texts:
I need to encrypt some text in the browser to be stored server side. After a little research I decided to use the SubtleCrypto API. I created the the crypto key using the following code:
window.crypto.subtle
        .generateKey(
            {
                name: "RSA-OAEP",
                modulusLength: 4096,
                publicExponent: new Uint8Array([1, 0, 1]),
                hash: "SHA-256",
            },
            true,
            ["encrypt", "decrypt"]
        )

My initial testing was successful but later I discovered that any text longer than 446 bytes is failing. Which looks like to be expected according to this answer. I am no crypto expert so what should I do to encrypt larger amounts of data (low megabytes). Choose a different algorithm, or split the data in chunks etc?


texts: Inconsistency with PKCS#11 v2.40 CKM_AES_KEY_WRAP_PAD

texts:
There appears to be some inconsistencies between the PKCS#11 v2.40 Current  Mechanism Specification and the specification for AES Key Wrap Pad as defined in SP800-38F.

First, according to PKCS#11:

  The mechanisms will accept an optional mechanism parameter as the Initialization vector which, if
  present, must be a fixed size array of 8 bytes, and, if NULL, will use the default initial value defined in
  Section 2.2.3.1 of [AES KEYWRAP].

  The type of this parameter is CK_BYTE_PTR and the pointer points to the array of 8 bytes to be used as
  the initial value. The length shall be either 0 and the pointer NULL, or 8, and the pointer non-NULL.

However, according to SP800-38F, the ICV2 value for AES-Key Wrap PAD must be four bytes in order to correctly pad the input to the cipher routine (section 6.3 algorithm 5).

Secondly, PKCS#11 specifies that CKM_AES_KEY_WRAP_PAD is used for Encryption/Decryption only, not for Wrapping/Unwrapping operations (Table 65, in section 2.14 in the PKCS#11 current mechanism specification).  This seems inconsistent with the goals of the AES KEY Wrap Pad algorithm.

So my questions are:

Is this a known inconsistency and has Cryptoki released any updates to how the CKM_AES_KEY_WRAP_PAD algorithm can be used?  I cannot find anything on Google but maybe I missed something.
In my PKCS#11 implementation, can my solution be to inform the user (through documentation) that the IV for CKM_AES_KEY_WRAP_PAD will be truncated to 4-bytes?
I know this appears to be out of spec, but can I in my PKCS#11 implementation allow the user to use CKM_AES_KEY_WRAP_PAD for Wrapping/Unwrapping as well as Encryption/Decryption.


texts: How is it possible that $g^q \equiv 1 \pmod p$ for a generator g?

texts:
The context of this question is coming up with the parameters for the ElGamal encryption scheme.

One of the requirements for the parameters for ElGamal is that we have primes $p$ and $q$ such that $p = q \cdot k + 1$ for some $k$. For simplicity, let $k=2$. We also need a generator $g$ for $p$ such that $g^q \equiv 1 \pmod p$. (Feel free to correct me if I got any of this wrong).

However, according to this Crypto SE answer to “How to test if a number is a primitive root?”, a number $g$ is a generator of $p$ iff $g^{\varphi(p)/j} \not \equiv 1 \pmod p$ for all prime factors $j$ of $\varphi(p)$. Since $\varphi(p) = p-1$ (as $p$ is prime) and $p-1$ has just two prime factors, $2$ and $q$, we have $g^q \not\equiv 1 \pmod p$.

Doesn't this directly contradict the above requirement of ElGamal?

For a real world example, take IKE groups 1 and 2 from RFC 2409. With group 2, we have $p = $ some large prime and $(p-1)/2$ also equals some large prime. They give us the generator $g=2$. This checks out for ElGamal because $2^p \equiv 1 \pmod p$. I've also tested it with my implementation of ElGamal encryption and everything works fine. However, doesn't this contradict the definition for a generator? If I try to find a generator for $p$, the first one I get is $g=11$, because $11^q \not\equiv 1 \pmod p$ and $11^2 \not\equiv 1 \pmod p$. But if I use $g=11$, the encryption fails because, as far as I can tell, $11^q \not\equiv 1 \pmod p$.


texts: How do other, non-RSA algorithms, compare to the PKCS #1 standard?

texts:
Arguably the PKCS suite of standards have a profit-oriented bias as they are promoted by RSA and promote their algorithms over others in the form of RFCs and other means.

I'm considering the possibility that this information bias may include disinformation or omission regarding substitute algorithms that may be equally good if not better.

  What are the other algorithms that could fill the space that that the PKCS#1 RSA algorithm  is currently holding?


texts: The other answers for this confuse me, I know the principle of d in terms of the equation it has to satisfy. However I'm not sure how I would go about finding the private exponent without trial and error. I want to implement this in a program, but I'm not quite sure the algorithm I would use to find d. Can someone explain the equation or algorithm for finding d?


texts: Calculating characters from the sum of ASCII pairs

texts:
I have a series of messages (limited to only a-z and A-Z) that are encoded such that the sum is taken of every two ASCII values and concatenated. For instance, the message hello would be decomposed into the pairs he, ll, and o which would then become 104 + 101, 108 + 108, and 111 which finally is output as  205216111. Each pair is guaranteed to be 3 digits by zero-padding.

Is it possible to trivially decode this final number back into the plaintext? The words are in plain English and each word is capitalized. So far I have attempted to enumerate all possible permutations and identify words from a dictionary list but this has proven to be rather tedious with short messages alone.


texts:
For modulus $Q$ and stddev $\sigma$, [GHS12] suggests that, to achieve 128-bit security, just choose the dimension $N$:
$$
N\geq(Q/\sigma)\cdot 33.1
$$
This seems to suggest flexibility to choose smaller $\sigma$ ("as long as it is not too tiny"), but just paying a price on $N$.
Many instantiations seem to favor a fixed $\sigma$ about $3.2$ ([GHS12]). Especially, the homomorphic encryption standard said:

The standard deviation that we use below is chosen as $\sigma = 8/\sqrt{2}\pi \approx 3.2$, which is a value that is used in many libraries in practice and for which no other attacks are known. (Some proposals in the literature suggest even smaller values of $\sigma$.)

There are schemes using a smaller $\sigma$. Frodo is looking at approximating $\sigma\approx1$.
My question:
In my use case, I do need the noise to be very small.

Can one do $\sigma\approx0.1$?
If not, how small can $\sigma$ be, if one needs to minimize it?
Is it because we need to approximate continuous Gaussian, so $\sigma$ can never be too small?

Note that $\sigma\approx 0.1$ seems unreasonable, since, with a high possibility, all sampled values will be zero (by making it an integer). And [GHS12] mentions explicitly that the $N\geq(Q/\sigma)\cdot 33.1$ check does not apply to "too tiny $\sigma$", although the paper did not explicitly mention what is considered "too tiny".
Yet, the LWE estimator seems "okay" with $\sigma\approx0.1$. I guess small $\sigma$ is beyond the scope of the LWE estimator?


texts: Which organization is responsible for certifying a TSA?

texts:
I see there a number of free TSA services according to this page (not all are still in service).

In other sources I see references to the requirement of audits for the TSA to be 'rfc3161 compliant'. Given the number of free services, not to mention the new blockchain services (which are similar but not exactly the same as rfc3161), I'm finding it difficult to imagine they have all spent money on getting audited and certified. (This may pose a problem if and when the timestamps are presented before a legal court and their validity addressed or refuted by the opposing party). I am curious to know for the U.S.:

Are audits performed by a specific organization or private contractor?
In the U.S., is there an organization responsible for issuing a 'seal of approval'?


texts: Choosing primes in the Paillier cryptosystem

texts:
In the first step of key generation phase in Paillier cryptosystem given here.

It's given that

$$\operatorname{length}(p) = \operatorname{length}(q) ) \implies \operatorname{gcd}(pq,(p-1)(q-1))=1$$

where

$\operatorname{length}(k)$ = # bits in binary representation of $k$

$\operatorname{gcd}(a,b)$= greatest common divisor of $a,b$

How to prove the above equation, or where has it been proven?
In the third step of key generation, we have to select a random integer $g$ where $g \in \mathbb{Z}_{n^2}^*$ and in the step 2 of encryption we have to select a random integer $r$ where $r \in \mathbb{Z}_n^*$.

What I am wondering is "what is the known efficient way to select $g,r$ randomly". I mean whether we have to check in $\mathbb{Z}_{n^2}^*,\mathbb{Z}_n^*$ for such $g,r$ until $\operatorname{gcd}(g,n^2)=1$ and $\operatorname{gcd}(r,n)=1$ or is there any simple method while coding cryptosystem.
In the first step of encryption, it is given that plain text $m\in \mathbb{Z}_n$ .

So $m < n$ .

Suppose we are going to encrypt $k$-bit messages , so our $n$ must be $l$-bit
number, where $l>k$.

We know that product of two $s$-bit numbers gives a number whose number of bits is between $s+1$ to 2$s$ , Suppose we are taking the equal length primes to ensure the property $\operatorname{gcd}(pq,(p-1)(q-1))=1$, then it is necessary to take $k$-bit primes  since $m<n$ .

Is this correct?


texts: DES security if used a SHA3 function instead of Normal DES function?

texts: I was practicing some python programming and I decided to implement a simple DES encryption function, so i decided to take some shortcuts so instead of DES expansion boxes and s-Boxes i just used a simple keyed SHA3 hash function the input is: 32-bit right side + key(any length I want but I used 128-bit) The first 32-bit of hash are xor-ed with left side to produce ciphertext. So now ignoring that i designed my own crypto and the fact that I used a very simple key schedule function. what are the security advantages of using this hash function instead of normal one (taking in mind that it takes 128-bit key which is greater than 56-bit key of Normal DES), and how it will differ if I used SHA2 (would SHA2 susceptibility to length extension attacks affect the security). lastly what are the advantages of using this method.


texts: What is the difference between a sealed box and a normal box in libsodium?

texts:
I'm trying to learn libsodium to better my crypto knowledge. One nagging question I have is what is the difference between libsodium's sealed box and their normal box? Not in terms of technicalities as the docs do distinguish this well; but in terms of practical use cases.

Per the docs:

  Sealed boxes are designed to anonymously send messages to a recipient given its public key.

  Only the recipient can decrypt these messages, using its private key. While the recipient can verify the integrity of the message, it cannot verify the identity of the sender.

  A message is encrypted using an ephemeral key pair, whose secret part is destroyed right after the encryption process.

  Without knowing the secret key used for a given message, the sender cannot decrypt its own message later. And without additional data, a message cannot be correlated with the identity of its sender.

Sadly this doesn't address the use case when this is needed. For example Say Alice generates a keypair and gives Charlie the untrusted 3rd party the public key for storage. Bob asks Charlie for the public key and sends Alice a message using said public key. From my limited understanding of this this should be secure and prevent Charlie from knowing the message. Is this not your basic end-to-end-trust-no-one system in the same vein as PGP?

If this system were to be implemented with an ephemeral key exchange as suggested by the sealed box concept would that not just add more overhead to an already secure system?

Perhaps I'm misunderstanding and perhaps my intended use case is different which is why I'll explain my mental model to better give context. (Also note I think the signal protocol uses ephemeral pre-keys and I also don't understand why in that context).

Alice runs an app on her phone which generates a unique keypair (unique in that it regenerates a new one every time the app opens) and then registers a unique address along with her public key with Charlie the back end server. The app then presents Alice with a URL that contains her unique address and a nonce. She shares this link with Bob who also opens the app providing it with the address and nonce. Bob's app generates a unique keypair then asks Charlie for Alice's public key (based on the address). Bob's app then encrypts Bob's public key along with the nonce and sends it to Alice (via Charlie). Alice's app verifies the nonce and then uses the provided Bob's public key and is now able to send him messages back.

AFAICT the above is a very basic key exchange through a third party in the same way we handle PGP key sharing on a key-server with the distinct difference in that once the session is over (app closed) the keys are no longer valid (secret keys erased) and a new session would be completely new identities and keypairs.

Is this even remotely related to the use of sealed boxes or have I only proved that I am sleep deprived and know nothing about crypto?


texts: Timing Side Channel on error-correcting code

texts:
This question may be a basic question but it is not clear to me at the moment.

I have an Error Correcting Code (ECC) in a key-encapsulation scheme designed for post-quantum cryptography which operates on secret data.

The ECC I am using is constant time as long as the number of errors which need to be corrected is constant, and as long as those errors occur at the same positions in the message. The runtime does not depend on the secret data itself, only on the #errors and their positions in the secret data.

Does this leak any useful information? The # of errors which occur is not always constant in a real scenario...


texts: Is there a cyclic RNG without an explicit form for $i$'th element which is guaranteed to have a sum of zero (subset of elements, $\mod P$ possible)

texts:
Let $X$ be a sequence element list of (pseudo) random values generated by a RNG and $x_i \in X$ a member of it. The period length is $k = |X|$ and it is a cyclic generator. For $i>k$ the value $x_i = x_{((i-1) \mod k)+1}$
(the list of random value outputs repeats again after $k$ values)

Now is there any such RNG with a sum of zero (of selected elements) :

$$0 =\sum_{j=1}^k \delta(x_j)\cdot g(x_j)$$

with
$$e_m =\sum_{j=1}^m \delta(x_j)\cdot g(x_j)$$
$$s =\sum_{j=1}^k \delta(x_j)\cdot x_j$$
$$c =\sum_{j=1}^k \delta(x_j)$$

using $\delta()$ as a selection function (selects by value).
$$\delta(x_j) =\begin{cases}
       1 &\quad\text{if $x_j$ should be part of the sum} \\
       0 &\quad\text{else} \\
     \end{cases}$$
$\delta\ could be e.g. only values which are less than a number or end with a 7 or have integer root or...what ever you like (but not index related)

an $g()$ as a modifier function to accomplish a sum of 0. That could be e.g.:
$$g_1(x) = x \mod P$$
$$g_2(x) = x -s/c$$

Target values and restrictions:
+Amount of unneeded computations should be small:
$$k/c < 10$$
+Number of unique values of partial sum should be as many as possible
$$|\{e_m, 0 < m <= k\}|=u$$
$$u/c > 0.6$$
+Computation time of $\delta, g$ should not increase during run time
+able to scale
+there should exists no efficient way to compute $x_i$ or $g_i$ for given $i$ (except $i=k$ or $i=v+k$ for known $x_v$) or index $i$ for given value $w=x_i$ (source code and runtime variables are known by the attacker, some linear speedup of $<10$ times is allowed)
+The RNG need to be started at different seeds but still generating all elements in $X$ in the same order. Some seeds may generate a different $X'$ with different values and/or order. Not more than 4 of those $X$ is allowed.
+There need to be a way to randomly pick a seed for the RNG
+Number of possible seeds $>=c/2$
+random value type can be integer, real, complex, vector, .... anything your like but it need to be representable in binary format

Outro & Example
With formulas above I tried to generalize the question.
A valid solution would also be a RNG which produces a permutation of all values between $1$ and $N$.
For Example $N=2^8-1=255$. The sum of those would be $N \cdot (N+1)/2$. To accomplish a zero sum
$\delta(x)$ could just be $1$ all the time and $g(x) = x \mod (P=2^7)$
If now for some reason the RNG produces all values from $1$ to $300$
$\delta(x)$ could only be $1$ for $x$ with a highest leading bit of $0$. With this it only sum up values from $0$ to $255$ again.


texts:
Pseudosquares ,which are not square but Jacobi symbol are still 1, are used in some cryptographic algorithm. What is the advantage of them over the exact squares? If we used squares instead of pseudosquares, what would we lost?
I think,factorization can be hard and so security is ensured. But I am not sure about certain reason


texts:
Assuming the alert protocol is encrypted AFTER a session has been established and the structure below, how does the client know whether to expect encrypted data or not?

http://en.wikipedia.org/wiki/Transport_Layer_Security#Alert_protocol


texts: Is it possible to manage an encrypted dataset for face recognition?

texts:
Im in my final year of PhD in computer vision and my supervisor has given me a task that I am not very familiar with. So I am teaching myself homomorphic encryption everyday. This question is mostly about clarifying my understandings as well.

He wants me to setup an encrypted dataset for an internal competition among his first year students. The task is to identify faces within the encrypted domain using homomorphic properties.

So to begin with I started reading about Paillier encryption and coded the encryption and decryption part from the equations in the literature review. So now I can encrypt data into ciphertext and decrypt that ciphertext back into its original text successfully. I then tested homomorphism and that is working as well. I can add together the ciphertexts and also multiply a scalar value to the ciphertexts. So the implementation and practical side that I taught myself was done.

I understand that in Paillier system we have a public key n (n = p * q) and g, and a private key mu and lambda. The client and the server know the public keys and the server can use this public key to perform homomorphic addition/multiplication and only the client knows the private key as only the client can decrypt the messages. Now from my understanding, his idea is for me to encrypt a simple face dataset like the ORL dataset and make available the encrypted dataset and the public keys for his students to perform operations on and hopefully determine the correct identity of another encrypted query image.

Now my main concern is about the practicality and possibility of all of this. My supervisor did not give me much details and just basically said make this happen.

My understanding is that to have a decent level of encryption for such a local dataset a n of size 1024 bits would suffice. So I should encrypt the images with a key size of 1024 and then give the encrypted dataset along with the public key to the students. Maybe I should also give the private key so that they can decrypt their results to see if they identified correctly.

Sorry for the long post but Im trying to understand is all of this possible? Can the students perform identification in the encrypted domain using only the data I provide them?


texts:
First off, I'm not an experienced cryptography or computer person, please bear with me. I have some basic experiences with PGP software though (not much of a redemption huh?). I have some data that I'd like to protect with ECC encryption, but I can't for the life of me find a tool or anything that can use ECC.

I'm not a computer programmer or anything. I just need a tool that I can use to encrypt my stuff with ECC. I'd be willing to pay for a software if anybody knows of one, but free is always best.


texts:
I understand the need for the hash function to be collision resistant and second pre-image resistant. For what reason, exactly, does a hash function need to be pre-image resistant?

If this property is not useful for signatures, what is the origin of this requirement, maybe privacy?


texts:
Given an elliptic curve with equation $y^2=x^3+ax+b$, and i want to find the number of points $(a,b)\in E(\mathbb{F}_p)$ where the polynomial has repeated roots, how do i do it? I have an intuition it is $p$, but don't know how to rigorously show it.

Thanks


texts: Construct rainbow table to break DES for a fixed plaintext

texts:
I'm facing a project where I need to build a rainbow table to break DES for a fixed plaintext.
I've already collected information about Hellman, DP, rainbow table method. Finally, I chose the rainbow table approach. I've read about the topic “Rainbow table for DES with all-zero plaintext”.
Now, my consideration how to choose good parameter to obtain highest success rate.

The notations:

N: search space
m: number of chains
t: chain length
l: number of tables

Stopping matrix is $C = mt/N$. Success rate is $R = 1 - e^{-C\cdot l}$.
By Theorem 6, $C = (-\ln(1- R))/l < 2$.

So… I can calculate $l$ to obtain expected $R$, from $l$ I can derive $C$.
Now I´m wondering: can I simply choose $m$ and $t$ such that $mt/N = C$, or must it be dependent on something else?


texts: Which values are used for an elgamal cryptosystem public key?

texts: I know that – within the elgamal cryptosystem – the values of $a$ and $b$ are public. But which values are used to create public keys?


texts: Do storage encryption systems care about size of data?

texts:
I was studying about Psuedorandom functions and their use as encryption functions. One of the things that I read was "birthday bound" or "birthday attack".

When encryption is used for something like disk encryption, the amount of data being encrypted can be very large and over time be large enough to launch a birthday attack. Do storage encryption systems care about it? Or is it not big of a deal? Or is my assumption of data size being a problem, wrong?


texts: Is there a way to generate a password from another but those 2 will have no relation?

texts:
For example I have the password X and I want to encrypt 2 different things. Even if one of them was stolen due to a keylogger, other will be completely safe. I wonder how safe something like this would be if the master key is completely random, secure and unknown. Also with what algorithm, program would i be able to do this on Linux systems?

I think something like this is possible actually because of Electrum's key generation method. It uses one master private key to generate all the addresses and private keys.


texts: Does re-transmission really reduce security?

texts:
I am using AES with GCM and a colleague told me "Repeating a VCC with the same key and a different message reduces the security of the key." He did not have any additional detail to offer.

What he meant was since the encrypted VCC is in a fixed location in a packet, bad guys could intercept the messages and correlate the two messages, somehow making it easier to crack the message or key because the VCC was repeated. (I don't understand how bad guys would know if the VCC was repeated or not...)

My understanding is the VCC is there to prevent replay attacks, nothing more, nothing less. I understand they should not be repeated.

So my question is this: does repeating the VCC with a different message and the same key actually make it easier to crack the encryption key? If so, how?


texts:
You plan to use a public-key cryptosystem based on the RSA trapdoor permutation in three different real-life applications, in which the attacker has, respectively, only one of the following resources:

a single computer,
a collection of computers distributed across the Internet, and
a quantum computer.

When choosing the length of the modulus n for the RSA trapdoor permutation, you plan to choose a different length for each of the above three attacker resource scenarios. Which of the following length settings is closer to your choice?

A. (a): 1024; (b): 2048; (c): 4096
B. (a): 512; (b): 1024; (c): I would not use RSA
C. (a) 2048; (b): 4096; (c): I would not use RSA
D. (a) 512; (b): 1024; (c): 2048

Not sure how to do this. Can anyone help me with this and explain why?


texts: Is the one-time pad still perfectly secret if all-zero keys are excluded?

texts:
I'm trying to solve this question related to one-time pads and perfect secrecy:

My solution is: I assumed that the current message space is  $M = \left\{ 0,1 \right\}^l$ and the new keyspace after removing $0^l$ from the set is $K = \left\{ 0,1 \right\}^l - 0^l$. Since clearly $|K| < |M|$, the new scheme is not perfectly secret.

Is my solution correct?


texts: Looking for a formula for "Given $x_1$, $\ldots$, $x_{n-1}$, the output $F(x_1,\ldots,x_n)$ is dependent of $x_n$ and is of $l$-bits security"

texts:
Suppose I have a function $F(x_1,\ldots,x_n)$, where each $x_i$ is of $l$-bits security (suppose each $x_i$ is a binary string of length $l$). At the same time, suppose there are $n$ persons, each one having a value $x_i = b_i$.
I want to write down in a mathematical formula the following: "given $x_1=b_1$, $\ldots$, $x_{n-1}=b_{n-1}$, the output of $F$ is dependent of $x_n$ and is of $l$-bits security". I.e., if any $n-1$ persons plug in their values, there are $2^l$ possibilities for $F(b_1,\ldots,b_{n-1},x_n)$.

For example, consider the function $F(x_1,\ldots,x_n) = x_1$.
The output of $F$ is only dependent on $x_1$.
This function offers no security: if player 1 plugs $x_1=b_1$, there is one unique possibily for $F(x_1,\ldots,x_n)$ ($l=0$).
Second example (bit-wise sum). Consider $F(x_1,\ldots,x_n) = x_1 + \cdots + x_n \pmod{2}$.
Given $x_1,\ldots,x_{n-1}$, the output depends on $x_n$ and is of $l$-bits security.
Now, returning to the question, I have an intuition that the formula that I want is
$$H(F(x_1,\ldots,x_n) | x_1,\ldots,x_{i-1},x_{i+1},\ldots,x_n) = H(h_i) \quad \forall i=1,\ldots,n$$
where $H$ is the Shannon Entropy.
Can someone point if I am in the right path and formally describe the formula that I am looking for and explain it?
Thanks in advance.


texts: How does a pseudorandom generator produce a similar distribution to $U_{n}$?

texts:
According to Wikipedia, a function ${\displaystyle G:\{0,1\}^{\ell }\to \{0,1\}^{n}}$ with ${\displaystyle \ell < n}$ is a pseudorandom generator against $\mathcal {A}$ with bias $\epsilon$  if, for every $A$ in ${\mathcal {A}}$, the statistical distance between the distributions $A(G(U_\ell))$ and $A(U_n)$ is at most $\epsilon$ , where $U_{k}$ is the uniform distribution on $\{0,1\}^{k}$.
My question is that if $\ell < n$, then $|G(U_{\ell})|$ < $|U_{n}|$. How can these distributions be so similar (i.e., have an error $\epsilon$ where $\epsilon$ is very small)? Shouldn't they differ very much as the number of elements in $U_{n}$ are at least twice as much as those in $G(U_{\ell})$?


texts: RSA with a prime substituted by a Carmichael number

texts:
If the public key in a RSA system is $(n,e)$ with $n=pq$, $p$ prime, $q <p$ a Carmichael number and $\gcd(e,(p-1)(q-1))=1$ then if $d$ is the inverse of $e$ modulo $k=(p-1)(q-1)$, I want to show that for every $0<M<n$ we have that $M^{ed}\equiv M (\hspace{-2mm}\mod n)$.

I've managed to prove it is true if the $\gcd(M,n)=1$.

If $\gcd(M,n)>1$, I've make two cases, $p|M$ or $p\not|M$. For the first case I also know it is true, but I'm not able to prove the second case.

Any ideas?

And, if it is possible, I'd like to prove it just using the definition of Carmichael numbers, i.e., for every $a \in \mathbb{N}$ such that $\gcd(a,q)$ we have that $a^q \equiv a (\hspace{-2mm}\mod q)$. I know there is an equivalent definition by Korselt's criterion, but we haven't studied it and I'd like to prove it without using it.


texts:
We have Mersenne Twister pseudorandom number generator. It has several variants, CryptMT among them, that is of cryptographic grade.

There are alternatives to Mersenne Twister, like Xorshift or Xoroshiro.

Question: Do those algorithms have cryptographic variants, or are they secure per se, or are there other simple pseudorandom number generators that are good for cryptography?

I need a generator that has good random properties as it will be used to generate random matrices (not keys). At the same time it has to be unpredictable enough so the attacker has little control what matrices are generated when messing with the seed.

CLARIFICATION:

The setup is as follows: a random seed is chosen and used to generate pseudorandom square matrices over Boolean ring. Those matrices, when chosen randomly, have certain probability of being singular or not. The PRNG must generate such a sequence so the probability of a matrix being singular is the same as if they were chosen randomly.

The matrices are not secret, they are presented to the user and forward secrecy is not needed. Based on initial state the user might be able to predict all next matrices in a sequence, as long as they admit the right probability distribution.

ATTACK SCENARIO:

An attacker might be able to alter some bits of the random seed. Not all bits, as he might be restricted to altering only a subset of bits of the seed, or flipping several bits at once. Even when the attacked has such ability, the probability of a matrix being singular should be the same as if it was chosen randomly.

HARDER PROBLEM:

We want not only (non)singularity of a matrix to be close to random distribution, but also its rank.


texts: Why don't most encryption algorithms use perfect secrecy?

texts:
Isn't it possible to make algorithms that are both computationally complex and have many possible answers if you try to crack them without knowing the password?
Why aren't many popular algorithms like AES like this?


texts: How to count the number of selected element in each slot within the packed ciphertext

texts:
Given an encrypted ciphertext (n slots, packed n elements into a single ciphertext), such as ={(2,0,1,2),(3,2,1,3),(3,4,0,4),(5,1,4,2)}.
Formally,  slots can be expressed as  blocks, each block with  slots. The range of the elements in each block is [0,],  is the largest element in this block. We want to count the number of  in each block.
For example, as for , =16 (just an example, should be much larger in real-world applications), =4, =4, the ranges are [0,2], [0,3], [0,4] and [0,5]. Now we want to count the number of 2,3,4,5 in each block.
One way is to transform  into ={(1,0,0,1),(1,0,0,1),(0,1,0,1),(1,0,0,0)}, then we make additions using rotations within these slots. But how do we transform this?


texts: Does this qualify as a one-way function?

texts:
First, we observe that the expression X*Y mod P (where X and Y are secret and P is a large public prime) reveals no useful information.
Next we define an extending function E(U, M) which "somehow" transforms U in such a way to guarantee that the result consists of at least M bits. For example, by returning the bit pattern of U with the Mth bit set. (In practice we might add a few more constraints there in order to satisfy non-malleability).
Finally, we have a function F defined as follows:
Q = E(V, N)
F = (Q * E((Q * A) mod B, N)) mod C
Where A, B, C are large public primes, V is secret, and N is the number of bits of the largest prime.
So my question is, does F satisfy all of the following properties: non-reversibility, preimage resistance, and collision resistance?


texts: ECDSA key recovery - floating point values

texts:
I'm currently attempting to recover an ECDSA key.

I have $m$, $m'$ and signatures $(r, s)$, $(r', s')$, and  I know that $k$ is constant, the curve is NIST P-192 and the hash function of the. As such, I'm attempting to compute $d_A$ as shown on the wikipedia page for ECDSA.

However, after recovering $k$ (on the stage where I am computing $d_A$), I get a floating point result for $d_A$. Is this to be expected? If not, what would be the correct way of handling it?

My code, if it helps:

#!/usr/bin/python
import hashlib
import ecdsa.util
import ecdsa
import sys
import base64

n = 6277101735386680763835789423176059013767194773182842284081
r1, s1 = ecdsa.util.sigdecode_string(open("sig1.bin", "rb").read(), n)
r2, s2 = ecdsa.util.sigdecode_string(open("sig2.bin", "rb").read(), n)
hash1 = hashlib.sha1('iSsuZJOq1FNKMuK4wm88UEkr21wgsypW'.encode('utf-8')).digest()
hash1 = ecdsa.util.string_to_number(hash1)
hash2 = hashlib.sha1('x3wqOnaetBPO66TrBaMyr3NQIDbhvK0w'.encode('utf-8')).digest()
hash2 = ecdsa.util.string_to_number(hash2)
print(r1 == r2)
#Much modulo N. Such wow.
#This totally didn't bite me in the ass for quite a while or anything <.<
top = (hash1 - hash2) % n
bottom = (s1 - s2) % n
print((top / bottom) % n)
k = int((top / bottom) % n)
print("Common constant k=0x%x" % k)
secret = (s1 * k) % n
secret = (top - hash1) % n
secret = (top / r1) % n
print(secret)

And the output:

True
6.337358414243492
Common constant k=0x6
50.34135291546233


texts: "hex" vs. "base64" encoding when enciphering

texts:
Examining different implementations of encryption / decryption  with cipher on Node.js, I paid attention that some implementations use hex encoding:

let encrypted = cipher.update(value, "utf8", "hex");

while other prefer base64:

let encrypted = cipher.update(value, "utf8", "base64");

Questions:

Does encoding choice play a significant role in encryption for a cipher?
From security point of view, can the wrong encoding choice affect the outcome?


texts: Why is a bit biased when generated from random $v \in Z_q$ for odd q?

texts:
I am not understanding the following from "Lattice Cryptography for the Internet" by C. Peikert (pages 10, 11):

  When $q$ is odd, while it is possible to use the above methods to
  agree on a bit derived by rounding a uniform $v \in \mathbb{Z}_q$, the
  bit will be biased, and hence not wholly suitable as key material.

I don't understand the biased part and how it is related to $q$ being odd or even. Any help would be appreciated.


texts: Given 2 Digital Signature generated by $S=D\times k^r$ how do you solve for $k$?

texts:
Given 2 signature $(D_1, r_1, S_1)$ and $(D_2, r_2, S_2)$ and the Signature is generated as $S=D\times k^r \mod N$ where $N$ is a product of 2 primes and $r_1$, $r_2$ is co-prime. How do you solve for $k$?

I got the following equations :

\begin{align}
S_1 &= D_1 \times k^{r_1} \mod N \\
S_2 &= D_2 \times k^{r_2} \mod N
\end{align}

I get that the hint should come from the co-primes of $r_1$, $r_2$. But I can't see why.


texts: Block cipher with key longer than block size

texts: When a block cipher key length is greater than the block length, is it the case that for some keys $k_0, k_1$ (with $k_0 \not= k_1$) and plaintext message $m$ that $E_{k_0}(m) = E_{k_1}(m)$?


texts: Where shoul I store private/public keys and how should I share it?

texts:
I'm new in terms of encryption and I have to encrypt the data between two Java Spring applications, one have serves as MVC framework and other as Web Service, I'm implementing an asymmetric encryption by generating the private and public key with RSA at the beginning of the deployment cycle and saving the keys in binary files locally in the hard drive but I’m not sure if that is the best way of doing it, and then I have to share the public keys between the two projects automatically but I don’t know how should I do this, I was planning to exchange the keys by sending a petition to the Web Service.

I'm using the KeyPairGenerator class to get a KeyPair and writing the PrivateKey and PublicKey objects to local disc.


texts: Is establishing a secret key possible given this characteristic primitive?

texts:
I am wondering if there are any readily available solutions for the following problem:
I have a ring-topology network with several devices connected to it, some malicious, some legitimate. I want to authenticate / establish a shared key between two legitimate devices, without the malicious ones finding out the key. There are no preshared secrets or certificates or anything, only this: During startup (and perhaps in regular intervals) I can exchange several messages between two trusted devices knowing for certain that the messages were sent by that trusted device (due to device-specific characteristic voltage spikes on the network).
Is this sufficient to establish a shared secret or key? I personally dont see a way but wanted to ask. Thanks!


texts: Reusing IV but still generating different code?

texts:
I'm in a beginner's cryptography class and I'm trying to figure out if I'm doing something wrong, or if I just don't understand why something is the way it is.

I created a simple .txt file of 124 bytes and encrypted it with AES-CBC three times: twice with the same IV of '135797531', and once with a different IV of '246808642'. I also used the same password for all of them. Then I opened all the encrypted files in a hex editor to analyze the contents, and I saw that--aside from the header bytes--the code of each one was completely different. Even the ones that used the same IV. I was under the impression that if I use the same IV and password to encrypt a file twice, then they would both result in the same code, and that explains why an IV should be different each time. But with what I have, it's looking like it shouldn't really matter even though I know that's not the case. Did I do something wrong, or is there another explanation?

Edit: Code that was used-

openssl enc -aes-128-cbc -e -in text1.txt -out text2.txt -k '0123456789' -iv '135797531'


texts: Using same encryption key in different schemes

texts:
Is it safe to encrypt possibly same plaintexts with 2 different algorithms using same secret encryption key? This question is similar to this question except they use 2 keys. More formally:

$E_k(m) = E_{1,k}(m)||E_{2,k}(m)$

I understand that this could be easily made secure by producing few more keys out of the one key that is provided by, for example, using a stream cipher over predefined plaintexts or by hashing the key with predefined prefixes. I am wondering if there are any non-obvious problems with mixing schemes. I suspect there may be, since both ciphertexts together provide more information to an attacker than each ciphertext alone.

Consider this. Both schemes use 512 bit keys. First encryption outputs a ciphertext that is a function of message and first half of the key, concatenated with second half of the key in the clear. This scheme is secure in itself, because the key bits essential to security are kept secret. Remaining bits are considered junk. Second encryption does the opposite where first half is outputed in the clear. Together, entire key is revealed.

On side note, I am aware that same RSA keys should not be used for encryption and authentication. GPG uses separate keys. Feels like a similar issue.


texts: How come “short” (eg 80 bit) MACs are regarded to be safe?

texts:
I‘ve got two questions:

Why are much shorter output lengths of, e.g 80 bits, sufficient for MACs ?
Assume  a message $x$ that is sent in clear together with its MAC over the channel: $(x,MAC_k(x))$. What does Oscar have to do to attack this system?

I think I can answer the first question: it’s because of the Birthday Paradox
But for the second, I don´t know how to start. It’s not given how the MAC is calculated. I could do a secret pre- or suffix attack ?


texts:
Literature on the DSA (e.g. Gupta 2014) agrees that the security in DSA relies on the difficulty to solve two distinct discrete logarithm problems (DLP):

One is the DLP in prime-order ($q$) subgroups of $\mathbb{Z}_p^*$ for which the most efficient algorithm is Pollard's rho method. I understand this is basically calculating the private key $x$ given the corresponding public key $y$ for $y=g^x$ mod $p$, and to avoid this we choose a large enough $q$ (e.g. 160-bit).

The other DLP is said to be in $\mathbb{Z}_p^*$ itself, to which the Number Field Sieve algorithm would apply; but I am uncertain what the meaning behind this second DLP is, i.e. what is the exact calculation that we try to do here, and how would it affect the security of digital signatures that are based on subgroups, not the overall $\mathbb{Z}_p^*$?

My initial idea was that it is because the domain parameters are in $\mathbb{Z}_p^*$, but I can't find online sources or literature that goes into more detail regarding this point.

What is the Discrete Logarithm Problem in (Z/Zp) in the DSA?


texts: Provably Secure Post-Processing of a True Noise RNG?

texts:
My customer wants an RNG that uses a true noise RNG and a post-processor that will provide provable security against recovery of the true noise RNG output.

Is there a provably and post quantum secure hash function that I could use?


texts: Knowing the key, how do I decrypt the affine cipher?

texts:
I have an encryption function

$$E(p) = (ap + b) \mod{26}$$

where the parameters are  $a=7$, $b = 10$, and $p$ is the plaintext letter.

I was asked to decrypt the ciphertext

LJMKGM

using this information.

So, I tried to solve in this way:

I wrote the letters and indexed them from 0 to 25.
For each indexed ciphertext letter, I used this function to decrypt $$D(c) = (ac-b) \mod{26}$$ where $c$ is the number that represents the ciphertext letter.

I know that the plaintext is "please". For the first ciphertext letter, my method works, but for the rest it doesn't work.. what is my mistake?


texts:
From my understanding of the basic Diffie Hellman scheme, the final result is 1 key that is known to both sides and now can be used for symmetric encryption.

From my understanding of ECDHE-RSA scheme which provides PFS, a pair of ephemeral DH keys are created instead of another RSA pair because of computational considerations.

I can't seem to understand how does the process of ECDHE-RSA which creates a DH public + private key pair is similar to the basic Diffie Hellman scheme which results on 1 key, and not 2.

Is the actual basic Diffie Hellman scheme as described with simply with colors in wikipedia is being used in SSL/TLS?

I'm confused by the issue as it seems that the ECDHE-RSA process is actually an "RSA-RSA" process, only that the generation of keys is by DH (?)?


texts: Is it possible to create a "digital seal" to tell if a document has been opened?

texts:
So, in real life we have a handful of ways to leave a physical mark on a packet to know if it has been opened without authorization (eg. you can use 'opened' security tapes, or you can put a signature or stamp right through the envelop opening). One thing i see these tells share, is that they are some sort of signature that self destructs on any attempt to open the package.

My question is if you can build a digital equivalent to these seals. I'm aware encrypting the packet is a way to ensure its confidentiality, but it requires the eventual recipient to know a secret to decrypt it. One scenario where I don't see this working is sealed wills/testaments (which should only be opened and read once the testator has actually died), in this case when the custodian of the will first receives it, the eventual recipients are still unknown (the testator could die many years in the future, by then many of the intended recipients could be gone too).
My first thoughts are, probably it's impossible, as it's always easy to make a bitwise copy of the "sealed" document, open it, and then deliver the unmodified one with its intact signature, but i wanted to know if someone with more experience in cryptography could come with a solution.


texts: Hash functions to the power of two and three notation

texts:
I have found in a Wireless Sensor Networks security paper, operations where cryptographic hash functions are elevated to the power of 2 and to the power of 3 (i.e. $h^2(x)$ and $h^3(x)$).

This might be a very simple question but I haven't found this notation in other literature. I wonder: does this notation mean that you need to compute the hash twice or thrice (i.e. $h(h(x))$ and $h(h(h(x)))$?

In the paper, $h$ is defined as a collision free one-way hash function.


texts:
I have been studying a cryptosystem using Mersenne primes. More specifically, this paper: https://eprint.iacr.org/2017/481.pdf
I have implemented this cryptosystem in python but I am missing the key encapsulation system.
In page 12, they refer to something known as "expandable hash function". It should take as input a $\lambda$-bit string and output an uniformly random $n$-bit string ($\lambda<<n$) of Hamming weight $h$. This weight $h$ is already determined (actually $h=\lambda$).
I am kind of new to this stuff. Is there a way to implement this hash function in python? Many thanks in advance.


texts: How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key

texts:
Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ to generate $Q$, and then "throwing away" $a$ (forgetting about it) isn't a valid solution. Also note that $Q$ should be uniformly distributed over all valid values (i.e. as if $a$ was chosen uniformly between 0 and $n-1$).
A toy application I have is about making some "fake" Diffie–Hellman secret exchanges, where 1 party can't get to the secret because they don't know their key $a$ (and weren't just be trusted to "throw away" the value of $a$ after generating $Q$). This is all to ultimately enable "playing poker over the phone".


texts:
I came across an exercise "custom" block cipher which looks like a counter mode implementation, but it is not exactly it. I want to check if this scheme is IND-CPA secure.

Here is a picture of the scheme:

I have already ruled out the following attacks:

1) Using the raw CBC attack, due to that it behaves like a counter mode

2) Attacking the IV, assuming that it increases by a known number every time, because only one of the two plaintext messages will be returned to the adversary. So this makes impossible the connection to one of the two original messages (like the answer on this question suggests)

Any help or suggestions would be very helpful.


texts: Is there an advantage to using a hash in combination with a key-derivation function?

texts:
Note: This question was originally asked at Information Security Stack Exchange, but was moved here due to a topic overlap.

It is currently recommended by OWASP to use an adaptive key-derivation function, such as Argon2, PBKDF2, scrypt or bcrypt, when storing passwords securely.

Is there any advantage or disadvantage to combining such a key-derivation function with a traditional cryptographic hash (SHA-family, etc.)  function, such as follows: $hash,$salt = kdf(hash($password), $salt).

Attempts at answering the question

Before writing this question, I attempted to find a solution myself. Since cryptography is somewhat famous for being difficult to "get right", I was still uncertain if my reasoning is applicable.

My reasoning was as follows:

  Let's assume that the chosen hash algorithm were completely broken,
  meaning that an attacker could easily calculate a value1
  that would match a given hash. If the used key-derivation function was
  secure, the attacker would not be able to gain any advantage compared
  to a system where the plaintext password would be directly supplied to
  the key-derivation function.

1: Not necessarily the original value, but a value which would result in the same hash.


texts: Prove the correctness of decryption process of Paillier cipher

texts:
The definition of Paillier cryptosystem is the same as the one on wikipedia.
Now the random integer $g$ is chosen of the form $$g=(1+n)^{\alpha}\beta^{n}\bmod n$$, where $\alpha$ and $\beta$ are in $\mathbb{Z}_{n}^{*}$. Prove that
$$m\;=\;L(c^{\lambda}\bmod n^{2})\mu\bmod n\;=\;\frac{L(c^{\lambda})\bmod n^{2}}{L(g^{\lambda})\bmod n^{2}}\bmod n$$, where $L(x)=\displaystyle\left\lfloor\frac{x-1}{n}\right\rfloor$ denotes the quotient when $x-1$ is divided by $n$ and $\mu=\left(L\left(g^{\lambda}\bmod n^{2}\right)\right)^{-1}\bmod n$.
(Carmichael's theorem: For any $r\in \mathbb{Z}_{n^{2}}^{*}$, we have $r^{n\lambda}\equiv1\bmod n^{2}$.)
The above is the question description. The following is what I came up with.
\begin{align*}
L(c^{\lambda}\bmod n^{2}) &= \frac{c^{\lambda}\bmod n^{2}-1}{n} \\
&= \frac{g^{m\lambda}r^{n\lambda}\bmod n^{2}-1}{n} \\ &= \frac{(g^{m\lambda}-1)r^{n\lambda}\bmod n^{2}}{n} \\ &= \frac{g^{m\lambda}-1 \bmod n^{2}}{n}
\end{align*}
\begin{align*}
L(g^{\lambda}\bmod n^{2}) &= \frac{g^{\lambda}\bmod n^{2}-1}{n} \\
&= \frac{g^{\lambda}-1 \bmod n^{2}}{n}
\end{align*}
But I have no idea how to proceed. I still haven't used the formula for $g$. I think the solution may involve some finite field theorems but I really cannot recall any.


texts: What grade of protection does a private key's passphrase provide at best?

texts:
Does a passphrase with high entropy provide the same level of security as the private key itself?
General scenario: An attacker has access to a private key file that is protected with a passphrase that has the highest entropy imaginable. Does this provide an advantage to the attacker?
A more concrete scenario: Synology offers a convenient cloud backup service to the users of the NAS systems: C2. It's protected with "AES-256 and RSA-2048 encryption". But: They also upload the private key into the cloud. To me this sounds alarming. But I actually can't judge if this makes any difference when choosing a passphrase with high entropy.


texts: What is the polynomial to use in the Massey-Omura cryptosystem?

texts: The Massey-Omura cryptosystem uses "multiplication over the finite field $GF(2^n)$. I'm just starting understand the idea of multiplying polynomials and I've searched for online calculators to use for this. Thing is, all of these calculators request that I enter some sort of polynomial modulus and I don't know which one the cryptosystem uses.


texts:
These slides talk about how GCM can be sped up if one uses $x^{128}+x^{127}+x^{126}+x^{121}+1$ as the reduction polynomial instead of $x^{128}+x^7+x^2+x^1+1$.

When one is doing that one needs to multiply the polynomial you're attempting to reduce by $x^{-127}$, "better written as" $x \cdot x^{-128}$. I have three questions about this...

Does this need to be done in addition to and prior to the method described on page 20 of those slides? Like do I need to explicitly multiply every polynomial I'm trying to reduce (let's call this polynomial $y$) by $x^{-1}$ and add $y \ll 1$ and $y \ll 128$? My assumption is that it does but idk
When page 20 of those slides say $x_0 \cdot C200000000000000_{16}$ does it mean to do integer multiplication or polynomial multiplication? Like with integer multiplication $5\cdot5=25 = 19_{16}$ whereas with polynomial multiplication over a binary finite field $5 \cdot 5$ could be interpreted as $(x^2 + 1)(x^2 + 1) = x^4+ x^2 + x^2 + 1 = x^4 + 1 = 11_{16}$. I'm assuming you're supposed to do integer multiplication but idk
Is $C200000000000000_{16}$ supposed to be in big endian format or little endian format? I'm guessing little endian since that's what GCM uses? In that scenario then $C200000000000000_{16}$ could be rewritten more simply as $C2_{16}$ just as $0099$ can be rewritten as $99$.


texts: Why is this MAC based on secure PRF with ordering and randomization insecure?

texts:
Is this MAC secure:

  To authenticate a message $m=m_1||\ldots||m_l$ where $m_i \in
 \{0,1\}^{n/2}$, choose  $r \leftarrow \{0,1\}^n$ at random, compute
   $$t:=F_k(r)\oplus F_k(\langle 1\rangle || m_1) \oplus \ldots \oplus
 F_k(\langle l\rangle ||m_l)$$

  (where $\langle i \rangle$ is $\frac{n}{2}$ bit encoding of the integer $i$) and send $\langle r, t\rangle$. $F$ is a pseudorandom function.

The question comes from "Introduction to Modern Cryptography" (4.4c) where it is asked to prove that it is insecure, however I'm not sure it is. Here is my intuition (I understand that it is very weak):

The problem comes from the fact that $\langle i \rangle$ is $n/2$ bit encoded. Therefore there is only negligible chance that any r will be of form: $\langle i \rangle || m$ where $i$ is of polynomial size. If this was only $\log n$ bit encoded then we can do something.

So each message xor $F_k(\langle 1\rangle || m_1) \oplus \ldots \oplus F_k(\langle l\rangle ||m_l)$ is XORed with $F_k(r)$ which is basically a random bit string (since $F$ is PRF) that has negligible chance of occuring twice. Therefore each tag is independent from each other.

I tried to prove that it is secure by simulating what would happen if it was breakable, but i was unable to prove that any fraudulent tag would have a unique $F_k(\langle i \rangle || m_i)$ that we haven't sent already during the simulation.


texts: How to prove security of scheme constructed by Hash then PRP

texts:
Suppose there is a scheme where a message is first hashed and then sent to a PRP. If the hash is done using an $\epsilon$-bounded universal hash function and the PRP $K\times \{0,1\}^n\rightarrow\{0,1\}^n$ is a $(q,\delta)$-PRP.

The objective is to show this scheme $K\times K_n\times \{0,1\}^*\rightarrow\{0,1\}^n$
is actually a $$\biggl(q,\delta + \frac{{q\choose 2}\epsilon}{2^n}+{{q\choose 2}\epsilon}\biggr)$$ PRF.

I am able to show this scheme is a $(q,\delta+X)$-PRF, but still not finding a way how to show X to be $$\frac{{q\choose 2}\epsilon}{2^n}+{{q\choose 2}\epsilon}.$$


texts: What does the symbol $W_t$ mean in the SHA-256 specification?

texts:
I'm really confused about the computation about SHA 256.

$$W_t = \begin{cases}
M_t^{(i)} & 0 \leq t \leq 15 \\
&\\
\sigma_1^{256}(W_{t-2}) + W_{t-7} + \sigma_0^{256}(W_{t-15}) + W_{t-16} & 16 \leq t \leq 63
\end{cases}$$

The $W_t$ variable: What's the value of $W_t$? How do I get that value?

I'm still confused because of the explanation using the English language. I'm a beginner guys, any help from you will be a plus point for me about hashing.


texts: Potential weaknesses when combining hash functions?

texts:
For consistency's sake, M is the message, H1 and H2 are separate hash functions.

I've heard that concatenation or XORing hash outputs together do not provide improved security against preimage and collision attacks. In some cases, they actually reduce the security instead. Therefore, consider the following scenarios:

(1) Scenario A: H1(M)||H2(M)=Z

In this scenario, the hash output of H1 and H2 are concatenated to form the final output Z. Let's say H1 is a weak hash function, and H2 is a strong hash function. If I find a preimage M for H1(M), does it mean that I have found a preimage for H1(M)||H2(M) as well?

(2) Scenario B: H1(M)||H2(M)=Z

In this scenario, H1 and H2 are both 256-bit hash functions truncated to 80-bits output, and are concatenated together to form the 160-bit output Z. Let's say we want to find a preimage for Z, which is an 160-bit string consisted entirely of "1"s. Let's say H1 is weak, and I can instantly find 2t preimages for H1(M), in which these Ms can produce an H1 output of 80 bits of 1. In this case, how much remaining work do I need to find a full preimage M for the H1||H2 concatenation that would hash to an output Z of 160 bits of "1"?

(3) Scenario C: H1(M)+H2(M)=Z, where "+" denotes an XOR operation

In this scenario, H1 and H2 are both 256-bit hash functions truncated to an 80-bit output, and are XORed together to form the 80-bit output Z. Let's say we want to find a preimage for Z, which is an 80-bit string consisted entirely of "0"s. Let's say H1 is weak, and I can instantly find 2t preimages for H1(M), in which these Ms can produce an H1 output of 80 bits of 0. In this case, how much remaining work do I need to find a full preimage M for H1+H2 concatenation that would hash to an output Z of 80 bits of "0"?


texts: Probability that two different files can have same MD5 hash for both an unencrypted and encrypted version (AES256, same key between files)

texts:
This math is way over my head, and don't even know if it can be done, but here are the assumptions:

Take unencrypted File [Fu] of variable length, but assume 100KB as an example.
Let File [Fe] be the AES256 encrypted version of [Fu].
Let Hash [Hu] be the cryptographic hash using MD5 Algorithm of [Fu]
Let Hash [He] be the cryptographic hash using MD5 Algorithm of [Fe]
Let File [Fmu] be an unencrypted file that is different from file [Fu] by at least one bit.
Let File [Fme] be the AES256 encrypted version of [Fmu]
Let Hash [Hmu] be the cryptographic hash using MD5 Algorithm of [Fmu]
Let Hash [Hme] be the cryptographic hash using MD5 Algorithm of [Fme]
Assume the key for AES256 to be constant.

Question:
What is the probability that both [Hu] = [Hmu] and [He] = [Hme]. In english, what is the chance that two different files can have identical hashes in both an unencrypted and encrypted form? My guy says it isn't possible, or the odds are dependent on the size of [Fu]. Thoughts?


texts:
Last week I came upon this problem in my h.w.:

  Let $OT^m$ denote 1-out-of-2 oblivious transfer of $m$ bit inputs.

  Let $RandOT^m$ denote the following primitive:

  The sender’s input consists of two m-bit strings, $x_0, x_1$.
  The receiver has no input.
  At the end of the protocol the receiver learns $(b,x_b)$, for a randomly chosen $b$ in $\{0,1\}$, and learns nothing about $x_{1-b}$. The sender learns nothing. (Note that $b$ must be chosen at random, and neither nor the server should be able to choose the value of $b$).

  Show the following two reductions, for the semi-honest case.

  It is possible to construct $RandOT^1$ from $OT^2$.
  It is possible to construct $OT^1$ from $RandOT^1$.

I solved the first problem quite easily, but I just can't figure a way to solve the second one.


texts: How large a product out of 3 close-by factors need to be to avoid factorization?

texts:
For encryption a prime $P = 2 \cdot Q \cdot R \cdot S +1$ was used.
An adversary want to solve the discrete log problem $m \equiv g^i \bmod P$. For this he want to use the Pholig-Hellmann algorithm.
To use this he need the factorization of $P-1 = 2 \cdot  Q \cdot R \cdot S$.
Factor $2$ is trivial so he only need to know the primes $Q, R, S$

(edit)
He should also not be able to project a value $m$ into a subgroup, like:

$$m^{2\cdot R \cdot S} \equiv v \bmod P$$
$v$ is $1$ or has order $Q$
(edit end)

He does know prime $P$ and the internal structure of $P-1$ has $4$ factors and one of those is $2$. He also knows the other three factors are quite similar to eachother:
$$\frac{P-1}{2} \approx Q^3 \approx R^3 \approx S^3$$
with
$$ \max(Q,R,S) \le 1.25\cdot\min(Q,R,S)$$
or
$$\forall a,b,c \in \{Q,R,S\}: 0.8\cdot a \le b \le 1.25 \cdot c$$

edit2: That means the potential factors are in limited range between $\sqrt[3]{(P/(1.25^2))}$ and $\sqrt[3]{P}$

For values consisting out of two factors the current record is afaik about 240 decimal digits or 795-bit (records-wiki)

Question: How large need to be a value out of three prime factors as described above to be as secure as the current record for two factors?

($Q,R,S,P$ can be set to special kind of primes, like safe primes, as long those conditions from above hold )


texts: How is Encryption Actually Used in Public Networks at This Moment?

texts:
Has anyone done a study, assembled a snapshot, of how encryption is actually being used on the Internet at this moment?

So many companies do traffic analysis, the usage share of operating systems, etc., and one imagines that national-level agencies do this too, perhaps in incredible detail, but does any open-source information exist that quantifies the use of cryptographic hashes, asymmetric and symmetric algorithms, cryptographic libraries, etc.--and the services they provide?

Reliable data is certainly available.

Such a study on current use could answer many interesting questions:

  How much global message and email traffic is being encrypted all the
  way through an ISP?  With what?  How much is GnuPG being used? What cryptographic primitives are actually in decline? What services-- confidentiality, integrity, non-repudiation,
  availability, non-availability (!), authentication-- are really being
  requested, and what is their usage share?

Does a detailed, open-source (or compromised) study of global encryption use exist?


texts: How are certificate status obtained on browsers?

texts:
There are two ways of checking the status of a digital certificate:-

Offline Authentication (CRL)
Online Authentication (OCSP, SCVP)

Several browsers (like Mozilla Firefox) have given up the use of CRL over OCSP.

OCSP and SCVP are susceptible to MITM attacks.

Then which method is used a primary means of checking the status of a digital certificate?


texts:
Prove that the following modification of $\operatorname{CBC-MAC}$ does not yield a secure fixed-length $\operatorname{MAC}$:

Modify $\operatorname{CBC-MAC}$ so that a random $IV$ is used each time a tag is computed (and the $IV$ is output along with $t_l$). I.e., $t_0 \leftarrow \{0, 1\}^n$ is chosen uniformly at random rather than being fixed to $0^n$, and the tag is $t_0, t_l$.

Answer. The scheme is not secure. In particular, let $m$ be a one-block message and let $(IV, t)$ be its $\operatorname{MAC}$-tag received from the oracle. Then, the tag $(m, t)$ is a valid $\operatorname{MAC}$ for the message $IV$. (More generally, for any $m'$ the tag $(IV \oplus m', t)$ is a valid $\operatorname{MAC}$ for the message $m \oplus m'$. This means that it is possible to generate a forgery for any desired single-block message.)

From the paper CIS 5371 Cryptography, Home Assignment 4

My question is how is the tag $(m,t)$ a valid forgery. This is my understanding:

If I used numbers so $m=101, IV=110, m\oplus IV=011$, but the forgery says that I can use m, so that $m=101, IV=101, m\oplus IV=000$, which is obviously not the case. Could someone explain?


texts: Calculating the amount of zero bits to be appended to the message

texts:
From FIPS 180-3

  Suppose that the length of the message, $M$, is $l$ bits. Append the bit $1$ to the end of the message, followed by $k$ zero bits, where $k$ is the smallest, non-negative solution to the equation $l + 1 + k \equiv 448 \mod 512$ . [...] For  example,  the  (8-bit  ASCII)  message  “abc”  has  length $8 \times 3 = 24$, so the message is padded with a one bit, then $448 − (24 + 1) = 423$ zero bits [...].

The example only works for $0 \leq M < 448$, so I've come up with this formula for calculating $k$.

$$k = 448 - (l + 1) + 512 \cdot \left\lfloor \frac{l + 64}{512} \right\rfloor $$

or shorter

$$k = 447 - l + 512 \cdot \left\lfloor \frac{l + 64}{512} \right\rfloor $$

Is this the shortest/most performant way to calculate $k$?


texts: Storing a Secure Boot image with AES-GCM instead of AES + RSA signature

texts:
In Secure Boot (here defined as data is encrypted and authenticated), we can encrypt the data with AES-128 and authenticate it with a RSA signature, computed over the data's hash, afterwards.

On boot, the device first calculates the hash of the encrypted data, verifies it with the given signature, decrypts the data, and starts executing.
However, calculating the hash and verifying the signature is kind of expensive in case of time and resources, especially for embedded devices.

Proposal:
My idea is to replace AES and RSA signature with AES-GCM to speedup the overall boot time.
Using AES-GCM, we achieve the same security goals confidentiality and authenticity.
The used AES key is stored securely on the device in a HSM (Hardware Security Module).

Drawback:
I am aware of the fact that I loose the advantage of not having the private key on the device to generate a valid signature. In case of key compromise an attacker can read the data but cannot authenticate new data. Using AES-GCM a key compromise means that the attacker can not only read the stored data, but also authenticate it meaning he is able to execute his own data and fully take over the device.

Question:
So besides the discusses drawback, would you consider this a valid approach? Or is there any reason for not using AES-GCM that I overlook?

Edit: Added more details to the description.

Just to clarify this. I am not talking about updating the data to be executed. In the described situation the data is already on the device (how the data is put initially onto the device is not relevant here).


texts: Why do block ciphers need a non-linear component (like an S-box)?

texts:
Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)?

How does it make the cipher more secure?

The only intuition I have is a non linear function can have many roots (solutions). E.g. for a non linear $y = F(x)$, if attacker knows $y$ to find out the $x$, there might be many choices which satisfy $y= F(x)$ hence it adds up complexity at attacker's end when he tries to make his way back (trace back) from cipher text to plain text.

Any references or detailed material are appreciated.


texts:
From Wikipedia:

  In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function.

Is there a more formal security definition for what they are and what properties they are trying to guarantee, like ind-cpa security for encryption schemes, or collision resistance for hash functions?


texts: GOST R 34.11-2012 hash function works from the end, is this convenient in practice?

texts:
RFC 6986

Step 2.
       2.1.  Check the condition |M| < 512
            If it is true, then go to Step 3.
            Else, perform the following calculations:
      2.2.  Calculate the subvector m belonging to V_512 of the message
            M:
            M = M'||m
            Then perform the following calculations:

So, this hash function process message from the end. Is this convinient in practice, when user wants to hash some big data, for example few gigabytes file, or when low CPU/RAM device wants to hash stream of data on the fly? The code have to keep entire message in buffer, and start hashing only when it receives full message.

I understand, that this approach is more secure and eliminate length extension attack, but it is very unpractical.


texts: RS Erasure Coding and Shamir's Secret Sharing

texts:
So I was trying to understand the basic difference between erasure coding and secret sharing, and I found this paper (that you can find here or here).
For what I understand, it states that Shamir's Secret Sharing is basically a particular instance of a Reed-Solomon Code;
However I cannot really understand the difference between any RS code and a SS coding from a security standpoint.

Imagine that I have an RS code (m,n) and a data chunk to encode. After encoding the data I will have n chunks, and if I want to reconstruct the data, I will need at least m shares of the data, right?

How this is different to an instance of Shamir's Secret Sharing (m,n), where I need m shares out of n to reconstruct the secret? Are they perfectly equivalent, or SS is some way more secure?

I admit to be really ignorant about the detailed technical/math aspects of how the two work, and I am more interested in the practical point of view.


texts: Number of plaintext–ciphertext pairs needed to rule out false keys with a reasonable likelihood in AES

texts:
I am new to cryptography and I've got the following question from Understanding Cryptography:
Imagine that aliens — rather than abducting earthlings and performing strange experiments on them — drop a computer on planet Earth that is particularly suited for AES key searches. In fact, it is so powerful that we can search through 128, 192 and 256 key bits in a matter of days. Provide guidelines for the number of plaintext–ciphertext pairs the aliens need so that they can rule out false keys with a reasonable likelihood.
What I tried
I know that the expected number of keys that encrypt a plaintext $x_1$ to $y_1$ is $2^{k-n}$, where $k$ is the key length in bits, and $n$ is the size of a block in bits.
I also know that given $\{(x_1, y_1), \dots, (x_t, y_t)\}$ PT-CT pairs, the expected number of false keys which encrypt all plaintexts to the corresponding ciphertexts is $2^{k-tn}$.
Therefore, for AES-128, AES-192, and AES-256, I would expect that only two PT-CT pairs is sufficient, given that the expected number of false keys would be, respectively, $2^{-128}$, $2^{-64}$, $2^0=1$.
What the answer manual says
The manual says that, for AES-128, only one pair is sufficient. This one I can see why, since the expected number of keys that map $x_1$ to $y_1$ one be $\frac{2^{128}}{2^{128}}=1$.
For AES-192, the manual says that "in order to find the correct key with a probability of 50 percent, we require $2^{63}$ pairs of plaintexts and ciphertexts". And for AES-256, also with 50% probability, $2^{127}$ PT-CT pairs are required.
I cannot see why such values are required for AES-192 and AES-256.


texts:
From Twitter:

  Marc Stevens released a new 76-step (out of 80) SHA-1 collision, and SIMD libdetectcoll https://marc-stevens.nl/research/

What is a 76-step collision, and how does it differ from a "regular" collision? Is it related to whatever a "freestart" collision is?


texts:
I had heard that although it's easy to implement message digest functions like MD5, SHA-1, SHA-256 etc. in CUDA (or any other GPU platform), it is impossible to implement bcrypt there.

bcrypt is different from these hash functions, in that Blowfish is a block cipher, and in order to produce a one way hash a "feed back" is used.

I am not too familiar with the GPU platforms. Does anyone know if bcrypt can be ported to a GPU and if not, why?


texts: Can we find the exact number given remainder of the numbers with mod m?

texts:
I have around 1500 numbers. The numbers $x_i$ are calculated as
$x_i$=($p*t_i$) mod m. $p$ constant and same for all the numbers while $t_i$ are chosen randomly everytime. For example the given numbers $x_i$'s are calculated as:

$x_1$=($p*t_1$) mod m.

$x_2$=($p*t_2$) mod m.

.
.
.

$x_{1500}$=($p*t_{1500}$) mod m.

given $x_i$'s and m, can we find the p using above $x_{i}$'s ?


texts: Encrypting Data with user + custodian private keys

texts:
I want to be able to have a private user key (system generated) which, if destroyed, effectively renders all user data unrecoverable. This key would be used across the entire system to protect the user's data. Instead of having to implement and maintain integrations across all systems to delete  a user's sensitive data  we could just delete the key, rendering the data useless. However, the problem with this is that there is no granularity: the system has multiple custodians and each custodian should be able to determine who has access to decrypt the message.

We've been using KMS data keys for envelope encryption so the system must have permission to decrypt the envelope key before they can decrypt the message. I was hoping to be able to do something similar but incorporating the use of a user-specific key.


texts: Predicting with a machine learning model while preserving the privacy

texts:
Imagine Alice has trained a machine learning model. She wants to store her model in a blockchain so that everyone can use it; however, she wants her model to be private so that no one can steal her trained model.
Is there any way that a model can be used for prediction only while being private? For example, is there any homomorphic encryption method for predicting with an encrypted model?


texts:
I was given a cryptography question during an interview the other day and I couldn't come up with a valid answer. Imagine you are given an efficient algorithm which for a given RSA public key (n,e) is able to decrypt 1% of the messages encrypted with that key. 1% means that the algorithm will deterministically decrypt 1% of all possible ciphertexts on the first call, and will never decrypt the other 99% of all possible ciphertexts with any number of invocations. Figure out an algorithm that uses this one and can decrypt any message.

Any ideas ?


texts: Secure Channel - Encryption and Decryption Keys For A Message

texts:
I'm currently reading Cryptography Engineering and in Chapter 7, the topic of secure channel is discussed.

The channel described is using CTR for encryption. Below I include images with pseudo-code used in the book (source):

In Secure Channel: Initialization, 4 different keys are generated (assuming no collisions).

In Secure Channel: Sending a Message the key stream is generated using KeySendEnc as the key to the encryption function (let's say we're using AES here). Then, what we do is XOR the message we want to encrypt (plaintext || authenicated plaintext) with the key stream generated in the previous step. To authenticate the plain text, KeySendAux is used. Up to this point, everything makes sense.

Now, in Secure Channel: Receiving A Message, KeyRecEnc is used as the key to generate the key stream k. Then, the encrypted message is XORed with this k to obtain the original message (plaintext || authenicated plaintext). If KeyRecEnc ≠
 KeySendEnc, then the key stream k, generated in the two cases is different. My question is exactly here, how do we obtain the original message if we XOR the ciphertext with some other key stream, different from the one that we used to encrypt the message in Secure Channel: Sending a Message.

Then, KeyRecAuth (KeyRecAuth ≠ KeySendAuth) is used to obtain a MAC. This MAC is then compared with the received MAC (after it's decrypted). How can those two MACs can ever be the same (ignoring collisions), since the input to the HMAC-h function is different in both cases (because KeyRecAuth ≠ KeySendAuth).

Thanks in advance.


texts:
Given a non-primitive LFSR sequence (i.e number of states is less than $2^n - 1$); how do we find out the the characteristic polynomial? Will Berlekamp-Massey algorithm work in this case?

for example; for the following sequence-

[1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 1, 1]

the repetition period is $105$. Applying the Berlekamp-Massey algorithm returns

$X^7 + X^6 + X^5 + X^1 + 1$

Doing manually gives me a different answer.
Where am I going wrong?

EDIT

Adding what I did manually:

I found the primitive polynomials and took LCM to confirm the $Berlekamp-Massey$ output.

To check, I represented the polynomial as $11100011$ ; took the first seven bits of the sequence and did the $and$ operation with the polynomial. took the $xor$ of the output and appended that output to the initial 7 bits and continued. This is what I did to crosscheck the answer I received. It is here I went wrong probably.


texts: Recovering key length from transposition block cipher ciphertext

texts:
First of all I would like to say hello to all StackExchange users. So far I've been stalking the forum for some time, now it's time to leave the shadows.

In my master thesis I'm writing about heuristic methods in cryptanalysis, etc. ant colony algorithms or genetic algorithms. So far all methods seems to be quite intuitive, but I've got a problem in implementing part of them - most of these methods assume that key length is known. For substitution ciphers there are well known methods (Kasiski test, index of coincidence) of key length recovery.

Unfortunately I can't find any method of recovery key length in transposition block cipher (permutation cipher). Do you know such methods?

All best to you


texts: Complexity of number field sieve theorem does not match with security of elliptic curves

texts:
Number field sieve algorithm can is used to break discrete logarithm on field $F_{p^n}$. The algorithm has time complexity $\exp((c+o(1))\cdot(\log p^n)^{1/3}\cdot(\log \log p^n)^{2/3}$. Originally the constant $c$ is $(64/9)^{1/3} = 1.92$. Due to recent works, the more advanced Special extended tower number field sieve algorithm has $c = (32/9)^{1/3} = 1.54$.

Using this I tried to estimate the security of pairing-based elliptic curves. Consider BN256 curve. The pairing based elliptic curve has embedding degree 12. This means, the discrete log on BN256 can be mapped to discrete log on $F_{p^{12}}$, where $p$ is 256 bit prime. Now, on calculating the complexity of original NFS algorithm on $F_{p^{12}}$, we get roughly $$\exp(1.92 * (12*256)^{1/3} * (\log_2 (12*256))^{2/3}) = \exp(142.9) = 2^{206.16}$$ by wolframalpha (I ignored o(1) term for simplicity). So, BN256 curve originally provided 206 bit security. But in many places I saw that BN256 curve provided 128 bit security. Where I am doing wrong?

Edit: By @Poncho's answer, BN256 curve can be attacked better by pollard's rho algorithm. That justifies why BN256 is claimed to have 128 bit security earlier. After the recent Tower NFS algorithm, BN256 is claimed to have less than 110 bit security (Table in this blog). But when I calculate by wolframalpha,
$$\exp(1.54 * (12*256)^{1/3} * (\log_2 (12*256))^{2/3}) = \exp(114.6) = 2^{165}$$.
Therefore, even now, BN256 curve should have 128 bit security right?


texts: With AES-GCM, may I use multiple tags per key?

texts:
In my implementation of AES-GCM, the key might change only once per minute.  However, I wish to calculate a new tag every 6us, to reduce latency (since you have to buffer up a GCM "packet" before checking the tag and releasing it).

May I keep the same key and generate millions of tags using the same key, as long as the GCM counter increments for every 128-bit block?
Do I need to restart the tag computation process (i.e., clear accumulators) for each tag?
Or, must I change the key once a tag is computed and transmitted?
In a related question, can I use an IV of fewer than 96 bits?

Normally there is an IV of 96 bits and a 32-bit counter, but at my data rates (400Gbps) I'll burn through the 32-bit counter in less than 1.5 sec, and I don't want to have to update the key every second.

Could I use, say, an 84-bit IV with a 44-bit counter?


texts:
I encrypt 2 random keys with the same 'one' time pad. You can get both encrypted keys. You don't know anything besides the size.

Is there a way to attack the two time pad in this scenario?

And what if I would encrypt 1000 random keys. is there a way to attack the 'one' time pad?

PS. I have read a lot of posts about plain text attacks and language analysis which both certainly don't apply here.


texts: Possible problems in using a hash algorithm to construct a stream cipher

texts:
I'll define an example hash-based stream cipher as such:

$H: \{0,1\}^* \rightarrow \{0,1\}^{256}$ is the hash function.
$K=\{0,1\}^{256}$ is the secret key.
$N=\{0,1\}^{128}$ is the nonce.
$C=\{0,1\}^{128}$ is the counter.
$X=H(K||N||C)$ is the keystream output.

I've read several of the questions posed on this site about basing a stream cipher on hash functions. One of the replies said that the properties that make a hash function "secure" might not be enough to make a secure stream cipher. Would having the outputs of many similar inputs make it possible to calculate $K$?


texts: Are there any examples of signature schemes with multiple signing keys but one verification key?

texts: Need a signature scheme where signer signs with one secret key out of a set of signing keys, but verification can be done using just one verification key.


texts: Is there a symmetric-key cryptography based on key establishment techniques?

texts:
Most of the current key exchange techniques are based on public-key cryptography. Are there any key exchange/establishment techniques based on symmetric-key cryptography too?

In my setup primary assumption is both communicating parties can have pre-shared key  and further they need to exchange messages to derive a longer key for secure communication. (Quantum key distribution is not option for me.)

Are there any practical implementations for the above?


texts: In a system with TPM, an RSA private key is kept secretly by the TPM and no one can access it. When something needs to be decrypted using this key, does the TPM itself decrypt the whole massage? How is this transferred back to the SW calling API?


texts:
So, I'm kinda newbie in this cryptography stuff, I just like to understand complex things.A couple of months ago I was learning and I maybe found a pattern in prime numbers and their multiplications, lets check out.
So, it's high demanding to multiplicate random prime numbers, correct? I thought this: Instead of multiplicate the numbers, you can just isolate the last number of each one and sum them up, for example: 23518 and 619741, we can just take the last digit of both and get 2, right? I found out that, if the sum result equals to 2, the ending number in the multiplication it will ALWAYS be 1 (tested with 20k prime numbers)

This also holds true for all sums (2, 4, 6, 8, 10, 12, 14, 16 and 18)
Table:
1 [(1, 1), (3, 7), (9, 9)]
3 [(1, 3), (7, 9)]
5 [(1, 5), (3, 5), (5, 5), (5, 7), (5, 9)]
7 [(1, 7), (3, 9)]
9 [(1, 9), (3, 3), (7, 7)]
So in the RSA-260 challenge number
( 2211282552952966643528108525502623092761208950247001539441374831912882294140
2001986512729726569746599085900330031400051170742204560859276357953757185954
2988389587092292384910067030341246205457845664136645406842143612930176940208
46391065875914794251435144458199) we know that the last digit sum MUST BE, 6, 10 or 14, right? reducing our possibilities by a lot.
Can anyone confirm this for me? I'm really dumb in programming but I think this is a start. Check out the spreadsheet I did. https://docs.google.com/spreadsheets/d/1rcAIz5094WGqVZLGgCiTZotzrHg8TeQ2kQSB6lhAEaU/edit?usp=sharing


texts: Is ECB mode more suitable than CBC mode while encrypting a long bit string?

texts: I know that ECB is less secure than CBC, but will it be suitable for encrypting a long bit string?


texts: Easy example of commit scheme not binding

texts:
I'm told that the following commit scheme:

$(c,k) = Commit(x;r) = (Enc_r(x),(x,r))$

Does not bind which means that the sender could produce $c,k,k'$ such that:

$Open(c,k) \neq Open(c,k')$

I know this is a very basic example but how can I reason about it?


texts: Proof of correctness of a homomorphic ElGamal sum

texts:
Let's suppose we are using the exponential ElGamal as a public-key encryption scheme, so that we encrypt $g^m$ instead of $m$, for some generator $g$. Let $x$ be the private key, and $h=g^x$ be the public key.

We have two parties, and each one of them has a ciphertext encrypted with the same public key: $(R_1,S_1)=(g^{r_1}, g^{m_1} h^{r_1})$ and $(R_2,S_2)=(g^{r_2}, g^{m_2} h^{r_2})$, respectively.

These two parties then gather and perform the homomorphic sum of their ciphertexts by computing the product of their ciphertexts: $(R_3,S_3) = (R_1,S_1) \cdot (R_2, S_2) = (g^{r_1+r_2}, g^{m_1+m_2} h^{r_1+r_2})$.

Is there any way they can prove in zero-knowledge that the sum is correct? That is to say, that $(R_3,S_3)$ is the correct encryption of $m_1+m_2$ without revealing anything else about the addends ($m_1$ and $m_2$ should be kept secret) nor the (plaintext) value $m_1+m_2$?


texts:
Say you are given an efficient deterministic algorithm 'I' that can invert the RSA
function on 1% of the points in $Z^*_{N}$. That is to say that if y $ \in $ $Z^*_{N}$ is a "good" point for 'I', then
$(I(N, e, y))^e$ = y. (You don't know what these "good" points for 'I' are, however.) Show that you can use 'I' to build an algorithm 'A' that inverts the RSA function on any input, and that is fast on average. That is, if x $ \xleftarrow{$} Z^*_{N}$ and y $\xleftarrow{$} x^e$ mod N, then A(N, e, y) returns x. Give a description of your 'A', and explain why it is always correct and fast on average.
As a hint, consider using randomization and exploiting the multiplicative property of the RSA function.

My idea was to come up with an algorithm which picks $y_1$ and $y_2$, which when multiplied together get y and then proceed to invert both those points.

$y_1 \xleftarrow{$} Z^*_{N}-\lbrace{1,y\rbrace} $
$y_2 \xleftarrow{$} y.y^{-1} mod N $
$x_1 \leftarrow I(n, e, y_1) $
$x_2 \leftarrow I(n, e, y_2) $
$x \leftarrow x_1.x_2 $ mod N
Ret y, x

Now, x has to be the inverse of y because
$ x^e \equiv (x_1.x_2)^e \equiv x_1^e.x_2^e \equiv y_1.y_2 \equiv y $
But, the problem is the probability that I can successfully invert $y_1$ or $y_2$ is less than 1% with algorithm I(?). So, this algorithm probably fails in 99 out of 100 cases. Even if I repeat it until I get "good" set of points, it is going to be horribly slow. How do I solve this problem and make the new algorithm fast? And, how do I prove its fast?


texts: Blake2: truncate 512-bit hash is safer than 256-bit by Config?

texts:
I need to calculate 256-bit hash in my code, using BLAKE2.

I know I can set BLAKE2 to generate itself a 256-bits hash for any data but I´m curious to know what can be safer and faster:

1- Create the 256-bit using Blake2Config module; or
 2- Truncate the normal 512-bit result getting the leftmost 32 bytes (256 bits).

In a first time, I guess getting the leftmost 32 bytes can be safer and not so slower than get 256-bits from Blake directly.

Am I wrong?
Thanks for any comments.


texts: How to break RSA signature on XOR of hashed blocks

texts:
I'm trying to figure out if there's a way of breaking or weakening the following method of signing long messages

Given $M=m_{1}m_{2}...m_{n},\,\,|m_i|=64b,
\,\,h=h(m_{1})\oplus h(m_{2})\oplus\cdots\oplus h(m_{n})$

sign $h$ using the RSA method.

also, is it weaker than the original way (of signing every message separately)?


texts: Equality checking using additive homomorphic encryption

texts:
Given two ciphertexts $c_1 = enc(p_1)$ and $c_2= enc(p_2)$ using any additive homomorphic encryption scheme (or specifically Paillier).

Can we find out whether the underlying plaintexts $p_1,p_2$ are equal without decrypting $c_1,c_2$ i.e. homomorphically?


texts: Maintaining validity of ZKP throughout re-randomization of homomorphic ciphertext without linkability to previous ciphertext

texts:
Question:
How is it possible to adapt a ZKP for a homomorphic ciphertext to still be valid after said ciphertext has been re-randomized?

Context:
In a lot of e-voting systems homomorphic encryption is used to tally the individual votes preserving the privacy of the individual voters as only the total tally is revealed. Each voter must provide valid ZKP's proving that their vote is correctly formed and one of the possible values.

A way to achieve privacy is to re-randomize the ciphertext as well as the corresponding ZKP. This seems to be possible using Groth-Sahai proofs though I do not understand how as the ZKP somehow has to be bound to the ciphertext.


texts: Ballot box with multiple parties. All can read it, or none can read it

texts:
I am trying to create a decentralized moderation system for the game Diplomacy, a game for seven players. In each round of a face-to-face game, each player writes their moves on paper then puts it in a box; all moves are read at once. The game was popular as play-by-mail: you mail your moves to a magazine publisher, who aggregates all moves and publishes game updates to everyone. In each round of an online game, each player sends their moves to a third-party "moderator", who then aggregates the moves and relays all moves to all players. The players must agree beforehand to a third-party moderator.

I would like to create a decentralized system without the need for a moderator. Each player can run a web-accessible server. Each round, each player will broadcast their moves (encrypted somehow) to all other players. When all players have broadcasted their moves, only then can all players read the other players' moves.

Initially, I thought of using something like the Three-pass Protocol: Player A writes a message, puts it in a box with Padlock A, and sends it to Player B. Player B puts Padlock B on the box and returns it to Player A. Player A removes Padlock A and returns the box to Player B. Player B can now remove Padlock B and read the message.

The players would be arranged in a ring: Player A always passes messages to Player B, Player B always passes messages to Player C, etc. So each message ends up in a box with seven padlocks on it. Only when it has gone around the entire ring can all the players read the messages.

But this doesn't solve the problem of noncooperation: On the sixth pass, Player D can stop sending messages to Player E, read everyone else's moves, and not cooperate further.

Player D and Player F can also choose to cooperate with eachother, and keep Player E out of the loop. That would be bad for Player E.

In a game like Diplomacy, it is not acceptable to allow one player to read any other player's moves without all players reading all moves.

Another thought is for each player to privately send their moves, locked in a box, to each other player (via private-public keys). When a player receives the box, then that player broadcasts to everyone, "hey everyone, player X sent me a box which hashes to abc123!". When everyone finds that everyone else has received all other boxes, then they can swap them back. This allows some player to lie to everyone else, but the downside is "nobody gets anything".

I think I'm on the right track here, but I'm not sure. Is this a correct way of thinking about the problem? Has this already been done (I can't find another solution already)?


texts:
I'm using PHP to encrypt a string and Java to decrypt it on a remote server. To perform the encryption, I'm using the strategy that can be found here.

My problem is that the strings I encrypt are pretty small and very similar each other. Nevertheless, I'd like a high degree of randomness in the encrypted values.

Just to be clear, at current this is what happens:

$$encrypt(foo1) \rightarrow barA$$
$$encrypt(foo2) \rightarrow barB$$

While I'd like something like:

$$encrypt(foo1) \rightarrow b3SA$$
$$encrypt(foo2) \rightarrow 4FrB$$

How can I enhance the randomness of the encrypted values, by keeping the algorithm I'm already using?


texts: "official" guidelines about the minimum length of a truncated hash

texts:
I am looking for some reference documentation suggesting a minimum reasonable length for a truncated hash (specifically, a truncated SHA-256 hash) to ensure preimage resistance.

Obviously, truncating a SHA-256 hash to, let's say, a 32-bit value is unsafe since a preimage can be quickly found by bruteforcing.

But what about a 64bit value? What about a 128-bit value?

I found NIST Special Publication 800-107 R1: Recommendation for Applications Using Approved Hash Algorithms but I did not find there any specific suggested minimum value.


texts: Are there secure stream ciphers that cannot be parallelized?

texts:
Are there any stream ciphers (or a deterministic random number generators, that should work as well I guess?) that cannot be parallelized?
For example, if I seed it with a specific value, and then "run" it for a year, generating more and more bits, and finally get a bitstream off it, then that bitstream will be impossible (unless somebody "breaks" the cipher) to get a hold on without doing all that work synchronously and requiring at least a similar amount of time. (So that nobody will be able to get 100x cores to do all that work in 100x shorter time. They could always get a faster processor, or build a specialized chip or something, but it would still run the calculation single-threaded, synchronously still requiring a lot of time to get to the needed bitstream from the initial seed value.)
Do algorithms with similar properties exist? Or can everything be parallelized?


texts:
I am trying to get the idea of cyclic attacks againts assymetric RSA encryption.
Taken from Handbook of applied cryptography .

Let $k$ be a positive integer such that $$c^{(e^{k})} = c\mod n  \tag{1}.$$
There for
$k-1$ it holds that $$c^{(e^{k-1})} = m \mod n  \tag 2$$ where $m$ is the message for encryption $n$ is the modulus and $c$ is the ciphertext.

I can't understand why equation (2) must hold?


texts: Security Strength of BigInteger vs elliptic curve parameter value

texts:
Choosing 512 bit prime biginteger as secret value as in RSA
Choosing TypeA curve (rbits=256,qbits=512) and setting secret value by randomly selecting from $Z_r$ value
I wanna know which one has more security strength even though I know 128 bit security can be obtained with 256 bit elliptic curve and 3072-bit RSA keys.I need some detailed explanation.When we set rbits=256 bits, is it 256 bit elliptic curve? Or when we set qbits=256 bits, is it 256 bit elliptic curve?


texts: The Rijndael S-Box design generates a permutation cycle of type $2+27+59+81+87$. What effect would replacing that permutation with a cycle of type $256$ have on the security of AES?


texts: Implementation of oblivious transfer with symmetric primitive?

texts:
I'm now reading this paper Extending Oblivious Transfers Efficiently. I understand how to reduce an OT cost.
OT extension is a method that replaces an OT with many base-OTs.
But I'm still not sure how to implement each base-OT.

How is this possible?
Any references?

I prefer more recent construction.


texts: Client-side password stretching - danger of the salt being public?

texts:
In case of using client-side password stretching (plus a single hash on the server) - the server would need to send the salt before authentication, of course.

Though the salt is not considered a real "secret", is having the salt that public a serious consideration for rejecting this method (i.e. client-side password stretching)?

This answer (with more than 600 upvotes) says it's important to keep it secret. I know it's difficult to measure how important something is, but if you could give me some idea, that would be helpful. The reason to do it client side is to mitigate DDOS attacks.


texts: Why is a proxy needed in proxy re-encryption?

texts:
Context

Here's the usual proxy re-encryption scenario:

Alice, with key pair $(pk_a, sk_a)$ encrypts a message $m$, producing $c = encrypt(pk_a, m)$
Alice saves $c$ on an untrusted storge provider (Dropbox, IPFS, etc..)
Bob, with the key pair $(pk_b, sk_b)$ asks Alice to access $c$
Alice generates $re_{a\rightarrow b} = rekey(sk_a, pk_b)$, which she sends to a proxy
That proxy re-encrypts $c$ in $c' = reencrypt(re_{a\rightarrow b}, c)$
Bob can now download $c'$ and obtain the plaintext $m = decrypt(sk_b, c')$

Question

Why do we need a proxy? Can't Bob re-encrypt $c$ into $c'$ by himself?
From what I've understood, the only role of the proxy is to re-encrypt $c$ and nothing more.

In other words: can Bob and the proxy be the same person/device?

Further details

If Alice sends $re_{a\rightarrow b}$ to Bob via e-mail, or by letting it be publicly accessible (i.e. storing it on IPFS), Bob should be able to re-encrypt $c$ into $c'$ by himself, provided he has the right software to do so on his device.

What I'm also interested in is uderstanding whether there are any advantages for the re-encryption step being performed by a proxy and not by the recipient himslef. I can't think of a scenario where Bob may be forced to rely on a proxy.


texts:
So I have been reading this book called "Implementing SSL/TLS using Cryptography and PKI" While going through it, this snippet of code got me baffled

    static void compute_key_schedule (
    const unsigned char *key, int key_length, unsigned char w[ ][ 4 ] ) {
    int i; int key_words = key_length >> 2;
    unsigned char rcon = 0x01; // First, copy the key directly into the key schedule
    memcpy( w, key, key_length );
    for ( i = key_words; i < 4 * ( key_words + 7 ); i++ ) {
        memcpy( w[ i ], w[ i - 1 ], 4 );
        if ( !( i % key_words ) ) {
            rot_word( w[ i ] );
            sub_word( w[ i ] );
            if ( !( i % 36 ) ) {
                rcon = 0x1b;
            }
            w[ i ][ 0 ] ^= rcon;
            rcon <<= 1;
        }
        else if ( ( key_words > 6 ) && ( ( i % key_words ) == 4 ) ) {
            sub_word( w[ i ] );
        }
        w[ i ][ 0 ] ^= w[ i - key_words ][ 0 ];
        w[ i ][ 1 ] ^= w[ i - key_words ][ 1 ];
        w[ i ][ 2 ] ^= w[ i - key_words ][ 2 ];
        w[ i ][ 3 ] ^= w[ i - key_words ][ 3 ];
    }
}

The text says that in case of 128-bit key, round constant is shifted every 4 iterations (of forming single word of key for key schedule), making up total of 10 shifts, but at 8th shift, the round constant would be 0, and AES mandates that whenever it overflows, you should XOR it with 0x1b. So I get it that's why we did that if (i%36) rcon = 0x1b It makes sense, but if key_length is 192-bit, it would be problematic, since at iteration 36, it will pass the check if ( ! ( i % key_words)) and would proceed to change rcon to 0x1b, though there won't be any overflow at all! (I believe that key would be 0x10 at that time this shift will occur in case of 192-bit).

So it just doesn't makes sense to me and I wanted to know if there is something I am missing out on. At first I thought maybe it's necessary to rotate it every 4 iteration irrespective of key size but reading text and reading rest of code, I don't think that was an intention ever. Thanks a lot!


texts: I am doing research on cryptography primitives at a basic level and I faced a question on encryption methods. I understood that ECDH is an approach to for secure key exchange between two parties before the encryption process begins. It is quite useful in symmetric methods that use the same key for encryption and decryption. But I cannot understand the application of key exchange schemes in public-key encryption methods like ECDSA since only public keys are shared between two parties that does not need secure exchange. But such combination (ECDSA/ECDH) seems to happen in protocols like SSL. In what point does exactly secure key exchange methods like ECDH stands in a public key encryption method specifically ECDSA?


texts:
AES is supposed to be a symmetric key block cipher. The theoretical counterpart to this is a pseudorandom permutation.
I'd like to say that AES is a PRP (well, supposedly at least), but that doesn't seem correct; while there are larger variants of AES, I don't see how the algorithm extends to arbitrarily large security parameters.
How do I view AES theoretically?