texts: Proofs of security for anonymity in a multi-party setting

texts:
I'm looking for material that proves the anonymity of parties in a non-interactive setting. I would like to know if there are simulation based proofs (UC) and property based proofs (game based) for anonymity that I can look at.

Also when when proving such a protocol to be anonymous, how is one supposed to define anonymity? My main confusion I guess is how does one define the security of a system that shows anonymity, i.e. the system does achieve anonymity.


texts:
Why doesn't TLS provide end-to-end encryption?

This question is somewhat related to this,  this and this. If you want to talk to someone, say, through facebook, the TLS connection ends in the facebook server and they may be able to read it, before re-encrypting and sending it to the intended recipient. This seems a little off to me. Assuming the only thing facebook needs to forward the message is the metada which is not encrypted anyway, why TLS enables them to decrypt the message?


texts: Randomness and reversibility of a sequence generated by taking sha256 hashes of an predictably-changing input?

texts:
Let's say we generate a sentence in a way like for example this: Fix an initial seed. Attach '1' at the end of the seed and compute sha256 of such a string. This hash is our first number. Now attach 2 at the end of the seed(instead of 1 like in the previous step) and compute sha256 to get our 2nd number. And so on.

Will this sequence behave randomly? Would it be possible to extract any information about the inital seed if enough numbers of the generated sequence are known? Does anything in this matter change if we decrease the size of the generated numbers by, for example, truncating the hash to a couple of the initial bytes or taking the hash modulo a very small number?


texts: How much does a successful Distinguishing Attack "break" the attacked stream cipher?

texts:
I started reading about the most recent cryptanalysis of RC4 and it's variants. One of the papers I just finished reading ("Two Linear Distinguishing Attacks on VMPC and RC4A and Weakness of RC4 Family of Stream Ciphers" by Alexander Maximov) handles Linear Distinguishing Attacks.

Now, I understand that a Linear Distinguishing Attack can be used to (simply said) differ cryptotext from real random data. I also understand this proves the related stream cipher to be cryptographically broken, because the successful attack can be used as a base for further attacks. Yet, I am not sure I fully understand the whole range of consequences of a successful Linear Distinguishing Attack.

Does a successful Linear Distinguishing Attack mean the attacked stream cipher is completely broken from a practical point of view?

The question popped up in my mind, because there might be scenarios where Alice and Bob can guarantee that Eve will never get her hands on any plaintext at all. If I'm not mistaking, when Eve does not have (enough) plaintext, Eve can't do a successful linear cryptanalysis. That again could imply that a successfully attacked cipher could be still be used "under certain conditions". Is that correct?

Yeah, I know. No sane person would actually implement a cryptographically broken cipher (like RC4) as long as there are safer alternatives (like AES256) available… so please think of the scenario as a theoretical one. I'm only using it at part of the question since it might help me to completely understand the full impact of a successful Linear Distinguishing Attack, what it practically means for attacked ciphers, and how much a successful Linear Distinguishing Attack actually breaks an attacked stream cipher.

In fact, I guess my question boils down to a more general question covering more than just linear distinguishing attacks… do all distinguishing attacks generally count as a complete break, from a practical perspective?


texts: RSA common protocol failure exam preparation

texts:
I am learning for the exam in cryptography and I have found an assignment about the common protocol failure in RSA.

Assignment:

  Suppose Bob uses an RSA cryptosystem with modulus $n$ and encryption
  exponent $e_1$, and Charlie uses an RSA cryptosystem with the same
  modulus n and encryption exponent $e_2$ , where the greatest common
  divisor of $e_1$ and $e_2$ is 1. If Alice encrypts the same plaintext m to
  send to both Bob and Charlie, she computes $c_1=m^{e1} \mod n$ and $c_2=m^{e2} \mod n$, and sends $c_1$ to Bob and $c_2$ to Charlie. Suppose Oscar intercepts $c_1$
  and $c_2$, and computes as follows:

$f=e_1^{−1} \mod e_2$

$g=(f ∗ e_1 − 1)/e_2$

$h=c_1^{f}∗(c_2^g)^{−1} \mod n$

  (a)  Prove that $h = m$, thus Oscar can decrypt the message Alice sent
  without knowing the private keys of Bob or Charlie.

  (b)  Illustrate the attack for $n=18721$, $e_1=43$, $e_2=7717$ , $c_1=12677$ and
  $c_2=14702$.

No I try to prove it:

$h=c_1^f*(c_2^g)^{-1} \mod n$

$h = m^{e_1f}*(m^{e_2g})^{-1} \mod n$

$h=m^{e_1(e_1^{-1} \mod e_2)} * m^{-e_2(((e_1^{-1} \mod e_2)*e_1-1)/e_2)}$

But now I got stuck. Maybe I don't have to expand $f$ and $g$. I also found a useful site on this problem, but there it is not clear why $m^{e_1f - e_2g} = m$.

RSA common modulus failure

I also found some interesting questions and answers here on this site, but they do not explain me the steps I need.

Maybe someone can help me here.


texts: When NIST disallows the use of 1024-bit keys, what effect will that have on SHA-3 (with max. 512 bits)?

texts:
Quoting the article Gone in 60 Months or Less:

  The National Institute of Standards and Technology (NIST) has disallowed the use of 1024-bit keys after 31 December 2013 because they are insecure. Rapid advances in computational power and cloud computing make it easy for cybercriminals to break 1024-bit keys. When a researcher from Ecole Polytechnique Fédérale de Lausanne (EPFL) in Switzerland cracked a 700-bit RSA key in 2007, he estimated that 1024-bit key lengths would be exploitable 5 to 10 years from then. Not even three years later, in 2010, researchers cracked a 1024-bit RSA key.

So, we're talking about a 512-bit "cryptographically secure" hash meeting cipher implementations where 1024-bit keys are not disallowed anymore by the end of the year 2013.

What does that mean for SHA-3, as the NIST submission sets the rate $r$ as 1152, 1088, 832, or 576 (144, 136, 104 and 72 bytes) for 224, 256, 384 and 512-bit hash sizes, respectively? Can we still think about using SHA-3 to hash passwords to the desired bit-length and comply to NIST rules on the long run, or do we need to expect NIST gradually starting to enforce that 1024-bit key rule across all protocols?


texts: Relationship between generating elements given by cycles in Cayley graph

texts:
The strong RSA assumption is that the following problem is hard to solve.

"Given a randomly chosen RSA modulus $n$ and a random $z \in \mathbb{Z}_n^*$, find $r>1$ and $y \in \mathbb{Z}_n^*$ such that $y^r=z$."

The RSA assumption can be written as "it is computationally difficult to find a non-trivial relation in the RSA group $(\mathbb{Z}/pq\mathbb{Z})^*$". So when considering Cayley graphs, the problem of finding relationship between generating elements can be viewed as finding cycles in the Cayley graph, since cycles give relationships between generating elements.

(As an example, suppose a Cayley graph is generated by the elements $s$ and $t$. When we trace along $sttstt$, suppose we have traced along a cycle of length 6. Then because it is a cycle, $st^2st^2=e$, which actually represents a relationship between the generating elements $s$ and $t$.)

When we consider a situation of finding $y$ such that $y^r=z$ as mentioned above, we don't know which cycle gives this particular relationship right?

Is there way to connect this with the length of the cycle, so that we have some kind of an idea which type of cycle gave the above relationship?

Also, another question came to my mind is, when finding $y$, we might be able to use an algebraic method by making use of a private key or some data relevant to the cryptosystem considered. But if we hope to try to give a solution to $y$ though the process of finding a cycle in the graph, it is going to be very difficult, right?

I mean it'll be difficult even for the sender and receiver of a message, because finding cycles take time, even when done using an algorithm, right?

Thanks a lot in advance.


texts: C# implementation of curve25519 to ed25519 conversions

texts:
WRT the selected answer here:
Can curve25519 keys be used with ed25519 keys?

Is there any c# implementation of this or equivalent?

Thanks.


texts: Why do we need Merkle–Damgård strengthening

texts: Reading through some manuals, wikis and other documentation I'm learning about Merkle–Damgård construction. I understand why padding beginning with '1', followed by '0's is needed, but I can't understand why we're adding length of input in the end. This length-padding is called Merkle–Damgård strengthening. Could anyone explain to me why it's needed. I don't see the benefit.


texts:
From Cryptography I on Coursera, Week 2, "Exhaustive Key Search Attacks":

  Now let's assume that DES is what's called an ideal cipher [...] Of course,
   DES is not a collection of 2^56 random functions

Prof. Boneh doesn't offer any explanation of that, he mentions that in passing like something obvious. But why exactly DES is not an ideal cipher? Is it simply because there are no ideal ciphers at all?

And a follow-up question, if DES is not a collection of 2^56 random permutations, then how many permutations does it actually offer? And how do I calculate that number?


texts: How Can I decrypt this VNC Authentication handshake?

texts:
I'm trying to analyze a mobile application and I believe it is is using DES.  Here is a sample of the authentication handshake.

{""id":"handshake","authentication":"vnc","authentication-challenge":"A489C9790FB7C3CE2E56868C788641FC"}

{"id":"handshake","authentication-response":"D33BAD35B07EF500A82329749CEE9192"}

{"id":"handshake","authentication-passed":true}

For simplicity, the password is set to AAAAAAAA.

For authentication, it is identified as "VNC".  This leads me to believe that they are using VNC authentication, as defined by RFC 6143.

https://tools.ietf.org/html/rfc6143#section-7.2.2

The documentation states:

The client encrypts the challenge with DES, using a password supplied
by the user as the key.  To form the key, the password is truncated
to eight characters, or padded with null bytes on the right.  The
client then sends the resulting 16-byte response

So if  I understand correctly, If I were to encrypt "0xA489C9790FB7C3CE2E56868C788641FC" with the key of "AAAAAAAA" it should equal "0xD33BAD35B07EF500A82329749CEE9192".  Is that correct?

Challenge contains:

$ cat  ~/Desktop/challange | xxd -p
a489c9790fb7c3ce2e56868c788641fc

I try to run:

$ openssl des -in ~/Desktop/challange  | xxd -p
enter des-cbc encryption password:
Verifying - enter des-cbc encryption password:
53616c7465645f5f3f72b55c62bf2c9da805942f64f028b090cecc652dde
8cdade63763a253c1d33

Which doesn't prepuce what I am hoping for, which is D33BAD35B07EF500A82329749CEE9192.  What am I doing wrong?

EDIT:

I found this online.

http://www.vidarholen.net/contents/junk/vnc.html

I believe this might explain why I'm having issues.


texts: Ensuring that an operation takes a relatively specific amount of time, but easily verify the result

texts:
I want an algorithm of some sort that can ensure that an operation takes a fairly specific amount of time, but proof that this operation was done can be completed relatively inexpensively.

For instance, I can prove that an operation will probably take around 30 seconds by doing a cycle with a hashing algorithm such as SHA256 such that the output of the hash feeds directly back into the input. If I count how many hashes are computed within 30 seconds on a modern computer I can be relatively sure that it can't be significantly faster on better hardware.

So, you can ensure that another user waits for around 30 seconds by giving them the amount of rounds they must do of the hash.

And then, for the receiver to verify that they did the hash, they would calculate the given input X amount of rounds and verify that the result matches what they were given.

However, this is hard, because to verify they took that amount of time, the verifier must also take that amount of time.

Is there a way to do such a thing with the verification taking significantly less time than the actual computation?

For instance, one idea is to use asymmetric RSA encryption. Usually, signing a given input is slower than verifying the signature. So, you could possibly sign the input for X amount of rounds and then verifying X amount of rounds would be significantly faster. However the actual amount of data that would get signed would explode (because each round requires adding another signature) and I think  RSA would not be secure to use in this manner.

Is there some way to do this securely and without exploding amounts of data for each required round?


texts: When are hash functions considered insecure?

texts:
I'd like to know when a hash function is considered insecure. Clearly, if it is easy to invert then it's not secure at all. Apart from that, let's say I've found a bunch of inputs $x_1, x_2, .. ,x_n$ s.t their hashes are equal. Would this mean my hash function is insecure even though $n$ is much smaller than my input space?

In general, when is a hash function considered insecure?


texts: Is there a practical security difference between OTP with letters and OTP with numbers?

texts:
Is there a practical security difference between “OTP with letters” and “OTP with numbers”?

If, for example, I encrypt a letter message using Tabula Recta with a random letter key, I would get:

THISI SATES TXAAA - message
MOSSK VFXNN EJRQW - OTP key
FVAKS NFQRF XGRQW - cipher

Would such encryption be less secure when it comes to frequency analysis, compared to (let's say) Dirk Rijmenant's CT-46 OTP where the most frequent letters (AEINOR) are associated with a single digit instead of two digits, like the rest of the less frequent letters in the alphabet?

Example:

THISI SATES TXAAA
83753 82390 82183 28290 83871 11000 - message
08733 64840 36236 58407 58482 94160 - OTP key
85020 28550 56957 70893 35499 27940 - cipher


texts:
I get a request from a client who encrypts the message with the wrong AES key. Is there a way for me to know what AES key the client actually used? I understand I may get the decrypted msg which is likely to be wrong, but from what I understand, the key itself cannot be retrieved from the request sent by the client.

In other words, is there a way for me to do something like this -

if (client.aeskey != server.aeskey), print Error.

Please confirm if my understanding is correct.


texts: How to securely store and validate a 4-digit PIN used on a mobile device?

texts:
I want to be able to securely (1) create and (2) validate a PIN, typed by a user primarily in a mobile app. There is no 'typical' password, although there is another 2nd factor.

The starting point would be something based on OWASP standards for passwords:

get salt_1 (send to user device)
hash PIN on device using salt_1 and bcrypt
send over HTTPS to backend
get salt_2
hash the received hash using salt_2 and bcrypt
save resulting hash or compare against previously saved hash

Now, this scenario obviously has a limited viability and robustness due to low PIN entropy (4 digits), so typical approach for passwords requires at least some alterations.

My ideas for additional security measures would be:

salts should be treated as secret and stored securely and separately from hashed PINs (as in this answer )? If yes, sending it, even briefly, to user device is compromising this security a lot? Can I do something more here?
limiting retrials of PIN validation appears to be more crucial than with passwords

Is there any other approach or enhancements to existing approach that I should consider?

There are, obviously, at least 3 perspectives: backend leak, MITM and device leak and the last one is the one I am least confident with, but maybe I should leave this to the user if he "chooses" to compromise his device security?


texts:
We've been trying to understand how Telegram's VoIP end-to-end encryption works.

Key Exchange

Detailed description of the key exchange algorithm is documented on the Telegram website.

Here is the crux of the algorithm, taken from the same page:

A->B: generates a and sends g_a_hash := $hash(g^a)$
B->A: stores g_a_hash, generates b and sends g_b := $g^b$
A->B: computes key $(g^b)^a$, then sends g_a := $g^a$ and the fingerprint $f\left((g^b)^a\right)$.
B: checks $hash(g^a)$ = g_a_hash, computes key $(g^a)^b$ and checks $f\left((g^a)^b\right) = f\left((g^b)^a\right)$.

For the $hash(x)$ function, they use SHA256.
Fingerprint $f(x)$ is the lower 64 bits from SHA1.
All messages between $A$ to $B$ go through Telegram server that basically re-transmits messages to the other party.

Questions

Why are they using $hash(g^a)$ in the first step? They say that sending the $hash(g^a)$ first doesn't allow the party $B$ to select $b$ such that $hash((g^a)^b)$ will have some specific properties. Do such attacks exist?
Why $f\left((g^b)^a\right)$ is sent in the last step? They explain it "as an implementation sanity check". Does it make sense?


texts:
For a padded message, M, using the El Gamal encryption schema, how can we determine the random number $r$, when we are given $p$, the prime number, $g$ which is the primitive root of $p$, $b$ and $x$ which is the private key.

So the public key is $(g,b,p)$ where $b=g^x$ $mod$ $p$.

To encrypt, we compute: $y_1 = g^r$ mod $p$ and $y_2 = M*b^r$ mod $p$. Then the encrypted version of $M$ is the pair $(y_1,y_2).$

I also know $s=(M-a^y)(r^{-1})$ mod $p-1$. Now we know the El Gamal signature on $M$ which is $(y,s)$.

So in conclusion, I know $(g,b,p,x,y,s)$ where $y$ is the message. I want to know how to determine $r$ from all this information. How can I do that?


texts: Terminology for parties in authentication protocols

texts:
Is there a common terminology to designate parties in authentication protocols?

For example, we typically use prover and verifier to designate parties with zero-knowledge proofs.


texts:
I'm learning about Feistel Ciphers at the moment, but having issues with the formulae, so I can't move on from it.

Encryption:

$_{+1} = _$
$_{+1} = _ \oplus ( _ , _)$

For the round function $( _ , _)$, could someone advise on what exactly I need to do? Let's say my key is $1197$, what needs to happen in between the brackets, $(_ , _)$ , full diagram screenshot attached, thanks.


texts: Is a RSA-signature of some identifying data a safe way to implement a license key?

texts:
I have this idea of implementing a license key:

After the user downloads the program, he connects to a website and sends his Windows product ID.
The website, then, sends this back to him with a signature using a private RSA key.
The program, then, checks, using a public key, whether it is really signed by the private key, and stores this message it got.

Now, every time the program starts, it retrieves this message, and checks it in the way mentioned in 3., comparing that with the windows product ID retrieved from the operating system.

This is done using 1024 bit numbers.
I can't encode anything with the private key using what the computer language (C#) offers. (I don't want to implement my own algorithm – I don't know enough about encryption.)

Is the Windows product key long enough for this? It's something like 12345-abc-1234567-12345. (Get it by right-clicking on “my-computer”, and clicking “properties”.)

I apologize for my non-cryptographer way of asking. Here are the questions:

a) Is encrypting a small number by a large key safe?

b) Is signing a message (as opposed to encrypting it) safe?


texts: El Gamal encryption scheme and symmetric encryption scheme

texts:
Consider the El Gamal encryption scheme, a symmetric encryption scheme (KG,E,D), and the following hybrid encryption scheme having an encryption algorithm that, on input a public key (G,q,g,h), where h=g^x, returns (c1,c2). For which of the following c1,c2 values (and assuming a suitable definition of the key generation and decryption algorithms) does the hybrid encryption scheme satisfy indistinguishability in the presence of chosen message attack?

A.c1=g^y, c2=E(k,m), where k = g and y is random
B.c1=g^y, c2=E(k,m), where k = h and y is random
C.c1=g^y, c2=E(k,m), where k = g^y and y is random
D.c1=g^y, c2=E(k,m), where k = h^y and y is random

I think the answer should be one of C and D, but not sure which one. Can anyone explain which one is the correct and why other three are not? Thanks so much!


texts: RC4: Find the complete plain text of a ciphertext when we know part of the plaintext

texts:
I need to decrypt an encrypted file with RC4 to answer to a Internet challenge.

The file in question is a dump of a Teensy ROM and it is completely encrypted.

Luckily, it looks like it's a standard Intel HEX format.

For the example, a clear file taken at random:

:1000000001C100001DC100001BC1000019C100009A
:1000100017C1000015C1000013C1000011C100008C
:100020000FC100000DC100000C94D80A09C10000E6
:1000300007C1000005C1000003C1000001C10000AC
:10004000FFC00000FDC00000FBC00000F9C00000C0
:10005000F7C00000F5C00000F3C00000F1C00000D0
:10006000EFC000000C9442090C941309E9C0000091
:10007000E7C00000E5C00000E3C00000E1C00000F0
:10008000DFC00000DDC00000DBC00000D9C0000000
:10009000D7C00000D5C00000CA0BEC0BD10CEC0B94

I can deduce some of the XOR keys used for the first 9 bytes for example (:10000000) but also for all others (:10001000, :10002000, the return characters of each line, ...).

I started with a somewhat generic question because I am not an expert in cryptography about a "bad" implementation of RC4. But we must believe that it was not the right steps.

I tested approaches like bruteforce attack. But with a key of 256 characters apart from making the concatenation of words hoping that the password is formed in this way. But do not appear!

I dropped the "standard" attacks based on WEP/RC4 or SSL/RC4 because I did not find any corelation with my problem.

So, is it possible to decrypt a text encrypt with RC4 without even knowing the encryption key?

Taking into consideration the Intel HEX file format:

characters 0-F this is a .hex
because of its structure, checksum at the end of each line and the normalization of the line break, ...

I have not found much about the possibilities of decrypting a file with RC4 when we know only part of the plaintext.

I do not know if all teensy dumps start with the same 9 first bytes. But the first and the last bytes of each line can be known.

Now is it possible to decipher the rest?


texts: Encrypt a small amount of data with a password derived from PBKDF2

texts:
I have a small amount of data (about 128 bits) to secured with a strong password.

I plan to run PBKDF2-SHA2-256 on the password and a 128 bit random salt to generate a 256 bit derived key. Then with the first 128 bits of the derived key (Key1), XOR it with the data to encrypt it. Then create a MAC by using the last 128 bits of the derived key (Key2) i.e. HMAC-SHA-256(Key2, encrypted data). The data would be stored as salt | encrypted data | MAC tag.

Is it fine to do that? Or is there a more standard construct?


texts: Why does RSASSA-PSS produce different signature each time even if I use same salt and same message?

texts:
I understand that RSASSA-PSS is not deterministic. But I see that in message encoding, MGF and SHA functions are deterministic. So even if I keep default salt length, it produces different signature.

Where is the randomness introduced?


texts: Why is it important to generate a pseudorandom permutation from a pseudorandom function?

texts:
Most of the papers on block cipher constructions, especially the ones which discuss constructing block ciphers of arbitrary lengths or small domains, the techniques are designed based on building a PRP from a PRF. The ones that are based on Luby-Rackoff etc.

Why is it that the input message first to be processed by a pseudorandom  function and then followed by a pseudorandom permutation?  Why cannot we construct PRP straight from input message?


texts: I wish to simulate an implementation of a DES Cracker using verilog. But every paper I read give only abstract hints but no concrete steps or how really to go about it. How is it usually done? For example for DES encryption there exists a sequence of steps with ordered connection of known blocks.


texts: How to calculate size of a codebook lookup table to break block cipher?

texts:
I was reading a book called Serious Cryptography. There is a page saying that block size must be large enough to prevent codebook attacks:

When 16-bit blocks are used, the lookup table needs only 2^16 × 16 = 2^20 bits
of memory, or 128 kilobytes. With 32-bit blocks, memory needs
grow to 16 gigabytes, which is still manageable. But with 64-bit
blocks, you’d have to store 2 70 bits (a zetabit, or 128 exabytes), so
forget about it. Codebook attacks won’t be an issue for larger blocks.

Where is the 2^16 * 16 coming from? I think it's supposed to be 2^16 + 2^16 the sum of ciphertext possibilities and the sum of plaintext possibilities that match this specific ciphertext, right?


texts: What is customizable in ECDSA signature and verification?

texts:
Let's say I make a signing and verification ECDSA modules. Signing module receives plain message and outputs signed message. Verification module takes signed message and checks consistency.

Theoretically which things should be known to both modules:

Padding scheme for message
Hashing function
Scheme for combining message and signature

Something else?

Additionally signing module should know the private key, and verification module the public key. How these keys were generated (parameters used, such as curve used) is irrelevant to signing and verification modules?


texts: For CBC, if the initialization vector is corrupted, can we still decrypt the message?

texts:
Actually, I think IV (initialization vector) is random number which is same size as the other block of plaintext. But if the IV is corrupted, message cannot be decrypted because original IV used to encrypt doesn't exist so it actually cannot recover the message from ciphertext.

Is it right?


texts: Why is the IV passed in the clear when it can be easily encrypted?

texts:
The initialization vector (IV) is exclusive or'd against the plain text before encryption for the first block sent in order to prevent an attacker from learning that duplicate message blocks are being sent.  This technique is often used with streaming modes like CBC.

I have researched some of the questions that were asked about whether it was safe to pass the IV in the clear.  The general consensus seems to be that the IV can be safely passed in the clear, but the IV should be random to prevent certain kinds of attacks.  Using a counter for the IV is also thought to be vulnerable as well and only randomly generated IVs should be used.  I don't really understand this since the reason stated for passing a random IV is that it can not be easily guessed.

In any case, my question is as follows:

It should be relatively easy to send the first block of a message encrypted, but without any IV processing.  This first block could contain the IV which would then be used for all remaining blocks of the message.  Since the IV in the encrypted message is random, there should never be any duplicate first blocks.  How come this is not being done and isn't it at least a little safer than sending the IV in the clear?


texts: Security of Paillier against chosen ciphertext attack

texts: Is there a proof by now that Paillier is secure against chosen-ciphertext attack? The original Paillier paper mentions that it is not.


texts: Key derivation function in theory & practice

texts:
I am implementing a cryptographic protocol and I'd like to generate a set of seeds using a seed for a pseudo-random function. The reason is that I can pass on only one seed and it can be used to generate the other seeds.

As we know each derived seed is used to generate a set of pseudo-random values.

According to pseudo-random function definition, the seeds must be truly random (and not pseudorandom). So if I use a master seed to generate some other seeds the derived seed would not be truly random (according to the definition).

Question 1: How can I fill the above gap (i.e. satisfy the pseudorandom function) and have a secure key derivation function?

Question 2: Are the key derivation functions deterministic (i.e. given a master key it always generates a set of derived keys)?


texts:
I am new to linear cryptanalysis, so I decided to try to break a toy cipher that was designed to be vulnerable to linear cryptanalysis. Unfortunately, I can't get it to work no matter how hard I try. I've read the Wikipedia article and several papers, but they always seem vague on how to turn equations that hold over the sbox into ones that hold with high probability over the entire cipher, and I am stuck on that. What am I doing wrong?

First off, the cipher.

# RustleJimmy 2 Block Cipher

sbox = [ ((2 * i + 1) * 0x4d / 2) & 0xFF for i in range(256) ]
sinv = sorted(range(256), key=lambda i: sbox[i])

def T(block):
    # bit transpose of 8 bytes
    x = sum(block[i] << (8 * i) for i in xrange(8))
    t = (x ^ (x >> 7)) & 0x00AA00AA00AA00AAL
    x = x ^ t ^ (t << 7)
    t = (x ^ (x >> 14)) & 0x0000CCCC0000CCCCL
    x = x ^ t ^ (t << 14)
    t = (x ^ (x >> 28)) & 0x00000000F0F0F0F0L
    x = x ^ t ^ (t << 28)
    return [ (x >> (8 * i)) & 0xFF for i in xrange(8) ]

def R(byte, n):
    return (byte >> n) | ((byte & ((1 << n) - 1)) << (8 - n))

def encode(block, key):
    block = [ord(b) for b in block]
    key = [ord(b) for b in key]

    for i in xrange(8):
        block = [ block[j] ^ key[(i + j) & 0x7] for j in xrange(8) ]
        block = [ sbox[block[j]] for j in xrange(8) ]
        block = [ R(block[j], j) for j in xrange(8) ]
        block = T(block)
        block = [ block[j] ^ block[i] if i != j else block[j] for j in xrange(8) ]
    block = [ block[j] ^ key[j] for j in xrange(8) ]

    return ''.join(chr(b) for b in block)

It's a block cipher with a 64bit key that operates on 64 bits. There is no key scheduling; the entire key is used for each round. The sbox is very simple, in fact the three least significant bits are just a linear function of the input. Unfortunately, the linear portion of each round mixes and rotates all the bits so it is not obvious how to take advantage of this.

Here is what I've tried so far.

The sbox is given by $y = 77x + 38 \mod 256$ where x is the input and y is the output. Scaling and rearranging this gives $5y + 2 = 129x + 192$, allowing the equality to be expressed using only xors and 5 nonlinear carry bits. I believe 5 is the minimum possible since the fourth bit is nonlinear and it has to propagate the rest of the way.

Each carry bit can be written using the majority function on three inputs.
$$c_{xyz} = majority(x,y,z) = x \wedge y \oplus x \wedge z \oplus y \wedge z$$

This can also be written as the sum of a linear approximation and an error term.
$$c_{xyz} = x \oplus y \oplus z \oplus 1 \oplus e_{xyz}$$

Where $e_{xyz}$ is 1 with probability $\frac{1}{4}$.

Given these equations, plugging them into the full 8 round cipher and simplifying gives 64 linear equations relating ciphertext to plaintext and key bits. However, since these equations have error terms, they are not guaranteed to hold. Assuming the error terms are independent (they aren't but for simplicity I had to assume that), then the probability of an equation with $n$ error terms holding is $\frac{1}{2} + \frac{1}{2^n}$. Therefore, we need to find equations with very few error terms.

Unfortunately, the equations produced above had 80-140 error terms each. Using the greedy algorithm to find linear equations with fewer errors resulted in a reduced set with 70-123 terms. Unfortunately, this means that the probability advantage is still only $2^{-70}$, meaning it is much slower than brute force. So at this point I am stuck. What am I doing wrong? With such a weak sbox and few rounds, it doesn't seem like it should be this hard to break the cipher.


texts: Assume I have a plaintext and a ciphertext, encrypted using some key and AES with CBC mode. I don't have a service, that I can send something to, so I can't use the Padding Oracle attack. Are there any ways to get the key? I also know that the message was encrypted twice using random words from a very big dictionary.


texts: Collision or second preimage for the ChaCha core?

texts:
Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words.

Can we exhibit collisions, or second-preimages (with implies the former), for the ChaCha core?

Clarifications: I'm using ChaCha core (which is not formally defined by Bernstein) as being to ChaCha what Salsa20 core (that he defines here) is to Salsa20; thus including combining input and output of a number of rounds using 32-bit additions. I'm not asking about collisions with the output of the ChaCha stream cipher (which keystream generator uses the ChaCha core).

The Salsa20 core has the easily verified property that if we toggle the leftmost bit of each 32-bit word of the input, the output does not change, making it trivial to exhibit second-preimages (thus collisions). These collisions or second preimages are not an issue in the uses of the Salsa20 (or ChaCha) core proposed by Bernstein, because enough input of the core function is fixed to arbitrary values that it prevents (as far as we know) exhibiting collisions and second-preimages matching these added constraints. The question is thus more out of curiosity than anything else.

ChaCha and Salsa20 cores exhibit some other properties that a random function would not, like being stationary at zero, or having remarkable identities between output words when all input words are identical. These are not an issue either, only a consequence of the deliberate design decision of putting the nothing-up-my-sleeves numbers out of the core function, in order to facilitate its analysis.

Update: Perhaps some of my curiosity really comes from briefly being culprit of making (in the context of the use of the Salsa20 core in scrypt) the very confusion Bernstein notes:

  I originally introduced the Salsa20 core as the "Salsa20 hash function," but this terminology turns out to confuse people who think that "hash function" means "collision-resistant compression function." The Salsa20 core does not compress and is not collision-resistant. If you want a collision-resistant compression function, look at Rumba20. (I wonder what the same people think of the FNV hash function, perfect hash functions, universal hash functions, etc.)

Here are both core functions in C99; we are seeking distinct values for in such that the corresponding out are identical.

#define CHACHA  1   // 1 for ChaCha, 0 for Salsa20
#define ROUNDS  8   // number of rounds, must be even; standard values are 20, 12, 8

#include <stdint.h> // for uint32_t

// 32-bit left rotation of v by n bits, with n in range [1..31]
#define ROTL(v,n) ((uint32_t)(v)<<(n) | (uint32_t)(v)>>(32-n))

// ChaCha or Salsa20 core, parameterized by CHACHA and ROUNDS
void djbcore(uint32_t out[16], const uint32_t in[16]) {
   int i;
   uint32_t x[16];
   for (i = 0; i<16; ++i) x[i] = in[i];
   for (i = 0; i<ROUNDS/2; ++i) { // each loop does 2 rounds
        uint32_t t;
#if CHACHA // compiled for ChaCha
#define DJBQ(a,b,c,d) /* quarter round for ChaCha */ \
  t=(x[a]+=x[b])^x[d]; x[d]=ROTL(t,16); t=(x[c]+=x[d])^x[b]; x[b]=ROTL(t,12); \
  t=(x[a]+=x[b])^x[d]; x[d]=ROTL(t, 8); t=(x[c]+=x[d])^x[b]; x[b]=ROTL(t, 7);
        DJBQ( 0, 4, 8,12) DJBQ( 1, 5, 9,13) DJBQ( 2, 6,10,14) DJBQ( 3, 7,11,15)
        DJBQ( 0, 5,10,15) DJBQ( 1, 6,11,12) DJBQ( 2, 7, 8,13) DJBQ( 3, 4, 9,14)
#else // compiled for Salsa20
#define DJBQ(a,b,c,d) /* quarter round for Salsa20 */ \
  t=x[a]+x[d]; x[b]^=ROTL(t, 7); t=x[b]+x[a]; x[c]^=ROTL(t, 9); \
  t=x[c]+x[b]; x[d]^=ROTL(t,13); t=x[d]+x[c]; x[a]^=ROTL(t,18);
        DJBQ( 0, 4, 8,12) DJBQ( 5, 9,13, 1) DJBQ(10,14, 2, 6) DJBQ(15, 3, 7,11)
        DJBQ( 0, 1, 2, 3) DJBQ( 5, 6, 7, 4) DJBQ(10,11, 8, 9) DJBQ(15,12,13,14)
#endif
   }
   for (i = 0;i < 16;++i) out[i] = x[i] + in[i];
}


texts: MOV attack when $E(\mathbb{F}_q)$ is cyclic

texts:
Suppose $P\in E(\mathbb{F}_q)$ and $R=dP$.

In the MOV attack, we compute $\alpha=e(P,T)$ and $\beta=e(R,T)$ and try to solve the discrete logarithm problem for $\alpha$ and $\beta$ in the finite field $\mathbb{F}_{q^k}$ where $k$ is the embedding degree.

But if $E(\mathbb{F}_q)$ is cyclic (which it can be even in the supersingular case), $\alpha,\beta$ are doomed to be $1$.

So what am I missing here?


texts: Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

texts:
I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce must never be paired with the same key for a second encryption.

The encryption key is randomly generated, used for a single encryption, split using Shamir's Secret Sharing Scheme, and discarded. When the key is reconstructed for decryption, there is no chance that it can be fed back through to encrypt again; a new random key is always generated for each encryption.

If that's the only constraint, then twelve zero bytes are as safe as twelve random bytes prepended to the ciphertext. I'm reading that the AES-GCM nonce is used as the IV for AES in CTR mode. It's okay to use a zero IV for AES-CTR as long as the key is never reused, but I don't want to assume without confirmation that AES-GCM does nothing relevant with the nonce besides passing it to AES CTR. Am I missing anything?


texts: How does reusing IV for OFB mode breaks the scheme

texts:
Consider a Plaintext P1 and Ciphertext P2, which is known to the attacker. If the attacker knows that the IV used in encrypting P1 in OFB mode is the same used to encrypt another plaintext P2, how can he find out the content of P2 given the ciphertext C2?

Will the attacker have greater limitation if it is encrypted in CFB mode instead?


texts:
I am refering to the theorem:

  If the Discrete Diffie-Hellman problem is hard (i.e. if the DDH assumption holds), El Gamal is IND-CPA secure."

which is stated here along with the proof.

So we have adversary A that has a non-negligible advantage with CPA and we are trying to build adversary B that can break DDH.
B is given $a$,$b$,$c$ which could be $g^x$, $g^y$ and $g^{xy}$ or $g^z$.
Then A outputs $m_0$,$m_1$ to B which encrypts by picking random $b$ and returning to A: $c_0=b$, $c_1=c*m_b$

Now if $c=g^{xy}$ then A will be like interacting with real encryption oracle. Otherwise they say it will be like receiving random values

What I couldn't understand, is that since $c=g^z$ where $z$ is randomly chosen, assuming order of group $q$ which is prime, then there is always $k$ such that $z=k*y\ (mod\ q)$. So even when the B is given $g^z$ the encryption of the message could be a valid el gamal encryption, so it shouldn't look that random to the adversary A.

Is that right?

EDIT:

So apparently, as pointed out by fkraiem, since the adversary is given the public key $g^x$, when $c_0=b$ he expects the encrypted message to be: $c_1=g^{x\cdot y}\cdot m$ not just a random $k$. The probability of $k=x$ is negligible.


texts: Why every access structure is a multipartite access structure?

texts:
The set of authorized subsets of participants is called an access structure.

In a multipartite access structure,  the set of participants is divided into several parts and all participants in the same part play an equivalent role.

In the 12th line of abstract of this paper,  it is given that every access structure is multipartite,  I am getting confusion regarding this statement. How to understand that every access structure is a multipartite access structure?


texts:
First a hypothetical situation:

Key1: Is a password (let's say "TooMuchEncryption") and then hashed with SHA256

Let's say you have 3 files, first you encrypt the files with AES256 with Key1 and then package them into a zip file. Then when you send it to a friend, you encrypt that whole zip file with the public key of your friend with PGP and you send it to him via a TCP channel.

Forget the time, because of course: this road would take a 'very' long time on a avarage computer (4 cores, 8 threads) (right?).

But it is secure. The chance anyone will decrypt those 3 files, is quite small (assuming they don't have those keys and they intercepted it by listening to the TCP channel).

But are these files 'over-encrypted'? Does it even make sense to apply so much encryption (first AES then PGP)? Would just zipping that file and protect that with Key1be enough?


texts: How to change the known ciphertext so the known plaintext is changed in AES CBC mode?

texts:
I already read a blog about the padding oracle and also some posts about how to change the plaintext but it didn't work out.

So I have the encrypted cookie (AES_CBC):

5468697320697320616e204956343536 d6ca0a2883280762915414c54e97df1b 40871b72f45ec7f9510a080095436d51 4129e137aaac86a0f7fa8bd3d250b9d1 df35b668fcb93f00bb06692560a3fed8 a3b523d385f1477b6daac14ff2416c67

which I could decrypt with the padding oracle to:

hex: 5468697320697320616e204956343536 7b22757365726e616d65223a20226775 657374222c202265787069726573223a 2022323030302d30312d3037222c2022 69735f61646d696e223a202266616c73 65227d0d0d0d0d0d0d0d0d0d0d0d0d0d
ASCII: This is an IV456{"username": "guest", "expires": "2000-01-07", "is_admin": "false"}

I now have to change the cookie date so it is not expired and I also have to change is_admin to true. So first I wanted to change the year in the date to 3000 to only have to change one number.

The expiry year is part of the 4th plaintext block, byte 3: P_43
The corresponding encrypted ciphertext block byte will be defined as: C_43
The manipulated plaintext byte will be defined as: P_43'
The corresponding ciphertext byte will be defined as: C_43'
The bytes from other blocks will have the same definition [cipher=C or plain=P]_[block][byte]

Since I want to change the number 2, I know that P_43=32 (ascii to hex).
In addition I know that I want to change the plaintext to show the number 3 so P_43'=33
Looking at the ciphertext I can also see that C_43=e1 and C_33=1b

So what I already tried, is the following:
Calculate C_33' = (P_43') xor (P_43) xor (C_33) = 33 xor 32 xor 1b = 1a and change C_33 to C_33' = 1a

Since it did not work I also tried some other stuff (which made no sense for me) I read in the forums like:
C_43' = (P_43') xor (P_43) xor (C_43) = 33 xor 32 xor e1 = e0 or
C_33' = (P_43') xor (C_33)

Can someone please explain me what I am doing wrong? I wrote my own padding oracle script based on the blog post about it and I successfully decrypted the message but I really don't know what I am doing wrong here.


texts: Efficient way of generating a random number of N (less than 64) bits with exactly M bits equal to one

texts:
Would there be an efficient way to implement a function with the following signature:

unsigned long long int random_word(size_t n, size_t m)

that would generate a random machine word (64 bits here) such that exactly m bits over the n least significant ones at set to 1. For example: random_word(10, 3) would generate a 64-bit random number such that 3 bits over the 10 LSBs are set to 1. For a given n and m every possible output should have equal probability (uniform distribution of possible permutations).

If assembly bit twiddling hacks to do that are known, great, if not, I am looking for references and research directions.


texts: Are PQ/Classical Hybrid Key Exchanges a reflection of how little we trust PQ cryptography primitives?

texts:
My students have asked me some questions about why there are standards being developed for hybrid public key systems with both a classical and a post-quantum component.

Given that when elliptic curve cryptography was first being deployed no one suggested using elliptic curve cryptography with classical RSA or Diffie-Hellman in a hybrid scheme; when SHA-3 was standardized no one suggested making a hybrid of SHA-3 and SHA-2; and when AES was invented no one suggested using it in a hybrid with Triple DES or some other cipher--is the desire for PQ hybrids a reflection of the distrust we have in the fundamental primitives that underly our post-quantum schemes?

If we do trust these primitives, why the need for a hybrid?


texts:
The question pertains not in terms of security but computing operational functionality, as it how the computation is done.

Is it true that for RSA with no padding, the length of data must be equal to the length of key?

If so, why is that so? What is the reasoning why the data needs should have the same number of bits as the modulus? What is the mathematical implication?

Examples:
Limitations to input size corresponding to key size in bits:

keysize: 512 bits  (64 bytes),  number of input bytes: multiples of 64
keysize: 768 bits  (96 bytes),  number of input bytes: multiples of 96
keysize: 1024 bits (128 bytes), number of input bytes: multiples of 128
keysize: 2048 bits (256 bytes), number of input bytes: multiples of 256
keysize: 4096 bits (512 bytes), number of input bytes: multiples of 512


texts: In PKI, with a hash-encrypted message (first hashed, then encrypted), how is the plaintext ever retrieved?

texts:
Consider a normal PKI encryption flow - hash the plaintext, then encrypt the hash with the private key of the sender and then encrypt it with the public key of the recipient. All this is good - and I am good even with the decryption steps taken by the recipient.

I still don't understand how the recipient gets the plaintext from the hashed ciphertext. The recipient can easily 'decrypt the hashed plaintext'. But then what - all you are left with is a hashed plaintext. There is no way to un-hash it. How does the recipient retrieve the plain text message from the hashed message?


texts:
Actually, I think I know why, but consider RSA2048 and SHA256. What about to, instead of padding, just use pbkdf2 with just 1 iteration to expand the 256bits hash to full 2048bits and use those 2048bits as an input for the plaintext RSA?

What would be wrong with that crypto-schema?


texts:
I am working on a project for a client which involves decryption of data which was encrypted using RSA.

The system in question retains three independent copies of each data-set, but each copy is encrypted with a different key. In this scenario, all of the private keys are gone and i want to know if anyone knows of a methodology to use the three encrypted copies of the data (which are identical - no padding) to determine the original data-set.

Any help/thoughts/comments would be appreciated.


texts: If there is an algorithm A can calculate the modular square root of input n, How to use it to get prime factors?

texts:
Suppose you are given an algorithm $A$ which takes $y \in \{0, 1, \ldots , N − 1\}$ as input, and outputs $x \in \{0,1,\ldots,N − 1\}$ such that $x^2 \equiv y \pmod{N}$. Design an efficient, randomized procedure that uses $A$ to get prime factors.

This is a homework problem for the graduate algorithm course.

It's similar to this question. The difference is that we don't have a specific number 51733469. My idea is that we can randomly pick a number $a$ between $[1,n-1]$, use $A$ to calculate it's modular square root and do exactly like the solution here? Or the randomly-picked number $a$ should satisfy any sort of condition?


texts: Can I safely replace XOR with ADD in a stream cipher?

texts: In a stream cipher, the bytes of the plaintext are usually XORed with the keystream to produce the ciphertext. Would there be anything wrong with adding the bytes instead (with overflow), if adding happened to be faster than XORing on a particular system?


texts: Is the salt value a secret or can it be stored in cleartext just like the IV?

texts:
From Wikipedia I read that the IV is used to randomise the mapping of cleartext to cipher text and that the IV is usually stored (in cleartext) together with the encrypted record. (http://en.wikipedia.org/wiki/Initialization_vector)

However if I look at a specific implementation in C# when deriving the key using Rfc2898DeriveBytes, a salt value is required and I understand the need of the salt.
But obviously I will need the salt later on the regenerate the key from my secret passphrase.
Does that imply that the salt itself is not a secret and can be stored together with the encrypted record in cleartext, just like the IV?

string passphrase = "Hello World, I'm the secret!";
string salt = "13245678";

var deriveBytes = new Rfc2898DeriveBytes(passphrase, Encoding.UTF8.GetBytes(salt), 50000);

using (var rijndael = new RijndaelManaged())
{
    rijndael.KeySize = 256;
    rijndael.Key = deriveBytes.GetBytes ( rijndael.KeySize / 8 );
    rijndael.IV = deriveBytes.GetBytes ( rijndael.BlockSize / 8 );

...
}


texts:
I am looking for an algorithm/procedure that encrypts a text
where the alphanumeric data is encrypted into password-protected alphanumeric data.

I have seen other algorithms where a text like "Hello, How are you?" will be encrypted into something like this: JHo+8D337H/hLwg9n2n2n8+du783bsH9hdsSEWj93==

This is not what I am after.

I am looking for something that does this: "Hello, How are you?"
will be encrypted into "Kjehh, Jey uwh wmd?"

Any idea how to do that?


texts:
If I follow the wikipedia or crypto.stackexchange definition, any simple XOR encryption where the key is as long as the plain text should qualify as a secure block cipher.

Now I thought what would happen if I just use this together with a block cipher mode of operation? After all, they should build a secure scheme with any secure block cipher. As you can probably guess by now, the outcome of this is nowhere near being secure. (Not even considering the small key space in this particular example, that could easily be fixed, but there are very obvious connections between the plain and the cipher text.)

So my question is: What is a block-cipher, so that it qualifies for use with any of the block cipher modes of operation?


texts:
I have to implement a 256*256 bit Montgomery multiplier for pairing computations. The straightforward approach is to use a bit-serial version, but I would like to utilize the built-in 64*64 bits multipliers on soft cores of modern FPGA devices, therefore I need a blockwise implementation (64 bits each). Two choices for implementation are:

Get a 512-bit product and then apply Montgomery reduction.
Reduce the intermediate products (128 bits) in each step using Montgomery reduction.

Which strategy is faster? If intermediate results are reduced in each step, then what should be the value of $R$: is it $2^{256}$ or $2^{64}$?


texts:
So I'm trying to understand the complexity of the biclique attack on Grostl and I have some questions:

1) The paper introduces sliced bicliques where on Grostl one constructs a biclique of dimension 1 and accordingly, we get 4 $Q's$ at state#5 and 4 $P's$ at state#8. What I understood is that each pair of $Q's$ should hash to the same value at the matching point (state#13), similarly for the $P's$. My question is how is this possible if we have 4 different $Q's$? My understanding is that can happen if we consider only the parts at state#13 that are not affected by the difference (white bytes), is my undarstanding correct?

2) The complexity of the attack should be equal to #bicliques(cost of biclique construction + cost of computing forward and backwards to the matching point + cost of checking for a full match if partial matching took place), right?

3) Cost of biclique construction is the $2^{70}$ for the super Sbox solutions and consequently using the free 48 bytes in the $Q's$, we can have $2^{384}$ bicliques without the need to construct new one. However I cannot understand the $2\times(8 + 16 + 2 + 7 + 56 + 8) = 194$ Sboxes for both the forward and backward recomputation. I understand that we're supposed to recompute the white bytes that affects the 4 leftmost columns white bytes at the matching states only but howcome there are 6 terms in the above computation althought we only have 2 rounds in each direction after the biclique? and how are the 194 Sboxes equal to $2^{-3}$ call of the permutation if the 10-rounds permutation has 640 Sbox lookups in Total?

4) What about the complexity of checking for the full match if we get a partial match?

Thanks in advance.


texts: Parallel file encryption and authentication for large files

texts:
For a cloud storage upload client I want to encrypt files during upload, so that they cannot be read by the cloud service provider or anyone who gains access to the account. I would like to use some standard format, instead of rolling my own crypto, but I couldn't find anything that does what I want.

The main problem is that I want to split large files and upload them in parallel to maximize bandwidth. If uploading of a part fails, I might have to go back and upload the same part again. Therefore, I need an encryption scheme which allows encrypting only some parts within a file. Also, a full authentication pass before uploading should be avoided.

After a lot of reading in the past two days I came up with the following scheme:
Split the file into fixed sized (few KB) blocks. Calculate the SHA-1 hash of each individual block and append it to the plaintext. Encrypt the plaintext and the following hash using AES in CBC mode with a random IV for every block. This is similar to what RFC 4880 specifies for symmetric encryption, just with blocks. This provides authentication for every individual block. To protect the file as a whole, an additional last block with a concatenation of all block hashes is processed using the same technique.

From the RFC 4880 document it's already clear that this only provides modest security against modifications. So I'm thinking about further improvements. The use of a simple hash function could be replaced with a HMAC. From this document it's clear, that authenticate-then-encrypt is not generically secure. However, for CBC mode this doesn't apply, so I would like to keep authenticate-then-encrypt, since it allows easy checking of the encryption key, without decrypting the whole file. I'm also not very happy about, the last block which repeats all the previous hashes. Maybe a HMAC off all previous hashes would suffice? I hope someone can shed some light on the practical security of this technique.

I also stumbled across GCM, which seems exactly what I want. However, I understand that there is a limit of ~68GB, which can be encrypted for a given IV/key pair. Is it safe to approach this limit, or should one stay far below? Also, I didn't find any good Python library which actually allows parallel encryption using GCM.


texts: Create digital signature with input from multiple users?

texts:
Suppose that users A,B and C want to create a digital signature together. The users do not trust each other so, they need to create a signature that receives input from all of them.

The best way I though of was with RSA where each user performs a step of the key calculation:

User A selects prime p
User B selects prime q
User C selects the e (By calculating N=(p*q) and so on...)

So now you have a set of keys where all users had an input.

My question: Is there a better way ?  (preferably with more users)

Any type of signature will work, just needs input from many users.


texts: Group receiver and sender, only parts of them can decrypt

texts:
suppose there is a group $\mathcal{N}$ of $n$ people with public/private key pairs $(pk_i,sk_i)$ $i=1,\cdots,n$. Is there any scheme that I can send message to a subset of users $i_1, \cdots, i_m$, only the users in $i_1, \cdots, i_m$ can decrypt the message?

I know Broadcast Encryption can do this, but the number of keys broadcast encryption may produce is 1.25$r$ times of the original one, where $r$ is the number of users who cannot accept the message. However, I want only a small portion of people that can decrypt the message. Thank you!


texts:
What is the recommended key length for DKIM? I'm currently thinking about a 1024-bit key vs. a 2048-bit one.

From the crypto point of view for RSA, 2048 or 4096 bits is clearly recommended--no discussion on that point. Having glanced over various posts, it seems there may be some trouble at the mail or DNS level with keys of 2048-bit length.

Moreover, using 1024-bit keys seems to be the current trend.

Which key length is best for DKIM?


texts: Homomorphic encryption over finite fields

texts:
I'm curious on the following question: let $\mathbb{F}_{2^n}$ be a finite field which is an extension of $\mathbb{F}_2$ with order of $n$, is there an encoding scheme $e:=\mathbb{F}_{2^n}\rightarrow \mathcal{C}$ for some domain $\mathcal{C}$ and satisfies linear homomorphic, i.e. $$\forall x_1,x_2\in \mathbb{F}_{2^n}, e(c_1x_1+c_2x_2)=c_1e(x_1)+c_2e(x_2),$$where $c_1,c_2\in\mathbb{F}_{2^n}$ are some constants.

A naive idea is that we regard $s\in \mathbb{F}_{2^n}$ as a binary vector and encrypt the bits one by one, then we can do the arithmetic operation on $\mathbb{F}_{2^n}$ in the bit level over the cipher vector (which only require additive homomorphic over $\mathbb{F}_2$). However, this will have a huge cipher space i.e. $c*n$ where $c$ is the security parameter makes the bit level encryption secure.

My question is:

  Can we do better than the naive approach above? Or, is there any existed results on this topic?


texts:
I need to find RSA private key $(d, N)$ knowing $(e, N)$. It's "own" RSA implementation. As i know
$p$ is random 70 bit number, then $q$ is $p-2^{10} < q < p+2^{10}$
$d$ is max 16 bit long with low number of ones in binary representation.

$e= 4223234360740816682261885795416553301541344119$

$N = 5074772291286459206774040208059072021046562917$

I tried to use Wiener's_attack with implementation from GitHub.

It gives me $d = 1031$. Is it the answer ? How to check if is it valid ?

What are the right ways to find d ?


texts: Select a single message without showing which one has been selected

texts:
Can anyone suggest a cryptosystem for the following problem?
We are working on a university research project.

Problem

Alice has multiple messages $M_i$, $i = 1,\ldots ,n$.
Bob should obtain any, but exactly one $M_i$, without obtaining other $M_j$, $j \neq i$.
Alice, on the other hand, shouldn't get the exact $i$, which has been selected by Bob.

Analogous physical world scenario

Alice writes each $M_i$ onto a distinct piece of paper, and puts these pieces into a hat.
Then, Bob shuffles the pieces by hand without seeing them, draws one piece and, finally, burns the others. Obviously, Bob doesn't have a chance to peek into the hat. Also, Alice cannot see which piece Bob has selected (she is not able to leave secret marks in the pieces).


texts:
The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following unanimity protocol for three players:

  Three players want to determine whether they all agree on the
  point at issue; if they do not all agree, then they will not discover who stands
  alone against the other two. This is useful in situations where eventual consensus is required, but there is a danger that voters might be unduly influenced by knowledge of the other votes.

Q: The given solution uses playing cards. What is the most natural cryptographic solution of this problem? (Hopefully it will work for more players.)

The secure two-party computation of logical AND from the same article was discussed at Is there a cryptographic solution for this “dating protocol”?.


texts: Why is a Diffie-Hellman key exchange required when RSA is already being used for key exchange in TLS?

texts:
Specifically with TLS,

What is RSA used for during key exchange?
What is Diffie-Hellman used for?
Since RSA already provides authenticity and confidentiality, why is Diffie-Hellman used during the exchange?
I've heard DH exchanges aren't secure. Is that something to be worried about in an RSA with Diffie-Hellman exchange?
If DH is used for forward secrecy. What's wrong with just generating new RSA key pairs and exchanging keys with that?

The use of Diffie-Hellman along with RSA is the one thing I don't understand about modern Public-Key Cryptography.


texts:
I have a system where some clients communicate with a server. every client has its own name and role and some other parameters that sends these info to the server in every message and the server uses those info somehow...
All communications are encrypted with symmetric keys. I have a master key that only I and the server know it.
A client's key is derived from the master key this way:

client1_key=hkdf(16, MASTER_KEY, 'client1')

a client sends its encrypted messages to the server along its name/key ID, so the server can reconstruct the client's encryption key from the master key and the client name and decrypt the message. Other info like client's role are contained within the encrypted part because I wanted to reveal only the minimum/absolutely necessary information in clear text communication.

a problem here is that with this scheme, a client can claim, with the exception of its own name, other parameters that don't really belong to is. e.g. it can send any role it wants to the server and the server has no way to verify that those parameters are relevant to that specific client.

my solution to this problem was generating an HMAC over all restricted parameters and sending it alogn the other info (client name and encrypted message) to the server by every client. so each client receives its own key and the accompanying hmac that restricts the key use:

key_use_hmac=hmac_sha256(MASTER_KEY, client_name||client_role||another_parameter...)

then at the server this hmac is recalculated after extracting the client's parameters from its decrypted message and compared with that sent along the message by that client, if they match, the message is accepted, else the message is rejected.

an example of a message sent to server by a client:

name=client1, key_use_hmac=xxxx, encrypted_message=xxxxxxxxxxx

only name and key_use_hmac are send in clear text (key_use_hmac could also be sent within the encrypted part, but i thought it is not necessary at all - am i correct?).

I want to know if my scheme is sound enough or not.
thank you!


texts: Hash-based asymmetrical encryption (not digital signature) schemes?

texts:
In the Wikipedia article or another article about post-quantum crypto there's a plenty of information about hash-based signatures. But where are hash-based ecryption with pubkey?

  But, over the long-term, it's generally confidentiality (i.e. encryption) that you need to maintain and I haven't talked about post-quantum encryption at all in this post. (Maybe in the future.)

Why articles about hash-based asymmetric encryption are more hard to come by?

Possible reasons:

It is impossible and the proof is basic enough that it not deserves an article (or a question here)
It is even more impractical than hash-based signatures
It is secret and classified
It is somehow not interesting and nobody cared to research it
It is called by some other term, using which articles get found easily.
Linked articles actually do speak about them, but I don't read attentively and missed it.


texts:
It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is predictable - it is incremented for every message, but never communicated - the attacker only knows it increases by one, but not the exact value. Can they still attack from that information alone?

Edit: I'm asking if it is ok to just increment the IV for every message given that the attacker doesn't know the initial IV


texts: Self authenticating tamper resistant first meetings

texts:
I'm not sure what the precise words I am looking for are so I apologize if there is a better way to phrase this. What I am thinking of is ways to transfer an identity in a way that it is tamper resistant and can be used for authentication.

Normally to know who someone is people use driver licenses or a person's face. In cryptographic terms this would be similar to your public key. You can use this to sign and encrypt messages validating you are who you say you are just like when someone speaks and you here it come from the person's mouth. You know who they are by their face.

If you send a public key over a unsecured network it has the chance to be modified in such cases as using Diffie-Hellman key exchange. Your communications are secure but not authenticated.

One solution to this is such things used by PGP a network of trust where people would sign your key after seeing your photo id or knowing you by being your friend etc. They vouch for your identity by seeing those things that prove who you are.

Would it be possible to digitize this by transferring video of a person with a QR code representation of your key? Such as a video chat the other person can see your face and your public key. The attacks on this would be man in the middle but even then you would either have to modify the video stream or create a fake of the video with your own QR code.

Is there any other holes in this (obviously if you don't have a webcam it won't work) that I am not seeing? Is there a way to mitigate modifying the QR code in a better way (obviously this would be a very specific attack but unless you can somehow make it time sensitive or somehow make it so it can't be changed*)?

Edit

Some other thoughts, in stead of a QR code (which people may not have access to a printer and you don't want to just transmit the screen or a picture of it digitally as that could easily be replaced) maybe a hash of the public key, though it does have the down side of being 160 characters for sha1 so it is long.

PGP uses a web of trust this could also happen you already know many people who most likely know people you know. You could confirm that in fact it is them (to a certain degree) by other people you both know.

While video could be altered (again highly unlikely but I don't think it would be hard, tedious yes) voice would have another issue to be faked (though this being the start of the connection may not be of benefit as they could queue up it, though it would be odd as video messaging wouldn't be synced, and somehow use audio to piece it together).

All these things take time to alter and attack, sense it is streaming it would seem resistant in that a video message naturally needs to be in sync and not delayed, if there is a long delay that could potentially be an issue. However (though I am not sure how feasible this is), computer automation could speed up tampering**.

Another though was some kind of shared secret but I think this would be weak because either it is rather public (where did we sit at the xyz game last week) or if secret enough why not just give each other your QR code...

* However any method of signing the video wouldn't work because you would just change the key as well... maybe encrypting it with the other person's public key but that still would be weak against a man in the middle attack wouldn't it?

** Computer automation is obviously rather unlikely but it could be possible for a QR code as it is meant to be computer readable, less likely for a string written on paper or voice information (as far as I am aware of).


texts:
Alice and Bob want to perform a Diffie-Hellman key exchange using the group $G$, a
primitive root $g$, Alice’s secret key $k_A$ and Bob’s secret key $k_B$. In each case below
compute the element of $G$ that Alice sends to Bob, the element that Bob sends to
Alice, and the secret key that Alice and Bob will share.

$G=\mathbb Z/163\mathbb Z$(as an additive group), $g = 2$, $k_A = 128$, $k_B = 65$.
$G=\mathbb F_{163}^*$, $g = 2$, $k_A = 128$, $k_B = 65$
$G = [0, 1) ∩ \mathbb Q$ with group operation
$$a\Diamond b = [a + b] = a + b − \left \lceil{a+b}\right \rceil$$
$g = 23/123$, $k_A = 358$ and $k_B = −44$.
$G = GL_2(\mathbb F_{17})$, $g= \left[\begin{array}{ c c }
     2 & 3 \\
     4 & 5
  \end{array} \right]$, $k_A = 13$, $k_B = 5$.

For $1)$  I did the following, Alice sends Bob $A = (128)2 \bmod p$ and then Bob sends Alice $B = (65)2 \bmod p$. Their secret key is $(128+65)2 \bmod p$.

For $2)$ I did this: Alice sends Bob $A = 2^{128}$ $mod p$ and Bob sends Alice $B = 2^{65} \bmod p$ Therefore, their secret key is $B = 2^{(65)(128)} \bmod p$.

For $3)$ Alice sends Bob $128\Diamond 23/123$ and Bob sends Alice $65\Diamond 23/123$ so their secret key is $(128\Diamond 65)\Diamond 23/123$. However I don't know whether this is right or not.

I don't know how to do the fourth one.

Any help is appreciated. Thank you.


texts: Use of cryptographic hash for computing previous block hashes in blockchains

texts:
Why is the previous block hash computed using a cryptographic hash function instead of a regular hash function in Bitcoin and other blockchains?
What cryptographic hash properties (pre-image resistance, second pre-image resistance and collision resistance) are needed and why?


texts: Distribution of randomness in elliptic curve Diffie-Hellman shared secret

texts:
The specification for a project I'm working on says to use elliptic curve Diffie-Hellman for key exchange, specifically using the secp224r1 curve.  In the notes it is stated:

  take the last 16 bytes of the shared secret byte array (do not use the first 16 bytes — those are not as uniformly distributed as the last 16 bytes!).

So my questions are:

Why are the last 16 bytes more random than the first 16?
Is this specific to the secp224r1 curve, or is it general to the elliptic curve version of the Diffie-Hellman algorithm?


texts: Cipher feedback mode with shift registrers

texts:
Can someone please explain to me how the Cipher Feedback Mode works? From what I have read some examples have a shift register in its explanation but some examples don't. Is there two versions of CFB and what is the difference? What is and how does a shift register work?
The first picture shows the process without a shift register and the second picture uses a shift register.
Screenshots from the related video:

Also, in the explanation of AES on Wikipedia it says that the four steps sub bytes, shift rows, mix columns and round key addition is done in 14 cycles for a 256 bit key. Is that the case for the CFB mode as well or is that just for a different mode of operation?


texts: What algorithm does .NET use to generate primes for RSA and how can I verify it?

texts:
There is an implementation of RSA in C# .net, but how can people know that this implementation is considering all the secury stuff conserning to RSA?

For example I want to know what is the algorithm that they use to generate prime $p$ and $q$, and how the verify that that primes are good primes and they don't need to look for another pair.
Also, what value of $e$ they are choosen?

Is there some documentation with this kind of information aviable online?

Best regards,


texts:
I'm designing a system where a registration code is generated, it is sent to the user, and then the user registers himself/herself based on this registration code into the system.

The registration code has some expiration time, so that if the user doesn't register within the validity period, the registration code will expire a new registration code needs to be generated.

Is there any standard that would suggest what should be the entropy of such a registration code?

On one hand, it should be long enough so that an attacker can't guess it.
On the other hand, it should be short enough so that the user can enter it easily into the system.


texts: Should AES-CMAC key cryptoperiod be affected by MAC truncation to avoid birthday-attacks?

texts:
Given a 128-bit key used for authentication based on AES-CMAC, the NIST 800-38B recommendations suggest at least two criteria for a good key cryptoperiod:

after 'MaxInvalids' error messages the key should be retired (considering the MAC truncation and the accepted Risk in appendix A);
the key should be changed to limit its message span (e.g. $2^{48}$ usages for AES-128).

My question is: should the second criterion be considered if I have MAC truncation?
In my scenario, I'm assuming that the attacker can only see truncated MACs (suppose $30$ bits after truncation). Since I'm using truncation, and this criterion is made to avoid attacks based on detection of a pair of distinct messages with the same  MAC  before  its  truncation, should I still consider this criterion? If yes, should the limit still be $2^{48}$ or is it affected by the truncation?

UPDATE

The scenario is: only truncated MACs are sent to a limited-bandwidth network, and the attacker has access to the network. Considering Elias answer I removed the assumption that the attacker sees only truncated MACs, which is not meaningful. So, if we remove this assumption, do I have to shorten the cryptoperiod to consider $2^{15}$ (truncated MAC), or I can just consider $2^{64}$ (entire MAC)?


texts: What is the recommended number of iterations for Argon2?

texts:
I've recompiled my operating system ("LionBSD" based on FreeBSD) to use Argon2i as the default password hashing algorithm in crypt/libcrypt.

I'm wondering what the recommended number of iterations would be?

As an example, OpenBSD uses 8 iterations of bcrypt by default.


texts: Is there a cipher that avoids double bigrams?

texts:
Are there any known ciphers that whose ciphertext (given any plaintext) avoids bigrams of the form "aa, bb, cc, etc."?

What about known ciphers that make bigrams of form "aa, bb, cc, etc." rare compared to other bigrams?

I understand that it is easy to construct a cipher that does this, but I am wondering if there are any in the literature that have this property.


texts: Can we map SHA-256 output bits to fixed-length input bits?

texts:
If I have a set of $N$-byte input values to be hashed using SHA-256, then what are the mapping functions for each of the 256 bits of the output?

It seems to me that hashes are one-way partially because we don't know the input size, but if we did know the size to be $N$, then I expect to find a generalized mapping functions for each of the 256 output bits as functions of the $N$ input bits.

To be clear, I am not trying to find an input for a given output - I am happy for a mapping to still be a 1-way function.  Say, for 1000 bits of input, each output bit may be a function of all 1000 bits, or perhaps fewer, or perhaps with extra variables (S-box etc): ox = f(i0, i1,...1N, s0, s1,...) for the Xth output bit as a function of up to $N$ input bits and other variables.

In theory, should this be possible? If not, why not? If yes, what are some tips to learning all 256 mapping functions from the algorithm?


texts: Secretless authentication method for remote hardware

texts:
We're working with a microcontroller that is not secure enough to store secrets. The ROM could be dumped in a properly equiped lab.

This is why we considered integrating a certified Secure Element that would store the secrets we need for our infrastructure (some keys and certificates). This way the secret would be stored in a valid device regarding security standards.

However, in this new architecture, the Secure Element would be deported from the host microcontroller, which requires to secure the communication between the SE and the Host.

Yet,  all the current authentication methods we know require to store something (a secret, a key a certificate), what we cannot do because the microcontroller is not secure enough...

That leads to two questions:

What is the purpose of integrating a Secure Element or Secure Access Module to address the needs of secret storage for an infrastructure if it requires another secret for connection?
Is there any authentication method that would not require secret, but would garantee anyway identities?

Many thanks


texts: Can ChaCha be turned into a collision resistant hash function by xoring keystreams?

texts:
In his paper about RFSB Bernstein states that the compression function

$(m_1,\ m_2,\ m_3,\ ...\ ,\ m_n) \rightarrow c_1[m_1]\ \oplus\ c_2[m_2]\ \oplus c_3[m_3]\ \oplus\ ... \oplus\ c_n[m_n]$

is surpsingly collsion resistant. Reading this paper, I asked myself weather one can use ChaCha with increasing counter instead of arrays to reach nonlinearity. To do so, one would use the alternative initial matrix

k k k k
m m m m
m m m m
c c c c

where $k$ are the constants provided by Bernstein, $m$ is the message (which takes the place of the key) and $c$ is the counter which was expanded to 128 bit since there is no need for a nonce in this scheme. The usual ChaCha algorithm is applied to this matrix.

Obviously, the maximal message length should be $2^{128}$ message blocks of 256 bits each (minus padding) to prevent counter overflow.

Also an attack who intercepts a hash $h$ and knows one message block and its position is easily able to replace it by calculating $h' = h\ \oplus\ ChaCha(m, c)\ \oplus\ ChaCha(m', c)$.

However, if the attack want's to perform a second preimage attack on $h$, he basically would have to find a $m$ with $ChaCha(m, 0) = h$, which is as hard as recovering a key from a 512-bit ChaCha keystream. The attacker can  control the counter by adding dummy-blocks, which may give him an advantage given that reduced-round versions of ChaCha have differential characteristics.

However, when it comes to finding any collision, I'm not sure whether you would be able to find a collision with less than $2^{256}$ (birthday attack) calls to the compression functions.


texts: Hiding the identity of a party within the Kerberos authentication scheme

texts:
In the Kerberos authentication protocol, as described here:

would it be safer to replace step (1) with:

$$
A \rightarrow T : A, E_{K_A{_{T}}}(B, N_A)
$$

so that a passive adversary does not know the identity of party B with which A wishes to communicate?

Or even add an extra layer of security by encrypting the whole message with a globally distributed symmetric key:

$$
K_G
$$
thus message (1) becoming:
$$
A \rightarrow T : E_{K_G}(A, B, N_A)
$$

where KG is a global key shared with all potential clients, and the trusted third party T decrypts any incoming request with this key; it assumes that all inbound ciphertexts are initially encrypted once with the respective key.


texts:
I am developing a mostly-offline authorization system that authorizes a user using an deterministically generated AuthKey derived from a MasterKey derived from a high-entropy chunk of data (128 bits) and a low entropy data (for example, an email address).
The total length of the concatenated data will never be more than dkLen (256, either by hashing the low entropy data using md5 or using padding), and AuthKey will be used in order to generate a ECC asymmetric pair.

MasterKey = KDF ( HighEntropy, LowEntropy )
AuthKey = KDF ( MasterKey, keynumber )

For this purpose, and in order to avoid bruteforce I am considering using hkdf or scrypt.
My primary concerns are:

Are there considerable chances of key collision?

I know that just with the 128 bits of entropy there are 3.4028237e+38 combinations, even more with the low entropy data.
Still, provided that no one used the same LowEntropy value, and considering:

dkLen=LowEntropy.length+HighEntropy.length

Is It possible for two different AuthKeys to collide?
¿After applying a KDF to the 256 bits of data, and getting 256 bits of data, will the chance of collision be reduced or increased?

Is there any reason, given the previously exposed model, to choose HKDF over scrypt?

As far as I have read scrypt requires more resources and therefore is more costly to bruteforce, a recent question suggests that

Don't ask the user for memory/cpu factors, you don't need them if the input is high entropy. You don't need a salt either.

The thing is I want HighEntropy and LowEntropy to be a headache to bruteforce, if possible, even in a long-term post-quantum cryptography futuristic enviroment.

Also, is there any reason for the either the highentropy or the lowentropy data to be used specifically as key or hash?


texts: Using multiple permutations to strengthen the security of a cipher

texts:
In one book it says

  a set of permutations with the composition operation is a group. This
  implies that using two permutations one after another cannot
  strengthen the security of a cipher, because we can always find a
  permutation that can do the same job because of the closure property.

If I try to understand the bold part, is below explanation correct?

Assume you have a set of all permutations of "abc", that is:
Your set is: "abc" ,"acb", "bca", "bac", "cab, "cba".
Let's take "abc".

Permute it once and get say: "cba" (Let's say permuting once means you encrypt it).

Now let's assume you want to strengthen above permutation by permuting it once again (encrypt it once more), e.g. now you permute "cba" and arrive at "bac".
In theory one could have arrived at "bac" from "abc" in a single permutation too (in a single encryption), thus additional permutation didn't really make much sense from this point of view. Because it says basically what you can do in two permutations you can effectively also do in a single permutation.


texts: Encrypting data at rest using AES-GCM, where should I store MAC (Message Authentication Code)

texts:
I am trying to secure user's profile in database (data at rest). This user's profile is downloaded only after successful authentication at server (based on user's entered password and user name).

The user's profile is encrypted using AES-GCM

PBKDF2 derived symmetric key (derived from entered password)
A random salt
The nonce

The operation returns me the encrypted data and a MAC (Message authentication code)

I need to decrypt the data without authenticating from server using the same entered password

New PBKDF2 derived symmetric key
Same salt as used for encryption
Same nonce as used for encryption
Same MAC as generated from encryption

My question is where (along with encrypted data? somewhere else?) and how (encrypted? hashed?) should I store the MAC in database?


texts: Is every output of a hash function possible?

texts:
Is every output of a hash function (e.g. SHA1, MD5, etc) guaranteed to be possible, or, conversely, are there any output values that cannot possibly be created from any input? In other words, are hash functions surjective?

If so, what guarantees this? If not, is it possible to discover such impossible outputs via an attack faster than brute force?


texts: Why are the first few bytes of a gpg encryption always the same?

texts:
If I run the command 'gpg -a -e < input.txt > output.txt' with completely different inputs (e.g. from /dev/urandom), the first 19 characters are always the same.  What is this header?  Is it identifying in any way?

For example:

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.11 (GNU/Linux)

hQEMA5QidX3vO49mAQf/dZzGGqfxC/7T7sOM+ome1i7Cwd1e2dOiTvRIA2LYZXpi

and

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.11 (GNU/Linux)

hQEMA5QidX3vO49mAQgAkz+xM9ojPvOBUtDRvCecr344PJbmbaMFxJrpJBICnywE


texts: Are there reference implementations of ECQV implicit certificates?

texts:
I am interested in exploring ECC implicit certificates, specifically using the ECQV protocol. While the actual implementation would not difficult to perform using building blocks provided by most ECC capable libraries, I really would like to compare my application with a reference implementation.

Does anyone know of a reference implementation of ECQV?


texts: How to use ECDH keypairs algorithm for encryption and decryption same like RSA keypairs without key agreement?

texts:
Is it possible to use ECDH key pairs (Public and private keys) for encryption and decryption like RSA key pairs in encryption and decryption.
Say for example,
if i have RSA key pairs then i could do below things,

// Encryption
this.cipher.init(Cipher.ENCRYPT_MODE, this.publicKey);
hexEncodedCipher = this.cipher.doFinal(value);

// Decryption
this.cipher.init(Cipher.DECRYPT_MODE, this.privateKey);
hexEncodedCipher = this.cipher.doFinal(value);

So Is it possible to do the same thing for ECDH ?
And is it correct way of doing things ?


texts: Are there two-way encryption algorithms that include a work factor?

texts:
I recently learned about the hashing algorithm bcrypt, which allows you to specify a "work factor" for the hash which can be incremented to stay ahead of Moore's Law. I understand there are some other hashing algorithms that also do this.

Are there any two-way encryption algorithms with this property? For example, I'd like to be able to encrypt a file such that it takes a couple of seconds with today's machines to decrypt it using the correct key, and therefore someone who is trying to guess the key will be severely rate-limited.


texts: Is it possible to decrypt a ciphertext with a different private key?

texts:
In public key cryptosystem, there are often two keys (pub and pri) and two functions (Enc and Dec) such that:

Enc(pub, m) = c
Dec(pri, c) = m

Usually pub and pri are generated as a matching key pair and used together. However, given a ciphertext c, without knowing pri, is it possible to successfully decrypt it into the original plaintext m with a different private key pri' other than pri?


texts: On Linux, does /dev/random unblocking imply that /dev/urandom is seeded?

texts:
Linux has the familiar problem that /dev/random blocks too much (insisting on being information-theoretically secure), while /dev/urandom doesn't block enough (it will return data before it's been adequately seeded). The new getrandom() system call does the Right Thing, but as of this writing it's not yet universally available in the major distros.

My question is: if I succeed at reading a single byte from /dev/random, does this imply that /dev/urandom is seeded? I've spent some time staring at http://lxr.free-electrons.com/source/drivers/char/random.c but haven't been able to figure this out. Entropy provided by device drivers gets mixed into the input pool, then the input pool feeds separate /dev/random and /dev/urandom output pools, but I can't glean the conditions which trigger transfers from the input pool to the output pools, or (consequently) whether it's possible for /dev/random to be fed while /dev/urandom starves.


texts: Cryptographic system with double keys with reversible order

texts:
While reading Shamir, Rivest and Adleman's paper on "Mental Poker", I've met a mention of system such that $E_a(E_b(x)) = E_b(E_a(x))$, without however disclosing details on it, with $E_a(x)$ being “encrypt plaintext $x$ with key $a$”.

Do any existing secure modern cryptosystems have this property, and how is it called for later reference?


texts: Signed XML SignatureValue element value (hash in base64) contains &#xd

texts:
My application is .NET based.
I have signed xml from third-party environment (Java based).
Its signature value base64 string contains carriage return #xd;.

<SignatureValue>rNNNqGYd4sEuEyOle0sCHHBv4UVrzBcntgxSuzqm7NrRHpD8qxPu1GpxBtcUKr3bJ0YME2J9SgFA&#xd;wsfp/Vd+0g==

According to
Canonical XML Version 1.1:  Line breaks normalized to #xA on input, before parsing

and
Extensible Markup Language (XML) 1.0: End-of-Line Handling
I should remove carriage returns from XML before making any actions with its nodes.

I need to calculate SignatureValue element hash in order to add\verify Signature timestamp.
I can`t find any information how to handle carriage returns in XAdES elements values.

If I decide to remove carriage return from base64 before calculating element hash, third-party application can leave it and calculate hash with carriage return in order to verify my hash and vice versa .
In these cases hashes won`t match.

I also need some levers how to stand my position in such confrontation with third party system.


texts: I've been trying to find specific examples of where Web of Trust is being used today, but there seems to be little information about this. Are there any businesses using Web of Trust today? What do they use it for?


texts: Assume $S$ is a domain. $S' \subseteq S$ and all elements in $S'$ are invertible.  $H:S'\rightarrow S$. If $H(x)$ is a one-way function, is $f(x)=H(x)\cdot x^{-1}$ a one-way function?


texts: Crypto scheme to map data to users in a way that is anonymous to database server

texts:
I am trying to finish a paper on censorship resistant data-sharing systems in semi-centralized ways. I know the below threat model can be mitigated by using decentralized system, but I am looking for a possible theoretic solution for the following, without being able to change the rules.
Consider the following threat model:

A website that allows accounts for journalists to receive leaked documents / data.

Each journalist has an ID on this website (say username, public key, public key fingerprint, whatever will do).

Whistle blowers use those IDs to send leaked data using this website.

The journalists need to be able to log into their accounts on the website and see all the information that was sent to them, like a list of "support tickets" or something like this.

The website should not be able to see that data content in clear text. - this problem is fixable by implementing database encryption with key derived from user password and kept in session, and dumped at the end.

The threat that needs to be fixed: CENSORSHIP OF ACCOUNTS.
The problem with the above system is that journalists accounts are static. They are also public, and known to everyone including the possible censors.
So, a censor with "authority" can easily force the website to "block" account XXX or otherwise make its data unavailable. Regardless the data itself is secure and safe, not read by any party, it can still be made unavailable to the journalist by censoring their accounts.
What I need is a hint in order to implement multiple cryptographic functions in a system that will allow a website to map data to an account anonymously.
Explained in laymen terms (for simplicity):

You go to a website to send some information to user / account: XXX.
Consider the information you send is already encrypted end to end from you to the receiver, so the information itself is not at risk. The only risk is for the information not to reach the receiver.
The website needs to be able to show that data to user / account XXX when they log in and needs to also have a technical impossibility to "freeze" or "censor" the account XXX in order to not receive further information if required by a censor.

I was thinking of zeroproof systems but I have no clear way to implement them. Also, if instead of account names we use whole pubkeys, senders can send encrypted data directly but a censor can force the website to "filter" pubkey X.
So, the base problem remains unsolved.
Even if one would use Time based codes based on OTP that link to certain accounts, a censor could still force the website to identify the journalist account by trying to send some dummy data themselves to that certain account using a time based token.
Ideas? Thanks in advance.


texts: Is it possible take a piece of data in secret?

texts:
I want something like this, but in a digital sense:

  You and others walk into a room. Everyone knows who each of you are and everyone is doing their best to figure out what piece of paper each person is taking. Fortunately the all the paper is in a box. You bring your own envelope, shuffle the papers blindly and put one in your envelope, then walk out.

Since no one can see the inside of your envelope you're fine. The problem is the box.

If a website generates a thousand GUIDs and has to give you one of them, but isn't allowed to know who you are, how would it be done? The website must know you are eligible for a GUID, but how does it give you something to prove you may have a GUID and not know which you take?

I know you can sign something blindly, but can you take something blindly?


texts: What does Keccak being "efficiently invertible" mean?

texts:
Reading through Wikipedia, I saw this:

  It has been shown that the Merkle–Damgård construction, as used by SHA-2, is collapsing and, by consequence, quantum collision-resistant, but for the sponge construction used by SHA-3, the authors provide proofs only for the case that the block function f is not efficiently invertible; Keccak-f[1600], however, is efficiently invertible, and so their proof does not apply.

So:

What does "efficiently invertible" mean in this case? It isn't reversible (as in decryption), so what else could that mean?
Why is Keccak invertible? Is it by design or did they not bother as it's not important?


texts: Homomorphic encryption diagram and trouble about a paper

texts:
I'm reading a paper based on Homomorphic Encryption: “Fully Homomorphic Encryption over the Integers: From Theory to Practice” (PDF).
Now, I need a diagram of this algorithm if possible with all the operation that the sender of cyber text do.
I'm reading the text and I encountered some problems:

Given several multiples $q_ip$ of $p$.

What is $q_i$?

$c = q p + 2r + m$.

When noise is raised/introduced in the system?


texts: Does MAC provide origin authentication? Why not just use symmetric encryption?

texts: Let's assume Bob and Alice has a secret key for MAC. If MAC is constructed by the key and the message, that means that both Alice and Bob can construct the exact same message and MAC. So, Bob can claim Alice created certain message, not him. What's the point to use MAC then? Why not just use symmetric encryption?


texts: RSA/DSA: Wouldn't it make sense to sign using decoding the data hash?

texts:
Why is encoding using the private key used for signing? Wouldn't it make sense to keep the premise, that private is for decoding and public is for encoding? i.e. create a hash and threat it as a result of the crypting and decrypt it. The decrypted value being the "signature". Than when someone want to validate the signature, he would encrypt the signature and he would get the hash.

Am I missing something? Why is this not used?


texts: URN for ECDSA signature algorithms (including hash algorithm)

texts:
The URN form ECDSA signature algorithm is urn:nist-gov:ecdsa.

But I am not able to find a named URN for algorithm SHA1withECDSA or SHA256withECDSA.

Up to now I've found the xmldsig URL for this algorithms: http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1 and http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256

And I have the option to generate the URN with its OID, according to RFC3061: urn:oid:1.2.840.10045.4.1 and urn:oid:1.2.840.10045.4.3.2

I could even create my own version of its URN as something like urn:nist-gov:ecdsa-sha1 and urn:nist-gov:ecdsa-sha256

But, is it a named standard URN for signature algorithms SHA1withECDSA and SHA256withECDSA?


texts: Multi Authority Attribute Based Encryption Library

texts:
Anyone aware of a library that has MA-ABE implemented in any language preferably python?

P/S - I hope this is the right place to ask this. Apologies if not, then a redirect will be appreciated


texts: Is there an instance where integrity protecting metadata is bad?

texts: In JWEs there's a unprotected data field as well as recipients are not integrity protected. Is there a case where integrity protecting this data would be a problem? If it doesn't make a difference, why isn't the entire JWE message integrity protected?


texts: Key space size when either of two public keys are valid for authentication?

texts: If for authentication a user can own either A OR B public key instead of just one specific key is that equivalent to halving the key space. i.e. it it theoretically twice as easy to brute force and only equivalent to a 128 bit key?


texts: Verilog simulation & synthesis of Diffie-Hellman key exchange

texts:
Is there any freely available verilog implementaion of Diffie-Hellman key exchange?

I couldn't find anything using google. So, assuming its not there I started implementing on my own.
The code is hosted at https://github.com/nulpoet/verilog_diffiehellman.
Behavioral simulation in xilinx works.
However it cannot synthesize the remainder(%) operator.

So, I does anybody know how to design a module for remainder operation in verilog that computes the remainder in a single clock cycle?
Any links to literature discussing the algorithm would suffice.

Solution to any of the above two question would solve my problem.
Thanks in advance!


texts: Which mathematical operations does secp256k1 point multiplication use?

texts:
To convert a bitcoin private key to a public key, the secp256k1 point multiplication math is used.

Could I – theoretically – convert a private key to a public key just using the four arithmetic operations and scalars. If not, what else would be absolutely necessary?

I want to do it using a purely mechanical engine, so the answer to this question will help me clarify my problem.


texts: Stream vs Block cipher: Synchronising and the receiver

texts:
I am learning cryptography at school and I was wondering:

How are the blocks/streams after decryption synchronized at the receiver to form one long meaningful message?
Am I right by saying that stream cipher will incur a LOT more overhead while synchronizing?


texts: Hardness assumption: Extracting $g^y$ from $g^x, g^{x+y}$?

texts: I am new in cryptography and I wonder whether there is any hardness assumption in cryptography where computation of $g^y$ is hard given $g^x, g^{x+y}$ ($g$ is group generator, $x$ is selected randomly while no restriction is on $y$).


texts:
Currently I am working on a implementation of PBKDF2 for an embedded microcontroller.
My question is that my psuedo-random function is fixed (SHA-512 HMAC) how do perform 'rounds' of encryption?
I am using a vendor provided SHA-512 HMAC implementation has been verified to output correct results for single iteration vectors. The parameters the SHA-512HMAC function are (message, message length, key, key length) to do rounds do it just feed the output digest of the function into the key input to my function?
Thanks


texts: Why don't we use bcrypt and scrypt together?

texts:
Everyone is comparing bcrypt to scrypt. Bcrypt is proven, lots of cryptoanalysis and no vulnerabilities so far, but uses very low memory. While scrypt uses a lot of memory, but it's too early in its life. Is there anything problematic by using them in cascade/together? Like scrypt the password then bcrypt the result. Eg.: bcrypt(scrypt(pwd))

Is this a problematic approach somehow or everyone just tries to solve one problem with one and only one KDF?