texts: Solving a quadratic equation for a variant of Rabin

texts:
My understanding of Rabin
We have $p$ and $q$ which are distinct primes congruent to $3 \pmod 4$.  Then we have $n = pq$.
Encryption is done as $e(m) = m^2 \pmod n$, where $m$ is our message.
Decryption is done by evaluating $d(c) = \sqrt{m} \pmod n$, where $c$ is our ciphertext.  This can be accomplished by determining $m_p = c^{(p+1)/4} \pmod p$ and $m_q = c^{(q+1)/4} \pmod q$ and their negative counterparts.   Then, $m$ is congruent to both $m_p \pmod p$ and $m_q \pmod q$.  Chinese remainder theorem can be used to calculate the four possible values of  $m$.
The variant of Rabin which I'm having trouble with
I'm having trouble with a variant of Rabin which uses the encryption function $e(m) = m^2 + Bm$ where B is an arbitrary value. We then have $c = m^2 + Bm$ which leads us to $0 = m^2 + Bm - c$.  I'm confused as to how to proceed from this point.
My guess is that I must solve the quadratic formula, yet solve the $\sqrt{b^2 - 4ac}$ portion as you solve the square root in regular Rabin.  However, my attempts at this have failed. Is this the correct approach?


texts: A fast non-cryptographic hash function that is "strong enough"?

texts:
I'm designing a simple one-time-password mechanism for authentication against a possibly-insecure server - i.e. I don't want to use symmetric shared secrets.

The first idea that came into mind was using a hash-chain with a cryptographic hash function, where each device has a random $\text{key}$ and broadcasts
$H^n(\text{key}), H^{n-1}(\text{key}), H^{n-2}(\text{key}), \ldots, H^{1}(\text{key}), \text{key}$.
However, storing the whole chain requires too much memory for my needs.

I found some techniques here and here to store only few elements from the chain ($H^{n-k}(\text{key}), H^{n-2k}(\text{key}), H^{n-3k}(\text{key}), ...$), and calculate the elements in between dynamically.
This converts the "space problem" to a "calculation cycles problem" - unfortunately all the cryptographic hash functions that I've checked require too many cycles (=too much power consumption) for my needs, considering the fact that I have to calculate them multiple times in order to save a significant amount of space.

I consider using less secure hash function for the dynamic hash calculation.
This hash will be used only for the elements "between" $H^{n-k}(\text{key}), H^{n-2k}(\text{key}), H^{n-3k}(\text{key}), ...$ so it has to be "unbreakable" only for $k$ time - suppose a key is generated every minute, finding $k$ sequential preimages in $k$ minutes should be "really hard" (but finding them in $10k$ minutes may be possible).

I don't care about second preimage resistance, or defending against very resourceful attackers.

Do you have any suggestions for a hash function? What about SipHash-2-4?


texts:
Consider we implement remote service, which will be accessible via API(i.e. restful http or grpc). All users are authenticated via pgp keys and each user has pgp keypair.

How to implement authentication for such a service?

I see multiple approaches and I'm unsure which one to choose:

Convert keypair to X509 certificate, use TLS certificate authentication (1, 2) to authenticate users. Requires some fiddling on client side, also unclear how to convert.
Require users to sign timestamp on each request. Check that timestamp is close to current server time. Unclear if this approach is secure.
Give users expirable tokens, which are either stored in DB or have MAC, require users to attach token signatures.
Some better approach I cant think of


texts: Does the GCM authentication tag need to be protected?

texts: I am just learning about the GCM mode of AES and I'd like to start using it in my software.  However, I have a question about its use.  As I understand it the output of a GCM encryption operation is the ciphertext plus an "authentication tag."  I know that the key needs to be guarded from discovery, but does this authentication tag need to be protected like the key does?  Or, would it be safe to prepend the ciphertext with the tag and IV and then send that whole blob through unprotected channels?


texts: Solving not so much overdetermined system of multivariate polynomial equations

texts:
I'm studying algorithms solving multivariate equations. I'm stuck in solving overdetermined set of quadratic equations. Concretely, with the number $n$ of variables, the number of equations is $m=\epsilon n^2$. If $\epsilon\geq 1/2$, it is known that trivial linearization solves the set of equations. However, in the case that $\epsilon<1/2$, the trivial linearization seems not working anymore.

But there are some papers suggesting that if $\epsilon$ is somewhat large ($1/16<\epsilon<1/2$) then the system of equations can be solved in $O(n^{2\omega})$-time where $2\leq\omega\leq3$ is linear algebra constant. Efficient algorithms for solving overdefined systems of multivariate polynomial equations claimed that the time complexity of XL algorithm is $O(n^{\omega\lceil\frac 1 {\sqrt{\epsilon}}\rceil})$. It implies that if $1/4\leq \epsilon<1/2$ then the time complexity is $O(n^{2\omega})$. But I cannot catch the case.

One more paper here. Complexity of Groebner basis computation for semi-regular overdetermined sequences over F_2 with solutions in F_2 claimed that the degree of regularity is asymptotically $\max(1/8\epsilon,2)$ which implies that if $1/16\leq \epsilon<1/2$ then the time complexity of F5 algorithm is $O(n^{2\omega})$.

For both cases, I don't know how the algorithms can get such time complexity (when maximal degree of XL or F5 computation is 2). Are those my missings or just asymptotics not for the cases?


texts: Problems with using AES Key as IV in CBC-Mode

texts:
I'm a pentester and currently analysing a web application which are using some strange encryption scheme.

The point is: They encrypt using AES-128, generate a (not cryptographic secure) key and use this as encryption key AND initialization vector.

I'm not a crypto expert, but I know that this is bad (aside of the insecure generation of the key). The problem is, that I don't know what the concrete consequences are?

Can someone please enlighten me, so I can explain to the developers that this is bad? Thanks


texts:
I've been asked by a client to give some advice on hashing and as it isn't my area I'm looking for someone who knows what they are talking about.

The client is hashing 4-6 digit PINs (mostly 4 digit) with bcrypt, they have the work factor set as high as the business will allow them but they are worried that due to the small key space it will still be possible to reverse individual PINs. They are now thinking of encrypting the hashes before storing them to add an extra layer of protection. The encryption is fast enough to not affect login times so my suggestion of using the additional processing to increase the work factor instead was rejected.

What do people think? I can't see it hurting and adding the additional hurdle probably won't hurt but I've heard of odd interactions between different algorithms so don't want to say to do it without someone who knows their stuff looking at it.


texts: Whether the proof created by prover can be tampered in zero knowledge proofs?

texts:
I am studying zokrates recently. I know that the prover will finally generate a proof, and then the verifier can use this proof and public input as input to verify whether the prover has certain knowledge. I want to know if it is possible for the prover to tamper with the proof, and then the tampered proof can also pass the verification of the verifier. I guess it should not work in theory, but I want to know why.
Hope you can help me, thanks!


texts: X3DH Protocol - How can the receiver calculate the Shared Key?

texts:
I'm reading about Signal Protocol and X3DH Protocol. In the X3DH Protocol, Alice sends a initial message to Bob encrypted with a Shared Key(SK). This SK is calculated using (this section):

DH1 = DH(IKa, SPKb)
DH2 = DH(EKa, IKb)
DH3 = DH(EKa, SPKb)
DH4 = DH(EKA, OPKB)
SK = KDF(DH1 || DH2 || DH3 || DH4)

Where IKa is the Alice's identity key, IKb is Bob's Identity key, SPKb is Bob's signed prekey, EKa is Alice's ephemeral key and OPKb is Bob's one-time prekey. All these keys are public.

In the next section they describe how Bob receives this message. Bob loads his private identity key and private one-time pre key and does the same steps as Alice does before to derive the SK. I couldn't understand how this SK calculated by Bob can decrypt the message sent by Alice. Alice uses only public keys and Bob uses his private keys. So my question is: How can the SK generated by Bob decrypt the message sent by Alice?


texts: AES Algorithm processing time in Arduino vs Raspberry Pi

texts:
The Arduino employs an 8-bit ATmega series microcontroller whereas the Raspberry Pi is based around a 32-bit ARM processor, and the Arduino is typically clocked at between 8-16MHz and with 2-8kB of RAM available, and in contrast the Raspberry Pi can be clocked at up to 1GHz and may have up to 512MB of RAM.

This clearly states that AES Algorithm will work way too faster on RPi than on Arduino, yet, out of curiosity, what would be the maximum time Arduino would take to perform AES-256 Encryption with the encryption key provided. ?

Is there anyway to calculate these timings for both Raspberry Pi and Arduino ?


texts: Using key derived using HKDF or NIST sp800-108 with AES-CCM/GCM

texts: Is it safe to use keys derived using HKDF or NIST sp800-108 with AES-CCM/GCM ? The NIST SP800-108 and SP*00-56C spec says "To comply with this Recommendation, the derived keying material shall not be used as a key stream for a stream cipher". AES-CCM/GCM using AES in CTR mode which is a stream cipher. Given the construction of the "expand" portion of HKDF and NIST SP800-108 is very similar/same, is it safe to use the key stream derived from these key derivation functions with these modes of AEAD ?


texts:
Let $\pi : \{0,1\}^n \rightarrow \{0,1\}^n$ be a permutation.

Let $E(k, x) = \pi(x \oplus k)$ where $x,k \in \{0,1\}^n$.

Why isn't $E$ a secure block cipher?

My idea: Suppose $E$ is a secure block cipher.

If one let $k = 0^n$ and let $\pi(s) = s$ for any $s \in \{0,1\}^n$, then one can build an adversary that could guess, for example, that for $x_0 = 0^{n/2}1^{n/2}, \; x_1 = 1^{n/2}0^{n/2}$, the first half of $E(k, x_0)$ would be equal to the second half of $E(k, x_1)$ and the second half of $E(k, x_0)$ would be equal to the first half of $E(k, x_1)$. Such an adversary should have a considerable advantage and then $E$ couldn't be secure.


texts:
I am currently writing a payment system to accept payment details from an NFC enabled smartphone (BlackBerry 9900) to a Windows client (C#.NET)

I am currently having two issues relating to security:

What is a good way to secure the data for transmission over NFC? I'm thinking public key encryption so that it can be encrypted on the phone using the public key and then decrypted by the .NET on the other side using the private key.
How to secure the data so that the data can't be cloned by another reader i.e. another reader pretends the be the windows client and reads the secure data. This could then be played back to the windows client by the attacker at a later data to make a payment. I'm thinking that when the phone taps the client reader the client will send a token that must be present in the data returned from the phone that includes the sensitive data. I think that maybe the public and private keys should be created per each transaction request. The public key sent to the phone to encrypt the data. Maybe that would suffice as the token also as if it can't be decrypted by the client then it's an invalid request.

Please note that I have no experience in cryptography at all. I'm aiming to implement a solution that has libraries readily available in .NET 3.0 and BlackBerry SDK 7.0.


texts: Implementing AES in C++: 4x4 Array of unint8_t, or 4x1 array of uint32_t?

texts:
I'm implementing AES in C++, and, inspired by the way words are handled in SHA, I decided this time to handle the state as a one dimensional array of 4byte unsigned integers as opposed to a two dimensional array of bytes. To get the bytes out of each of word, I use shifts and mod. E.g. to get the first byte in state[0], I would retrieve byteA = (state[0] >> 24); and to get the second, byteB = (state[0] >> 16) % 256;

In the mix columns and substitution steps, I have to extract and replace bytes from the word, but in the shift rows and add key steps, I can operate on an entire row at once, eliminating the need for 4 extra iterations per row.

Unless this would be very specific to my implementation, I'd appreciate some input on which might be faster.


texts: Is XSalsa20-Poly1305-SIV a reasonable choice for nonce-misuse-resistant authenticated encryption?

texts:
Consider XSalsa20-Poly1305-SIV.  This is obtained by:

computing a MAC $t_{secret}$ of the plaintext from the key and nonce, as in ChaCha20-Poly1305 except that the plaintext, not the ciphertext, is MAC'd.
compute $t = F(K,t_{secret})$, where F is the ChaCha20 core (or any other PRF).
use $t$ as the auth tag and as part of the XSalsa20 nonce.

Questions:

Is this secure?
Is this provably secure, assuming that the ChaCha20 and Salsa20 cores are strong PRFs?


texts: Is there any such thing as "proof of location"?

texts:
I'm looking for a way for someone to prove to me their geographical location without a trusted third-party. Imagine wanting to prove to someone you're actually physically in a specific place. I'd imagine you'd need something like perhaps a receiver of some kind to triangulate the location of a satellite that could perhaps only be calculated in that spot?

Is this possible?


texts:
Advantages of having a 64-bit CPU vs 32-Bit CPU smartphone
  …
  3. Complex Encryption. Improved Security: 64-Bit can process incredibly large numbers allowing you to better encrypt data against unauthorized access.

source: http://www.amongtech.com/what-is-the-advantage-of-having-a-64-bit-smartphone/

Is the above statement correct, in particular with regards to the term “complex encryption”? I mean, how is the complexity increased with 64 bits? Is that related to the increase of the key size?


texts: what are the advatanges and disavantages of the digital signature algorithms for JWT?

texts:
I am using a Java JWT library jose4j.
There is a list of digital signatures algorithms which can be used.

HMAC using SHA-2
RSASSA-PKCS1-V1_5 Digital Signatures with with SHA-2
Elliptic Curve Digital Signatures (ECDSA) with SHA-2
RSASSA-PSS Digital Signatures with SHA-2

I tried to understand what the advantages/disadvantages of the algorithms are but Google searches of "HMAC vs RSASSA-PKCS1-V1_5" did not return results.

What are the pros/cons of these algorithms?


texts:
Concerning private key (symmetric) IND-CPA game definition:

Attacker $A$ queries the encryption oracle polynomial number of times.
$A$ sends the challenger $C$ a message pair $m_0$ and $m_1$. $C$ picks a random bit $b$ and sends back to $A$ a cyphertext $Enc(m_b)$.
$A$ makes further queries to the encryption oracle polynomial number of times.
$A$ tries to guess $b$.

An encryption system is considered broken if $A$ has a non-negligible advantage in guessing $b$.

My question is:

Let's denote the original game as $Game_0$. Now we remove step (3), i.e. $A$ cannot query the oracle after receiving the challenge cyphertext. We call this $Game_1$. Is it true that if $A$ can break $Game_0$, she can necessarily break $Game_1$? In other words, does any encryption system exist such that $A$ cannot break $Game_1$, but can break $Game_0$ with the extra queries after receiving the cyphertext?
Similarly, now we remove step (1), i.e. $A$ cannot query the oracle before receiving the challenge cyphertext. We call this $Game_2$. Is it true that if $A$ can break $Game_0$, she can necessarily break $Game_2$? In other words, does any encryption system exist such that $A$ cannot break $Game_2$, but can break $Game_0$ with the extra queries before receiving the cyphertext?


texts: Simple homomorphic crypto for 32-bit integers

texts:
I'm looking for a simple way to perform homomorphic crypto on 32-bit integers. My only requirement is that I can add and subtract from the plaintext value without actually decrypting it. The crypto need not be particularly strong - the implementation is designed to be a deterrent rather than something more concrete.

Are there any simple algorithms to do such a thing? I'm looking for something that's easy to understand and implement.


texts: TLS Key Exchange content in DHE vs. ECDHE

texts: When the key exchnage is DHE, the server key exchange message contains the key paramteres: g^y (the server's public DHE value), g, p. Can you clarify to me what is the server key exchange content if the key exchange is ECDHE? What paramters are included there?


texts: $\mathrm{Hash}(A\|B)$ where $B$ is known, $A$ is unknown. Would knowing $\mathrm{Hash}(A\|C)$ as well as $C$, speed up a brute force search for $A$

texts:
Let's say $\mathrm{Hash}(A\|B)$ is a hash of two concatenated strings, $A$ and $B$.
Suppose I am trying to figure out $A$ from $\mathrm{Hash}(A\|B)$, I know $B$ but not $A$, I want to brute force to find $A$. Let's ignore practical reality for a moment.
If I also know $\mathrm{Hash}(A\|C)$, $\mathrm{Hash}(A\|D)$ etc, as well as $C$ and $D$ etc. can I use this info to reduce the time required in the brute force search?


texts: In RSA, why does $p$ have to be bigger than $q$ where $n=p \times q$?

texts: In openSSL – during RSA key generation – if $q$ is bigger than $p$, they exchange them. Why is that?


texts: Proving for a single input vs several inputs. Is there any difference?

texts:
I am working on a new protocol for pattern matching. While defining the ideal functionality, it is possible to say:

Alice sends $p$ and Bob sends $T$ to the ideal functionality. i.e. searching for one pattern.
Alice sends $p_1,\dots,p_\lambda$ and Bob sends $T$ to the ideal functionality. i.e. searching for several patterns at once.

In both cases, Alice outputs $f(p_i,T)$ and Bob outputs nothing.

It is also possible to prove in both cases.

Is there any difference? Does the second definition add anything to security guaranties?


texts:
The FIPS 140-2 Derived Test Requirements has a statement:

  AS07.09: (Levels 1, 2, 3, and 4) The seed and seed key shall not have the same value.

What is the difference between a seed and a "seed key"?


texts: Security of KDF1 and KDF2 (hash based KDF's)

texts:
It's still common to come across implementations of KDF1 and KDF2. Basically these are KDF's that simply derive multiple keys from the key seed and a counter:

$K_i = \operatorname{KDF}(K_{master}, i) = \operatorname{H}(K_{master} | c)$

In this function $|$ means concatenation and $c$ is the encoded value of $i$ in 4 bytes using an unsigned big endian notation. KDF1 and 2 only differ with regards to the starting value of $i$.

The issue with the KDF is that a hash is not necessarily a PRF. Actually, I've only seen MD5, SHA-1 or SHA-256 being deployed.

Are there any particular attack vectors that can be used against this construction? Is there any practical/pressing need to switch to HKDF or a NIST SP 800-108 approved hashing algorithm or are the concerns purely theoretical of nature?

Please note: above only shows KDF1/2 in their least complex form, using only a single output block and with an empty $OtherInfo$.


texts:
I am implementing DTLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit.

Below is my client finished message

Can anyone explain this message?

How many bytes for verify data?

Is there authentication tag if yes then how many bytes for authentication tag?

And how many bytes for nonce?

And is all the message encrypted if not then how many bytes are encrypted?

How can i verify this message?


texts:
In the case of using a cipher suite with all algorithms NULL  e.g.: TLS_NULL_WITH_NULL_NULL the protection against replay, swapping and filtering is guaranteed?
(I am talking about message protection, not handshake's one)

Because I have seen that the MAC uses a sequence number, so maybe this is used against replay. If I do not calculate the MAC our TLS fragments are vulnerable to replay, swapping and filtering?
Or the fact that we are using a reliable transmission protocol avoid that ( and in this case what's the point of using a sequence number in the calculation of MAC)?


texts: Is ISAAC Cipher Cryptographically Secure?

texts:
http://en.wikipedia.org/wiki/ISAAC_(cipher)

This question was asked before but the answers seem vague, and I want to know about ISAAC specifically, not ISAAC+.

It seems some cryptanalysis was performed on it and the only seemingly major drawback to security is that some initial rounds may be biased (although on the official website, looking at the implementations the author of ISAAC purposefully skips the first round).

Also, is there anything unique to seeding this cipher? Can I not just pass it any securely generate random seed?


texts: Practical One Time Pad Based on Diminished Rate of Random Number Exhaustion

texts:
One reason why One Time Pads are impractical is that sender and receiver need copies of the same random numbers. This can quickly exhaust the set of numbers if communication is frequent.
Proposal: The set of random numbers kept by pairs of senders and receivers is only the seed values for a shared PRNG. If the seeds are known to sender and receiver thru a shared list then the numbers produced by the PRNG should be identical. If the seeds are ransom then would not the output be random and usable for encoding and decoding?
Process:
In effect, pairs of communicators would share the same list of random seeds. As a message is created, the next random seed is pushed into the PRNG and the numbers produced are used to encode the cipher stream.
The sender's list of shared random numbers is decremented by one.
The receiver looks up the current random number seed and pushes it into the same PRNG. This delivers identical numbers which are used to decrypt. They receiver decrements their random number list by one.
Clearly, the messages will always be shorter than the list of numbers generated by the PRNG.
I don't know if keeping lists of true random numbers is a storage issue and whether this scheme saves much storage. However, it would only require 1 random number per message instead of potentially hundreds for any given message.
The PRNG could be on a local PC, smart phone or on the net.
The scheme would get complex with multiple communicators since each would need a list of seeds for their communication only and each would be decremented with each message.
I believe it would extend the time before periodicity appears. In this sense it would be a more efficient use of random numbers. Whether security is compromised or is worse than a true OTP is beyond me.


texts: RIPEMD versus SHA-x, what are the main pros and cons?

texts:
RIPEMD is a family of cryptographic hash functions, meaning it competes for roughly the same uses as MD5, SHA-1 & SHA-256 do. The Wikipedia page for RIPEMD seems to have some nice things to say about it:

"designed in the open academic community"
"not [...] constrained by any patents"

I rarely see RIPEMD used in commercial software, or mentioned in literature aimed at software developers. This old Stackoverflow.com thread on RIPEMD versus SHA-x isn't helping me to understand why.

What are the pros and cons of RIPEMD-128/256 & RIPEMD-160/320 versus other cryptographic hash functions with the same digest sizes? Why isn't RIPEMD seeing wider commercial adoption?


texts:
Let's say I tell you $G: \mathbb{F} \rightarrow \mathbb{F}$ is a random permutation (some finite field). Does that mean:

$G$ is one-way, so that if I give you $G(x)$, it is infeasible to determine the pre-image $x$?
Is $G$ hiding in the sense that you can't figure out anything about $x$ given $G(x)$? For example, you could determine if $x$ were even/odd?

If the second question is true, how do I capture this in a game?


texts: Homomorphic encryption - addition for more than two parties

texts:
I have just found out about the homomorphic encryption and I was wondering how is it possible to perform an addition for more than two parties?

More concretely, I want to have several parties $P_i$, each of which picks a value $p_i$ only known to themselves. Now I want another party $R$ to only learn $r=\sum p_i$, that is the sum of all the private values, but $R$ must not learn any specific $p_i$ and $P_i$ may not learn $p_j$ unless $i=j$.

From my understanding so far, the way the Homomorphic Encryption works is that you have $A=2$ and $B=3$ as values then you get the encrypted values $E(A)$ and $E(B)$. Then $E(A+B)$ it's computed and when you decrypt $E(A+B)$, one gets the correct result which is $5$.

What if you would like to do $A+B+C$, where $C=4$, with the homomorphic encryption? How will the private keys be allocated so that $A,B$ and $C$ can receive the final result ($9$), while they don't know the values of each other?

(P.S.: I am a student and I am asking this only for my academic curiosity. I am not currently taking any crypto course, so that's why I would really appreciate your help!)


texts: Information theoretical security of an inefficient Shamir based access structure

texts:
I have studied Sharmir's scheme as well as the multiple assignment scheme proposed by M. Ito. My question is if anyone can tell me if the following scheme is theoretically secure:

Terms:

P = set of participants

B = Access structure

A = Access set (authorised set within access structure)

t = cardinality of Access structure (|B|)

d = cardinality of Access set (|A|)

S = the secret

So the scheme is extremely inefficient in that it involves creating exactly t different (d,d) Shamir schemes, such that there will be t different randomly chosen polynomials that all share the same secret s

Edit:
So the scheme is an access structure secret sharing scheme, basically it defines certain subgroups of a group of participants that are valid and can therefore reconstruct a secret.

For instance if there was a group of people p1,p2,p3 and an access structure of {p1p2, p1p3} then only the combination of p1 and p2 or p1 and p3 should be able to uncover the secret. so p1p2 and p1p3 are valid subgroups and p2p3 is an invalid subgroup and should therefore not be able to uncover the secret.

This scheme is theoretically insecure if an invalid group can uncover any information.This includes uncovering or computing a number that is NOT S (the secret) and knowing that this number is not the secret. so if p2p3 compute their shares and find a number S' that they know is not the secret then the scheme is insecure!

Example:

Let S = 6, P = {P1,P2,P3}, B = {P1-P2,P1-P3) such that P1 and P2 can find the secret as well as P1 and P3

Now we generate 2 shamir schemes with the same secret:

f1(x) = 6 + 4x

f2(x) = 6 + 7x

so we need two shares from each scheme:

s1, s2 = (1,10) and (2,14)

s'1, s'2 = (1,13) and (2,20)

P1 gets s1 and s'2

P2 gets s2

P3 gets s'2

Can anyone think of any reason as to why this scheme is not theoretically secure, it is very inefficient but as far as i know it is secure, i just don't know how to prove or disprove it.

many thanks


texts:
The Stellar cryptocurrency whitepaper lists "asymptotic security" as a key advantage over other consensus protocols (for example, proof-of-work in Bitcoin). What do they mean by this? As I understood it, it refers to guaranteed safety, as in: results valid and identical at all nodes. However, this can't be guaranteed for a decentralized system, as any node can join the system and refuse to accept the state presented by other nodes. So they must mean something else…

What does the term "asymptotic security" mean?

Here is an excerpt from the whitepaper where they vaguely characterize asymptotic security:

  Safety rests on digital signatures and hash families whose parameters can realistically be tuned to protect against adversaries with unimaginably vast computing power.


texts: How exactly to concatenate two differential trails to form a boomerang disguisher in practice?

texts:
I've been reading many papers on boomerang/rectangle attacks. The general strategy is to find two trails for a small number of rounds and then concatenate them to form a longer distinguisher. Specifically, they decompose the cipher $E$ to $E = E_1 \circ E_m \circ E_0$, and employ some ladder/sbox switch at the connecting point $E_m$ and/or use the BCT to determine the probability of $E_m$.
I am having trouble understanding how exactly one defines $E_m $ given two short trails $E_0$ and $E_1$. For example, let $S$ denote the S-box layer, $L$ denote the linear layer and $X$ denote the key addition of some toy cipher:
$E_0$ 2 round trail trail:
0 0 0 1 --S--> 0 0 0 6 --L--> 0 0 6 0 --X--> 0 0 6 1 --S--> 0 0 d 6 --L--> 0 6 1 0 --X--> 0 6 1 1

$E_1$ 2 round trail trail:
3 1 1 1 --S--> 1 0 0 0 --L--> 0 0 0 1 --X--> 0 0 0 0 --S--> 0 0 0 0 --L--> 0 0 0 0 --X--> 0 0 0 1

Where/how would one define $E_m$ between these two trails? Assuming the transitions $(0 \rightarrow 3), (1 \rightarrow 1)$ have $pr = 1$ and $(6 \rightarrow 1)$ has $pr = 0.5$ from the BCT


texts:
Bit of a noob question and a fair bit of Googling didn't help. I understand that the current encryption standard is AES256. A few questions

Is the point of this (and other encryption techniques) to reuse the same private key for multiple messages? If we're using one-time keys, then a simple addition is enough and the complicated AES256 protocol is unnecessary yes?
If we are using the key multiple times, how many times is it okay to use it before the message is no longer secure?
How do we measure the strength or weakness of such a protocol? I assume the objective of an attacker is to guess the key but how is it quantified, how easily someone can guess the key?
Is it that given the encrypted and the plaintext for a given key, how easy it is to guess the key that is used as the "standard" to judge?

Apologies if this is too basic but all the explanations about AES focused on the details of the protocol, not these more basic concepts.


texts: Is this ID scheme Honest Verifier Zero Knowledge?

texts: I have this exercise but I don't know how to solve it. Anyone has an idea?..


texts: Can someone help me understand how to get the I/O relation equations in DES S- boxes

texts:
I am referring to the equations that have been discussed in Nicolas T. Courtois and Gregory V. Bard's Algebraic Cryptanalysis of the Data Encryption Standard (in proceedings of Cryptography and Coding 2007).

I need a working algorithm or program that will give me all those equations or at least count the number of such equations.


texts:
Is there an efficient way (algorihtm) to compute the solutions of the congruence $x^n\equiv a \pmod p$?

$n\in \mathbb{N}$
$a\in\mathbb{Z}_p$
$p$ is a large prime number

Note that:

By efficient I mean computationally efficient even when the given prime $p$ is appropriate for use in cryptographic protocols (hard to find discrete logarithm in $\mathbb{Z}_p$)
We do not know the prime factors of $p-1$.

It’s easy to find one solution when $\gcd(n,p-1)=1$.

I think this should be as hard as finding a Discrete Logarithm or as Factoring. Any ideas ? Thank you for your time.


texts: How many bits of entropy does an elliptic curve key of length n provide?

texts:
A FAQ for an open source project makes the claim:

  Indeed, an elliptic curve key of length n provides $n/2$ bits of security.

I have two questions:

What is the practical difference between "bits of entropy" and "bits of security"?
How does one estimate the number of bits of security (or entropy) for an elliptic curve private key of length $n$?


texts: Character frequency graph for cipher text

texts: I have studied about the mono-alphabetic substitution cipher. With Character frequency graph, the encrypted text can be decoded. I am wondering how can be happen?


texts: What does the PFX file extension stand for

texts:
PFX is commonly used as a synonym of PKCS#12 certificate stores. However, I've never seen an explanation why these stores are called PFX (on Microsoft platforms) in multiple articles, including those of Microsoft. I can think up some names for what is seemingly an acronym, but "protected file X.509" doesn't seem to work well.

Does anybody have any idea what it actually stands for?

EDIT: I did know, but I forgot.


texts: Is there a way to modify the contents of data being sent between two parties in such a way that the MAC verification algorithm will not detect the tampering?


texts: What is the difference between a stream cipher and a one-time-pad?

texts:
A (synchronous) stream cipher is an algorithm which maps some fixed-length key to an arbitrary-length key-stream (i.e. a sequence of bits): $C : \{0,1\}^k \to \{0,1\}^{\infty}$.

This key-stream is then XOR-ed with the plain text stream, giving the ciphertext stream.
For decrypting, the same key-stream (generated from the key at the receiver side) will be XOR-ed with the ciphertext stream, giving again the key stream.

A One-time pad is an algorithm which takes a key of large size (at least message size), and XORs its start with the plaintext to get the ciphertext. For decryption, we XOR the start of the key with the ciphertext to get back the plaintext.

These look quite similar – could one say that a stream-cipher is a (special way to create/use a) one-time pad, or that the one-time pad is a kind of stream cipher?

Are there any important differences between these two classes of algorithms?


texts: Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

texts:
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.

Can I recover that key?

If, how big does the list of plaintext and matching ciphertext have to be to be able to find it in a feasable amount of time (say in 1 or 2 hours)?


texts: Possible to detect if a message is PGP encrypted/signed (ciphertext)

texts:
Let's say I have a text field somewhere (i.e. an interactive user submitted text field on a PHP script, or a console application. Basically anything that accepts user input.)

How can I detect if said text field contains only a PGP encrypted/signed message? I could just fingerprint the BEGIN PGP ENCRYPTED MESSAGE header/footer but I was hoping there was a more accurate solution.

I wouldn't need to decrypt said message as I wouldn't control the private key, I just need to check if the message is a PGP encrypted message in the proper format, so to speak.


texts: Whatsapp E2EE - Why scanning the QR-code?

texts:
E2EE can be established in Whatsapp by scanning the QR-code on the other person’s phone.

But I read on the FAQ page that this code / number can also be sent to the other person via SMS, Email, etc.

Isn’t it possible to establish an E2EE without this «increased» effort? Are they trying to make it difficult for the users? Because as far as I know the computers for an internet connection do these sort of things without these weird methods that Whatsapp uses.

Are there any advantages in scanning a QR-code?


texts: Security of an ECDSA Adaptor Signature Implementation

texts:
I'm currently working on an implementation of ECDSA Adaptor Signatures, and part of the signature scheme calls for a NIZK proof to verify knowledge of exponent over two public keys that share a private exponent.
The signature scheme also requires Positive ECDSA signatures s.t. $|s|$ <= $(q-1)/2$
The two public keys are of the form $g^k$ and $g^{y*k}$, and I'm using the Chaum-Pedersen protocol for the consistency proof.
I was concerned about negating $s$ during pre-signing, to achieve SUF-CMA security of the signature scheme. However, think I was applying the negation in the wrong place.
Only one version of $s$ passes pre-verification, and conditionally negating $s$ when adapting the pre-signature $s = \tilde s * y^{-1}$ results in a Positive ECDSA scheme. This is currently what the code does.
Here is a link to the relevant code snippets:

https://github.com/GeneFerneau/adaptor/blob/main/src/chaum_pedersen.rs
https://github.com/GeneFerneau/adaptor/blob/main/src/lib.rs

This is the paper I'm working from: Generalized Bitcoin-Compatible Channels
Thanks in advance for any help and/or critique
Update:
In an answer to a related question (https://crypto.stackexchange.com/a/89179), Alex Xiong posted about the Chaum-Pedersen protocol for DH-triples. This is actually the primitive I was looking for instead of the modification I made to Schnorr identification.
Many thanks Alex!
Will continue researching, and post updates when/if I have any.


texts: Estimated hardware cost to crack ARGON2ID hashed passwords

texts:
I can find a bunch of information on stuff like bcrypt and script, but I am interested in estimating the cost per hash on something like Argon2id that is GPU hardened.  I am trying to do the best with what I have here. The requirement is that the user is given an 8 letter password that I can generate.
My strategy is to use the human-facing password to use generate a secret key for a libsodium crypto_secretbox_easy.  I know this is not ideal, so I am operating under the assumption that as soon as the message is stored someone will attack it.  While not sensitive I just want to make it annoying enough to keep the normal baddies out.  (ie, not the NSA)  Knowing that I want to make sure I can at least pick something that will make it cost-prohibitive for someone to just download a bunch of these and start cracking the messages. So is there a way to estimate the cost to generate enough hashes to get access to the contents?


texts: Ed25519 signature verification as described in RFC 8032

texts:
In RFC 8032, section 5.1.7, it is prescribed that an Ed25519 signature is verified if

$[8][S]B = [8]R + [8][k]A'.$

The text then says

It's sufficient, but not required, to instead check $[S]B = R + [k]A'.$

What is the point of the first criterion, if the second one also works and is arguably simpler and less computationally expensive, in general?


texts: Are relatively prime numbers used in RSA

texts: We know that the Totient function is multiplicative. Which means that when $p$ and $q$ are relatively prime, then $\varphi(p q)$ is equal to $\varphi(p) \varphi(q)$. My question is, are only prime numbers used in RSA or can they also be coprime like e.g. 11 and 16? I am asking this because I understand why RSA is multiplicative when p and q are prime but not when they are relatively prime.


texts: Understanding LFSRs and Berlekamp-Massey Algorithm

texts:
I have a tutorial question which focuses on LFSRs and Berlekamp-Massey Algo (which is totally out of my syllabus). Please forgive me if my questions seem stupid.

I'm given these information:

  {"lfsr":{"seed":"1100110001100101"},"keyFragment":"101010001111001110000110111001101","cipherText":"bb0000e911b4238a6ca3"}

My seed is 1100110001100101 (16 bits)

My key fragment is 101010001111001110000110111001101 (33 bits)

My cipher text is bb0000e911b4238a6ca3 (in hexadecimal)

  Apply the Berlekamp-Massey algorithm on the key stream fragment you
  were given to obtain the feedback polynomial that generated the key.
  For full marks, you have to implement the algorithm yourself, attach
  key parts of the algorithm to the report as an appendix and describe
  briefly which bit of the implementation you found the most
  challenging. If you use someone else’s code or an online service you
  will not be awarded full marks; in this case make sure you acknowledge
  the source of the code or service you use.

I'm using an online calculator and my LFSR is x^16 + x^12 + x^3 + x^1 + 1.
Which means that my tap positions are 1, 3, 12 and 16.

  Question 6: Generate the full key stream in order to be able to decrypt the
  cipher text you intercepted (i.e. what you were given)

From this question, I have no idea what to do. I don't exactly understand how multiple taps work. I understand that with one tap position you are able to XOR and obtain last bit for every cycle. My fundamentals are weak, and most resources come with a difficult mathematical explanation which I cannot understand.


texts: Converting discrete log problem to a multivariate system of equations

texts: Is there any method of converting a discrete logarithm problem to an equation system, such that the solution of the system corresponds to the solution of that instance of DLP?


texts: Does mixing two derived keys make a stronger key? And if so, how would I mix?

texts:
I have to generated a secure key from some meta data and a password, and I'm free to choose among a dozen of key derivation functions (KDFs). The problem is, I'm not too happy with either one. Some are well known and proven to be secure but they are not expensive enough to really survive a massive brute force or dictionary attack (e.g. bcrypt or PBKDF2). Others claim to be prepared against such attacks, but they are not so well known yet, they are rather new and have not been studied for years, so it's still possible that someone finds a weak spot or a backdoor (e.g. scrypt or Argon2, and scrypt already turned out to be weaker than people initially thought it would be). Using just a single KDF seems out of question to me if you really need secure and hard to attack keys, it's like betting all your money on a single horse: if it loses, you've lost it all.

Remembering the Intel random number generator fail? The Linux kernel hackers said that this problem doesn't really affect the random number generator of the Linux kernel as the CPU generator is only one among many random sources and

  Random + Not-Random = Random

so as long as at least one of these sources is able to provide good random numbers, the result is still random, even if an attacker can control the quality of the other sources.

Wouldn't the same apply to mixing derived keys?

Good-Key + Bad-Key = Good-Key (???)

So if I use two derivation functions, one that is known to be secure but a bit weak and one that is very strong but not (yet) known to be secure, wouldn't this lead to better keys than just relying on one method?

And if this assumption is correct, how would I mix the two keys? What would be a good, secure method for that? Treating them as big numbers and then just doing add + modulo? Concatenating them and hashing the result? I'm a bit afraid that using a bad "mix function" will weaken the final result when the mix function becomes the weakest link of that chain.

Update

Mixing the keys is just "an idea", of course, maybe instead of mixing it would be better to use the output of one KDF as the input for the other one. At least that makes the whole thing less parallelize-able and thus harder to attack for number crunchers. But maybe that's not true, maybe it makes it much easier to attack if one of both KDFs fail as now you have a chain and as I said above, a chain is often only as strong as its weakest link. Also interesting, if I use two KDF, A and B, and it is more likely that A is weak than B, would it be better to do A(B(x)) or B(A(x))?

Another idea I had was using an HMAC for mixing, one key would be the data and one key would be, well, the key. Calculating an HMAC if you only have one of both, the key or the data, is still extremely hard, so if just one KDF fails, that shouldn't be a problem. Of course, the final key depends on the security of the HMAC function but the HMAC algorithm is in use for decades, one could say it has been proven to be secure. And that is true even when using such a poor hash function as MD5. MD5 itself has been broken long ago, it's totally useless for cryptography today, yet, so far nobody ever managed to break HMAC-MD5, which means HMAC is a good function and maybe HMAC-SHA2 would be a good way to mix two keys?

This seems such an obvious problem that I'm pretty sure all these questions have been asked before and even answered before, I'm not here to invent anything new, no way(!), I just haven't been able to find the answers, that's what I'm here for, finding answers.


texts: How efficient are the generic attacks regarding near-collision-resistance?

texts:
In a recent answer I gave a definition of near-collision-attacks. Now beyond the definition and what to do with this type of attack my knowledge is fairly limited. So here's the question:

Let $H:\{0,1\}^*\rightarrow\{0,1\}^n$ be a cryptographically secure hash function. Let $k\in\mathbb N$ be $0<k<n$. Without further details, how much effort is needed to find two strings $x_1,x_2$ such that $$\Delta(H(x_1),H(x_2))\leq k$$

holds?

As in the other answer $\Delta(x,y)$ shall denote the Hamming distance between $x$ and $y$.


texts: We're currently approaching the end of our semester, but I've found that our homework is starting to consist more of encrypting and decrypting using different types of algorithms instead of learning any other core fundamentals. Even though we've switched over from symmetric to asymmetric algorithms. I'm wondering if we're missing any other core fundamentals in a semester of learning cryptography? We've seemed to just focus on different types of algorithms this entire semester along with what aspects of cryptanalysis they meet. What else are we missing? (This is for personal use to learn more on the side)


texts: Why would Carter-Wegman-style message authentication not be broken by P = NP?

texts: Researching about the implications of P = NP to cryptography I found someone say that the only cryptography left standing would be the one time pad and Carter-Wegman-Style message authentication. While the one time pad seems obvious, I am not sure about Carter-Wegman-Style message auth. Can anyone explain this?


texts:
Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)?

If the answer is no, then how can SHA-1 be considered broken?


texts:
I have a binary sequence of length $2^{20}$. I am using the NIST statistical test, assess.

What should be taken for ./assess and  How many bitstreams? in this test?
In the final Analysis report, what p-values should be there to pass this test?


texts: Prevent communication with a node assuming full transparency

texts:
I have an IoT device that I have set up to communicate with AES-256-GCM encryption. The working version has the encryption key stored in plaintext in a file on the device (this is going to be improved). Every time it is communicated with, a new key is included inside the encrypted message and the device updates its key to match it ready for the next message.
I would like to prevent someone from being able to communicate with a device, even if they have accessed everything on it.
Plan
I am thinking of setting up a (what, salt? hash?) which is sent to the device with each encrypted communication, which it adds/multiplies/hashes with something it has stored to create the password it can use to decrypt the communication. What should I look into to do this properly?
Good or bad idea?
I know it's highly discouraged to 'roll your own' when it comes to crypto, so I want to know whether taking this step would be considered well- or ill-advised.
Thank you.


texts: What is the impact of a server not fully verifying the data in the Client Finished packet of a TLS connection?

texts:
F5 BIG-IP devices suffer from a vulnerability in which not all bytes of the Finished packet in a TLS connection are validated. The sort-of technical description can be found here. F5 don't consider it a vulnerability, so they won't patch it, and it is currently causing me a headache right now for PCI compliance reasons. At the moment nobody seems to agree on whether there's a bug or not, and there's not really a clear explanation of the actual impact and attack requirements.

My understanding is that the Client and Server Finished packets in TLS are designed to post facto mutually authenticate the handshake messages, including the master secret key exchange. My thought process is that, if an attacker were to man-in-the-middle the TLS connection, they could leverage this vulnerability to downgrade the connection by spoofing the Client Finished packet, or possibly even compromise the master secret. I'm unsure as to how the process would go from there, with the validation of the Server Finished packet on the cient.

Assuming that some arbitrary number of bytes in the Finished packet are not properly validated, what's the real impact of this vulnerability? With this bug in play, does the security of the connection mostly rely on the client's validation of the Server Finished packet?


texts: How to verify the claim of entropy available made by Linux 4.5?

texts:
The Linux kernel has an entropy source and it estimates its amount of bits in the device /proc/sys/kernel/random/entropy_avail.  How can I verify that this number makes sense?  I did the following experiment.  The system in question is:
# uname -rvmpio
4.15.0-1050-aws #52-Ubuntu SMP Thu Sep 12 19:56:00 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

The following program prints the number of bytes of information available in each second as claimed by the kernel.
$ while true; do cat /proc/sys/kernel/random/entropy_avail; sleep 1; done | awk ' { t += 1; s += $0; print "t =",t,"sum =",s/8, "avg =", s/t/8, "now =",$0/8 }'
t = 1 sum = 86.375 avg = 86.375 now = 86.375
t = 2 sum = 174.625 avg = 87.3125 now = 88.25
t = 3 sum = 175.875 avg = 58.625 now = 1.25
t = 4 sum = 179.75 avg = 44.9375 now = 3.875
t = 5 sum = 186 avg = 37.2 now = 6.25
t = 6 sum = 186.875 avg = 31.1458 now = 0.875
[...]

The following program consumes /dev/random as much as possible and estimates how many bytes of information is practically available at each second.
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>

int main() {
  int r, bs; char b[512];
  unsigned int t = 0, n, sum = 0;
  fcntl(0, F_SETFL, fcntl(0, F_GETFL) | O_NONBLOCK);
  while (1) {
    n = 0;
    while ( (bs = read(0, b, 512)) != -1) n += bs;
    t += 1; sum += n;
    printf("t = %3d, sum = %3d, avg = %.4f :: just read %d bytes\n",
           t, sum, (float) sum/t, n);
    sleep(1);
  }
}

Here's how to compile and run it:
$ make p
cc     p.c   -o p
$ ./p < /dev/random
t =   1, sum =  20, avg = 20.0000 :: just read 20 bytes
t =   2, sum =  20, avg = 10.0000 :: just read 0 bytes
t =   3, sum =  20, avg = 6.6667 :: just read 0 bytes
t =   4, sum =  26, avg = 6.5000 :: just read 6 bytes
t =   5, sum =  26, avg = 5.2000 :: just read 0 bytes
t =   6, sum =  26, avg = 4.3333 :: just read 0 bytes
t =   7, sum =  26, avg = 3.7143 :: just read 0 bytes
[...]

Keeping the file system in high activity (while true; do find /; done), we get a certain number of bits being produced at regular intervals.  Running p first to keep entropy production being consumed as much as possible and then checking out the estimate by the kernel, it seems these two numbers do not quite converge, but they are roughly close.  After 100 iterations, I get the following values:
$ while true; do cat /proc/sys/kernel/random/entropy_avail; sleep 1; done | awk ' { t += 1; s += $0; print "t =",t,"sum =",s/8, "avg =", s/t/8, "now =",$0/8 }'
[...]
t = 100 sum = 1534.12 avg = 15.3413 now = 7.625
t = 101 sum = 1537.88 avg = 15.2265 now = 3.75
^C

$ ./p < /dev/random
[...]
t = 100, sum = 2002, avg = 20.0200 :: just read 0 bytes
t = 101, sum = 2014, avg = 19.9406 :: just read 12 bytes
^C

It seems therefore that Linux 4.5 underestimates its amount of entropy --- assuming I'm the only consumer.  This assumption is probably false, but perhaps I am not too far from the truth.  My verification finds about 5 bytes over the estimate of the kernel.


texts: What encryption mode should I use to protect CAN bus communication?

texts: I have a CAN bus project and I should encrypt the communication between nodes using the AES algorithm. Which encryption mode should I use?


texts: Computing power function with BGW scheme

texts:
Is it possible to use BGW scheme, to compute (private value) power of  some other private input?

I believe that it's not possible, because this scheme allow only multiplication and addition. Where here we need to know the number of multiplication operations in front of the protocol.

Is there any other MPC (more efficient than Yao's GC/ or extension to BGW), that I can use to compute a "gate power"?

Thanks.


texts: May it be possible that the trusted third party knows the parties' private keys in an "ideal model" of a Secure multiparty computation protocol?

texts:
May it be possible that the trusted third party knows the parties' private keys in an “ideal model” of a Secure multiparty computation protocol?
I wonder if it may be possible that a trusted third party knows the private keys (e.g. the encryption's private key or the digital signature's private key) in an "ideal model" counterpart of a Secure MPC protocol.
The trusted third party may use such knowledge to simulate authenticated (and publicly verifiable) payments from one party to another, etc...


texts: How to divide 2 coordinates on elliptic curve?

texts: On the elliptic curves, there is no divide function, and I need divide coordinates - X/Y, o I need not divide but make (X minus or multiply to "modified" Y). How to modify Y?


texts: How can a lattice attack be applied to ECDSA signatures?

texts:
The aim is to check if it is possible to break the ECDSA cryptosystem under the following criteria.

Suppose that each ECDSA signature is generated by using the GLV method for point multiplication (the random nonce $k$ used in each signature is decomposed into $k_1$and $k_2$).
For every ECDSA signature, I can obtain few bits (least significant bits, most significant bits, ...) of the respective $k_1$ and $k_2$.

Is it possible to carry out a lattice attack to gain the value of the underlying secret key ($\alpha$)? If yes, then can you explain the attack in detail?

PS: I have a beginner level understanding of ECDSA and lattices.


texts: Can I construct a PRP by sorting results of a PRF?

texts:
I am using HMAC-SHA256 as a pseudorandom function family (PRF). I read somewhere that a pseudorandom permutation family (PRP) can be implemented by applying a PRF and sorting the output.

For example, if $x_1$ mapped to $4$ under a specific key in the PRF, and $x_2$ mapped to $2$, then the PRP for $\{x_1, x_2\}$ would be $\{x_2, x_1\}$ under that same key.

Does that make sense? Is this PRP construction secure, or do I have to implement a Luby-Rackoff construction using the PRF?


texts: Will using large keys with Classic cryptographic algorithms beat quantum computers?

texts:
This is a purely theoretical question. Everyone is talking about quantum cryptography being the next big thing as quantum computers will be much faster than the computers we have today.

So, from my understanding, quantum computers will have a much larger computation speed.

My question is, instead of looking for new algorithms to beat the computation speed of quantum computer, why can't we just use huge sized keys to encrypt data?


texts: Breaking variations of Linear Congruential Generators

texts:
So I have been trying to learn a bit of cryptanalysis and breaking pseudorandom generators as of recently, but I have run into a roadblock in my learning as I cannot crack this one problem.  Basically it is a variation on an LCG, but I cannot figure out how to solve it, even though I am pretty certain it is weak, I just lack the understanding of what technique to try.

The generator is from the random number generator used by TI calculators as found here.

Basically it goes as follows:

$$\begin{align}
s_1&\gets s_1\cdot a_1\bmod m_1\\
s_2&\gets s_2\cdot a_2\bmod m_2\\
r&\gets (s_1-s_2)/m_1\\
\text{if }&r<0\text{ then }r\gets r+1
\end{align}
$$
[Notes of the editor: That generator is equivalent to the one of figure 3 in Pierre l’Écuyer's Combined Multiple Recursive Random Number Generators, CACM Volume 31 Issue 6, June 1988, p. 742-751. The moduli $m_i$ are primes slightly below $2^{31}$ with $\gcd(m_1-1,m_2-1)=2$ and $m_1$ slightly larger than $m_2$. The $a_i$ are even constants somewhat below $\sqrt{m_i}$, giving maximal period and said to give good results for the spectral test of the multiplicative LCGs. Variable $r$ is floating-point. In l’Écuyer's paper, we have $r=((s_1-s_2)\bmod m_1)\cdot(\widetilde{1/m_1})$ where $\widetilde{1/m_1}$ is a close floating-point approximation by default of $1/m_1$, and $v=u\bmod m$ means that $0\le v<m$ and $m$ divides $u-v$. ]

This small variation has stifled my attempts (which have been off and on for a few months).  If anyone has an explanation of how to get the next number from only the results I would love to know, or even if you could point me in the right direction it would be greatly appreciated.
Thanks!!!

P.S.: I hope this is in the right category, I am new to this website and have also searched through the similar questions and couldn't find any that would help me out here.


texts: Shannon information entropy value of 64 bit data?

texts:
So basically i have a set of float data, its value ranges from -1.3117 to 1.7956 and then i convert this data into 64 bit binary value(assuming it is originally 64 bit double float). After that, i convert it into 64 bit integer. I encrypt this data with an encryption algorithm. The cipher histogram shows the distribution of the data are uniform like these.

After that i calculate the cipher data's shannon information entropy value and i got around 15.0525 and 15.497477 for the plain data's shannon information entropy value.
What i want to ask is, from what i know that cipher data consist of 8 bit integer data ideal shannon information entropy value is close to 8 bit, so i thought that this 64 bit integer data ideal shannon information entropy value is must be close to 64 bit right?why did i get shannon information entropy value around 15 bit on both cipher and plain data despite the uniformy distributed histogram of the cipher data? i get that the plain data shannon information entropy value usually not close to the ideal value but i dont get why the cipher data shannon information entropy value is close to 15 bit not close to 64 bit.


texts:
I guess I do not understand the word 'parallelizable'. Why are ECB CBC and CFB parallelizable?

It would be nice if someone could explain it in a short way.


texts: Why does the new encryption scheme proposed by authors stop an adversary from guessing the subspace of the secret key?

texts:
In  this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking).

Specifically this scheme:

If you look at the update procedure they simply multiply the current secret key $g^s$ and multiply it by $g^{Bu}$

If you tamper with this updated secret key you get a mutated secret key $T(g^{s+Bu})$.  How do we know this new mutated secret key does not depend on the random subspace $B$ (in some arbitrary way) ?


texts:
I have now studying the RSA, but I think that is it possible to have some

probabilistic version like a random bit string "r" XORed with the key?

Is there any probabilistic version of RSA?

Thak you so much


texts: Can an AES-GCM be cracked if the key is known but the nonce isn't?

texts:
I'm kind of new in this field and I've been trying to learn it.

I'm now facing an issue where I have a couple of packages encrypted with AES-128 GCM and I have the key that was used to encrypt these packages. However, I dont know the nonce or the H.

Is there any way for these packages to be decrypted? or is the nonce not being known keeping them safe in a case like this?

Would appreciate all help. Thanks a lot!


texts: How to represent a 32-byte SHA2 hash in the shortest possible string?

texts:
I'm calculating a SHA2 hash of a certain sensitive key value. I need to store files on disk using this hash a directory path prefix. So lets say I hash the key value 150023, I get a 32-byte value which in hex is 64-characters long - quite a long filename.

What's the shortest string I can get of this 32-byte hash, that would have some degree of uniqueness? I could use Base64 but that would be about 40 chars. Should I simply truncate the 32-byte hash value? Would it have frequent collisions if I used similar key values?


texts: Do Message Digests protect public cryptography from replay attacks?

texts: I read about HMAC and want to be sure if it protects against replay attacks as well.


texts:
Assuming there are a group of individuals with static ecdsa keypairs, of which the public keys are in a shared database that all of them have access to, how can each participant publish an ephemeral public key and prove that it was made by an individual owning one of the static keys in the database without sharing which key it's associated with & without allowing multiple ephemeral keys to "associate" themselves with a single static keypair?

Is there any construction that can deal with both the association part & the making sure there aren't multiple ephemeral keys per static key?

(Not a homework question, just something I was thinking about while reading over proposals for private look-ahead in proof-of-stake blockchains)


texts: Scale-Invariant DGHV Scheme - Decryption

texts:
I have just started reading the Scale-Invariant Fully Homomorphic Encryption over the Integers paper and I'm a bit confused about something:

When decrypting the ciphertext:

$c = r + (m+2r^*) \cdot \frac{p-1}{ 2} + q \cdot p^2$

using the decryption function m = (2c mod p) mod 2, I get $-m$ instead of $m$. Can someone please explain to me what I'm doing wrong?


texts: I am currently thinking about the complexity of a brute-force attack on a cipher. Let the key length of the cipher be 64 bit. Then there are $2^{64}$ different keys in the keyspace. If you do a brute-force search, in the middle you will have to search through $2^{63}$ keys for success. So my question is now, what is the complexity of the attack? Is it $2^{64}$ or $2^{63}$? I am not sure about it.


texts: Can the person who decrypts a homomorphically encrypted value know what operations were run?

texts:
I'm looking at the SEAL library but I'm trying to figure out what happens in a certain use case.

For example:

Alice encrypts the number 123456 homomorphically and sends it to Bob.
Bob adds 25 and does 3 left rotations on the value. He then sends it back.
Alice decrypts the value and gets 481123.

Following Step (3), is there a way for Alice to find out what operations Bob ran besides just guessing?

Maybe I'm not just confused about how the noise thing works.


texts:
As an appendix for my bachelor thesis, I proposed a solution for a TRNG that uses JPEG images as entropy source.
It's open source and available on GitHub.

My question is:
can this be really considered as a TRNG?

Obviously I tried to create a TRNG (and not a PRNG or a CSPRNG), but you know... the devil is in the detail.
Here some info, so you can help me enstablish if it can be considered as a TRNG or just a bottle of snake oil :)

How it works

It uses two different input images (with the same resolution). These images are considered independent because captured in two different moments.
It uses the Mixing technique, so the output will be unpredictable if at least one  of two images is unpredictable.
Only some of the total amount of pixels are considered. The CSPRNG SecureRandom sets for each considered pixel how many consecutive pixels have to be discarded. In this manner the correlation between consecutive pixels is avoided. This also guarantees that if the generator is run twice two different outputs will be generated.
Only the BLUE channel is considered. So the correlation between different channels is avoided.
The noise that can be found inside an image is located in the least significant bits (LSB). For this reason only the LSB of each input byte is used. You can choose to consider the second least significant bit too.

Bruce Schneier guidelines

In Applied Cryptography, Bruce Schneier lists some guidelines to check if a generator could be considered as (CS)PRNG or TRNG:

  For our purposes, a sequence generator is pseudo-random if it has this property:
  It looks random. This means that it passes all the statistical tests of randomness that we can
  find.
  For a sequence to be cryptographically secure pseudo-random, it must also have this property:
  It is unpredictable. It must be computationally infeasible to predict what the next random
  bit will be, given complete knowledge of the algorithm or hardware generating the sequence
  and all of the previous bits in the stream.
  Philosophy aside, from our point of view a sequence generator is real random if it has this
  additional third property:
  It cannot be reliably reproduced. If you run the sequence generator twice with the exact
  same input (at least as exact as humanly possible), you will get two completely unrelated
  random sequences.

And the solution I proposed:

I executed some tests, and seem promising. Maybe other tests are required (?)
It doesn't use hash functions. Each output bit is dependent on a specific pixel only. So, if an attacker knows the previously created bits, he cannot foresee the future ones.
It uses a CSPRNG just to choose the pixels to consider. So, executing the generator twice, each time two different outputs will be generated.


texts: Cryptographic algorithms compromised and alternatives?

texts:
After Edward Snowden's release of top secret information we have seen clues that the NIST certified crypto-algorithms like AES might be compromised.

  Although not as fast as AES, we prefer Twofish because we are suspicious of anything NIST certified (we explain why here.) We’ll also go with the Whirlpool hash algorithm for the same reason (see the full documentation for more info on this subject)

From https://www.bestvpn.com/blog/18538/veracrypt-how-to-basics/

Also from another article on the same site: https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs-sstp-vs-ikev2/.
If you scroll down to the NIST section they discuss this built-in back doors in NIST certified crypto-algorithms with different sources of evidence.

So they recommend using Twofish, but compared to AES, Twofish algorithm strenght isn't as good as AES. Also AES is "pretty" post-quantum computer algorithm proof, but is Twofish too?

My question is: in for an example Veracrypt you can choose between different algorithms. Should you pick AES, Twofish, AES(Twofish) or Twofish(AES). Also if you should choose Twofish, is it post-quantum computer algorithm proof? Even a little?


texts: While using onetime encryption is it possible that one can deduce the key of a message if the contents of the message are already known?

texts:
Let's say we have a randomly encrypted message and I pasted the contents of that message on a blog for some reason I do not share the key.

Would you be able to figure out the key?

This is the message not encrypted:

This is the message.

This is the encrypted message:

 -----BEGIN OneTime MESSAGE-----

Version: OneTime 1.122

Pad ID: b1255b5389588da3c0e00b87213afb6bd79a0bbb

Offset: 0

QlpoOTFBWSZTWUyTjxYAAAJ+gAgCA4FKYABwSAEoAQAQIAAigA0xMEKBpoZGTEHGQdDBjUXXyo7R
HxdyRThQkEyTjxY=

-----END OneTime MESSAGE-----

The package will not let you use keys twice. Its protocol follows this rule especially for communicating to two computers over telnet, nc, ssh, etc. The protocol can be found here in this link https://www.red-bean.com/onetime/ .


texts:
I'm studying how the selection of prime numbers in RSA encryption may affect the security of the encryption in regards to the public key.

Essentially, are there any specific types of prime numbers that render the most secure public key? (meaning that someone cannot backtrack the public key and figure out the private key)

Or do the prime numbers just have to be 'sufficiently' large?

Thanks for helping out :)


texts:
Is this problem still hard?
Given $$(g,g^a,g^b,c)$$ decide if $c=a\cdot b$?
If there is an adversary that solves the standard Decisional Diffie-Hellman Problem then it can solve my new problem. But I can't understand that my new problem still hard or not.
Did anyone see this problem or similar to my problem? Can anyone help me?


texts:
The first go-to weakness when talking about substitution ciphers is frequency analysis. It assumes that there's a simple 1 to 1 character mapping between the plain text and the cipher text.

Could a frequency analysis be thwarted if this were a 1 to Many mapping?

For example, what if the input text contained say 30 characters: 26 letters, space, period, question mark, and exclamation mark. Enough for most communication needs between two people. The output could be quite a bit larger, like the 95 printable characters. E could be mapped to multiple output characters that appear at unusual frequencies in the cipher text that don't look like E on a frequency analysis. This mapping could also map space to 1 or more characters so you can't analyze word length or word frequency.

Every character could map to at least 3 output characters and knowing that some characters are already pretty rare they may not even need to be mapped to that many. Perhaps just 2 or even 1 that way other more frequently used characters could map to 5 or 6 cipher text characters.

Is there a different kind of analysis that could target a cipher like this?


texts: Question about Damgård–Jurik crypto system

texts:
I am reading the paper about Damgård–Jurik cryptosystem.

In the proof, I found this equation

  $c^d = (g^mr^{n^s})^d = (\boxed{(1+n)^{j m}x^m}r^{n^s})^d =  \boxed{(1+n)^{j md\pmod{n^s}}}(\boxed{x^m}r^{n^s})^{d\pmod{\lambda}}$,

where $g=(1+n)^{j x}\pmod{n^{s+1}}$, $n=pq$ is an RSA module number, $\lambda$ is the least common multiple of $(p − 1)$ and $(q − 1)$, and $\lambda|d$.

I don't know why $((1+n)^{j m}x^mr^{n^s})^d = {(1+n)^{j md\pmod{n^s}}}({x^m}r^{n^s})^{d\pmod{\lambda}}$ holds, can anyone tell me?  Thank you!


texts: Why can't we use a hash with no collision to compress data reliably?

texts:
According to wikipedia, a hash maps digital data of arbitrary size to digital data of fixed size.

For all practical measures, a hash is a unique signature of a big chunk of data. But there is such a thing as a collision free hash, I "heard".

Other than being able to decompress back, arguably the main difference between compressing and hashing is precisely that collision factor - but what if the hash has no collisions?

Why exactly can't we "just" get that "perfect" hash and use it as a compressing method instead? Wouldn't it be able to generate way smaller files?

I see how I must be just missing something, so it's just my way of trying to understand what's the underlying difference between hashing and compressing! :)


texts: Prove you computed $hash^r(input)$ for some cryptographic hash function

texts:
What is the most efficient way to prove that a person computed $r$ rounds of some cryptographic hash function (ex. SHA256) on an input? Specifically, I'm trying to optimize (1) the running time of the verifier and (2) the size of the proof (in that order).

The trivial solution seems to be to show all $r$ hashes, where $v_i = hash(v_{i-1}), \space \forall i \leq r$, but this seems very space inefficient.


texts:
If an Initialization Vector (IV) is reused (under the same encryption key) in Cipher Feedback Mode (CFB), what is the effect upon security?

I know there is some negative effect upon security, but I can't figure out if it leaks information about just the blocks with the same IV, or if it destroys security for all the data encrypted under that key.


texts: What happens if no final subtraction is done in Montgomery multiplication?

texts:
I'm doing Montgomery arithmetic modulo $N = 2^{255}-19$ for the Curve25519, picking $R = 2^{256}$ for Montgomery.

After multiplying two numbers $0 \leq A,B < N$ in the Montgomery representation using MonMul, I would normally obtain the result $0 \leq C < N$ also in the Montgomery representation.

However, if I forget the conditional subtraction in MonMul I obtain some $0 \leq C^{\prime} < 2N$. In other words, I basically ended up in a different representation which is not unique anymore.

I could live with that and do all the additions/subtractions modulo $2^{256}-38$ instead afterwards. That means I basically postponed the conditional subtraction until the end of my whole computation.

But my question is what happens if I have to do MonMul again somewhere during my computation? It would mean that one (or both) of the input numbers for MonMul could be in fact between $N$ and $2N$.

Do I have to make the conditional subtraction before doing the MonMul again (to put my numbers back in the right representation)? Or can I still postpone it until the end? I realized that not doing the subtraction before any repeated multiplication didn't spoil the computation so far. Does it really hold universally for my $N$?


texts: Why is diffie-hellman-group1-sha1 used instead of diffie-hellman?

texts: For SSH why is Diffie-Hellman-group1-sha1 used instead of just Diffie-Hellman? In other words, why is the hash function used?


texts: Is there a cryptographic protocol that let's me prove someone has a large binary?

texts:
I'm working on a system that has a P2P component. When an individual downloads a binary and decides to mirror it, they advertise themselves in a providers set. The binaries can range from 1-1000MB. I need a mechanism to prevent the abuse use case where they flood the provider set without ever having the binary, and serving up bad data.

The client trying to prove the blob only has some small metadata about the blob <1MB. They need to ensure that the provider actually has the blob before initiating download.

Alice, Bob, and Malorie

Alice, Bob, and Malorie are trying to share large files. Both Alice and Bob have high bandwidth links to Malorie. There also exists an unencrypted HAM radio link between the three agents, so Malorie can see everything Bob and Alice send to one another.

Sometimes Malorie lies. Everyone knows the SHA1 hash of the file. Bob shares the file with Malorie. How can Alice check if Malorie has the file once Bob goes offline, without transmitting the entire contents of the file from Bob to Alice?

Is there a protocol for this?


texts: Dividing a secret into multiple nodes in a blockchain kind of system with time-release?

texts:
I would like to have these features and want to ask if it is theoretically possible:

a) There is custom software running on nodes in a blockchain style
b) A secret is kept in the blockchain that needs to be released at some point in time (let's say this can be the height of the blockchain).
c) No node and no one can see the whole secret before time since he would need access to all the nodes.
d) The time-lock can be extended by consensus of the network

Questions:

What happens when a node goes offline? The secret is not complete
then.
How is the initial split is happening so the whole secret is not
visible at any point in time? A client maybe that knows all the
nodes and sends them a piece?


texts: What are some disadvantages of homomorphic encryption schemes?

texts:
I'm doing some self-teaching / research for my own benefit in homomorphic cryptography.

I've studied both additive and multiplicative schemes (Paillier and RSA respectively), but all I can seem to find are the benefits of the schemes.

Are there any disadvantages to these schemes being used for homomorphic operations (minus their obvious limitations in not being fully homomorphic)? If so, where should I be looking, and which key-words have I not been searching for?


texts: CBC with random prefix but no IV - secure?

texts:
I'm looking at a datagram-based protocol that encrypts a payload. The payload is encrypted with AES or blowfish in CBC mode, and the result is then authenticated with a HMAC.

To save space, the protocol uses a zero IV, but prepends a special prefix to the data before encryption.

The prefix consists of 12 random bytes, followed by a unique sequence number that isn't reused for the same key.

In summary, the datagram payload basically looks like this:

HMAC(12+ bytes) CBC-ENCRYPT (IV=0, RANDOM(12 bytes) SEQUENCE(4 bytes) REAL_DATA)

My question is, is there an obvious flaw to this construct? As I see it, it basically is like normal CBC, but instead of a fully random IV, it uses ECB-ENCRYPT(random + sequence) as (effective) IV.


texts: Crack cryptographic hash functions using Toffoli gates?

texts:
Might it be possible that reversible combinatorial circuits (or some emulating software) are going to be used to get the input of the white box?

I mean if I have constructed a proper reversible circuit then (in theory) I can obtain the input of whatever output I get. Am I missing the point?

Here is the relevant WP link for those interested: http://en.wikipedia.org/wiki/Toffoli_gate


texts: When truncating an AES MAC value by "w" , how do I justify that "w" is still negligible?

texts:
I'm taking an online class on cryptography at corsera.org / Stanford, and the professor is explaining that it's OK to truncate an AES MAC to $w$ bits as long as $1/2^w$ is still negligible (say $w > 63$)

Where did the value $1/2$ come from?
How is 64 and above negligible?
What is non-negligible today (5/17/2013) and in the future (5/17/2020)?


texts: AES ECB mode for both encryption and authentication

texts:
Can AES ECB mode be used for both encryption and authentication, assuming the following conditions are always true?

Encryption of exactly 128-bit (1 block) size messages
Different keys used for both encryption and authentication
Authentication AES ECB uses encrypted ciphertext as input and outputs 128-bit MAC


texts: If trapdoor OWF exists then f is a trapdoor OWF, is there such a construction?

texts: Is there a known construction of f, such that given that a trapdoor OWF exists then f is a trapdoor OWF, so we can construct inefficient cryptomania, ala Levin's construction for minicrypt in "The Tale of One-way functions"? Is there such a construction, which would yield OWF if we are in minicrypt, but TOWF if we are in cryptomania?


texts: Why does the ZUC need an initial vector?

texts: After reading the Specification of the 3GPP Confidentiality and Integrity Algorithms 128-EEA3 & 128-EIA3. Document 2: ZUC Specification, I just cannot figure out why does zuc need an initial vector, my current understanding is that the initial key and the initial vector are playing the same role in ZUC, is there anything that I miss?


texts:
I'm writing some software that requires the use of a CSPRNG with javascript for use in the browser and I'm wondering what libraries are available. Crypto-js doesn't seem to have a CSPRNG I can directly call (unless I missed it?). I've looked through the Stanford crypto js library, but I'm uncertain how much analysis this code has gotten. http://bitwiseshiftleft.github.io/sjcl/doc/symbols/sjcl.random.html

They appear to be implementing Schneier's Fortuna: http://sourceforge.net/projects/fortunaprng/

I've also seen https://www.clipperz.com/open_source/javascript_crypto_library/.

My question is there a well vetted crypto js library that has a well designed CSPRNG that generates values independently of some browser support? Or with a standard all modern browsers implement? And where is the entropy source? I'm used to crypto with languages like java and C++, not this fragmented world.


texts: I have 11 sboxes, I want to test them and find the best one. How can I do that, I found several criterions for that but I could not understand.


texts: NTRUencrypt: why is it dangerous to use two different ephemeral keys for the same message?

texts:
I'm self-studying NTRU encrypt, and I read following in the book "an introduction to mathematical cryptography" -Chapter 6.10-remark 6.50 (Jeffrey hoffstein, Jill Pipher, Joseph H. silverman):

NTRU is an example of a probabilistic cryptosystem, since a single plaintext m(x) has many different encryptions p*h(x)*r(x)+m(x) corresponding to different choices of the ephemeral key r(x). (In here, h(x) is public key, m(x) is a message, and p is a public parameter. r(x) is randomly chosen in the encryption phase.)
It would be a bad idea to send the same message twice using different ephemeral keys (i.e. r(x)), just as it would be bad to use the same ephemeral key to send two different plaintexts. The standard solution to this danger is to generate the ephemeral key as a hash of the plaintext.

My question is:
why is it dangerous to send the same message with two different random ephemeral keys?
And why does using the hash of the plaintext keep security?
I read a paper, "Authenticating Privately over Public Wi-Fi Hotspots", and they generate a query vector $v_i$ like in the below figure. (for Private Information Retrieval).
And the query consists of lots of (NTRU-encrypted) ciphertexts of '$0$', and an attacker absolutely knows it. Is it safe?


texts: Trouble understanding the correctness of this Zero-Knowledge proof of posession of a discrete log

texts:
I came across the following protocol for a "Zero-Knowledge Proof of a Discrete Logarithm" in Bruce Schneier's Applied Cryptography (second edition) book. I simply cannot prove to myself that this algorithm is correct, and have been unable to find an explanation of the protocol online anywhere, only finding the original paper it appears Schneier got it from. (In the paper it is referred to as 'protocol 2,' and many of the variables are different, but it is indeed the same protocol.)

The protocol is as follows:

Peggy wants to prove to Victor that she knows an $x$ that satisfies:

$A^x \equiv (mod$ $p)$

where $p$ is a prime, and $x$ is a random number relatively prime to $p-1$. The numbers $A$, $B$, and $p$ are public, and $x$ is secret to Peggy. Here's how Peggy can prove she knows $x$ without revealing it.

Peggy generates $t$ random numbers, $r_1, r_2, ..., r_t$, where all $r_i$ are less than $p-1$.
Peggy computes $h_i=A^{r_i}$ $mod$ $p$, for all values of $i$, and sends them to Victor.
Peggy and Victor engage in a coin-flipping protocol to generate $t$ bits: $b_1, b_2, ..., b_t$.
For all $t$ bits, Peggy does one of the following:

a.) if $b_i = 0$, she sends Victor $r_i$.

b.) if $b_i = 1$, she sends Victor $s_i = (r_i-r_j)$ $mod$ $(p - 1)$, where $j$ is the lowest value for which $b_j=1$.
For all $t$ bits, Victor confirms one of the following:

a.) If $b_i=0$, that $A^{r_i} \equiv h_i (mod \space p)$

b.) If $b_i=1$, that $A^{s_i} \equiv h_i h_j^{-1} (mod \space p)$
Peggy sends Victor Z, where

$Z = (x - r_j) mod \space (p-1)$
Victor confirms that

$A^Z \equiv B h_j^{-1} \space (mod \space p)$

I was unable to prove this to myself, being very confused as to how the probability that Peggy can successfully cheat is indeed the claimed $2^{-T}$ where t is the number of trials performed.

Mainly, I fail to understand how Peggy could possibly be caught during steps 4 - 5. The paper linked above claims "This is because [Peggy] can never answer both possible cases to be sent in step 2." but in step two she either sends $r_i$, a value she literally already has and does not need to compute anything for, or $r_i - r_j \space (mod \space p-1)$, which at least needs some computation, but certainly nothing she couldn't easily perform.

I understand how sending Victor all $h_i$ commits Peggy to the $r$ values, but fail to understand how she uses those to prove knowledge of $x$. I feel as if I'm missing something obvious.


texts: Distributed authentication in low trust environment

texts:
I would like to inquire if there is any Method to achieve the following:

There is a list $L$ of $n$ entities that are allowed to perform a certain action. $L$ is cryptographically signed by some authority, so nobody can change it without detection.
Now everybody (icluding everyone of the $n$ entities) should be able to grab a copy of $L$ and mirror it.

Is there any method one can devise a scheme, where everyone who holds a copy of $L$ can authenticate one of the $n$ entities. (for Example with a blind signature, or similar), without giving the mirroring Person the power to authenticate someone, who is not part of $L$.

Example:
Some authority releases $L = [Alice,Bob,Charlie]$. Now $Dennis$ takes a copy of $L$. How can I assure, that $Dennis$ can authenticate $Alice$ but not $Eve$?


texts:
My wireless sensor nodes and gateway application use timestamps as nonces and guarantee that different messages use different nonces so that security is not compromised.
If the gateway does not include logic to discard packets with old timestamps relative to its own clock for some reason, a replay attack can be sent to it. Beneficially, the sensor would then also be able to re-transmit the same packet later if the gateway was down. Let's say the sensor was not able to deliver the packet to the gateway, but an eavesdropper picked it up.
If the eavesdropper would like to replay this message for some reason, it would actually do the system a favor, as I can see it.
If the sensor only transmits sensor data samples with timestamps, can one say that it's invulnerable to replay attacks?
And if the "sensor" includes a button to switch something on and off (real-time function), one could discard packets with old timestamps.
Let's say a counter was used as the nonce rather than timestamps, and there are hundreds of sensors connected to the gateway. The gateway would then need to keep track of each counter that belongs to each sensor (complications like power cycling retention, flash endurance, etc.) to prevent replay attacks. However, by using timestamps (and sharing the current time to the sensors initially), no such counters need to be monitored -- wouldn't this be right?
Let's go back to the button example and say that a counter nonce was used. The man in the middle could then listen in to a button event packet and simultaneously do jamming at the end of the data packet (during CRC). This way, the gateway did not receive the packet, and it has not incremented its counter value (for this sensor). The jammer, however, did receive the packet (hoping that there were no bit errors). The jammer will continuously jam the sensor for future packets -- to prevent the gateway from updating its counter. Later, it would transmit the packet it copied earlier -- and the packet would be accepted(!) Using timestamps, this would not happen, as I can see it. Or am I missing something here?


texts: Does the key generation time affect the CPU load in a mobile phone, an embedded device? I am searching on Google for info, but I am not fully sure that I have concluded to something.


texts: Curve25519 function, scalar multiplikation

texts:
This is the main paper for Curve25519. In section 2: Specification there is a important theorem. In this theorem Bernstein defines the function $X_0 : E(F_{p^2}) \rightarrow F_{p^2}$.

First Question: Curve25519 is a Montgomery curve and uses the projektive arithmetic, which only needs the x-coordinate. The defined functions makes a scalarmultiplication and then takes the x-coordinate from the result. Therefore why isn't it defined as $X_0 : E(F_{p}) \rightarrow F_{p}$? ( or $X_0 : F_{p} \rightarrow F_{p}$ )

Second Question: When making a scalar multiplication on a point of a elliptic curve, the result is always a point. So why is it defined as $X_0 : E(F_{p^2}) \rightarrow F_{p^2}$ and not as $X_0 : E(F_{p^2}) \rightarrow E(F_{p^2})$? One can say, that $E(F_{p^2})$ is not the x-value of a point. In this case, why is it not defined as $X_0 : E(F_{p^2}) \rightarrow F_{p}$?


texts:
I am working on a bitcoin related project and I am trying to speedup the ecc calculation. I started with double-and-add and sliding window.

I would like to go move over to the jacobian coordinates. This is what I found out so far:

Point Doubling

if(Y == 0){
    return POINT_AT_INFINITY
}
S = 4 * X *Y^2
M = 3 * X^2 + a * Z^4
X'= M^2 - 2 * S
y'= M(S - X') - 8 * Y^4
Z'= 2 * Y * Z
return (X', Y', Z')

Point Addition

U1 = X1 * Z2^2
U2 = X2 * Z1^2
S1 = Y1 * Z2^3
S2 = Y2 * Z1^3
if U1 == U2:
    if S1 != S2:
        return POINT_AT_INFINITY
    else:
        return POINT_DOUBLE(X1, Y1, Z1)
H = U2 - U1
R = S2 - S1
X3= R^2 - H^3 - 2 * U1 * H^3
Y3= R * (U1 * H^2 - X3) - S1 * H^3
Z3= H * Z1 * Z2
return (X3, Y3, Z3)

I found out the point at infinity is (0, 1, 0), even I am not sure if this is correct. Since I am not sure about this point, I started to think about the point doubling algorithm. There it checks if Y is 0 and returns the point at infinity. What if the point double algorithm returns the point at infinity and I have to run it again? Y would be 1 in that case and the point doubling algorithm would not detect it.

I know that in affine coordinates this would be a problem but how does it look in Jacobian?

Thanks


texts: Do I understand (below) why Q = dP is easy while finding d is hard

texts:
As we all know for discussion of Dual_EC_DBRG, the point on an elliptic curve Q can be calculated from P and some (large) integer d

$Q = dP$

And we know that knowledge of Q and P is not sufficient to be able to compute d efficiently.

My understanding

I've been hoping to explain why, and I believe that they answer is that when computing dP, one doesn't have to perform d - 1 additions, but instead can make use of the fact that you can calculate $\{2P, 4P, 8P, \dots, mP\}$ where m is the smallest power of 2 greater than or equal to $d/2$. That set of points can be calculated with $\left\lceil\log_2 d\right\rceil -1$ additions.  And then to compute $dP$ we will need an addition for every 1-bit in d.

So in worst case, computing $dP$ requires $2\log_2 d$ additions. But this short cut is not available for computing d from P and Q, and so the number of additions (subtractions) is closer to d itself.

Is this close to being a useful understanding?


texts: What is 'Carry-forward verification' defense against MITM?

texts:
Wikipedia article on Man-in-the-middle attack mentions, in the list of defenses against it, some method called "Carry-forward verification", but it does not explain it. I am curious about different MITM defense methods in general. Can someone describe this method or point to description? (Of course googling does not give anything except wikipedia itself with its clones.)

ps. Would be grateful also if someone points me to more elaborated survey of MITM defense methods (and especially for key exchange).


texts: Why do we use addition and multiplication in GMW protocol

texts:
So i'm reading about secure computation and the GMW protocol.

I don't understand why the protocol evaluates the addition and the multiplication ?

Why not just the multiplication ?

I didn't find any information about the OT used in this protocol. Is this a basic one like Rabin's or not ?


texts:
I am currently doing some research on universally verifiable mixnets, but it seems to me that there are too few papers about them after 2006 or so and most of them come from the team of Douglas Winkstrom.
Is this correct?

Can anybody point me to current references about mixnets and their use in voting protocols?


texts: Number of bit operations required for encryption in a Block cipher

texts:
I want to find out how many bit operations are performed for encryption in AES-128 with messages size $128$ bits.
For public key encryptions such as RSA and ElGamal, I know that number of bit operations required are $O(n^3)$ if the key considered has $n$ bits.
Are these equal to $O(1)$?


texts: Is $\operatorname{negl}_1(n)-\operatorname{negl}_2(n) \leq \operatorname{negl}_3(n)$?

texts: Is this statement $\operatorname{negl}_1(n)-\operatorname{negl}_2(n)\leq \operatorname{negl}_3(n)$  true for some negligible function $\operatorname{negl}_3$ and security parameter $n$?


texts: I'm working for a professor to build a platform for students to take midterms and finals online. The student downloads the test during class (when the professor makes the test available on the server or passes out the paper copy). However,  because of unreliable internet service, we'd like for students to be able to submit their finals later, when they can find a reliable connection. What I need is a way for a server to check that the student has not modified their answers to the exam in the intermittent period.  How can I do this?


texts: Does Format Preserving Encryption have significant advantages over a randomly generated lookup table?

texts:
I have a need to anonymise phone numbers so that I can carry out testing and analysis work on telecoms data sets and comply with GDPR.  I typically receive a batch of a few hundred thousand events containing phone numbers, and need to anonymise all the phone numbers in that batch under the following conditions:

A definable prefix of the number should remain the same - I should only transform the right-most n digits.  n will typically be between 2 and 6
I should always transform the digits in the same way - abcd should always be mapped to efgh
The transformation should be one-to-one - efgh should be that output for only one input
I should only output digits

If I then receive a further batch of events condition 2 is removed - I can use a new transformation for a new batch.

I've considered two approaches to this requirement:

Randomly create a lookup table mapping each n digit string to another n digit string - I will do this for all n digit strings as a one-time exercise prior to encrypting a batch, and generate a new lookup table for a new batch
Use one of the Format Preserving Encryption algorithms - e.g. Format-preserving, Feistel-based encryption (FFX) as implemented in the PyFFX or libffx libraries, or FE1 in the botan library

In some cases I may need to reconstruct the original phone numbers in the future in which case I will store the encryption key or lookup table in some secure fashion.  In some cases I know I will not need to reconstruct them in which case I will discard the key directly after encryption.

Is there any advantage to using approach 2 over approach 1?  I can see the following possibilities:

Using a random number generator in 1 may be slightly less robust than using FPE
The encryption key for FPE can be substantially smaller than the mapping table in point 1 if there is a need to retain it
A publicly available FPE implementation may contain fewer vulnerabilities than a home-grown random lookup implementation

Are there any other considerations I should have in mind?


texts: Can we defends against RSA Timing attack when we use java.math.BigInteger.modPow?

texts:
I think that Montgomery and sliding window techniques are applied within java.math.BigInteger.modPow (and more specifically oddModPow). The sliding window technique is known to be vulnerable to RSA timing attacks as an adversary can distinguish between 0 and 1.
So if I implement RSA using java.math.BigInteger.modPow, is it vulnerable to RSA timing attack?
If it is not vulnerable to RSA timing attack, why?


texts: One time pad (OTP) perfect secrecy with different key space

texts:
Let say
$K_{0} = \left \{  0,1\right \}^n$
$K_{1} = K=\left \{ 0,1\right \}^n$ \ $0^n$
$[b\leftarrow \left \{0,1 \right\}, k \leftarrow K_{b}:b=1|k \neq 0^n]$ --- (1)
Key is chosen using constraints (1).
Is this scheme perfect secret assuming OTP is used as encryption scheme.

I thought of using Shannon theory (|K|>=|M|) of perfect secrecy but the key distribution is different. Therefore I could not come up with any solution.

Also: What's the probability of constraints 1? If we can find also we can say that given scheme is perfectly secret or not.


texts:
I just started some work on computation over encrypted data in the cloud. We're still in the early planning stages, and to really understand the kind of security we can offer I need to determine what kind of attacks to expect from an untrusted cloud server. My basic question is whether the cloud represents a semi-honest, covert, or malicious adversary.

My cryptographer's instinct tells me to expect the worst and assume that all untrusted cloud servers are malicious adversaries. However, for many of the commercial cloud services it seems silly to expect them to actively attack their customers. This leads me to think of cloud providers as semi-honest. Am I way off-base here?


texts: Prove monoalphabetic cipher is a valid symmetric cipher

texts:
I should prove mathematically that:

$D_k(E_k(p))=p$

I know

$E_k(p)=c=(p+k)\bmod26$

and

$D_k(c)=p=(c-k)\bmod26$

Substituting the two formulas to the initial assertion I have

$((p+k)\bmod26-k)\bmod26=p$

And applying the $\bmod$ property twice I have

$((p \bmod26+k \bmod26)\bmod26)-k)\bmod26=p$
$((p\bmod26+k\bmod26)\bmod26)\bmod26-k\bmod26)\bmod26=p$

But from here? How can I get rid of all that bunch of $\bmod$ to have $p$?


texts: How were the DES S-box values determined?

texts:
It seems like the S-boxes in DES have essentially random values.

How were these chosen?


texts: Perfect Secrecy for some distribution implies perfect secrecy for any distribution

texts:
I'm quite thrilled about this question I got for homework, even though we were given the answer to the problem. It goes like this: Let $\mathcal{M}$ be the set of plaintexts of a symmetric encryption scheme. Prove that if the scheme is perfectly secret for some distribution $D_{\mathcal{M}}$ over $\mathcal{M}$, then the scheme is p.s. for any distribution over $\mathcal{M}$.

It was quite surprising at first, but then it started to make sense since in $$Pr[C=c|M=m]=Pr[C=c]$$ the right side does not depend on $D_{\mathcal{M}}$... and that's basically all I have, still not sure if that's enough or a good approach, so any advise will be appreciated. Thanks a lot, cheers!


texts: SHA512withRSA - Looking for details about the Signature Algorithm

texts:
I am trying to find information about the Signature Algorithm SHA512withRSA and have been unsuccessful so far.

In the current state, the signature is too long, so I would like to check the code for overhead and try to remove reduce the size.

Can anybody give me some pointers on how to achieve that.


texts: Perfect secrecy and change of plaintext probability distributions

texts:
How to prove that if a cryptosystem has perfect secrecy for a given plaintext probability distribution then it will have perfect secrecy for all other possible plaintext probability distributions?

Do we have to make any additional assumptions on probability distributions (probability of each plaintext is not zero?) to prove this?