or another one that I could adapt ?

In summary, I would like to know if there are ways to implement the algorithms shown in the paper. Or is it just a theoretical state at the moment?


texts:
I learned from Dan Boneh's course that many cryptographic primitives (prngs, stream ciphers, hashes, hmac, key derivation functions) can be built from just one a block cipher or PRF.

For example, the sha-1 hash is based on a compression function which can be used to make a block cipher SHACAL-1. More generally a Hash from a block cipher using Davies-Meyer construction.

There was a question SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256) which explained some points about why AES is not suitable to base a hash on.

My question is: Is there a single block cipher or PRF (or other basic primitive) which is suitable to construct the other primitiveness from?

I looked into the simon and spec ciphers (PDF) for this purpose but they say:

  We have made no effort to guard against attacks in the open-key model, and Simon and Speck have not been evaluated for use as hashes.


texts: Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf

texts:
I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations.  I found a PDF of example ECDSA calculations from NIST here:
http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/ECDSA_Prime.pdf

In the section "Example of ECDSA with P-256", NIST gives two large hex numbers K and Kinv, which I presume are multiplicative inverses of eachother in the prime field of the P-256 curve.  I tried to verify that K * Kinv is equal to 1 (in modulo arithmetic) but I was unable to; I got a really large number instead of 1.

Could someone check my relatively simple work and tell me what I am doing wrong?  Or could someone verify it in their own way and tell me how they verified it?

Here is the excerpt from ECDSA_Prime.pdf I am looking at:

==============================================================
Signature Generation
msg is "Example of ECDSA with P-256"
Hash length = 256
...
K is
7A1A7E52 797FC8CA
AA435D2A 4DACE391 58504BF2 04FBE19F 14DBB427 FAEE50AE
...
Kinv is
62159E5B A9E712FB
098CCE8F E20F1BED 8346554E 98EF3C7C 1FC3332B A67D87EF

I found the prime value $p$ that defines the field for curve P-256 in NISTReCur.pdf.  I multiplied K and Kinv together in Ruby, taking advantage of that language's automatic handling of very large integers.  Here is my Ruby code:

# From http://csrc.nist.gov/groups/ST/toolkit/documents/dss/NISTReCur.pdf
# in the section entitled "P-256"
nist_p = 11579208921035624876269744694940757353008614_3415290314195533631308867097853951

# From http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/ECDSA_Prime.pdf
# in the section entitled "Example of ECDSA with P-256"
nist_k = 0x7A1A7E52_797FC8CA_AA435D2A_4DACE391_58504BF2_04FBE19F_14DBB427_FAEE50AE
nist_kinv = 0x62159E5B_A9E712FB_098CCE8F_E20F1BED_8346554E_98EF3C7C_1FC3332B_A67D87EF

puts (nist_k * nist_kinv) % nist_p    # expect to get 1, but did not

Note that the underscores are just spacers between the digits to make these long numbers more readable; they can be removed without affecting the program.

This code outputs the following number, even though I would expect it to output 1:

44876559229634927483363577082941808653359045812660811236387870057706848524951

I tried reversing the order of bytes in the NIST hex numbers and I also tried reversing the order of the 32-bit chunks, but neither yielded the correct result.

What am I doing wrong here?  Am I using the wrong value of $p$ for the P-256 curve?  Is my understanding of Kinv incorrect?  Did NIST miscalculate Kinv?


texts: Can a PRNG be made into a CSPRNG by hashing the outputs?

texts:
So I was contemplating this answer to my last question, and it got me thinking:

If I understand it right, one of the required properties of a CSPRNG is that it resists leaking information about its internal state from the outputs it produces.

So say we have a PRNG that meets all other properties of a CSPRNG (I do not yet trust myself to know what all those are), but is suspected of leaking too much of its state in the outputs.

My intuition is that we can maybe make it a CSPRNG by running its outputs through a hashing algorithm already known to be suitable for cryptography.

An example: say the PRNG has 128 bits of state, and produces 128-bit numbers as its output. If I were to, say, run it 8 times, I would have 1024 bits. Say I then feed that into SHA-512/256 or similar, and return the two 128-bit pieces of the digest as the new outputs.

So in this example I get two outputs of my new composed PRNG for every eight runs of the underlying PRNG. This might be less efficient than a proper CSPRNG, and might have washed out whatever other properties the PRNG might have had. But is it now a CSPRNG?

I suspect the answer is either "no" or "only if the original PRNG [...]" or maybe at best "the general gist is in the right direction but your specific example would not be because [...]", or some combination of those.

I also know that naive attempts to compose primitives like this without proper understanding can actually cause other problems.

It just occurred to me that some operations, like XOR and the hashing functions used in cryptography, can "destroy" information, in the sense that more than one possible input can produce the same output, while still retaining the right "randomness" properties.

That naively seems like what we need to reduce how much a PRNG's outputs reveal about its state, and I'm looking for some check if that is right or in what ways it is wrong.

And it seems like "can I turn a PRNG into a CSPRNG by running a secure hash on all of its outputs?" is a good question to explore at least some of that.


texts:
I'm encrypting some of my (not so much important) files with PBEWithMD5AndDES. Is it a strong method or it can be de-crypt easily without knowing my selected password?

I'm new to crypto, thanks in advance.


texts: possible MITM attack against servers that used to support weak DH?

texts: from reading the TLS 1.1 RFC, it looks like it would be possible to break a previously recorded TLS <1.2, 512-bit DHE ServerKeyExchange and then send it (unmodified, with the original, valid signature) to a client that still accepts TLS <1.2 and 512-bit DHE to impersonate a server that has since been fixed (disabling DHE and/or TLS <1.2 entirely) or "fixed" (using a larger DH group). TLS 1.2 seems like it would be immune to this attack, since its ServerKeyExchange signature includes the ClientRandom value. is there something i'm missing, or would this actually work?


texts:
The task:

The Playfair cipher with $I = J, X$  added into two same letters and
the key keep distance.

The plaintext:

CORONAVIRUS SPREADS FAST

The whitespaces in plaintext and key are to be discarded.

not sure what they mean by I = J, X
The table

I am not quite sure what they are asking for. I know that you usally remove letter J and replace it by I,   But now it says * I = J,X" what does he mean by that?
This is what I've written as "coronavirus spreads fast"
CO RO NA VI RU SX SP RE AD SF AS TX


texts: How does this formula work $(aG + bG) = (a + b) G$ in ECDSA?

texts:
Please explain how does this formula $(aG + bG) = (a + b) G$ work in ECDSA?

According to the source:

$a$ and $b$ are different private keys

Suppose

$a = 3$

$b = 4$

then the public key is $Q = aG$ and $W = bG$ (secp256k1)

Q = F9308A019258C31049344F85F89D5229B531C845836F99B08601F113BCE036F9

W = E493DBF1C10D80F3581E4904930B1404CC6C13900EE0758474FA94ABE8C4CD13

Now we take the formula $(a + b)G$

$(3 + 4)G$

$7g$

$c = 7$

public key $P = cG$

P = 5CBDF0646E5DB4EAA398F365F2EA7A0E3D419B7E0330E39CE92BDDEDCAC4F9BC

Now take the formula $(aG + bG)$

$(Q + W)$

And the amount of public keys $(Q + W)$ will be

DDC465F353664403A152988A8BA8662FC6EEFEEEE3076EF93B2A2732D56EC2CB

Why it turns out:

DDC465F353664403A152988A8BA8662FC6EEFEEEE3076EF93B2A2732D56EC2CB

Why is the answer of this sum not this value:

5CBDF0646E5DB4EAA398F365F2EA7A0E3D419B7E0330E39CE92BDDEDCAC4F9BC


texts: Which US standard includes a signature based on Ed25519?

texts: Which standard organization (e.g. NIST or ANSI) standardizes signature Ed25519?


texts: Why must curve25519 shared secret be hashed?

texts:
When using the curve25519 DH function, D.J. Bernstein recommends hashing the shared secret before using it as a session key for a symmetric block cipher. Why is that?

Hashing won't increase the entropy. Do the shared secrets from a curve25519 have some non-random properties that could be exploited if the shared secret isn't hashed?

I am puzzled...


texts:
In feistel cipher , does it matter that number of rounds be 16 ? is using 16 rounds will give the best result ? Or using any number of rounds is the same?

in cryptography and network security by william stallings we have : "The  essence  of  the  Feistel  cipher  is  that  a  single  round
offers  inadequate  security  but  that  multiple  rounds  offer  increasing  security.
A typical size is 16 rounds."

a typical is 16 but what's the efficient number ?


texts: Brute force attack multiple stream cipher

texts:
Assume that a scheme used to secure a specific system $Π=(Gen,Enc,Dec)$ which is thought have indistinguishable multiple encryption in the presence of an eavesdropper.

For any adversary $A$ that can break the scheme with

$\Pr[\text{PrivKmult}^A_Π(n) = 1] \leq 1/2 + \text{negl}(n)$

some PPT adversary $x$ breaks this scheme with probability

$\Pr[\text{PrivKmult}^x_Π(n) =1] \leq 1/2 + n^{-3}$.

Can I prove that any other PPT adversary can break this scheme with probability greater than $X$? If yes how can I do that?


texts: Prefixing data before encryption for passphrase confirmation?

texts:
I'm encrypting data with AES, using CryptoJS.

CryptoJS returns an empty string in case the data couldn't be encrypted with the given passphrase. I'm not sure if this is intended, or happens in all libraries, but I need to know whether or not the data was decrypted successfully.

The problem is this:

if(decrypted == '') {
    // Not sure if decryption failed or if data was empty to begin with
}

Would it be okay to prefix the raw data before encryption? Like this:

Raw data:

Lorem ipsum a dolor sit amet.

Prefixed:

this-string-is-used-to-verify-decryption;Lorem ipsum a dolor sit amet.

When decrypting the data, I could simply check if it has that prefixed data in. Meaning, an empty string would only be returned if the decryption failed.

var prefix = 'this-string-is-used-to-verify-decryption;';
if(decrypted.substr(0, prefix.length) == prefix) {
    // Decrypted successfully
}

Is there something wrong with this approach? Does it create a security risk, if an attacker knows all raw data will begin with a certain text?

I originally posted this question to StackOverflow. Thought I'd remove the code parts but they are fairly easy to understand, so I'll leave them.


texts: Is it OK to use a doubled key for XTS-AES?

texts:
https://en.wikipedia.org/wiki/Disk_encryption_theory#Xor%E2%80%93encrypt%E2%80%93xor_(XEX) reads:

The standard supports using a different key for the IV encryption than
for the block encryption; this is contrary to the intent of XEX and
seems to be rooted in a misinterpretation of the original XEX paper,
but does not harm security.[11][7] As a result, users wanting AES-256
and AES-128 encryption must supply 512 bits and 256 bits of key
respectively.

Does this means that it's OK to give XTS a "doubled" key - i.e. its two halves being identical?


texts: Can ECC correctness issues allow “remote attackers to spoof ECDSA signatures”?

texts:
CVE-2015-2730: Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote attackers to spoof ECDSA signatures via unspecified vectors.

  The formulas appearing in ecp_jac.c do not handle the case when the addition produces infinity or adds a point to itself. An attacker can use this to generate specially-crafted signatures that cause the validation algorithm to compute the incorrect point.

For the equations and other details, please check the following link: https://bugzilla.mozilla.org/show_bug.cgi?id=1125025

Could this Elliptic Curve Cryptography issue really lead to spoofed ECDSA signatures or is this purely a theoretical attack?


texts: What is the difference between Shor's algorithm for factoring and Shor's algorithm for logarithms?

texts:
There is a paper from Peter W. Shor from 1994:  Algorithms for Quantum Computation: Discrete Logarithms and Factoring, and I have a question about it and the algorithms presented.
For integer factoring problem, Shor's algorithm is working as a fast period finder for function f(x) = a^x mod N, where semiprime N is equal to p*q, a is fixed and all possible exponents x are quantumly computed. Then, Shor uses Simon's algorithm to find period r of f(x) such that f(x) = f(x+r) . With 0.5 probability, the output of quantum scheme r will be the even, and a^(r/2) will be the non-trivial square root of 1 mod N. Having such root we can easily crack N to p and q. (If there is something wrong with this description, please comment. The simple quantum circuit is
here.
But how does Shor's algorithm for the discrete logarithm problem work? There is only prime number P (and generator g), so we can't factor it into something having a square root. I'm even not sure that there will be any nontrivial square root in the mod p field.
The task for discrete logarithm is: given some x, equal to x = g^r mod p, with g and p known, find the r.


texts: prepaid meters that rely on a disconnected system

texts:
i have some experience with cryptography in the banking sectors, mostly in block ciphers like DES 3DES etc. im interested in prepaid electricity meters as it is a number that is generated from a central system which is disconnected from the meter its self.

This would mean they are using a symmetric algorithm using the device meter number and the "recharge" value to make it unique. so i presume there would be a secret key stored on the device of which they have the clear component in order to create the recharge token. similar to an HSM and its LMK. The tokens are 16 digits which in its self would make brute force difficult as you dont know the transformations performed on the input.

i was thinking about how ciphers where "broken" during the mid 1950's, how would someone analyse cyphertext without knowledge of the algorithm or the clear text content ?

just in case anyone thinks i'm going to try and do it. i'm not,its a question based on curiosity


texts: ElGamal in private set intersection: how to handle negative numbers?

texts:
I am trying to implement the Efficient Robust Private Set Intersection using Additive ElGamal.

For this, from the client side, my inputs are $C = \{1, 2\}$. So, the polynomial is $(x-1)(x-2)$ which is $x^2-3x+2$.

The next step is to encrypt the variable coefficients which are $1$, $-3$, $2$.

Can someone tell me how to use ElGamal for encrypting negative numbers. If there is an example which one can run from Client and Server side, it will be really helpful.


texts: How to calculate the maximum output size for data encrypted with a RSA Private Key?

texts:
I have an an encryption algorithm I am working with that looks like this:

prv_key_enc(sha1_hash(data))

Where, the RSA parameters are:

RSA/ECB/PKCS1Padding
1024 bit keysize

I have provided the RSA parameters as well as information on the data that will be encrypted (sha1 hashed value) because I do not know if those details will affect the size of the output (hence this question).

Question: Is it possible to calculate the maximum number of bytes that will be output by the RSA encryption?

NOTES:

The algorithm is fixed by a third party and can not be changed.

Encoding of the encrypted data

The output from the RSA encryption will be base64 encoded, so the above algorithm becomes this:

base64(prv_key_enc(sha1_hash(data)))

Therefore, the final output size will be:

ceil( num_bytes_from_enc / 3 ) * 4

prv_key_enc

I don't know how to express the algorithm for prv_key_enc except for providing an example implementation (including the base64 encoding) using Java:

Cipher c = Cipher.getInstance("RSA/ECB/PKCS1Padding");
c.init(Cipher.ENCRYPT_MODE, privateKey);
bytes outputData = org.apache.commons.codec.binary.Base64.encodeBase64(c.doFinal(data));


texts: Why the output length of a KDF should be the same as the underlying OWF?

texts:
Quote:

  The chosen output length of the key derivation function SHOULD be the same as the length of the underlying one-way function output.

Could someone please help explain the benefits and concerns?


texts: Is it possible to apply the El Gamal encryption/decryption technique using Edwards curve in Montgomery form

texts:
I've been trying to understand the ElGamal encryption/decryption technique. I plan to use it for sending a private message to the server. That is: Alice needs to send $Pm$ (private message encoded via Koblitz's or some other mapping on an elliptic curve) across to Bob.
Alice knows Bob's Public key $(P_{Bob})$, Only Alice has her private key $k$. $G$ is the generator of the curve that both Alive and Bob have agreed on (including other curve domain parameters).
So assuming the above the private message is converted to two cipher points $$\left([k]G, (P_m + [k]P_{bob})\right)$$ and sent to Bob, Bob extracts $Pm$ as follows

Bob multiplies his private key $b$ with the first point $[k]G$ to get the shared secret $[b\cdot k]G$
Bob subtracts the above from the second cipher point
$$(P_m + [k]P_{bob}) - [b]([k]G) = P_m + [kb]G - [bk]G = P_m$$
Bob gets the private point $P_m$ and decodes the message from $P_m$ using Koblitz's or some other mapping.

Note: Please find this video which explains the above.
I assume the curve has to be represented in Weierstrass form for the Point addition i.e $P_m + [kb]P$.

But the question is can I do it on Edwards curve in Edward's represented form? i.e $ed25519B$.

Also can I do the same on $curve25519$ i.e Montgomery form.

The reason for using the Edward curve is because of speed/efficiency optimization since I plan to  use this on a microcontroller (nrf5340 w/ CRYPTOCELL-312)
I am referring to elliptic npm pkg for the PoC on Javascript, I am currently testing this PoC
in JS.
I understand that curve25519 in Montgomery form doesn't support unified add but supports differential point addition and makes use of ladder point addition and doubling for multiplication. Am just not sure how to go about the point addition technique assuming I strictly need to keep the point addition/multiplication cost as low as possible.I.e use ed25519 and/or curve25519(x25519)
I also understand there are ways to convert points from one form to another, If this is the crux to a solution to my question  I would also like to know its feasibility in terms of popular libraries in JS/node and C/C++ like libsodium or something.


texts: In ECC, how do I prove that point addition is commutative?

texts:
I am studying elliptic curve cryptography and this question is related to the commutative property of point addition operation.

Point addition $P_3(x_3,y_3)$ of two points $P_1(x_1, y_1)$ and $P_2(x_2,y_2)$ is given by the following rules:
$$x_3 = (\lambda^2 - x_1 - x_2) \bmod n$$
and
$$y_3 = (\lambda (x_1 - x_3) - y_1) \bmod n$$
where
$$\lambda = \frac{y_2-y_1}{x_2-x_1} \bmod n.$$

To prove that the point addition operation is commutative, I simply interchange $x_1$ by $x_2$, and $y_1$ by $y_2$, and what I get is:

$$x_3' = (\lambda^2 - x_2 - x_1) \bmod n$$
and
$$y_3' = (\lambda (x_2 - x_3) - y_2) \bmod n.$$

Now it can be seen that $x_3 = x_3'$ but $y_3 \ne y_3'$; that is, I am not getting the same point $(x_3, y_3)$. But I have read everywhere that point addition is a commutative operation.

Please help me understand the problem.


texts:
Has any work been done on analyzing the SHA3 sponge construction for use as an entropy pool (e.g. /dev/random)?

All the use cases I've heard of consts of a sequence of input operations followed by a sequence of output operations where as an entropy pool would require security to be maintained for any sequence of intermingled input and output operations.


texts:
I am using HMAC (hmac-sha256 to be precise) message authentication without encryption.  My question is, is having a short message make it easy to determine what my secret key is?

My C# code is as follows

HMACSHA256 hmacSha256 = new HMACSHA256(new byte[]{0xfa, 0x35, 0x24, ..., 0x5e}); // 64 byte secret key

byte[] authForMessageA = hmacSha256.ComputeHash(new byte[]{0x25}); // very short message
byte[] authForMessageB = hmacSha256.ComputeHash(new byte[]{0x66}); // another message, same key

I am exposing both the message (0x25 and 0x66) along with their authentication hashes to the public, does this make it simple for a hacker to determine my secret key (brute force or otherwise)?


texts:
I have been recently working on garbled circuits for a course and I think I don't have the the proper background for understanding them. I don't know how to approach such problems.

Here is an example of what I'm looking for. Other examples include the function for maximum of two entries each having 2 bits, the function that checks if the two entries have equal Hamming weights, etc.

How does one go about solving the question that I linked?


texts: Understanding a faulty Needam-Schroeder protocol

texts:
Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works.

A chooses $N$ (nonce) and sends to C (trusted server): $A, B, N$
C chooses $K$ and sends to A: $Kac(N, K, B, Kbc(K,A))$
Now Trudy acts in place of Alice
A decodes, checks $N$ and $B$, and sends to B: $Kbc(K,A)$
T (as A) replays to B: $Kbc(K',A)$, where $K'$ is an older session key
B decodes, chooses nonce $N'$ and sends to A: $K'(this is B, N')$
B sends to T (not to A): $K'$ (this is $B, N'$)
A sends to B, $K$ (this is $A, N'-1$)

If $Kbc$ is the shared secret key between Bob and the trusted server C, how is it possible for Trudy compute $Kbc(K',A)$? Trudy does not have $Kbc$…


texts: Is there a known vulnerability when using identical key and salt with PBKDF2?

texts:
For optimum security, a random salt should be chosen for PBKDF2.

I came across a scenario where I  produce a hash of a random file that serves as the "password". Due to the nature of files, this has similar entropy issues as a "normal" password.

What would happen now if I decided to take the same (low-entropy) hash as the salt, too?  Is there a known attack on this? Of course, in this scenario the salt would be kept secret. But still, since it is not entirely random, does this compromise the overall security, and if so, how badly? I know that for example "key as IV" severely compromises certain ciphers, so I'm afraid it could do harm in this situation, too.


texts: What is the difference between PPE and SPPE?

texts: Can somebody explain, in simple terms, the difference between Pseudo Random Permutation Ensemble and Super Pseudo Random Permutation Ensemble?


texts:
The company I work for needs to develop a simple system where, for each client, we encrypt a token on our server, which is then transmitted to the client. The decryption is performed by the server itself when the client transmits the token (thus the only machine that performs crypto is the server).

The token is for an external service, so integrity checking is not an issue.

I wrote code that encrypts these tokens using AES/CBC, using the same key and a unique IV; I am not aware of any practical attacks against AES, even with an arbitrarily large number of known ciphertexts.

My colleague insists that an adversary could break this (i.e. get the key and decrypt stuff) after collecting a (possibly large) amount of ciphertexts; thus, he argues that we should have one key per client on the server.

Who is correct?