texts: How compared encryption algorithm in terms of efficiency

texts:
I want to compare two cryptographic algorithms. The first algorithm is RSA, and second algorithm is ElGamal elliptic curve cryptography. Now, I’m looking for a way to compare the speed of the two algorithms (time needed to complete calculations).

Someone told me about computing “time complexity”. Is that really an advisable way to compare things?


texts: Does FHE's longer key bring more security than traditional encryption algorithm?

texts: I check some key size which FHE libraries generated, for example, HElib's key size will be more than 300M, while tfhe's is also nearly 100M. Since these keys are so long, does it guarantee FHE encryption is more safer than traditional encryption, such as RSA?


texts: How (generally) do modern schemes deal with an adversary with the capacity to either instantly, or over time, corrupt a majority of parties

texts:
I'm curious about the honest minority case and what cryptographers have and are currently using to get around this. My motivation is primarily the MPC space, but I'm sure there are other subfields that encounter it.
Some thoughts of mine include:

It seems that a high threshold Shamir Secret Sharing Scheme or just a vanilla additive sharing scheme would be required to operate on inputs while protecting privacy in a dishonest majority setting, however this does nothing to mitigate the fact that the adversary could easily compromise correctness.
I know SPDZ technically handles the dishonest majority case, my limited understanding of SPDZ is that they basically MAC everything and anything to accomplish this, but their approach also only provides safety from prying eyes and not any kind of probabilistic or computational guarantee of correctness.

I'm curious, is there some impossibility result in this area that I am just not aware of? It feels like there ought to be, because an adversary with that kind of control should be able to change the inputs of her puppets to compromise the output. Maybe if we limit the adversary to corrupting parties until after their inputs are initially submitted/distribute/broadcast we can say something of value?


texts: Is there a point in storing hash or plaintext in the last column of Rainbow Tables

texts:
As I read up on rainbow tables, I found that most sources suggest storing a plaintext - the result of Rk(hk) - in the last column, while others just store the hash hk, basically stopping one step earlier.

Is there a point in computing and storing the plaintext, instead of storing the hash? What do we gain from the extra reduction step?


texts: 1024 RSA Hash Signature attack. Forge a valid signature

texts:
I have an RSA signature of 1024 bit where i know the following:

Public modulus N
Public exponent (0x03)
Cypher message

Summary:

An MD5 hash is calculated from a collection of byte and is used as message (M).

Having an hash that is a perfect cube forge a signature accepted as valid will be easy.

Question:

Can someone give advice to find a pratical way to hashing messages changing ending until their hash will be a perfect cube?


texts: Subtracting one pederssen commitment from another

texts:
I am building a range proof to prove that a secret number x lies between a specific range a

prover commits to a values a<x<b

prover generates a pedersen commitment to a value a

prover generates a range proof to commitment that is commitment from 1 minus
  commitment from 2

prover sends range proof together with the opening of the commitment from 2

regarding step 3, how do I subtract one commitment from another? is there a better way?

Note: I am using the a javascript implementation to calculate the pederssen commitment
https://github.com/omershlo/simple-bulletproof-js


texts: How to generate tokens from a secret key?

texts:
The problem is simple: I want to be able to spit out 256-bit "tokens" that only I could've produced because I know my secret key $s$, and given any number of these tokens, no one can figure what $s$ is.
How could I do this? Or something similar?

Note that I want a "parallel" implementation: e.g. I could give different tokens to different people separately, and they'll all know it's me.

A "serial" implementation (which isn't what I want) would be much easier:

initially, pick a secret phrase $s_1$
Get the SHA digest $d_{i}$ of the current secret phrase, and pick your next secret phrase $s_{i+1}$.
post $(s_{i-1},d_i)$ publicly with the note that only you can produce the $s_i$ that corresponds to this $d_i$, and you will do that with your next post to prove it's you.
Go back to step 2

Ideally, the solution would be some function $F$ such that a token $t=F(s,r)$ can be verified to have come from $s$ no matter what random input $r$. And no one can figure out what $s$ is.

The scenario I'd have in mind is something like this: John Titor wants to post on 4chan, an anonymous forum, and verify that it's him posting every time by including a 256-bit token each time. How can he do this?

I know there's the potential security threat of some malicious entity trying to pass off old tokens, but ignore that (since there's dozens of ways around it).


texts: Is it safe to use a secret salted hash of a public id for client to prove ownership of id to a server that knows salt but does not store ids?

texts:
I am writing a peering server - the server assigns randomly generated public IDs to users, and I want users to be able to reclaim their ids in the future, but only to be able to claim ids that they have been assigned, not arbitrary ids or ids belonging to other users.

I also want to avoid storing any information on the server after its connection to a user closes.

I have limited knowledge of cryptography, but am thinking that the server can give the users their public ID and a secret produced by salting and hashing the id. To reclaim the id, the user would pass the server both the id and secret, the server would re salt and hash the id and ensure that it matches the provided secret.

Is this safe?  If so what hash function is appropriate, and if not is there a better approach?

Thanks!


texts: Times of nested algorithms in proofs of security

texts:
Proofs of security may be constructed such that an adversary $A$ is used to construct an adversary $A'$.
The reduction/algorithm which uses $A$ has to perform a number of computations in order to simulate the environnement of $A$ (t.i.t.s to intercept/answer to queries from $A$).

I've noticed that we evaluate the time $t'$ taken by $A'$ such that $t'=t+n \cdot t_c$ where $t$ is the time taken by $A$, $n$ is the number of computations made by the reduction and $t_c$ the time to perform one computation.

I don't understand why we generally conclude that $t \ge t' - n \cdot t_c$. I don't understand why we remove the quantity $n \cdot t_c$. It seems to me that $A$ and $A'$ terminate at virtually the same time ($A'$ uses the output from $A$ almost immediately).

An example: Assume that a computation needs $1$ unit of time. An algorithm $A'$ uses $A$ as follows:

$A$ makes a query (the elapsed time for $A$ and $A'$ is $1$)
$A'$ makes a computation and responds to $A$ (the overall elapsed time for $A$ and $A'$ is 2)
$A$ makes a query (the overall elapsed time for $A$ and $A'$ is $3$)
$A'$ makes a computation and responds to $A$ (the overall elapsed time for $A$ and $A'$ is 4)
etc ...
when $A$ terminates and gives the result to $A'$, we assume there is not need for more computations. It seems that $A$ and $A'$ terminate at the same time.

We see in this example that it's strange for $A$ to remove the time of computations (unless these computations are considered as "free").


texts: How to write proofs for universal composable security？

texts:
Recently, I learn Ran Canetti's famous paper, "Universally Composable Security: A New Paradigm for Cryptographic Protocols". But I find it very difficult to grasp. When I read the paper that proves the security of the protocols in the UC-framework, I can understand it a little bit, but I still cannot write the proof myself.
I have read some answers on this website, including

Simulation-based proofs and universal composability proofs,
What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?,

but they just teach me what is UC-framework, while I am still confused on how to write the proof(how to define the ideal functionality, etc.) after I read them. So is there any other good way to learn to write the proof in UC-framework?


texts:
In the following protocol $(P,V)$, prover $P$ and verifier $V $have common input $(N,X) \epsilon QR$ while the prover also has private input $x \epsilon SR(N,X)$. Let $SR(N,X) = \{x \epsilon$ $Z_{n}^{*} : X = x^{2} mod N\}$ and $QR(N) = \{X \epsilon Z_{n}^{*} : SR(N,X) \neq \phi (empty set)\}$. Also let $QR = \{(N,X) : N \geq 1 and X \epsilon QR(N)\}$.

Prover(P)                               Verifer(V)
                            <-CH----  Ch ← {0,1} (Picked at random)
c ← Z_{n}^$; Cmt ← c² mod N --Cmt-->
RSP ← c . x^{Ch} mod N      --RSP-->  d ← Rsp² = Cmt . X^{Ch} mod N; return d

  Question: Show that the protocol $(P,V)$ fails to satisfy soundness for the language $QR$ by presenting a strategy for a cheating prover to convince the verifier to accept (this means return $d = true$) with probability one when the parties have common input $(N,X)$ not element of $QR$.

My Solution:

Let $Ch = 0$. Then $Rsp \leftarrow c.x^0 \pmod N = c$. Then $d \leftarrow c^2 \equiv c^2 \pmod N$.

I am not sure what I need to show next such that $d$ always returns $true$.


texts:
So I got bored one weekend so I thought I would make a login system in python. I then realized if I wanted to reuse the accounts I made I had to store the account details locally. I realized I had to use some sort of encryption. I looked around for what is best for passwords and I chose to use use a SHA512 hash(I know it isn't encryption, but still). Now a few weeks later I discover about SHA3. I hear this is more secure so implement it in my code. Reading on the tutorial on the SHA3 module I am using to add SHA3 to my code, I see there is such thing as SHAKE. With searching all I can find is Weed growing forums. So I want to know:

What is Shake? Is it like a SHA hash?

Is there an algorithm that is used to make hashes? Or are hashes made some other way?


texts: Pseudo preimage for a hash made from a cipher

texts:
Consider the Miyaguchi–Preneel construction:

$H_0 = E(0,m_0) \oplus m_0$  (0 here means a vector filled with zeros)

$H_1 = E(H_0,m_1) \oplus H_0 \oplus m_1$

where $E(K,M)$ is a block cipher (for example AES), $m_0, m_1$ are messages.
What's the best way to find messages $m_0$, $m_1$, such that $H_1$ will have a given prefix? $prefix(H_1, len(P)) = P$? Is there a faster way than birthday paradox?


texts: Hide the presence of a key in a key-value storage

texts:
Problem: I want to build a key-value storage in such a way that it would be impossible to detect a presence of a key in the storage by inspecting it. In other words, any read operation with any valid key always returns a valid-looking value, and without additional knowledge about value it is impossible to say if this key was ever written to the storage, or is it a plain garbage.
Such kind of storage is possible. For example, a simple (but space consuming) approach would be to create a storage and pre-fill all possible valid keys with random values. Write operation replaces the existing value with the new one, delete operation replaces the existing value with a random one. Then just by looking at the storage it is impossible to tell which keys actually contain written values, and which just store a random garbage.
But this of course is impractical for large enough key space.
I suspect that there could be a more practical solution.


texts: Are collision-resistant hash functions even possible? [see description]

texts: Surely there can be no real collision resistant Hash function since hash values are of finite size which means there are finitely many of them, but there are an infinite number of messages we could hash, which means (using the pigeon-hole principle) that some messages must lead to the same hash value.


texts: In HMAC-MD5 Implementation, why "i_key_pad" and "o_key_pad" if They Are Public and Constant?

texts:
Please Consider: English is My Second Language

This Wikipedia article on HMACs shows a part of a HMAC-MD5 implementation making use of i_key_pad and o_key_pad:

# [...]

def hmac_md5(key, msg):
    if len(key) > blocksize:
        key = md5(key).digest()
    key = key + bytearray(blocksize - len(key))
    o_key_pad = key.translate(trans_5C)
    i_key_pad = key.translate(trans_36)
    return md5(o_key_pad + md5(i_key_pad + msg).digest())

# [...]

I really don't know how to even search this further, by I think I understand why they are used (padding). However I was wanting to find out if they also play a role in making the function more secure, and if so, why and how, if they are constant and public?

I could probably do the reading myself; I did try to search for this, but it seems such a specific topic that I, not being a native English speaker, could not find the appropriate English term for further research: if anyone could be kind enough to provide a link or a pointer, I shall be pretty appreciative.


texts:
Problem Overview

I want to securely store log files so the contents are secret, and they can't be modified without detection.

The files will be encrypted using authenticated encryption (AES in GCM mode), with a random IV and symmetric key for each file. The symmetric key will be encrypted using the public part of an RSA key pair. Both the IV and encrypred symmetric key will be included in the additional authenticated data.

This gives me confidentiality, integrity and authenticity - but only for each individual log file.

For example, let's say I have log files 2013-01-01.log, 2013-01-05.log and 2013-02-09.log - an attacker could delete 2013-01-05.log without detection.

I've come up with 2 possible solutions.

Possible Solution 1

The program could maintain an encrypted (and possible RSA-signed) 'counter file', which would contain a sequence number that would be incremented every time we write a new log file. The sequence number would become part of the log filename, and would also be included in the additional authenticated data. We could therefore detect any 'gaps' from missing files.

Possible Solution 2

The program could maintain an encrypted (and possible RSA-signed) 'database file', which would contain the filenames of all previously written log files. We could therefore detect any 'gaps' from missing files.

The Question

I'd like feedback on my 2 possible solutions - do they work, do they need some changed, have I missed anything?

Or are there better solutions to my problem?


texts:
I am looking for an application (Windows) or code example that might help me find patterns in an encrypted file.  I have a ciphertext for which I want to see when a key is repeated.  I am not trying to break the encryption - just test for when a pattern repeats if it does so.

I've searched, but haven't found anything yet.

Thanks.!


texts:
The diffusion property of a cipher defined by Shannon refers to the ability of a cipher to cause a lot off bits in the cipher text to be modified, when even a single bit in the plaintext is flips.

However, in stream ciphers – when the cipher text is the xor of the plaintext with the key pattern – a flip in the plaintext will always cause exactly one bit modification in the cipher text.

Does this mean that stream ciphers have a low level of diffusion?


texts:
Random keys are often produced using high-quality random generators. Assuming a key produced for a symmetrical cipher, this means that the number of zeros and ones in the key will, on average, concentrate on about half of the key's length.

Having this in mind, is it anywhere more profitable to start a brute-force attack from bit patterns with similar population counts (that is, with similar counts of ones and zeros)? Will this increase the probability of success?


texts: Name of specific cryptography property of XOR

texts:
Given

$C$ = M $\oplus$ K1 $\oplus$ K2 $\oplus$ K3

One can decrypt $C$ in any sequence, like:

$C$ $\oplus$ K1 = M  $\oplus$ K2 $\oplus$ K3

$C$ $\oplus$ K1 $\oplus$ K3 = M  $\oplus$ K2

$C$ $\oplus$ K1 $\oplus$ K3 $\oplus$ K2  = M

Or:

$C$ $\oplus$ K2 = M  $\oplus$ K1 $\oplus$ K3

$C$ $\oplus$ K1 $\oplus$ K3 = M  $\oplus$ K2

$C$ $\oplus$ K1 $\oplus$ K3 $\oplus$ K2  = M

Notice that on the 1st decryption we started with XORing with K1, and on the 2nd we started with K2.

If we were to use AES, as far as I understand, you would have to decrypt in the same order as you have encrypted.
Given:

$C$ = $AES(AES(AES(M,K1),K2),K3)$

If you were to decrypt in the following manner for instance you would not get M:

$AES^{-1}((AES^{-1}(AES^{-1}(C,K2), K1)),K3) \neq M$

On the other hand:

$AES^{-1}((AES^{-1}(AES^{-1}(C,K3), K2)),K1) = M$.

My question:

1) What is the name of the property which allows a cypher to be decrypted in any order after encrytpion (like in XOR).

2) Are there common cypher (not including XOR) which contain this property (assuming K1,K2,K3 are known to different actors and cannot be shared).


texts: Does the XOR operator provide diffusion if the right side of plain text is XORed against a round key which is then XORed against the left side to produce that side of cipher text, for example in a Feistel cipher.


texts:
I have provided a diagram of a Galois type LFSR. I am told it outputs a sequence of period 31.

Find the sequence output by this LFSR.

By applying the shifts I got the seemingly trivial answr of $0,0,0,0,1$ which I know must be wrong since it has a period of 31. Where have I gone wrong?


texts:
I'm quite new to this topic and have several questions concerning HMAC and NMAC:

Why does NMAC need two keys? How can it be attacked if we just used some sort of initialization vector instead of the first/second key?
What is the purpose of ipad and opad in HMAC?
What if the key is longer than the block size?
Can the key be longer than the number of input bits of a hash function?


texts: Access control problem in oblivious transfer

texts:
I am not sure whether the title is proper or not, but this question comes to my mind when I was reading $k-n$ oblivious transfers.

In a $k-n$ oblivious transfer (OT) protocol, a party A has $n$ messages and another party B wants to retrieve $k$ of them. There are two basic requirements for OT:

A should not know which $k$ messages are retrieved by B.
B should not know other messages besides the $k$ messages.

Then, does B have access right to all the $n$ messages?

If B does not have the access right, B can retrieve any $k$ messages. In this case, B can actually retrieve all the $n$ messages.

If B does have the access right, why do we need OT. B can simply retrieve all the $n$ messages, since existing OT schemes require $O(n)$ communication overhead.

With this question in mind, it is hard for me to think of any practical scenarios where OT can be utilized. Can anyone give some application examples of OT?

EDIT: I found that there are some research papers about access control in OT. Still, the problem I asked above is mainly in the scenario of information retrieve where access control seems very important. I am interested in other possible applications where OT without access control can be utilized.


texts: Where to store sensitive keys in a device?

texts:
I am working on some security features that should be executed by the firmware of a consumer device whose communication to a server must be secure.

Any exchange of data is based on symmetric cryptography, with keys created by "Elliptic Curve Diffie Hellman Key Agreement".

For reasons of cost, a dedicated hardware security module (HSM) was omitted. Instead, all cryptographic algorithms are executed within the board firmware, additionally supported by powerful hardware accelerators directly on the MCU to handle AES and ECC.

All RAM and used flash memory is internal to the MCU.
JTAG interface is disabled.
No external memory is used.
Beside of executing directly within the firmware, all cryptographic algorithms are state of the art.

The open question is, where to store sensitive keys:

Is it acceptable from a security point of view, to keep private and symmetric keys in the MCU's flash memory, since there is no way to penetrate from outside, except perhaps the monitoring of power consumption as a side channel attack? To be more secure, all these keys are additionally encrypted by a unique device key, to be created upon factory startup. However, I feel, because this device key is also kept solely within internal flash that this gives only very little additional security.

What considerations should be considered to verify whether such an approach will fulfill standard security requirements or not? What would be the right way without using a dedicated HSM?


texts: RSA factorization for special primes $p$ and $q$


texts: Is there a digital time-stamping scheme that does not rely on a time-stamping authority?

texts:
Given a bit string, is it possible to assign it an immutable time stamp that is verifiable as correct without assuming a (one or more) trusted time-stamping authority? A time-stamp is correct if it is within delta milliseconds of the creation of the (instance of the) bit string, for some fixed but small delta. The creation time of a bit string is chosen by its creator / owner (but it is immutable once stamped).

To start off the discussion, I suspect that there will be a need to connect to some sort of physical information source (a la atomic clocks, resistor noise, radioactive half-life etc.) and make some clever use of it.

If it is not possible, I would like an argument that exposes the fundamental barrier.
If it is possible, I would like an exposition of the main idea and links to papers or patents for details.

I apologize if my question has a simple answer that my novice mind has  missed.

Thank you for considering my question and I appreciate your spending any  cycles on a stranger's query.

Update 1: When I say that the creator of the bit string may choose the timestamp, I mean that they can choose when to timestamp the bit string. If they decide to do so at some time t, then the bitstring must be time-stamped to show time t (within delta). It does not mean that the creator can choose any timestamp in the past or future. Such arbitrary stamping must be impossible in the scheme, of course.


texts: As an analogy to asymmetric key encryption, does the following work? If not why not?

texts:
public key... a padlock (anyone can lock it)

private key... the key to the padlock (only key owner can open it)

Alice and Bob each have their own padlock and key

Anyone can get a replica of any padlock (public key) but only the padlock owner can open it (private key)

Alice sends Bob a private message:

Alice locks a box with Bob's padlock (public key)
Only Bob can unlock it.

Bob wants to be sure the box came from Alice:
(Bob gets Alice's signature)

Bob sends box to Alice locked with her padlock
Alice unlocks it, then puts Bob's padlock on instead, and sends it back to Bob
Bob sees only one padlock which he unlocks with his key. He knows that Alice had the box as only she could have taken her padlock off.


texts: Creating multiple independent keys for cascading - recommended approach?

texts:
I would like to use cascading encryption with 3 algorithms in a similar fashion to Truecrypt, so for example:

Encrypted = AES( Twofish( Serpent(Secret, key1), key2), key3)

The aim of this is of course simple: if 1 algorithm is broken, the other(s) still provide security.

But what is the best approach to derive each key independent from each other, from the one passphrase? It was not obvious to me from TrueCrypt source how they did it, my websearches have failed, and understandably from that result it seems there are very few discussions so far on crypto stackexchange in regards to generating multiple independent keys.

I'm asking for suggestions, not making any recommendations, but in Applied Cryptography Bruce Schneier mentions how to derive an independent key that can be used to check if a key is valid, which if I'm understanding correctly is approximated as this:

KeyVerify  = Hash(password . salt)               // stored only for verifying but not used
RealKey    = Hash(KeyVerify . password . salt)   // actually used

Note: KeyVerify is independent from RealKey, but not vice versa

So I'm wondering if that approach might be of use, but I'm not confident how to extend it ... for example, something like this maybe?

RealKey2    = Hash(RealKey1 . password . salt) // for 2nd cipher
RealKey3    = Hash(RealKey2 . password . salt) // for 3rd cipher

Seeing as the KeyVerify/RealKey example shows a one-way line of independence, I'm guessing that the order the keys are used in is also a fundamental part of the solution.


texts: Which block cipher mode(s) is most appropriate in these applications?

texts:
I have a few questions I'm stuck on for a cryptography course I'm doing, any help would be much appreciated.

The first application is for decryption on a multicore processor. I assume any of ECB, CBC, CFB or CTR would be suitable since decryption would be faster when performed in parallel, but are any of them significantly more suitable than the others and how?

The second is where it is preferred/desired to use a processor's idle time for precomputing encryption or decryption tasks before the plaintext or ciphertext is available. Not really sure how to tackle this one.


texts: What is the correct name for bytes which are to be signed?

texts:
I have some bytes, and I sign them with my private key using ECDSA. The resultant (71) bytes are the signature.

But what is the name of the bytes I have signed? (If this were encryption, they would be called "plaintext".)


texts: For hardware encryptions, is it possible to know the key by analysing the hardware?

texts:
For example, Square reader uses hardware encryptions when swiping credit cards.

Is it possible to know the key that is used by the hardware encryption cipher by analysing the hardware circuitries?

The key has to be somewhere in the hardware, right?


texts: SHA-1 collision for strings of two symbols

texts:
Is it possible to have strings of two (Unicode) symbols with equal SHA-1 hash?

For example, smth like "ab", "ba".


texts: Does using a snapshot of running PID on Linux provide enough entropy?

texts:
I am thinking about running the following linux command on each boot to generate a new random token each boot.

printf '%s' "$RANDOM"`ps -e` | md5sum | cut -d ' ' -f 1

The first part takes a string from the shell's $RANDOM variable and then from ps -e snapshot of every running process and PID at the moment.
The second hashes the string.
The last part simply cleans up the string by removing the trailing space-dash outputted with the hash.

Is this enough to generate a quick random string with enough entropy?


texts: Why does the PKCS1 RSA private key structure contain more than just exponent and modulus?

texts:
The ASN.1 spec for the PKCS1 RSA private key format is as follows:

RSAPrivateKey ::= SEQUENCE {
    version           Version,
    modulus           INTEGER,  -- n
    publicExponent    INTEGER,  -- e
    privateExponent   INTEGER,  -- d
    prime1            INTEGER,  -- p
    prime2            INTEGER,  -- q
    exponent1         INTEGER,  -- d mod (p-1)
    exponent2         INTEGER,  -- d mod (q-1)
    coefficient       INTEGER,  -- (inverse of q) mod p
    otherPrimeInfos   OtherPrimeInfos OPTIONAL
}

As far as I understand, only the modulus and public exponent are required for encryption, and only the modulus and private exponent are required for decryption. Why does the key file contain all these additional fields and what are they used for?


texts:
Is it necesary to introduce noise in building fully homomorphic encryption?

At present, almost all formally published FHE schemes are based on noisy approach. However, there are some noise-free FHE constructions posted at ePrint or arXiv. But all these noise-free FHE schemes have not been formally published, due to --- partially --- lack of provable security reductions. Gentry also published his position paper "Computing on the edge of chaos: Structure and randomness in encrypted computation" in ECCC. These progress urges me to think the above question.


texts:
Can anyone explain why CBC-MAC is not secure for variable length message?

I read many books, but there are still some confusion. Such as the highlighted parts in previous pictures

Questions:

why need to set $T''=C_0$?
why $T'''=T''$. How to prove this relationship?
$new\ message = P_0,P_1,(P_0 \oplus T')$?


texts: On a lower bound for the birthday problem

texts:
I'm now familiar with a lower bound for the birthday problem as exposed in the theorem A.16 of Katz and Lindell book (alternatively see this webpage).

If one denotes by $C(q,N)$ the probability of collision when taking elements independent and uniformly distributed from a set of size $N$ The bound is obtained by assuming $q \le \sqrt{2N}$:

$C(q,N) \ge \frac{q(q-1)}{4N}$

However, the bound that I has been hold in my class is (without the inequality assumption in $q$):

$\forall N \in \mathbb{N}.C(q,N) \ge \frac{(q-1)^2}{2N}$

How can I prove this bound correct?


texts: Zero knowledge proof of symmetric keys and encrypted texts resulting in the same text, if the symmetric keys are encrypted with asymmetric ones

texts:
Suppose I have:

text T,
symmetric keys X, Y
encrypted text T with symmetric keys X, Y = TX, TY accordingly
asymmetric key Z, used to encrypt X, Y to transmit them to a person. Let the encrypted symmetric keys be ZX, ZY.

I want to prove that:
The result of decrypting TX using X equals the result of decrypting TY using Y.
I will provide ZX, ZY, and TX, TY.

Is this possible?
Are there some other alternatives for this purpose? (the purpose is to prove that given two different keys and encrypted texts they result in the same thing - but without compromising the keys themselves)


texts: Questions about Private Oblivious Transfer Protocol

texts:
The receiver R chooses $a,b,r$ and computes as follows:

If σ = 0 then $A = (g^a, g^b, g^{ab},g^r)$.

If σ = 1 then $A = (g^a, g^b, g^r, g^{ab})$.
R sends $A$ to S.
Denote $(x,y,z_0,z_1)$ the tuple received by S. Then, S checks that
$(x,y,z_0,z_1)\in G$ and that $z_0 \neq z_1$. If not, it aborts outputting ⊥.

Otherwise, S chooses random $u_0,u_1,v_0,v_1$($\in{1,2,...,q}$) and computes the following four values:

$w_0 = x^{u_0}·g^{v_0}$,    $k_0 = {z_0}^{u_0}·y^{v_0}$

$w_1 = x^{u_1}·g^{v_1}$,    $k_1 = {z_1}^{u_1}·y^{v_1}$

S then encrypts $m_0$ under $k_0$ and $m_1$ under $k_1$.....

Here are my questions: Is it must necessary to choose random $u_0,u_1,v_0,v_1$, and what if  $u_0 = u_1, v_0 = v_1$, in which situation the OT protocol seems work well and property of privacy keep unchanged.


texts: Security of HOTP over an unencrypted channel for controling an actuator

texts:
I have a simple on/off actuator that I want to control remotely. I want to use available hardware: a pair of microcontrollers connected to a pair of wireless transceiver modules.

Can HOTP algorithm be used over an unencrypted channel securely?


texts:
Given 2 messages $m_1$ and $m_2$, in a chosen prefix attack, we want to find $s_1$ and $s_2$ such that:

$\text{MD5}(m_1 || s_1) = \text{MD5}(m_2 || s_2)$

Are $s_1$ and $s_2$ found by brute force or are there some rule(s) to construct $s_1$ and $s_2$ based on $m_1$ and $m_2$?


texts: What's the most secure way to derive a key from a password repeatably?

texts:
I'm trying to write a cloud storage application where everything the user uploads is unreadable by the server, encrypted client-side before being sent.

Currently, the flow looks like this:

User inputs password
Password is salted and a 256-bit SHA-3 hash is taken
A new true-random key is generated
The password hash is used as a key to encrypt the random key and IV (AES-256-CCM)
The encrypted copy of the random key is sent to the server for storage
When the user logs in, they download and decrypt this, again with the password
The random key/IV pair is used to encrypt user files

How bad is it that I'm using a hash with a fixed salt as an encryption key? Is there a better way to do this? The problem is just that I need each password to generate exactly the same key each time, and I didn't see how to do that without a fixed salt, and indeed, a fixed IV in the encryption action.

Also, if it isn't clear why I'm using this key to encrypt another key, my thought is that the second key is significantly more random (minimum 4500 passes of PBKDF2), plus it provides the potential to change the password without having to re-crypt every single user file.


texts: How to solve Columnar Transposition Cipher without a key

texts: I have been given a 77 character message for decryption, but no matter where I look all the Columnar Transposition scripts out there are all requiring of a key. I believe the number of columns to be 7, but I am looking for a code that output all permutations of those 7 columns so that I can use a dictionary attack to find the messages that have readable words in them and reduce the number of outputs to look through.


texts: AES - Finite Field Multiplication on 8 Bit Platform

texts:
Section 4.1.1 "Finite Field Multiplication"(page 53) of "The Design of Rijndael", it states

How the equation 4.1 has been formed and transformed into equation 4.2?

In section 2.1.6 "Polynomials and Bytes"(page 15), equation 2.27 and 2.28, highest power of x is 7, whereas in above equations 4.1 and 4.2, it is 8. How?

In next line it states

  The multiplication by 02 is denoted xtime(x). xtime can be implemented
  with a shift operation and a conditional XOR operation.

From Equation 2, it seems all values have been given left circular rotation by 1 bit, but what is Conditional XOR? How this multiplication can be implemented with a shift operation and a conditional XOR operation?


texts: Understanding the Definition of Most Significant Bits in the Hidden Number Problem

texts:
Boneh's and Venkatesan's "Hardness of computing the most significant bits of secret keys in Diffie-Hellman and related schemes" defines the Hidden Number Problem (HNP). The HNP shows that computing the most significant bits of a Diffie-Hellman shared secret is as hard as computing the entire secret.

The paper defines the function $MSB_{k}(x)$ which I originally interpreted to be the $k$ of $x$ most significant bits (e.g. $MSB_{2}(13)$ should be  $11_{2}$). However, the paper uses the following definitions:

  Given a prime $p$, we define $MSB_{k}(x)$ as the integer $t$ such that $\left(t - 1\right) \cdot \frac{p}{2^{k}} \leq x \lt t \cdot \frac{p}{2^k}$.

  For convenience we will sometimes assume that $MSB_{k}(x)$ is an integer $z$ satisfying $|x - z| \lt \frac{p}{2^{k+1}}$.

I'm struggling with these definitions for a few reasons:

These inequalities can have a set of possible solutions but the $k$ most significant bits of $x$ should just be a single $k$ bit solution.
These definitions rely on a prime $p$ but $x$'s most significant bits are independent of $p$.

From my research it sounds like these definitions are a bit more "flexible" then the definition that I have in mind but I don't intuitively grasp how the flexible definitions relate to the definition have in mind.


texts: Does public key encryption support a large message size?

texts: I'm somewhat new to encryption. I see that the actual RSA sizes are 1024 and 2048? Can those key sizes support data blocks of 128 MB?


texts:
The Poly1305-AES paper summarizes the MAC as

$$ \mathrm{Poly1305}(m, \mathrm{AES}_k(n)) = {H_r(m) + \mathrm{AES}_k(n)} \mod 2^{128} $$

Can I presume that $+$ here is just meant as a form of 16-byte mixing $H_r(m)$ and $\mathrm{AES}_k(n)$, and that XOR would be equally effective (since both already are 16 bytes)?

Now following from that, if I were to use Poly1305-ChaCha, could I simply append $H_r(m)$ to the plaintext and XOR it with the cipherstream just like regular plaintext? Because the cipherstream is already a function of the key and the nonce this seems safe.


texts: Diffie-Hellman private key recover with non-prime modulus

texts:
Say we have a classic Diffie-Hellman key exchange. We have the following parameters of a public key:

p,g,y

Where $p$ is the modulus, $g$ is the base, $y$ is the public key, and $x$ is the private key in the following equation:

$y = g^x \bmod p$

It happens that the modulus is a composite number, which can be factored into primes.

How can someone find $x$, thus solving in the discrete logarith problem (DLP), by factorizing the modulus into primes, and solving the smaller DLP's with the primes, then combining them with chinese remainder theorem?


texts:
I have a problem with EC public key reading from smartcard using pkcs11 library.
With the secp256r1 EC algorithm, I always get 65 or 67-byte length public key with different smartcards. But with the ePass2003 token, the length of the public key is 61 bytes. Using the pkcs11 library all sign and verify methods work fine with these pair keys(so it seems key pairs are OK), but when I read public key I get 61 bytes.
I tried opensc for double testing. There is also EC_POINT is 232 bits with ePass2003, whether 256 bits with Safenet 5110.
You can see opensc keygeneration command and result below:
"C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool.exe" --modul C:\Windows\System32\eps2003csp11.dll --login --login-type user --keypairgen --id 1 --key-type EC:secp256r1
Using slot 0 with a present token (0x1)
Logging in to "ePass2003".
WARNING: user PIN to be changed
Please enter User PIN: Key pair generated:
Private Key Object; EC
  label:
  ID:         01
  Usage:      sign, derive
  Access:     sensitive, always sensitive, never extractable, local
Public Key Object; EC  EC_POINT 232 bits
  EC_POINT:   a6ea6b9ce6bd0e086f029b082e1a4096062b79293b782bb0d255363994fd846e93ef0950a1338fa2106769a46f692da9a1607cd98a68b42b85a1ab47c9
  EC_PARAMS:  06082a8648ce3d030107
  label:
  ID:         01
  Usage:      encrypt, verify, wrap, derive
  Access:     local

And it is the same code for Safenet 5110 token below:
"C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool.exe" --modul C:\Windows\System32\etpkcs11.dll --login --login-type user --keypairgen --id 1 --key-type EC:secp256r1
Using slot 2 with a present token (0x2)
Logging in to "GlobalSign SafeNet Token".
Please enter User PIN: Key pair generated:
Private Key Object; EC
  label:
  ID:         01
  Usage:      decrypt, sign, unwrap, derive
  Access:     sensitive, always sensitive, never extractable, local
Public Key Object; EC  EC_POINT 256 bits
  EC_POINT:   0441044de0b0df2e13f532240a9c3dd8123c86963ee7e456e62c4be767ff76a74ee935ba431a4d6159db031377d0a1e9cf2fc0b4e818912e9cfc124bc90c13f5b055c7
  EC_PARAMS:  06082a8648ce3d030107
  label:
  ID:         01
  Usage:      encrypt, verify, wrap, derive
  Access:     local


texts: How to deal with concrete security against lots of queries?

texts:
In general, $O(1/\epsilon^2)$ queries are required to distinguish between two distributions that are statistically close at most $\epsilon$.
This informal state deals with the required number of queries to distinguish between two distributions. However, I cannot find any statement that when we have $Q$ queries, then we can distinguish two distributions under some $P$ probability.
I have a few questions about some common knowledge in cryptographic fields.

How can I formally write the statement about concrete security against lots of queries?
How we set parameter to be secure against adversaries allowed $Q$ queries? As standard decision problems, adversary has a negligible advantage?
Why NIST PQC standardization recommend parameters to be secure against number of queries $2^{64}$? Is there a special reason? What is implicit consensus relate to $2^{64}$?


texts:
$$m^{ed} \equiv m \bmod n$$
$n =pq$, so by Chinese Remainder Theorem it is equivalent to
$$m^{ed} \equiv m \bmod , m^{ed} \equiv m \bmod q$$
where $n=p\cdot q$
So how did 2 come from 1 by the Chinese remainder theorem?
I know Chinese algorithm but How did $m^{ed} \equiv m \bmod p$ and $q$ come?


texts: A Question about Irreducible Polynomials


texts: How to detect what crypto-method is used by Filecoder.Q?

texts:
I have 2 different images, one original, and one locked by a malware detected by eset as "Win32/Filecoder.Q".

How to detect the encryption method that is used and the key, that is not using any public key/rsa/rc4 algorithm. There is diff:

If needed I can attached files (locked and original).


texts: How can we distribute Shamir's secret sharing scheme shares without a dealer?

texts:
Let's say $k$ users have shares to a $(k,n)$ secret sharing scheme, and they want to issue new shares. How can they do this without collecting the shares together?

In particular, no set of $k-1$ users (including the new users) should be able to learn the shared secret during or after the share generating process. There is also no trusted third party.

One way to do this is by doing a secure multiparty computation. Is there a way to accomplish the task without a general multiparty computation scheme?


texts: Side-Channel attack on RSA decryption using comparison result with p,q?

texts:
I was pointed to whether we could learn the secret key of RSA by repeatedly using following side channel:

We assume that there exists a side channel in RSA decryption using CRT that, if the most-significant bits of the input x (down to about half the size of x) are zero, reveals if:

$$x \bmod p > x \bmod q$$

Can we learn the secret key through that side channel?


texts: Attack on Cipher with Highly Related RoundKeys

texts:
Consider a variation of AES with modified Key-Schedule and following observation on the Key Schedule.

If there exists a relation d between two Master keys, the key schedule is so weak that all sub-keys generated from the master keys have a relation d

Then how this aspect of a cipher can be exploited in the following scenarios?

Distinguish Ciphertext from Random Text
Partial Key Recovery
Full Key Recovery

Any guideline or reference to papers explaining the basics of such attack is appreciated.


texts: $(\epsilon, \delta)$-differential privacy: main motivation of $\delta$

texts: I am wondering why (not how) we relax $\epsilon$-differential privacy to $(\epsilon, \delta)$-differential privacy. Is the main motivation to reduce the variance of the noise added to the query with a slight sacrifice from the strength of privacy?


texts:
I am implementing Shamir's secret sharing scheme on arbitrary binary files.  I don't intend to use this; this is a project to help me explore cryptography.  In setting up the finite field arithmetic, I chose my field to be GF(257).

My understanding is that a prime GF is needed to ensure that a single modular inverse exists for each value in the field (this conflicts with the answer to How can Shamir's method for secret sharing work in the GF(256)?).

Can someone explain this discrepancy?


texts: Is it possible to perform a rudimentary asymmetric key encryption algorithm by hand?

texts:
I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers.

First, I was recently demonstrating to a 12-year-old how encryption works. I created some basic cyphers and had him figure them out. (I recommend this; it's quite fun.) Wanting to up the ante, I looked for ways to send messages back and forth using public-private key encryption, and I failed with flying colors.

Second reason for wanting this is that it would really help me understand how asymmetric encryption works. At the moment, I can't figure out a way to do solve this on my own, and I feel that betrays my lack of understanding in the subject.

Finally, (this one may be a stretch) I'm writing a fantasy story, and I'd like to do something unique with the form of exchange. One thought was to have a memorized key that the owner held, which she would use to sign her (paper) payment of 30 units for a loaf of bread, or whatever, combining her key with the shopkeeper's public key. (UPDATE: Note that this gets into digital signatures, rather than asymmetric key encryption. I'm hoping they are related, but if they're not, forget it.)

Any ideas how to accomplish this? If it's simply not feasible, I would appreciate an explanation as to why.

There are two similar questions on this site, but neither of them address asymmetric key encryption, unless I'm more misinformed than I thought:

Is there a secure cryptosystem that can be performed mentally?
What is the most secure hand cipher?


texts: Elliptic curve group over a prime finite field $F_p$

texts: If $p$ is a big prime, and the elliptic curve $E$ is defined over $F_p$ by the equation $y^2=x^3+ax+b$ where $a,b\in F_p$. The point on $E/F_p$ together with the infinite point $\mathcal{O}$ form a group $G=\{(x,y):x,y\in F_p;(x,y)\in E/F_p\}\cup\{\mathcal{O}\}$. Then  is $G$ a cyclic group? what's the order of $G$?


texts:
Studying the bls signatures,  I am wondering how in practice should we handle the parameter G.

In many signatures scheme,  the generator used is a well known constant,  for example eddsa with ed25519 has a well known fixed  generator g. However, in the bls example from the C source code of the pbc library of Dan Boneh they generate a random G. In the literature they suppose the G is known by all parties. In jPBC sources , they save that system parameter G to a file.

Is there not a well defined constant G somewhere so client / signers don't have to exchange that value?

If I were to deploy a bls signature system,  how would I chose this G? There does not seem to be any constraint over this system parameters since it's taken at random.

Do I include it in the signature and generate a new one for each signature? (providing more randomness at the expense of a bigger size?) or should I generate one element at random and call it G and make it public? Or save to a file and maybe have multiple files for different recipients ?


texts: Encryption of plain text using stream cipher algorithm

texts: We know that in stream cipher algorithms plain text and generated key are Xored byte by byte. Generated key depends on how much plain text there is and on that basis key will generate and plain text is encrypted. So my doubt is I am using the latest stream cipher algorithm that is Rabbit and encrypting plain text using the Rabbit stream cipher so in that Rabbit's input key is 128-bit and after all operations output will be a 128-bit key that will Xored with Plain text and give cipher text. As here output is fixed 128-bit so if our data is more than 128-bit then how it will encrypt data? Do we have to do padding with our plain text to make it a multiple of 128-bits?


texts:
I'm trying to get my hands on the key that OpenSSL uses for a DES encryption. The key is based off a random number generator with a seed taken as parameter.

The code used is below, provided as part of my assignment. I'd like to get my hands on DES_cblock key both for debugging and to understand how the OpenSSL works. And also to XOR the key back with the encrypted text.

But how do I work with the DES_cblock data type? Is there a way to print a DES_cblock? Can I get the bits so that I can XOR it?

Thanks for any help!

void encrypt(uint32_t seed, const string& plaintext) {
    DES_cblock iv, key;
    DES_key_schedule schedule;
    srand(seed);
    for (int i=0; i<8; i++)
      key[i] = (unsigned char)rand();
    for (int i=0; i<8; i++)
      iv[i] = (unsigned char)rand();
    DES_set_odd_parity(&key);
    DES_set_key_checked(&key, &schedule);
    int fd = open("des.enc", O_CREAT|O_TRUNC|O_WRONLY, S_IREAD|S_IWRITE);
    if(!fd) {
      cout << "Could not open des.enc" << endl;
      exit(1);
    }
    DES_enc_write(fd, plaintext.c_str(), plaintext.size(), &schedule, &iv);
    close(fd);
}


texts: Testing hash functions for collision resistance

texts:
I was hoping to implement a software that allows testing a user-defined hash function for cryptographic properties (Meant to pique interest in cryptographic hash function for a school showcase), as well as compare them with well-known hash function to identify their hash functions strong points & weak points. However the property collision-resistance got me into a bit of a pickle.

The first obvious thought that occurred to me was the Birthday Paradox Attack, where given that we only with to find an instance of a hash collision
(henceprob of hash collision should assumed to be 0.5 or above)
thus if the hash function finds a collision on 2^(n/2) operations consistently.

The second option that I considered was to count the length of the hash value & determine the size of the pool for all possible hash values. From there on we prepare a plaintext list of that size to check if the hash values are distributed evenly across the hash value space.

The problem with the two proposed solution I given was that given that the hash value length is significantly large (256 bits or more) this might prove to be an hassle given the large amount of brute force needed to thoroughly check for collisions. Also I was hoping for a more refined way to identify their hash functions flaws.

I am currently looking at length extension attack, the way it functions sounds like a type of differential cryptanalysis attack, I was hoping that I can use this to derive a collision using the padding exploit. (By understanding how they pad. maybe I can use the same type of trick to result in a collision, am still unsure of how exactly it works so I might be completely wrong here)

Other than the methods mentioned above, is there any other ways that I can accomplish this?


texts: Can we use the same frame counter in A5/2

texts:
Let we have three encoded messages with length $3*456$ bits in A5/2 encryption. Can we use the same frame counter in the encryption process or we must use different?

(E.g. this because in the below attack, attacker consider same 22 bits frame counter in the encryption and decryption algorithm with three messages. )

https://www.npag.fr/project-a52hacktool


texts:
Does anybody know if there's known vulnerabilities in KCDSA/EC-KCDSA?

I have been researching for the past few hours and I haven't found anything. Wikipedia has very limited amount of information and based on the original whitepaper everything is rosy as expected.


texts:
Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64).
I hear it's some sort of OpenSSL interoperability thing: a b c.

Is there some standard reference somewhere (perhaps an RFC?) that explains how such OpenSSL-inter-operable AES-encrypted things are produced and later decrypted?

Ideally, an answer would link to a standard reference for the entire process, or perhaps a brief summary list of steps with a link to a standard reference for each step, something like:

To decrypt such a thing beginning with "U2FsdGVkX1" and with a known password,

first do base64 decoding -- see Wikipedia: base64. The result will start with "Salted__". Be careful not to use C strings, because the result may include several 0x00 bytes.
...
(I guess something about salting and the IV goes here?)
(I guess something about CBC or CTR goes here?) -- see Wikipedia: block cipher modes of operation.
(Perhaps something about message authentication goes here?)
...
AES-decrypt each block with decrypt_one_AES_block( key, block_of_128_bits ) -- see Wikipedia: AES article and A Stick Figure Guide to the Advanced Encryption Standard (AES).
save the result of each decrypt_one_AES_block(), concatenate them all together, and that's your plaintext. If the original was human-readable text or an HTML file, it may be OK to store the result in a C string; but other kinds of things may include several 0x00 bytes incompatible with C strings.

It may sound like I'm planning to write an implementation myself.
I reassure you that I plan to use one of several available libraries -- it's just that when reviewing the libraries, I'd like to know what they should be doing.
What should OpenSSL libraries be doing?

Is there a standard for OpenSSL-interoperable AES encryption?


texts:
A cryptosystem is using AES-128 in CCM mode with random IV.

Suppose an attacker capable of:

asking the cryptosystem to encrypt a single plaintext as many times as he wants; and
asking the cryptosystem if any ciphertext is valid (ie, if it decrypts to some plaintext)

The attacker knows what is the single plaintext that he can encrypt, but he cannot chose a different one to be encrypted. That plaintext is short -- around 50 bytes.

Each time, the cryptosystem will chose a random IV and use it to encrypt the plaintext, giving the attacker a different ciphertext for that single plaintext.

In this threat model, can the attacker "easily" obtain the secret key?
Can the attacker somehow modify the ciphertext in order to change the plaintext it will decrypt to? (he would have to be able to generate a valid MAC, since the cryptosystem correctly checks the validity of the MAC)

What about the same questions, if the attacker is able to encrypt some different plaintexts? He wouldn't be able to chose them, but he would know them. Suppose he can do it for, like, 10's of different plaintexts.


texts:
How many value can have a private key with this format? p,q,d = (19, 41, d) where  1< d <18x40?
I want know how to calculate that.


texts: Additional Data in AEAD (Chacha20-poly1305 libsodium)

texts:
I have recently been playing with Chacha20-Poly1305 in libsodium, and all of the examples state the additional data portion of the tag is stored in plaintext when encrypted. But from what I can tell the AD tag never actually gets put anywhere in the ciphertext. So if I were to simply transfer the ciphertext I would never actually be able to extract the AD portion (which is where I would like to store the nonce). And even if I were to just append the AD portion to the ciphertext afterward I am not certain the best way to retrieve it without doing something like OpenSSL with its Salted__ magic constant.
All of the examples say something like this:
#define MESSAGE (const unsigned char *) "test"
#define MESSAGE_LEN 4
#define ADDITIONAL_DATA (const unsigned char *) "123456"
#define ADDITIONAL_DATA_LEN 6

unsigned char nonce[crypto_aead_chacha20poly1305_NPUBBYTES];
unsigned char key[crypto_aead_chacha20poly1305_KEYBYTES];
unsigned char ciphertext[MESSAGE_LEN + crypto_aead_chacha20poly1305_ABYTES];
unsigned long long ciphertext_len;

randombytes_buf(key, sizeof key);
randombytes_buf(nonce, sizeof nonce);

crypto_aead_chacha20poly1305_encrypt(ciphertext, &ciphertext_len,
                                     MESSAGE, MESSAGE_LEN,
                                     ADDITIONAL_DATA, ADDITIONAL_DATA_LEN,
                                     NULL, nonce, key);

unsigned char decrypted[MESSAGE_LEN];
unsigned long long decrypted_len;
if (crypto_aead_chacha20poly1305_decrypt(decrypted, &decrypted_len,
                                         NULL,
                                         ciphertext, ciphertext_len,
                                         ADDITIONAL_DATA,
                                         ADDITIONAL_DATA_LEN,
                                         nonce, key) != 0) {
    /* message forged! */
}

But in real life you obviously only retrieve the ciphertext and would not have ADDITIONAL_DATA without extracting it. So what is the "standard" way of handling additional data in a AEAD scheme?
EDIT: Got the OpenSSL magic constant wrong.


texts: Zero-knowledge proof using quadratic residue: why two options?

texts: In the zero knowledge proof using QR, why do we even bother with the server sending us $b = 0$ back? As I understand it, the server selects $b = 0$ or $b = 1$. If $b = 0$, then the client (Alice) generates a random number $r$ and sends back $r^2 \bmod x$, while if $b = 1$, then Alice sends back $r^2 \, y \bmod x$. How is $b = 0$ of any value though? Why can't we just stick with $b = 1$?


texts: TLS Extension signature_algorithms values

texts:
I hate asking for a reference, but I'm having a hard time finding this.

The iana page on tls extensions just links me back to rfc5246 where it only has the following values:

enum {
    none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
    sha512(6), (255)
} HashAlgorithm;

enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
  SignatureAlgorithm;

I've got a client hello that I'm looking at here with the following signature and hash extension:

  000d 0014 0012 0403 0804 0401 0503 0805 0501 0806 0601 0201

Where can I find a reference for what these refer to?


texts:
I would like to use a unique encryption key and authKey for each payload that I encrypt and authenticate via AES256 CBC with HMAC-SHA256.  I'm considering the following:

Salt = 32 random bytes, unique to each payload, stored out in the open.
MasterKey = 32  random bytes, chosen once ever, stored securely
EncKey||AuthKey = PBKDF2(MasterKey, Salt, iterations)

Where EncKey will be 32 bytes used as the encryption key to AES256CBC and AuthKey will be 64 bytes used as the hashKey for HMAC-SHA256.

From my reading on crypto.stackexchange.com I understand that HKDF is probably a better function to use for deriving EncKey and AuthKey then PBKDF2 but in the development environment I'm in (.Net) I don't have access to HKDF from an authoritative source.

Is it ok to use PBKDF2 for this purpose?  And if so, is it better to use a high iteration count (like 100,000) or a low iteration count like 1?


texts: Does side-channel attacks offer any difficulty to Stinson's concept of `provable security'?

texts:
Here's a quote from Douglas Stinson:

  “[i]f a cryptosystem can be ‘broken’ in some specific way, then it
  would be possible to efficiently solve some well-studied problem that
  is thought to be difficult. For example, it may be possible to prove a
  statement of the type “a given cryptosystem is secure if a given
  integer n cannot be factored.” [...] [B]ut it must be understood that
  this approach only provides a proof of security relative to some other
  problem, not an absolute proof of security. This is a similar
  situation to proving that a problem is NP-complete [...].”

Source: Stinson, D. R. (2006). Cryptography, Theory and Practice. Chapman
and Hall, CRC, 3rd edition. Chapter 2, section 2.1, page 45.

Say there is a proof that a cryptosystem $X$ satisfies Stinson's definition.  An attacker builds a method to break $X$ by side-channel attacks.  Does that offer any trouble to the definition or to my proof?  Or would you say side-channel attacks have nothing to do with provable security?


texts: Why do we permute the table-entries of a garbled AND gate?

texts:
My problem:

Ana wants to garble an AND gate of a circuit,

A0 and A1 are the two strings used to represent true and false for the input wire A,
B0 and B1 are the two strings used to represent true and false for the input wire B,
C0 and C1 are the two strings used to represent true and false for the output wire.

Explain briefly how Ana computes the garbled table of this gate and why she must permute the table entries.

My attempt to solving this problem:


texts: Is there parameter recommendation of DSA or RSA?

texts:
I know there are recommendations of elliptic curve parameters (such as NIST P-xxx).

Are there recommendations of DSA (or DLP such as Schnorr signature) or RSA parameters?

If not, why?


texts:
The goal is to create a secret S on a trusted server by having users A, B and C each send a private seed to the server, in such a way that any 2 of them can later recover S by resubmitting their corresponding seeds.

Edit: the actual use case is to create a secret that the server can use in memory but won't persist on the disk. If the memory is reset, any two users can collaboratively recreate the same secret in the server's memory (with the possible help of some persistent recovery parameters that cannot, on their own, recreate the secret).

It looks like a "reversed" version of the Shamir Secret Sharing Scheme, where all users start with their chosen share and the algorithm needs to crunch those shares into a secret that meets the threshold recovery criteria.

What is the simplest way to implement such a protocol?


texts: How is it possible for someone to "Protect against Future Unknown Attacks"

texts:
In section 4.4 (page 6) of Camellia: A 128-Bit Block Cipher Suitable for Multiple Platforms - Design and Analysis, it says

  $FL$ and $FL^{−1}$ functions are inserted between every 6 rounds
  of a Feistel network to provide non-regularity across rounds. One of
  the goals for such a design is to thwart future unknown attacks.

How we can thwart against attack which we dont know, or which is yet to be discovered or established?


texts: Brute forcing an elliptic curve encrypted key

texts:
I've been reading about ECC, and what I've established so far (correct me if I'm wrong) is that:

pubKey = privKey * G

where G is some special point on the secp256k1 curve.

Doesn't this mean we could attempt to brute force a private key by using:

privKey = pubKey/G

for all potential values of G.

I know it would require some unfeasible amount of attempts, but what if by chance that one of the first few attempts happened to have the correct value?


texts: Break RSA when modulus is of the form $N = pq$ with $|q^2 - p|$ small

texts:
I need some insight in how to break the following RSA problem:

  From an RSA encryption scheme you know that the algorithm that
  generated the RSA modulus $N$ always outputs moduli of the form $N = pq$ such that the difference between $q^2$ and $p$ is not bigger than $2^8$
  in absolute value.

My question is: Shall I try to factor $N$? Which method should I use if so?

Somewhat related is this question.

Edit:
Solving for $q$, I have that $q$ is between the square root of $p-2^8$ and the square root of $p+2^8$.


texts: How unique and secure are verification codes created from different hashes?

texts:
In order to construct a short, yet cryptographically strong verification code, I'm thinking about using the output of several hashes computed over the same data (device uuids + raw certificate data).

Pseudocode:

char *data[] = [clientUUID + serverUUID + certificateData];
uint16_t dataLength = length(data);
char *verificationCode[15];

sha256Hash[] = sha256(data, sizeof(data));
sha1Hash[] = sha1(data+sha256Hash, sizeof(data)+sizeof(sha256Hash));
md5Hash[] = md5(data+sha1Hash+sha256Hash, sizeof(data)+sizeof(sha256Hash)+sizeof(sha1Hash));

// Store length at start so the size of data can't vary
verificationCode[0] = ((char *)dataLength)[0]
verificationCode[1] = ((char *)dataLength)[1]

// Now fill the rest of the verificationCode with a mix of bytes from the different hashes
verificationCode[2] = sha256Hash[0] ^ sha1Hash[0] ^ md5Hash[0]
..
verificationCode[15] = sha256Hash[13] ^ sha1Hash[13] ^ md5Hash[13]

I'd then present the verification code as base64-encoded string to the user on both devices (computer + mobile device) to verify upon pairing. My thinking here is that it should be computationally very expensive to find a set of data with the same length that generates the same hash results across all three hashes - and hence the same verificationCode result.

However, I also see that using only a portion of the hashes should definitely weaken the protection.

Is a verification code like the one computed above secure for a short time window (think: couple of minutes)? Or is there an established and proven alternative I can use for a short, human-readable verification code ?


texts: Explanation of protocol secure under random oracle but insecure with any hash fuction

texts:
It is known that there is a protocol that is secure in the random oracle model, but where any real hash function makes the protocol insecure.  The proof is constructive, but I could not understand the protocol in question.

Could someone explain the protocol in language that is easier for a programmer to understand?


texts: Shake 128/256 Output Length Restrictions

texts:
Are there any restrictions on the specified output length when using shake-128 or shake-256, to the extent that certain output lengths should be avoided/or not used entirely?

Edit:

If someone decided to declare an output length equal to 1600 bits would there be a full block showing? If yes, is this of any concern?

Is there any issue with SHAKE-256(message,output_size_in_bits)=SHAKE-256(message,1600)


texts: Can some one please express M209 Cipher Machine in terms of LFSR with Diagram or any simple method?


texts:
I have understood the "equivalences" between PRP, PRF and PRG. Now, I just read an statement in my lecture notes that made me think that there has to be a conversion between PRG and computationally secret encryption scheme:

  So, our definition of PRG is sufficient for the existence of a
  computationally secret encryption scheme. Later, we will see that this
  is definition is the right one as PRGs exist if computationally
  secret encryption schemes exist.

This means I can build a PRG from a computationally secret encryption scheme. What is the common and easy way to see this?


texts: Perfect zero knowledge for the Schnorr protocol?

texts: Can somebody explain (or point to a reference) why the Schnorr protocol cannot be proved zero knowledge?


texts: How should we assess the quality of steganography?

texts:
I am asking this question instead of extending the discussion of another question (Perfect Steganography).  I did try starting a chat room (https://chat.stackexchange.com/rooms/87636/perfect-steganography) but nobody knew about it ;-(.

I think that I have achieved near perfect steganography

This is an exceptional claim and should be accompanied by exceptional proof, but I am at a loss as to how to quantify/prove this claim.  I am asking for help with this validation - a refutation would be an acceptable outcome to this question.

The basic method is as follows: The bulk of the image data in the file represents coefficients to the DC algorithm.  These coefficients are routinely pruned to reduce the size and resolution of the image according to the needs of the image compressor.  The level of compression is typically constant across an image, and is chosen for its effect upon size/quality rather than on a rigourously defined process. Indeed many programs use a default quality setting, or allow selection of one of a number of predetermined quality settings.  These settings have different levels of effect on different parts of the image.

By modulating the quality of the image as the image data is traversed I can create a signal that can be interpreted as an array of bytes.  I call this the payload.  (The method has a few subtleties that might best be left for offline discussion.)

The byte array payload from an unmodified jpeg is effectively 'random'. By 'random' here I mean that there is no apparent order - the data is obviously not random as it is related to the image - but the relationship is so indirect as to be ignorable.  By replacing some of the bytes with an encrypted message (effectively more 'random' data) we can hide the message without increasing the apparent order (decreasing the apparent entropy).

As an example here are three versions of the same image one with no payload, one with a short message ("hello World"), and one with the first sentence of 'Lorem Ipsum'

http://vanleersum.uk/downloads/images/Drawing1.jpg
http://vanleersum.uk/downloads/images/Drawing2.jpg
http://vanleersum.uk/downloads/images/Drawing3.jpg

I cannot see a difference, and I would welcome proof that a difference is detectable.  Do not be fooled by the sizes.  The modulation of quality is as likely to reduce the size of the image as it is to increase it.

As a further illustration here are two images:

http://vanleersum.uk/downloads/images/eraseWithZeroes.jpg
http://vanleersum.uk/downloads/images/eraseWithFF.jpg

Where the normally 'random' payload has been set to all ones (FF) or all zeroes.  I would like to emphasise that this is not an encrypted message containing all ones or zeroes, but the underlying byte array that is inserted into the image. This is the most extreme variation I can imagine in the data, but the effect upon the image is negligeable.....

Now, showing you images is no proof at all.  So I provide two apps to play with:

http://vanleersum.uk/downloads/SmugglerMac.dmg  for MacOS
https://play.google.com/store/apps/details?id=uk.vanleersum.smugglerandroid for android phones.

Please can you suggest other ways to test my claim?

Notes as answers to comments:

None of the data involved is truly random.  Every change to every bit has a theoretically determinable effect upon the image. However the variations in the data that lead to variations from the original are all within the variations that could be expected in the output from some unknown but compliant jpeg compressor (or even the same compressor with slightly different settings).
I guess that perfection would require that an examiner with the original and the modified would see no difference.  I do not think that this is easily achievable in my scheme. Any change to any bit of any byte can be detected by a byte compare. So can I limit this discussion to whether the modified file in isolation can be shown to differ from the expected format in a way that would indicate that it contains a message?


texts:
I cannot seem to figure out how the operation table for this permutation is formed. Is it multiplying each index and doing modulus? I can't seem to figure out.

This is a Table 4.2 found in "Cryptography and Network Security" by Forouzan


texts: Distinguishing attack on stream cipher created from a block cipher in counter mode

texts:
A block cipher in counter mode creates a key stream by:

$$z_i = E_K(IV || i)$$

Where $IV$ is some chosen initialisation vector (with some length $l$ less that $n$ bits) and $i$ is the binary representation of the number $i$ in $n-l$ bits. The keystream is then $z_1 || z_2 || z_3 || \cdot \cdot \cdot$

How can we distinguish between such a key stream and a truly random bit sequence?


texts: Where is the authentication tag stored in file encrypted using AES-GCM?

texts:
So I am using cryptopp to encrypt a file in a project and I am using AES-GCM.
I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files.

However, I want to know where the authentication tag is stored? I notice if I specify a tag size of 0 then the encrypted file size is the same number of bytes as the original file.

Is the authentication tag simply appended to the end of the file?


texts: What is KEK and how is used for key sharing?

texts:
i'm trying to understand how the keys are shared on the 10Gbit passive optical network, and i've found that the keys are generated by ONUs or OLT and after shared with AES-ECB with KEK.

What is it this Key Encryption Key, and how is used with AES to share keys?
Thank You


texts: How can an interactive ZKP become non-interactive?

texts:
From my understanding, random oracles (hash functions) are used in the Fiat-Shamir heuristic to generate non-interactive ZKPs. I think I have a good grasp of how interactive ZKPs in this scheme work, but I am still struggling to understand how proofs can become non-interactive, from a high-level perspective.

In the Alibaba Cave example, I understand how interactivity can be used to prove that one party has a secret S. I have seen examples where the prover generates a hash of the solution to predetermined challenges of statistical significance, but how could the verifier recreate the hash of that challenge?


texts: Signature Scheme with proof of data possession

texts:
Most signature schemes first hash the data and than sign the hash. Correct me if I am wrong: The signature does not prove that the signatory was in possession of the document itself? In cases where the document hash but not the document itself is public, anyone could create a signature for the document without having access to the document data itself. Is there any well known signature scheme that gives a proof of data possession?

I am interested on any hints to existing signature schemes that provide proof of data possession at time of signature creations.

My question is if there are any existing well known/reviewed signature schemes that provide proof of data possession. I am not asking how to "roll your own".


texts: From where I should start to study cryptography?

texts: I am preparing for an exam which include cryptography challenges. I got five months to study. But I don't know from where I should start to study cryptography. Please help me. If possible, please describe website names and book titles which are suitable for beginners.


texts:
Let $b_1, b_2, \dots, b_n$ be blocks of a fixed size.
We take our hash function to be $H(x)$, for example SHA1.

What is the result of $H(b_1 || b_2 || \dots || b_n)$?

Edit:

Let me formulate it more clearly.
So I want to know if the following properties (or any other similar property) hold:

$H(b_1 || b_2) = H(H(b_1) || H(b_2))$
$H(b_1 || b_2) = H(b_1 || H(b_2))$
$H(b_1 || b_2) = H(H(b_1 || H(b_2)))$
Associativity (I assume it's not the case)
Commutativity (clearly not the case)

For any hash function like MD5, SHA1, etc.

Edit 2:

Okay, so how are large inputs treated by decent hash functions? Will the blocks be xored, then hashed. Is there a pattern or is it completely different from function to function?


texts:
Why have 4th and 5th steps in Needham-Schroeder Protocol? It is said "These steps assure B that the original message it received (step 3) was not a
replay.". But what is a replay here? And I don't actually get what those 4th and 5th steps do. Send some nonce?

Here is the protocol outline I am looking at (source)

  $$
\begin{array}{ccl}
   1.& A \to S \colon& A,B,N_a
\\ 2.& S \to A \colon&
              \left\{ N_a,B,K_{ab},\{K_{ab},A\}_{K_{bs}} \right\}_{K_{as}}
\\ 3.& A \to B \colon&
              \{K_{ab},A\}_{K_{bs}}
\\ 4.& B \to A \colon&
              \{N_{b}\}_{K_{ab}}
\\ 5.& A \to B \colon&
              \{N_{b}-1\}_{K_{ab}}
\end{array}
$$
  Where $N_a,N_b$ are nonces.


texts:
I am considering building a hardware RNG myself using cheap parts. Is this a good idea and safe enough?

Random sources: amplified Zener noise from one randomly chosen 1N4728A Zener diode and amplified reverse current of a randomly chosen SS9014 transistor.
Random stream generating: The two amplified signals are further amplified and biased with one LM324 chip and sent to analog input pins of an Arduino, and the full 10-bit ADC readings are used as the random source.
Whitening and stream mixing: how to do this on the Arduino's ATmega328P microcontroller?
Uplink: USB Serial.

Anyone have knowledge on how the whitening and stream mixing can be done? And how to evaluate the security of this system?


texts: Is it possible to recover an RSA modulus from its signatures?

texts: Let's say that you have some small number of RSA signatures of known data: you know some pairs $(m_k, c_k)$ such that ${c_k}^e \equiv m_k \pmod n$.  If you know $e$, because probably it's one of $\{3, 17, 65537\}$, is it possible to recover $n$?


texts: Is an android encrypted SDcard readable/decryptable easily by a desktop machine?

texts: If I encrypt my SDCard on my android phone using the built-in encryption software, and my phone dies for whatever reason, would I be able to easily by just using the pin/password to access that data later on my desktops [OS X, Windows and Linux]?


texts: Discrete logarithm problem and the chinese remainder theorem

texts:
Say that $G_q$ is a group of order $q = \Pi_{i=1}^{s} q_i$, where $log(q) = n$ and $q_i$ is an odd prime $\forall i$ such that $log(q_i) = O(log(n))$.
I'm tasked with arguing that $G_q$ is a cyclic group using the Chinese remainder theorem and further to describe an algorithm $A$ that runs in polynomial time and, given a generator $g$ of $G_q$ and and element $y \in G_q$, finds $x \in \mathbb{Z}_q$ such that $y = g^x$.
If i've understood things correctly, this is equal to solving the discrete logarithm problem for $G_q$, which is not possible in polynomial time in general. We obviously depend on some neat trick depending on the structure of $G_q$, which I don't see. Can some generous mind please provide some guidance toward the solution, or at least some hint to where to start?
EDIT: The Pohlig-Hellman algorithm obviously meets all criteria for the DLP in polynomial time, sorry for not realising this sooner. However, I'm still not sure as how to argue that this is a cyclic group using the CRT?


texts: Does having a bunch of plaintext/ciphertext pairs help you break a ciphertext with unknown plaintext?

texts:
Let say we have $N$ ciphertexts and each of them looks like this:

2iob3gRLvabM0QnMtgtMG5y4kCm=2xmLkasBUasLkQkjyQtQ3NFhU5UNkQ95U1nmk5UltxwZt1DltaojkQuHkxyXQI7=GYzYYf7t25ymQd7wtHJ52xWM3NJR3QTLUxmI3IZMU54NkitMGHz=2xmLvQnVtQUBk5Wa

assume it's encrypted URL string and we know output (actual URL) of each $N$ ciphertexts. In addition we know that the key is $m$ digits. So my question is how to assess complexity of breaking the $N+1$ ciphertext?


texts:
I found old key letters used in EFT HSMs with TDES keys, parted in two halfs. The check value printed on this letters is called IBM CV and doubled IBM CV.
My newer HSM does not support this kind of check value. Does anybody know how this value is calculated?
Thanks in advance


texts: Identify similar contents in encrypted data?

texts: Is it possible to compare two ciphertexts (two different encryption algorithms are used to create ciphertexts) to identify redundancy?


texts: Caculated time One Point Multiplication with double and method

texts:
I am using double and add method for point multiplication in affine coordinates. How we compute 1PM in double and method?

Di Wang said one point multiplication consists of repeated addition and doubling operations, so the calculated time of point multiplication

#ADD*1ADD + #DBL*1DBL

more less equals 1PM. But when I calculate with the formula show different result:

#ADD*1ADD + #DBL*1DBL = 127#ADD*2ms + 256#DBL*3ms = 766ms

Actual 1PM = 421ms.

This is a huge difference. Can anyone explain this difference?

Double and add algorithm requires log2(n) iterations of point doubling and addition to compute the full-point multiplication.

So I think that: $2^y = n$ where $y$ is number point addition or doubling

Edited:

Double and Add Method d=11=(1011)
Example : 11P= 2.((2.(2P))+P) + P, it consist of 3DBL + 2ADD. So 1PM less equal to #ADD*1ADD + #DBL*1DBL = 2ADDtimeof1ADD + 3DBLtimeof1ADD = time of 1PM.

If i have d lenghth = 256 bit, and i use Double-and-Method, How many #ADD and #DOUBLE iterations in there? DiWang said 127#ADD and 256#DOUBLE, can somebody explain how get this number?


texts: about entropy and random number generator

texts:
I am reading an article about cryptography of information and Pseudo Random Number Generator. The article said using 1$28$-bit entropy PRNG is safe in some cases of cryptography. I am not familiar with this field. But after doing some research, I got some understanding listed as follows (correct me if it is not correct)

entropy is used to measure how random the information is. One typical definition of entropy is the Shannon entropy which is defined to as $$H(F) = -\sum P(x) \log_2(P(x))$$ So if the information is carried by 128-bit data so each bit is occurred at probability $P(x)=1/2^{128}$, thus the entropy is 128.
I read several posts and they comes with a conclusion that PRNG does not add or increase entropy.

So based on above 2 points, can I say that a $n$-bit entropy PRNG is basically a random generator with initial state chosen as $n$-bit data not the algorithm of PRNG per se (assuming the PRNG implementation takes $128$-bit data of course). Is that correct?

If it is true, my question is as follow:

Should I get any $128$-bit data as initial state will make it result from PRNG random enough or that $128$-bit data should be prepared in specific way ?


texts: Fortuna PRNG: What is the effect of the block cipher key size?

texts:
The Fortuna PRNG uses AES-256 for generating output blocks by encrypting a counter value $C$ in CTR mode using a 256-bit key $K$. For the analysis, it seems the block size of 128 is the limiting factor, as the argument goes that by the birthday bound we expect a block collision after $2^{64}$ encrypted blocks, but CTR mode only collides after $2^{128}$.

All of this depends really only on the block size, so my question is, what is the effect of the key size for the underlying block cipher, and why was it chosen to be 256 bits rather than using AES-128, say?


texts: Different keys for clients but 1 key on server

texts:
Is it possible to have different keys on alot of (embedded) devices and just have 1 key on a server (to witch all these devices connect)? The main point here being when 1 device is compromised this does not mean the traffic between other devices and the server is compromised (even if the server does not know that 1 device is compromised).

Background:
All the devices will have a key pre-installed during the assembly of the device but must be changeable over internet.
Currently all devices in 1 system (a customer can have multiple systems) have the same key. But I am trying to create it in such a way that they all have different keys, hence the question.

What I think I know:
1. I believe DVD's and dvd-players use a similar scheme (ccr?) but this is broken.
2. There are Key Derivation Functions which could be used for this scenario.

For point 2 I am not quite sure how to use this i can (when assembling the device) make a salt and use it with (for example) PBKDF2 and a master key (which the server will have) than store the PBKDF2 generated key and the salt on the device and send over the salt to the server when the device is connecting so the server can create the key again. though after this i should set up a session key as well. and worst of all the salt will be vulnerable.

So this to me does not seem like a solution.

How should I do this properly, or am I looking at this the wrong way and should i do something different?


texts:
I know that the HMAC is a message authentication code that uses a cryptographic key in conjunction with a hash function (SHA1 , MD5, etc.). The HMAC output is 160 bits for HMAC-SHA160 and 256 bits for HMAC-SHA256 bits that can be truncated according to the intented application. My quesion is about input...

What is the maximum input size of HMAC-SHA160 and HMAC-SHA256 ?


texts: Is there any difference between a one-time pad and a Vigenère cipher with a long key?

texts:
I've been browsing Wikipedia and stumbled on the article for the Vigenère cipher. I realized after seeing the example that it's quite similar to the one time pad, except with a short key repeated as the source of "random" information. That is, if you make the key longer than the plaintext, the two are the same.

Is that correct?


texts: What are the “costs” to find a pre-image, weak collision, or strong collision?

texts: For a secure, n-bit hash function, what are the “costs” to find a pre-image, weak collision, or strong collision?


texts: Making both the IV and salt public for PBE with AES-CFB

texts:
Is it okay to make both the IV for AES-CFB and the salt for PBKDF2 public? Does this action of mine compromise security in any way?

I have an implementation of this cipher and had previously asked a question about this cipher on stack Overflow. One of the users who answered my question told that it is OK to make the both password salt and IV  public. Not that I don't believe him but just wanted to be double sure to correct my implementation.


texts: Why is RSA decryption the inverse of encryption?

texts:
In RSA, to encrypt a message, the following formula is used:
$$c=m^e\bmod n$$
For decryption,
$$m = c^d\bmod n$$
is used.
However, when I try to substitute the value of $c$ from the first into the second formula, I am unable to satisfy the equation, or rather unable to simplify the expression below:
$$m = (m^e\bmod n)^d\bmod n$$
What am I missing here?


texts: Is there any benefit to verifying PKCS#7 padding when using AES CBC and HMAC?

texts:
As I'm using HMAC to ensure integrity and authenticity of the ciphertext, is there any additional security benefit to verifying PKCS#7 padding when decrypting using AES CBC?

A previous question asked Why verify Padding at all? Part of the accepted answer was:

  In general, use a cryptographic MAC to protect your ciphertext, and verify it first. Emit those errors. Then padding errors should not occur at all.

But I note the qualifier "in general" and I also know a number of cryptography libraries do validate the padding.


texts:
$y^2 + xy = x^3 + ax^2 + b$ is the elliptic curve over $\mathbb F_{2^m}$.

In the elliptic curve standard, most of the curves use $a=1$ a lot.

Is there any mapping for this such that $y^2 + xy = x^3 + ax^2 + b$ is equal or similar to $y^2 + xy = x^3 + x^2 + b$?


texts: AES-GCM -- what is ICV and what happens if I don't use it

texts:
I am interested in using AES-GCM and after hours of reading on Internet I still have a few questions:

What will ensure the ICV, is it only Integrity ? If I don't need it on my purpose, can I spare it and still have secure encrypted data on my channel ? (If integrity is not verified, my packet will be dropped anyway)

our aim is just to encrypt data so that no one can get the information.

Thanks


texts: GlobalSign cert in Trusted root for Google Services shows Sha1. Security postures

texts: "GlobalSign" certificate in Trusted Root Certification Authorities for Google Services shows Sha1.  Security postures are different than just 2-3 yr ago.  At my home, router bought 2016, networked; and no use of RSA hard fob as I did; (cert has dates 2006-2021). May I best remove it to tame my internal concerns from online events raising questions about information assurance  (e.g. use MMC console on Windows 10 at home)?


texts: Can a user of a password-protected Wi-Fi sniff on other user's communication?

texts:
Imagine a Wi-Fi network protected by WEP/WPA/WPA2. Users can join the network in case they know the pre-shared key of the access point.

Is it possible for a user A (who has successfully logged into the network) to sniff on the data communication of another user B, entirely because A uses the same pre-shared key like B (and C, D, E....)?


texts: How good is the middle cube method with jumbled digits?

texts:
I had to make my own PRNG for a stream cipher for an inter-school science project. So I thought of cubing the seed instead of squaring it (like in the middle square method). And to prevent prediction of the next number, the digits in the cube had to be jumbled using a seed-dependent algorithm which the users had to implement themselves and share along with the seed. Then the middle had to be taken out of the jumbled cube. And also, if the numbers become zero, the next number will be the middle of the jumbled cube of the sum of the seed and any prime number, where the number of digits of the sum is equal to that of the seed.

Is this algorithm by any chance good? Can any one tell me its defects if it has any. And is it random enough?


texts: RSA Signature Forgery - Low Public Exponent + Improper Padding Validation?

texts:
Consider the following custom crypto:

We have a signed message M1 with corresponding signature S.
We have the 1024-bit modulus N and their small public exponent e (with an exact value of 3).
The message M1 is too large to sign directly, so instead they sign the SHA1 hash (160 bits) of the message.  The SHA1 hash forms the least significant bits and the remaining 864 bits (i.e. 1024-160) are zeroes.

So far, so good.
However, the signature verification is flawed:

To verify the signature, we calculate S^e mod N.
We don't verify all of the padding is zeroes.  Instead, we XOR the 160 lowest and 160 highest bits, then compare that result with SHA1(M1).  If the results match, we trust the signature.

The XOR is so that if any of the high 160 bits are non-zero, the XOR would damage the results of the low 160 bits (the SHA1 hash).

Question: given this flawed signature verification, how would you go about forging a signature for a different message, M2?

If they key used a slightly larger public exponent, say 17, would the forgery be much harder?

Here's what I've come up with so far:

We don't need the forged signature to be perfect.  The obvious goal is to create a signature that, after exponentiation, results in (from most to least significant bits):
[- 160 zero bits -] [---- 704 arbitrary bits ----] [- correct 160-bit hash -]

In practice, this means the forged signature needs to be:

Somewhat small, so after exponentiation, the high 160 bits are all zero.  (i.e. S^e mod M < 2^864)
After exponentiation, it only needs to end with the correct 160 bits.  (i.e. S^e mod M mod 2^160 = SHA1(M2))

As the attacker, we can append random bytes to M2 to generate different hashes, but we cannot predict the resulting SHA1 hash.  This gives us the ability to create SHA1 hashes with desirable properties, although I'm not sure what properties would be helpful.  (Factors into small primes?)

In a perfect world, we would simply keep trying new messages until we generate a hash that has an integer 3rd or 17th root, but this seems extremely unlikely.
Instead, I was thinking of taking the hash and prepending up to 704 bits so the resulting number does have a 3rd or 17th root.
This seems like a good candidate technique given that the ratio of fixed bits (160) is small in comparison to the number of free bits (704).
Unfortunately, I'm not sure how to construct such a number and brute force is too slow for a 2^704 search space.


texts: difference between leveled FHE and normal FHE scheme

texts:
What is/are difference/s between leveled Fully Homomorphic Encryption
  and normal Fully Homomorphic Encryption?


texts:
In the hashlib module in python is a function called m.update() where m is a hashlib.md5 object. My question, actually not specific to python, is how does this function work, such that:

m = hashlib.md5()
m.update("hello")
m.update(" world")

which is the same as if I would have done:

a.hashlib.md5()
a.update("hello world")

How does the math work to explain this?


texts:
Cryptographic primitives should have nothing-up-my-sleeve property to prove their designers don't have an advantage in using them versus the general public.

For example, Blowfish is using binary reprensentation of digits of π to initialize its key schedule. The Salsa20 family of ciphers use the ASCII string "expand 32-byte k" as constants in its block initialization process.

Now, my question is about widely used AES cipher. I cannot find any references to how its S-boxes were generated. Recently, it was proven that a Grasshopper block cipher S-boxes were generated using a hidden algorithm and that this made it potentially weaker.

So, does this mean AES doesn't have nothing-up-my-sleeve property? Can designers of AES have an advantage in using it?


texts: using non prime numbers in Blum Blum Shub or Blum Micali

texts:
I would like to use Blum Blum Shub, or Blum Micali methods as random number generators only. I am not interested in their encryption capabilities.
I was wondering, if I replaced the prime numbers with other random numbers that are not prime, how much will this affect:

the security of RNG
the randomness of the numbers generated.


texts: i've written a simple code for payload encryption, i'v done it with AES-128 CBC mode ,it works fine ,the senario is very simple : the publisher send a JSON payload format that includes the encryption key , IV (Initialisation Vector) and the encrypted data, the subscriber extract the key and IV then decrypt the data received, but i want to do a sort of hybrid encryption ,to encrypt the key with Asymmetric algorithm, i know the famous RSA, but after reading some articles, RSA is not suitable for constrained ressources devices, have you any idea wich algorithm can i use or somthing else that ensure the key transmission ?


texts:
There are often articles in the news that state that a certain country or hacker has been able to decrypt/hack highly protected systems: Some examples are the Lockheed Martin RQ-170 Sentinel that was downed in Iran and later said to be partly reverse engineered by China or the Snowden files that might have been hacked by Russia and China. There are plenty of other examples.

My question is now the following: How could this have been done considering the fact that a brute-force method would certainly not work because of the encryption strength and leaving other non-technical aspects like spies etc. out of consideration.


texts: Creating an encryption key from several other keys and using hash functions

texts:
I want to combine two or more keys to create a single encryption key that relies on all of them.  What is the proper method for doing that? Simple XOR? Using hash functions?  Something else?

I personally used this: k = md5( key1 || key2 ).  Note: || means concatenation.  I used md5 because I use 128-bit encryption and thus need a 128 bit output key.

Some other questions arise here for me:

Is using MD5 secure for this specific purpose?
I don't know of any other standard 128-bit output hash functions. It seems newer cryptographic hash functions all have 256-bit and more output lengths.
So is using another hash function that has a 256/512-bit output and then truncating the result down to 128 bits secure to an equal or more degree than using MD5?

Note that key1 and key2 are random keys, not passwords, and thus key stretching is not relevant or applicable.

If it is relevant, I generated both keys, and I know that both keys are cryptographically random.  Neither key was supplied by an untrusted party.  At present both keys happen to be the same length, but I'd prefer a more general solution that does not rely upon this assumption, if possible.


texts: MAC in SSH packet encryption, benefits to not including it?

texts: What are the benefits to not including MAC in a SSH packet encryption?  I understand what the MAC is there for, but if it was not included would there be an advantage?  Is the MAC somewhat redundant considering  the server host key is used during key exchange to authenticate?


texts:
ElGamal encryption algorithm is as follows:

To encrypt a value $m$, it chooses a random value $r$, and calculates

$c_1=g^r$ $mod$ $q$

$c_2=m*h^r$ $mod$ $q$

where $g$ is the group generator, $x$ is the private key and $h=g^x$ is the public key.

But if $m$ is 0, then $c_2$ will always be 0. How to deal with this?


texts: Hash which can be used to verify one of multiple inputs?

texts:
Is there a hash function H1 which, when given inputs a, b, etc., produces output Z, and an H2 which can verify any one of a, b, etc. when given Z like this:

H1(a, b) => Z
H2(Z, a) => true
H2(Z, b) => true
H2(Z, c) => false

And where Z is (currently thought to be) cryptographically secure (i.e., modifying Z in any knowable way makes H2 return false for any of the provided inputs)?

Edit: An additional condition which I forgot to articulate originally. a cannot be derived from b and Z, and b from a and Z. Without this condition, we can just use Shamir's Secret Sharing, with a k value of 1, a randomly generated secret Z and a, b, etc are our n values.


texts: Good challenges for a crypto competition for teenagers

texts:
I'm holding a cryptography workshop for teenagers (around 16 years old) at our university. As part of the workshop, I'm planning to run a crypto competition with prizes: there will be different tasks, each one will yield points, and the winners will get sweets.

However, for the amount of time I'm planning to kill with this game, I still need one or two more challenges. So far, what I have is:

Scytale: one band with letters on it and four potential objects - find out which is the right object so you can read the message and obtain the solution.
Caesar Cipher: Find out by how much the letters have been shifted to get the solution.
A transposition cipher (one where you write the text in a rectangle and then read the columns).
One with frequency analysis (they get the frequency table for the letters and a longer text which I chose to be pretty close to at least the most frequent values).

As you can see, these are all pretty basic stuff that can be done by hand. I don't really want to do anything that would require the kids to do any programming, although I suppose I could do something like install Cryptool2 on an old computer and have that as one station, if anyone has a nice idea that requires computer assistance.

I'm hoping that, among the community of crypto experts and enthusiasts here, some of you may have experience with running such competitions for kids and teenagers, and may be able to suggest some good challenges.  If you've organized something like this before, and know some suitable challenges that I haven't already thought of, please share them!


texts: Key Exchange MAC encryption order of events? Problem

texts:
I want to write the sequence of events of how a MAC encryption works for documentation at work.
For this purpose I have a document (given by my boss to me) in German and I am trying to translate it into english. However I think there might be a mistake on step 4. I am not sure and some how cannot find anything on the Internet.

MAC Master Key generated

MAC Master Key given to the partner (by hand or by certificate protected mail)

MAC Slave Key generated

Encryption of the MAC Slave Key with the MAC Slave Key and sent to the partner (this transaction will be safe since only the partner has the Master Key for decryption)

Is the fourth step really encryption of a MAC slave key with the same MAC slave key and sending it to partner? Shouldn't we encrypt the MAC slave key with the MAC Master key?
I am sorry if it is a rookie question because I don't know much about MAC cryptography.
Please can someone also explain how Master key and Slave keys are connected to each other? If it matters I am using MAC 91.2 & D.96A


texts: Knowing pre-encryption data, can we find the private key CryptoWall used?

texts:
I'm just repurposing a question already asked about Cryptolocker for CryptoWall:

  "If we know exact contents of some of the files prior to them being encrypted, would it be feasible to use those files to discover the private key?"

There's an answer posted for the case of CryptoLocker, but what about for CryptoWall?  I've read it is not as thorough, for instance not using the type of RSA encryption meant for large blocks of data.