texts: Is Encryption without knowing the input directly possible at all?

texts:
I know the question is rather unusual, but let me clarify what I'm searching for:

There is one person, lets call her $Alice$. $Alice$ has $n$ plaintexts $t_1..t_n$ and $n$ public keys $pk_1..pk_n$ of other persons.

Now $Alice$ has to encrypt one $t_i$ with a $pk_j$ for arbitrary $i,j$. Each key and plaintext should only be used exactly once.
After everything has been encryptied $Alice$ should not have any means to determine which $t_i$ was used to generate one of the outputs.
There are $n$ other players to which the keys $pk_1..pk_n$ belong. The other players all can see the encrypted results of $Alice$s encryption operation and nothing else. Obviously every one of them can only decrypt the plaintext encrypted with his or her private key.

Alice should be able to prove to every other player, that she does not know which plaintext got encrypted with which key.

Is that possible at all? I possibly left something out one needs to know to hint me to a proper solution, in that case please leave a comment and i try to provide the Information.

(Sorry for my mediocre english)


texts: Encrypt files on harddrive with double encryption

texts:
So I've been stuck on this question for a very long time.

How do you use double encryption to encrypt a hard disk so that all of the following conditions are met:

All data on the hard disk is encrypted.
There are multiple users and each user has his own key to make the harddisk readable/writable. Think for example of a normal user and the administrator. (everyone can access any file though, no permissions needed)
If a user forgets his key, a new key can be generated for him, with which he simply has access to the stored data.


texts: why can't use only one way function to construct a PRG, and don't use the hard core predicate?

texts:
The one-way function can expose some of the input and stay one-way, but still, that doesn't give the input.

As I read, we can't just construct a PRG from a OWF, but we need to use the hard core predicate of the OWF. Why is that?
Assuming $|f(s)| > |s|$, why is constructing a PRG in the following way wrong? $G(s) = f(s)$
Suppose $f$ is a permutation function. If $f$ gets a random $x$, then is $f(x)$ also random?


texts: Case Scenarios where Identity Based identification (IBI) Scheme can be employed

texts:
I was reading about identity based Identification scheme today. There are lot of articles and research paper on it. There is active research being done in this are of IBI schemes.
My question is simple. Are there any real life situation(case scenarios) where Identity based identification scheme can be used as a cryptographic primitive?
Thanks for reading. I would be grateful for any response.


texts: Recovery Passphrase Collission for BIP-39 and BIP-44

texts:
Referring to the standards of [BIP-39] and [BIP-44]: a 'master password' consisting of 12 words uniformly selected from a 2048-word dictionary corresponds to 128 bits of entropy, that is then used as a seed for the generation of keypairs in many wallet implementations.
While not contesting the sufficiency of the offered security, what stops an attacker from iterating over such seeds just to check balances on other's wallets? What would the threat scenario/attacker model be called?
Obligatory disclaimer: This question does not suggest, encourage or condone any illegal ulterior motive.


texts: Find out a set of values without sharing my own

texts:
I have the following problem which i am trying to find a reasonable protocol to solve it.

This is a simplified version of the problem.

Alice has a set of values $\{a_1,a_2,...,a_n\}$.

Bob has a set of values $\{b_1,b_2,...,b_n\}$.

Alice wants to learn which values Bob has that are equal to her values but without Bob learning any of the inputs she gives him, Alice is also not allowed to learn any other values bob has.

I appreciate an efficient solution but any solution at the moment is better than nothing.


texts:
I'm trying to implement the Blowfish cipher in Output Feedback mode.

OFB mode has two operations, XOR and the block cipher.  XOR inputs two blocks of the same length and outputs one block of the same length.  Blowfish inputs two blocks of the same length and outputs two blocks of the same length.

How can XOR and Blowfish be used together if they have different outputs?

Does the Blowfish cipher work with OFB mode?


texts: Should I use 2x the number of CPU / core for Argon2id parallelism?

texts:
I've read that I should use 2x the number of CPU available from some documentation while others suggest using between 1 and the number of CPU.
I realize there is no hard answer here but I'm curious what the advised best practices are. Especially with such a variation in advice.


texts: Is there a method/protocol to validate a self-signed certificate by comparing a shortened hash?

texts:
I'm working on a solution where an iPad should connect to a server software running on a laptop using TLS with a self-signed certificate that was automatically generated on the laptop during the installation of the software there. I need to make sure there is no man-in-the-middle attack, so the obvious solution would be to take a hash of the cert with a function that is second preimage resistant and show the hash on the laptop and iPad.

The problem is that carefully comparing all the digits of a SHA-256 hash, for example, takes a while so I'd rather have a method that is (almost) as secure and works by comparing only 10 digits or so.

In principle that must be possible because the numeric comparison protocol of Bluetooth works like that. Details see on page 13 of this document: http://u.cs.biu.ac.il/~lindell/PAPERS/BT-numeric.pdf

Is there an easy method or protocol to shorten the string of digits that has to be compared but without too much overhead? Re-implementing the way this is solved for Bluetooth seems like a lot of work.


texts:
I wrote application client-server. Now I would like to add safe connection.

First

When client connect to server - server send certificate in *.crt file.

Now I want to extract from this file the public key and validate certificate - check it is safe.

I use Lazarus/Delphi/Free Pascal

Can you tell me how can I extract from this file public key ready for use in hexadecimal (byte) format?

I know that in this file is $p$, $q$ and rest but I want final public key ready to use.

Maybe if not in my programming language then I can do this on my computer? Linxu, Windows?

How can I do this with private key? I have key in file with header:

-----BEGIN RSA PRIVATE KEY-----


texts: Show that the CBC-MAC construction applied to a PRP is not collision resistant

texts:
I'm trying answer the following question. Yes, it is a homework question, so I'm not asking for the answer directly but would like to get some pointers on how to solve it.

So far I have spent several hours thinking about this to no avail. I know I'm missing something incredibly simple. I have tried various permutations of fixing messages m1 or m2 or m3 to be constant while others change and seeing how that affects the value of c3 when it is returned, as well as various permutations of fixing the messages to be 0^blen in order to try to find a collision. Hoping to get some pointers in the right direction.


texts: Algorithm for proving Carmichael numbers

texts:
I have an application for determining if a number is a prime or not, currently I'm getting a random number, then doing the Fermat primality testing to find out if the number is probably prime (so this can still be a Carmichael number), I then test with a Miller-Rabin algorithm to determine if the number is probably prime (with probability of 2^-81 that this can still be a composite).

My questions are:

Is there an algorithm to find out if a number is a Carmichael number (deterministic or not)
Does proving Fermat primality test and the number is not a Carmichael one is enough to prove that the number is a real prime


texts:
What is the recommended way to derive a key for an HMAC-SHA256, from a passphrase and salt?

I'd like to compute an HMAC-SHA256.  I have a passphrase, and a message.

I note that RFC-7518 (JWA) states that for HMAC,

  A key of the same size as the hash output (for instance, 256 bits for
  "HS256") or larger MUST be used with this algorithm. (This
  requirement is based on Section 5.3.4 (Security Effect of the HMAC
  Key) of NIST SP 800-117, which states that the
  effective security strength is the minimum of the security strength
  of the key and two times the size of the internal hash value.)

From this I conclude that it is not recommended to use the bytes directly from the passphrase for the key.  The passphrase may not have the appropriate entropy, if it is not 32 ascii characters in length. Even then, still ascii.

Question 1. correct?

ok, next up is to derive a key.  I note that PBKDF2 can rely on HMAC-SHA256 to produce keys.

Question 2.  But .... now I am in a turtles situation, am I not?  I am using a HMAC-SHA256 with a low-entropy key, to derive a supposedly higher-entropy key for an HMAC-SHA256.

I had a heck of a time searching this forum, because every question uses the term hmac, password, pbkdf2, and sha-256.  Basically I want to know if it is sensible to use PBKDF2 with HMAC-SHA256... to derive a key to be used in an HMAC-SHA256.


texts: I am attempting to decrypt a 90 GB file that is encrypted using AES-256. I have the password. How long should this take to complete? I've had the process running for over 3 days with no progress.


texts: Where do hash functions get their preimage resistance?

texts:
I read through this answer and it seemed to make sense to me, but when I try to make a simpler answer to explain it to myself I lose something in the process.
Here is the much simpler hash function I wrote after reading the description of how MD5 works.

Take in a single digit integer input as M
Define A[0] to be some public constant
for int i=1; i<=4; i++:
A[i] = (A[i-1] + M) mod 10
return A[4]

This hash function uses the message word in multiple rounds, which is what the answer says leads to preimage resistance.  But with some algebra using mod addition we can reduce this "hash function" to just A[i] = (A[0] + i*M) mod 10.
A[1] = (A[0] + M) mod 10
A[2] = (A[1] + M) mod 10    //Substitute A[1] in
     = ((A[0] + M) mod 10 + M) mod 10   // Distribute outer mod 10 in
     = ((A[0] + M) mod 10 mod 10 + M mod 10) mod 10 // simplify mod 10 mod 10 to mod 10
     = ((A[0] + M) mod 10 + M mod 10) mod 10    // Distribute inner mod 10
     = ((A[0] mod 10 + M mod 10) mod 10 + M mod 10) mod 10  //factor mod 10 out
     = ((A[0] mod 10 + M mod 10) + M) mod 10    // remove redudent paraens
     = (A[0] mod 10 + M mod 10 + M) mod 10  // factor mod 10 in
     = (A[0] mod 10 mod 10 + M mod 10 mod 10 + M mod 10) mod 10 // simplify mod 10 mod 10 to mod 10
     = (A[0] mod 10 + M mod 10 + M mod 10) mod 10   // factor mods 10 out
     = (A[0] + M + M) mod 10
     = (A[0] + 2M) mod 1
// Repeat with A[3] to find A[3] = (A[0] + 3M) mod 10 and so on

Because A[i] = (A[0] + i*M) mod 10 is not preimage resistant, I'm confused as to what action in a hash function gives it its preimage resistance. To phrase my question another way, if I wanted to write a super simple hash function, what would I need to include to be preimage resistant?


texts:
I am trying to understand $AES$ and I wondered what happens in the case of a $128$ bit block size and a $256$ bit key.
All documents I read about $AES$ told me the key expansions algorithm for $128$ bit keys and $128$ bit blocks.
But I have a $256$ bit key ($8$ words) and $128$ bit block ($4$ words) and I am not sure how the key expansion works now.
Should I expand it how usual but instead beginning in the second round beginning in the third round?
Like this graphic shows:


texts: Which crytographic libraries to use for Elliptic Curve Cryptography and Bilinear Pairing?

texts:
I'm currently trying to implement a solution for Vehicular ad hoc networks based on cryptography. I choose to use python to implement the solution, but I don't know which libraries I have to use to implement the cryptographic functions (methods and modules). I searched about it but I didn't find good ones most of the libraries I've found where about implementing Cipher algorithms and hash functions. I need libraries for Elliptic curve cryptography and Bilinear pairing. Please, suggest me good libraries that have good methods.
PS: I'm using Python3.8 and Ubuntu os and these are the solutions that I'm working on https://www.cs.nmsu.edu/~misra/papers/T-ITS-2011.pdf and https://www.mdpi.com/2073-8994/12/10/1687/htm


texts:
Is there a crytpographic way to assert ownership of an asset (let's say a piece of stone)?

As an example, a number (public key) could be engraved in the stone, and the owner could keep a private key (never shared).

Anyone who wants to claim for ownership would have to decrypt a message, and only the one who has the private key can do it.

But one more thing: the ownership should be transferable. Here is the problem with the previous system: if the owner A sells the object to owner B, owner A could secretely keep the private key when he gives it to owner B.

What are the general cryptographic solutions for this? (except blockchain which is a famous solution nowadays, that I already know)


texts: AES function with 128 bit key and 128 bit input size - does it have perfect secrecy?

texts:
If I look at the version of AES that gets key of size 128 bit and encrypts messages of size 128 bits.

If I get some random key for the function, can I say it has a perfect secrecy and why?

After a lot of thinking it got me to the next question: if I apply AES 2 times, both times on the same input but with 2 different keys, can I get the same output or must the result be different?


texts: Is it possible to build a compact proof of the sum of all even numbers of a dataset?

texts:
Suppose I have a set of numbers:

[1, 7, 6, 4, 8, 9, 4, 6, 3, 3, 1, 5, 4]

Suppose also that a verifier knows the merkle root of that set, R, but he doesn't know the set itself. Is it possible to convince him that the sum of all even numbers - i.e., 6 + 4 + 8 + 4 + 6 + 4 is 32 with a string of a small, constant size (i.e., not depending on the length of the array)?

I thought that was possible with zk-snarks, but now I'm under the impression even a zk-snark proof would be of linear size w.r.t the number of elements.


texts: Is there a difference between password and key?

texts:
I encrypt data with this command:

openssl aes-256-cbc -a -salt -in C:\Users\User\secrets.txt -out C:\Users\User\secrets.txt.encs

The program then asks that I...

enter aes-256-cbc encryption password:

Is the encryption password the same as the key? Where is the password or key stored?


texts: ECDSA signature with Brainpool curves in TLS possible?

texts:
Even the up to date RFC 8446 lists at the page 41 as the options for the ECDSA in e.g. TLS_ECDHE_ECDSA_WITH_... only NIST curves:
      /* ECDSA algorithms */
      ecdsa_secp256r1_sha256(0x0403),
      ecdsa_secp384r1_sha384(0x0503),
      ecdsa_secp521r1_sha512(0x0603),

Does it mean that the certificates containing the public key based on Brainpool curves cannot be used for
signing the (EC)DHE parameters in SERVER KEY EXCHANGE?


texts: Is discrete log as hard when given same challenge in both pairing groups, in the case of BN curve and its sextic twist

texts:
This is a special case of the question
Generalization of the DL-assumption in bilinear group pair,
that wasn't answered.

Suppose $G_1$ is a BN curve over $F_q$. That is the set of elements
$(x,y)\in F_q^2$ such that
$$y^2 =x^3+b$$
for appropriately chosen $b$.
and $G_2$ is a sextic twist of $G_1$.
That is, the set of elements $(x,y)\in F_{q^2}^2$ such that
$y^2=x^3+b/\xi,$
where $\xi\in F_{q^2}$ is such that $W^6-\xi$ is irreducible over $F_{q^2}$.

Given $(P,s\cdot P)\in G_1^2$
and $(Q,s\cdot Q)\in G_2^2$
is it hard to find $s$?
Is it as hard as when given only one of the two pairs?


texts: Is this PRG secure? Different on halves of input

texts:
So yes, this is a homework question, but no I have not just copy pasted the question without giving it any thought.

The question goes:

  $H$ on input $x$ outputs $G(x)$ except for $x$ when $x_\text{Left} = x_\text{Right}$, then $H$ outputs $0^{2n}$ for $n = |x|$. Is $H$ a secure PRG for all secure PRG $G$? On even length binary inputs.

So I am going with no it is not secure, BUT in a size $n$ input, $1/(2^{n/2})$ of the input, the outcome will be $0^{2n}$ for $n = |x|$. So, as $n$ grows, the amount of input that is distinguishable (where the input is symmetric).

$1/(2^{n/2})$ is a negligible function, so does this fall under negligible, so H is secure?


texts: Can a nested block cipher avoid the meet in the middle attack by using a secret initialization vector for the inner encryption?

texts:
It seems to be believed that encrypting twice with a block cipher using an independent key each time is not as secure as you might expect because of the "meet in the middle" attack.

This is an attack with known plaintext.  The theory is that the attacker encrypts the plaintext with every possible key, and decrypts the known cipher text with every possible key and then looks for a match between decrypted cipher text and encrypted plaintext.  So brute force attacks takes only twice as long as for single encryption instead of $2^{\text{number of key bits}}$ times as long as you might expect.

However, as far as I can see, if the first encryption using $k_1$ used CBC with a truly random and secret IV, then no meet in the middle is possible because the attacker would have to encrypt for every key for every IV to find a match which for example in DES is harder than encrypting for every possible pair of keys.  In my hypothetical system, the IV can be simply double encrypted and prepended to the start of the ciphertext for the benefit of the intended recipient. It must not be used for anything else and if the second encryption wants to use CBC then it should use a separate random IV.

This seems so obvious that it must have been thought before, so what understanding am I missing?


texts:
People always say that "there is no such thing as unbreakable crypto!"

In most cases they are right. AES, RC4, RSA, C25519, DH, .... are all cryptographic algorithms which are crackable (with extreme effort).

The asymmetric stuff, you can factorize; the ciphers you would have to brute force.

But from what I understood, symmetric quantum crypto is kind of uncrackable. It uses quantum mechanics (who would have thought?) to directly send the symmetric key to the other machine. But the sequence changes every read cycle, so if the attacker would sniff the traffic he would have a key other than that which the recipient received, and the recipient would know that the key was tampered with.

So, is quantum cryptography even breakable without physical access to the machine? And if yes, how?


texts: RSA problem if i choose two specific small prime numbers?

texts:
I know that rsa normally is made to make it with big integers, but i trying to make the algorithm myself (with the help of wikipedia) and I´m making it with small numbers to track the problems easily.

The problem is that sometimes the decryption of the crypted message is wrong!
Exactly when I choose p=11 and q=5, the rest goes like this:

n=55
euler(n)=40 = (p-1)(q-1)
e=13
d=37

the crypted message (using message=65) is:

c=10

and using the chinese reminder theorem (wikipedia´s advise):

Dp=7
Dq=1
Qinv=9
m1=10
m2=0
h=2

and the decrypted message is:

message=10 !!!!!

It´s a problem of the choosen prime numbers? I think that the rest I made it fine, I also check it with rsa calculator:
https://www.cs.drexel.edu/~jpopyack/IntroCS/HW/RSAWorksheet.html

I know also that to choose d and e there are more options, but the choosen ones they would be fine too. Maybe there is some other condition that is not in the wikipedia?


texts: Cryptographic operations for NISTP256 can be implemented using montgomery method?

texts:
I need to implement cryptographic operations starting with the curve NISTP256. I have been told to implement it using Montgomery method. I read a pfd from http://saluc.engr.uconn.edu/refs/sidechannel/okeya00elliptic.pdf. It states that the order of the curve must be divisible by 4. But the curve's order is not a multiple of 4.

So does that mean the curve cannot be implemented using Montgomery method or is there any other ways to implement it?


texts: Windows 8/Server 2012: Passes FIPS-140-2 despite failing AES-GCM for IV != 96 bits long?

texts:
Background

Microsoft certifies Windows 7/8 as well as Server 2008 R2 and 2012 to be FIPS-140-2 compliant. Actually they certify just a small crypto core, bcrypt.dll (the library, which is unrelated to bcrypt, the key derivation function). Microsoft's FIPS-140-2 architecture is detailed here. Also, their FIPS-140-2 AES certificate on NIST's listing is certificate #2216, in detail here. You can see in the listing that AES in GCM mode was tested with comments IV Lengths Tested: ( 8 , 1024 ) , 96BitIV_Supported , GMAC_Supported. I do see other vendors also having an additional flag/comment OtherIVLen_Supported in their FIPS AES certificate that MSFT's own FIPS certificate lacks.

Issue

We tested bcrypt.dll for AES in GCM mode with the test vectors found in the AES GCM paper (hosted on NIST). We found that Windows' bcrypt.dll throws an error (NT_STATUS = An invalid parameter was passed to a service or function.) when using IVs that are NOT 96 bits. So basically the test vectors 5, 11, 17 and 6, 12, 18 fail as those two groups use IVs of size 64 bits and 480 bits respectively. The results are

Question

I know that IV size != 96bits means additional processing but how can they clear certification despite failing IV sizes of 64 and 480 bits? Or is IV at 96 bits the only required IV length needed for passing?


texts: How do you work out the private key in a RSA cryptosystem knowing a certain public key?

texts:
The public key:

n = 85 and e = 19

I know that n is the product of two prime numbers, now is it right of me to figure them out by process of elimination which I got p or q equals 17 and 5. Or is there a proper method of working this out?


texts: Password entropy much lower than entropy of encryption keys. Why is this acceptable?

texts:
When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner.

When talking passwords however, the standard these days is about 8 characters selected from about 94 characters on the keyboard. This translates to about $94^8$ possible passwords, which means about 52 bits of entropy.

Now, 52 bits is obviously less than 56 bits. But somehow a 56 bit key is considered weak while a 52 bit password is considered safe (i.e., many systems force you to use the 8 characters). Why is this so; I mean why are the standards lower when we talk passwords yet both passwords and keys are subject to the same kinds of brute-force attacks?

I know that humans would find it impossible to maintain a 128 bit password -- however, I wonder if there is some technical reason why a 52 bit password would not be as weak as a 52-bit encryption key for that matter.


texts: How to calculate Trace function for a point on an elliptic curve

texts:
I encountered trouble with calculating Tr (trace function) for points on an elliptic curve in polynomial basis ( $GF(2^m), m = 431$). Maybe there are any assumptions that can simplify and allow efficiently to calculate Tr operation?
I used the Seroussi approach to decompress points but it seems like I need some basic knowledge.


texts: Could multicollisions be used to mine large amounts of cryptocurrency?

texts:
I'm reading about hash functions at the moment, and in the book I'm reading there's a section on multicollisions. Specifically, using a 2-collision to find $2^N$ collisions in $N2^N$ time.

If, theoretically, a collision was found which was valid for cryptocurrency mining (however many 0s on the end), couldn't one find a large number of blocks which also collide with that, allowing them to be much more efficient than other miners?

Is my understanding of multicollisions correct? If so, is the difficulty of finding a 2-collision the only thing preventing this from being done?


texts:
How would one classify a stream cipher that is neither synchronous, nor self synchronizing?  I would have thought asynchronous, but from all the sources I can find, asynchronous is synonymous with self synchronizing.

The internal state of the cipher is initialized by a key and initialization vector.  The internal state is modified depending on the current internal state, and the previous byte of plain text.  The cipher does not synchronize after a fixed number of bytes.  Error propagation is unlimited, so corruption of one byte of cipher text makes the rest of the message undecipherable.

I would like to know the correct classification of the cipher.

Thanks to @otis and @kodlu, who suggested the terms synchronous and additive.  Searching those terms has led me to this article, describing nearly exactly what I am after.  On page 244, I paraphrase, where W [...] is the running key sequence and where we allow W, to depend both on the secret key (as is customary) and on [all prior bytes of] the plaintext.  This article is heavy on the maths and terms, so many of which I need to look up to understand their meaning.  I am still working through the terms used in the article, which is why I have not proposed an answer to my own question.  I am posting this source, because it might be helpful to someone with a stronger background to answer the question.


texts: Known attacks against ECC in case many multiples are known?

texts:
Suppose there's a secret value x, an elliptic curve with the (public) generator G, and a sequence of secret values a1, a2, ..., an. The attacker knows the results of the following expressions:
a1*x*G, a2*x*G, ..., an*x*G.
Is there any known weakness that'd allow the attacker to restore x based on this information? Maybe if n is becoming large enough (say, thousands/millions)? (To clarify: The attacker can not control the choice of a1...an.)


texts: Not understanding deterministic authenticated encryption (DAE) security definition

texts:
I have a question regarding the security definition of deterministic authenticated encryption (DAE) as defined by Bellare and Shrimpton. Their definition is reproduced below, and my question pertains to the emphasized part.

Definition 1 Let $\Pi = (\mathcal K, \mathcal E, \mathcal D)$ be a DAE scheme with header space $\mathcal H$, message space $\mathcal X$, and expansion function $e$. The DAE-advantage of adversary $A$ breaking $\Pi$ is defined as
$$\mathbf{Adv}_{\Pi}^{\mathrm{dae}}(A) = \Pr[K \gets \mathcal{K} : A^{\mathcal{E}_K(\cdot, \cdot), \mathcal{D}_K(\cdot, \cdot)} \Rightarrow 1] - \Pr[A^{\\\$(\cdot, \cdot), \bot(\cdot, \cdot)} \Rightarrow 1] $$
On query $H \in \mathcal H,X \in \mathcal X$, the adversary’s random-bits oracle $\\\$(\cdot,\cdot)$ returns a random string of length $|X|+e(H, X)$. As always, oracle queries outside the specified domain return $\bot$. The $⊥(\cdot,\cdot)$ oracle returns $\bot$  on every input.  We assume that the adversary does not ask $(H, Y)$ of its right (ie, second) oracle if some previous left (ie, first) oracle query $(H, X)$ returned $Y$; does not ask $(H, X)$ of its left oracle if some previous right-oracle query $(H, Y)$ returned $X$; does not ask left queries outside of $\mathcal H \times \mathcal X$; and does not repeat a query.  The last two assumptions are without loss of generality, as an adversary that violated any of these constraints could be replaced by a more efficient and equally effective adversary (in the $\mathbf{Adv}_{\Pi}^{\mathrm{dae}}$-sense) that did not.  The first two assumptions are to prevent trivial wins

Basically, I don't see how the last assumption (i.e., no repeated query) is without loss of generalization? More specifically, isn't this assumption needed for any deterministic scheme to be considered secure according to this definition?
Here is how you could break any deterministic scheme according to Def. 1, if queries could be repeated. First, repeat the same query $(H,X)$ to the left oracle (either $\mathcal{E}_K(\cdot, \cdot)$ or $\\\$(\cdot, \cdot)$) and get back $Y_1$ and $Y_2$. If $Y_1 = Y_2$ return 1. It's trivial to see that this attack has DAE-advantage $1-2^{-|X|-e(H,X)}$.
As justification for their WLOG claim, I imagine they had the following reduction in mind. Let $A$ be a DAE-adversary that repeats queries, and let $B$ the following DAE-adversary that doesn't. It runs $A$ and forwards all of $A$'s queries to its own oracles, except whenever $A$ repeats a query, where $B$ instead returns the same response back for that query (which $B$ cached). $B$ outputs the same as $A$. However, this reduction doesn't work! (In particular, it doesn't properly simulate the DAE game).


texts: What should the hamming weights be between every iteration of AES?

texts:
I have an assignment where I have to print out the hamming weights between every iteration of AES's diffusion steps and I have been getting a maximum weight on every iteration, but I can't seem to verify if that is correct or not.

It seems like the assignment was given to show that the weights increase as diffusion goes on, so I am a little suspicious of the constant weights of 1?

Should they be 1 on every iteration?


texts: Career switch from a Statistician to Cryptography Research

texts:
I am currently working as a statistician, and I hope to do a career switch to cryptography as I have become interested in cryptography research. I currently have a bachelor's degree in mathematics as well as working experience as a statistician.

What is the best way to do a mid-career switch for a statistician? Also, because I have knowledge and experience in statistics, I want to leverage my statistics background as best as possible for pursuing research in cryptography. Which research areas in cryptography would allow me to do so?


texts:
I came across the following question and it is confusing me.

I'm completely new to cryptography, so please excuse the beginners question.

  "Having just completed a course in Cryptography, Tom and Jerry start a
  new  business to manufacture and market cryptography products. Tom
  designs an encryption algorithm $E_k(m)$ which produces a ciphertext upon
  encrypting message m with a key k and keeps the algorithm a secret,
  but the length of $E_k(m)$ is made public. Then Jerry enthusiastically
  advises Tom to increase the security by  constructing $(E_k(m)\oplus m) \Vert (E_k(m)\oplus 1111…11)$ as the final ciphertext.

  Here $ \vert\vert $ is the concatenation symbol and $\oplus$ is the XOR operator.

  Is this a good scheme?"

Initially at first glance I can see that the new algorithm is more secure, but I couldn't actually get any ciphertext from the equation. Does that make it secure? or does it make it useless because there isn't any ciphertext to decrypt? OR is there ciphertext and I have just tackled it the wrong way?

I am probably going to kick myself, I'm probably missing the entire point.

I really appreciate any help!


texts:
Can anyone in 6th grade English explain the steps in the Substitution-permutation network algorithm or just point a link that does so? (which is included in many of the top modern algorithms)

Wikiepedia's link is not really that helpful and I can not locate anything simple on the internet for beginners.


texts:
If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy.

But the MT is also predictable. You can retrieve its past bits and predict its future bits.

What's the relationship between entropy and predictability?


texts: What is the definition of dummy password?

texts:
Recently, I try to read some papers about Password Authenticated Key Exchange (PAKE).  I can’t understand the meaning of “dummy password .” Can someone gives a concrete definition of it. And what is the difference between password and dummy password?

The context for this question is the following sentence:

  then, we modify the protocol so that $\pi$ in $y$ is a dummy password


texts: Is PKCS#5 deterministic if both sides use an agreed salt and iteration count

texts:
In a system were both sides have access to a common secret, and
publicly exchange an iteration count and salt, can a PKCS#5 (Password-based Encryption Standard) algorithm
be used to generate a key suitable for use as a session
key to support AES encryption of a small stream
(<1Mb) of data?

My question is: can both sides run the algorithm--given the "common secret", publicly available salt, and iteration count--and then generate the same key?

The intention is that a new session key would be generated
via this process for each new connection.


texts: In q-SDH problem, where are those points $\frac{1}{\beta+x}g_1$ or $g_1^\frac{1}{x+c}$ on elliptic curve?

texts:
For the q-SDH problem, given the generator $g_1$ as a point on the elliptic curve, I can picture the $\beta g_1, \beta^2g_1, ..., \beta^qg_1$ since we can simply do the point adding $g_1$ multiple of $\beta$ times.
However, I cannot picture the point $\frac{1}{\beta+x}g_1$ (for some $x \in Z_p $). Is $\frac{1}{\beta+x}g_1$ a point on elliptic curve?
Moreover, in this q-SDH paper, there is a notation $g_1^{1/(x+c)}$. Is this $1/(x+c)$ equal a fraction $\frac{1}{x+c}$?
I cannot picture this $g_1^\frac{1}{x+c}$ either.


texts:
I think I know how rainbow table works , I just wanted to make basic reduction function(for md5) in python with an approach that I am not taking a certain portion of hash but am taking the full hash and introducing below reduction function with an error handling method below is code.

Q1. is it necessary to take first or last or a portion of hash, what i mean is say a03d4d52516c03932b6815fe6c6f4151 (hexdigest) for this hash can i take every 8 bit and try to convert it to ASCII if that fails / goes out of ASCII range(90) then do nothing and try for next 8 bit. Please be informed i generated hash using utf-8 encoding.

Q2. Even i am able to generate plain text but result contains null bytes and if i use strip() to get rid of null bytes to generate the next hash on plain text result then hash changes. does md5 calculate on null bytes too ?

Result: v;92T/Mm - first plain text with no split()  -
                      hash=87aef402508bc715a1cf37b7ffe3c7ea

    v;92T/Mm - first plain text with split() to get rid of null bytes
                  hash=fc9d09e27c4ee842f7e262eb6a190da1

Code I tried(please run it to validate:

PYTHON 3.1

"""Trying a basic reduction function R1 , md5 Rainbow table new apporoach.
here am not taking ony last x bits of hexdihest hash always, it is randomized through error checking
Conventional reference: How to create reduction functions in rainbow tables?"""

import hashlib, functools, time, codecs

1. Constant hash function to be applied on the domain of P of f(H); where p belongs to P which is a finite set of alphanumeric character

def H(p):
    return hashlib.md5(p.encode('utf-8')).hexdigest()

2. constant split function to operate on 8 bit ascii char set

l=lambda x:x+2

Note I could do a utf-16 and 16 bits operation to generate other european charcter; but I only want to reduce hexdigest of hash to ascii readable char.

Note If i use  utf-16 then it will give me again 128 bits printable charactr in return as i dont need to put any error checking to get the result !

p=input("Gimme your password !\n")

h=H(p)

def R1(h):
    L=[]
    x=0
    for i in range(0,16):
        bit_op_8=h[x:l(x)]
        x+=2
        try:
            L.append(codecs.decode(codecs.decode(bit_op_8,'hex'),'ascii'))

        except UnicodeDecodeError:
            pass

    c=""
    for j in range(0,len(L)):
        c+=L[j]
    return c

result=R1(h)

print("after Reduction: ",result)

3.second hashing: f(H1)=f(H) but H1 takes R1(f(H))

#Here without using a strip() and not caring about null bytes
reduced=result
print(H(reduced))

#Here including nullbytes in result
reduced=result
reduced1=str(reduced).strip()
print(H(reduced1))


texts: Securely rekey/re-encrypt AES-encrypted file

texts:
Suppose I have a big file encrypted using AES (any mode you want) with key kA.
I'd like to give an untrusted proxy a kA->kB "conversion key" so that it re-encodes the file from kA to kB without learning the contents of the file or any of the keys.

Is this possible?

If not, are there any widely-supported encryption algorithms that allow that?


texts: Is there a way to inercept encrypted https connections by mimicking a cert authority?

texts:
In this video, it is shown how encryption can be theoretically intercepted without the client noticing it.

In short something in between the connection could make a handshake with the requested server and mimic a cert authority and create a secure connection with the client.

Could this work in the real world breaking integrity?


texts: Zero knowledge proof for verifying a machine learning model

texts:
Imagine Alice has trained a machine learning model. Bob wants to verify that whether Alice actually trained the model or not, but Alice does not want to reveal her model (because the model is personal and she wants to keep it private). So Alice wants to prove to Bob that she has the model, while not revealing any information to Bob.
Is there any zero knowledge proof to be able to do this scenario?


texts: Why do the elliptic curves recommended by NIST use 521 bits rather than 512?

texts:
Wikipedia says in reference to the elliptic curves officially recommended by NIST in FIPS 186-3:

  Five prime fields for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the prime fields, one elliptic curve is recommended.

The first four bit sizes are immediately familiar from other cryptographic algorithms, but 521 seems to be the odd man out. Wikipedia even includes a footnote assuring readers that it is not a typo:

  The sequence may seem suggestive of a typographic error. Nevertheless, the last value is 521 and not 512 bits.

Is there a cryptographically-sound reason for 521 bits instead of a more conventional power-of-two? If so, what is it — or if not, why and how was 521 chosen?


texts:
I'm taking a cryptography class and I come across these terms dense and sparse key space allt he time. What do they mean?

As far as I can I understand, dense key space means that there are more combinations of the keys in that particular space and sparse the opposite. If yes, assuming I use elliptic key cryptography i.e.

  y^2 = x^3 + ax^2 + bx + c,

How is it that elliptic key cryptography is more dense(less sparse) than the RSA cryptography?

Please tell me if I need to be clearer.


texts:
Is it better to have statistical zero-knowledge or computational zero-
knowledge in a system?

If it depends, is there a slightly accurate generalisation that can be made?

Maybe one can be somewhat reduced to the other (doubt it)?

Maybe one of them solves a larger class of problems?


texts:
Suppose we have a threshold ElGamal cryptosystem $(t, n)$ over an Elliptic Curve $E_p$, $p$ being a large prime, with the following parameters:

$G$ is a generator point of $E_p$ with order $q$
A dealer chooses a polynomial $f(x) = s + a_1x+...+a_{t-1}x \in Z_q[x]$  and $s \in Z_q$ is the secret key of the cryptosystem.
$Y = sG$ is the public key.
The dealer computes and distributes the secret private share $s_i$ to $P_i$ as $f(i)$, $i \in 1,2...n$.
With Lagrange interpolation, $s = \sum_{i=1}^ts_i\prod_{j=1}^t\frac{j}{j-i}$, $i \neq j$.
A ciphertext $(C1, C2) = (rG, M+rY)$, $r \in Z_q$, can be decrypted as $$M=-(\sum_{j=1}^tb_js_jC1) + C2$$ with $b_j = \prod_{j=1}^t\frac{j}{j-i}$, $i \neq j$.

My question is: since $s$ is an element in $Z_q$, shouldn't $b_js_j$ be also calculated $\mod q$?

$b_js_j$ can be $>q$ because it is not a field element but the number of times $C1$ is summed, right?


texts: Secret key formed by the combination of several keys

texts: I think there exists an algorithm to create a key from the combination of a group of keys in such a way that if I encrypt a message using the key formed from the combination, I should be able to decrypt it using any one of the keys from the group. Any idea?


texts: Perfect Secrecy in Symmetric Key Systems

texts:
For symmetric key systems does perfect secrecy imply that all ciphers in the cipher space are equiprobable?

I would think not, but I am finding it hard to come up with a counter example.


texts: Can a number be encrypted, added to other numbers, and then the sum decrypted?

texts:
I imagine there is a class of algorithms for this, but I don't know the name to google for more info.

To describe the desired behavior:

0 or 1 + "some seed" -> ciphertext-1
0 or 1 + "different seed" -> ciphertext-2
...
0 or 1 + "yet another seed" -> ciphertext-n
ciphertext-1 + ciphertext-2 + ... + ciphertext-n = ciphersum
ciphersum + private key -> cleartext of sum of original number


texts: Replacing a block cipher's key schedule with a stream cipher

texts:
Take Rijndael (AES) of block size 128 and reformulate it with a tweakable number of rounds and no key schedule.

Suppose we obtain:

Rijndael128(r, k)

where r is number of rounds and k is key of length r*128 bits (it is the concatenation of all round keys).

k is then made salsa20(x) where x is a 256 bit secret and nonce is constant.

Would this be at least as secure as AES-256 when r >= 14?
Assume no timing or side channels.


texts: Is exposing a constant IV an easy target to attacks?

texts:
I have multiple RFID tags which I want the data stored on them to only be read by certain users when scanned. What I did was basically to encrypt the data with a key using CBC mode, take the encrypted hex data and append it with the IV, and then put this whole string into the tag.

So, each tag will have a different IV but their data is encrypted by the same key.

Basically, Tag A is assigned with $IV_A$ and Tag B is assigned with $IV_B$, same for Tag C, D and so on. I would pre-encrypt the data on my computer, append the IV to the back of the encrypted data, and then transfer the whole string into the tags. The different data for each of the tags will all be encrypted with the same key. So, the data in Tag A would contain $EncryptedMsg_A+IV_A$. In Tag B, the data in it would look like $EncryptedMsg_B+IV_B$.

The IVs are appended in clear text behind the encrypted data. $IV_A$ will remain unchange as the IV of Tag A for as long as it is around. And $IV_B$ will remain unchange as the IV of Tag B too.

The users wouldn't be writing to the tag. They will only be reading from the tag.

However, the part where IV remain unchanged on each scan and exposed makes me feel uneasy about this method.

Will this method be sustainable to attackers? Should I have another key to encrypt the IV before appending to the encrypted data? Would it be stronger this way?


texts: Signing different types of messages with the same asymmetric key

texts:
I want to be able to sign different types of messages with the same asymmetric key. (For completeness, I am using Ed25519 for my signatures).

Why do I want to do this?

The same key is used to sign different types of messages. If I didn't use some method to differentiate between message types, an attacker might be able to ask me to sign one message of one type, and then use it as a message of another type.

Example crude solution

For a quick prototype, I used the following crude method.

To sign a message of type 1:

$\operatorname{Sign}[\text{key}](\text{"type1" }||\text{ message}_1)$

To sign a message of type 2:

$\operatorname{Sign}[\text{key}](\text{"type2" }||\text{ message}_2)$

I have a feeling that this is not the best way to get good separation between message types. This is especially true if one type string is a substring of another type string. I remember for example, that HMAC and hkdf use a more sophisticated mechanism (They don't just concatenate).

I don't want to reinvent the wheel here. Is there a common practice to solve this problem?


texts:
Let $Z^t = (Y_1,\ldots,Y_t)$ be a sequence of random variables each taking values in $Y$. The random variables are not necessarily i.i.d but we know the joint distributions. i.e for every $z = (z_1,...,z_t)$ we know $P^{Z^t}(z)$

The min-entropy of a random variable $X$ is defined as $-\log_2(\max P(x) )$ for x in the value set of $X$.

Finally, we define a sequence of values $H^\infty(t) =  -\log_2(\max P^{Z^t}(z))$ for $Z^t$ defined as above.

How can we show that $H^\infty(t)$  is monotonically increasing in t? i.e for $t' \geq t$ it is the case that $H^\infty(t') \geq H^\infty(t)$.

What I am trying without success is to show that $\max P^{Z^t}(z^t) \geq \max P^{Z^{t'}}(z^{t'})$ where $t \leq t'$.


texts: Does RSA-OEAP have integrity and authenticity properties?

texts:
RSA-OAEP is IND-CCA2 secure (indistinguishable under an adaptive chosen ciphertext attack). Does it also have the INT-CTXT (integrity of ciphertext) and INT-PTXT (integrity of plaintext) properties?

I don't believe that IND-CCA2 implies these. Are they true for RSA-OAEP though?


texts:
I'm trying to understand the UKS attack on KEA protocol.

This is described in this paper: Security Analysis of KEA Authenticated Key Exchange Protocol

So to summarize:

KEA protocol:

UKS attack on KEA:

"$\mathbb{M}$ registers a public key $g^a$ of some
honest party $\mathbb{A}$ as $\mathbb{M}$'s own public key. Then $\mathbb{M}$ intercepts a key-exchange session between $\mathbb{A}$ and some other honest party $\mathbb{B}$ and at the same time starts a session between $\mathbb{M}$ and $\mathbb{B}$. Now $\mathbb{M}$ forwards ephemeral public key $g^x$ from $\mathbb{A}$ to $\mathbb{B}$ and
ephemeral public key $g^y$ from $\mathbb{B}$ to $\mathbb{A}$. Since $\mathbb{M}$ has the same public key as $\mathbb{A}$,
both $\mathbb{A}$ and $\mathbb{B}$ will compute identical session keys, however they participate in
two different key-exchange sessions. $\mathbb{B}$ participates in a session with $\mathbb{M}$ while $\mathbb{A}$
participates in a session with $\mathbb{B}$. Finally, $\mathbb{M}$ reveals a session key of one of the sessions and announces the other session as a test session. Given a challenge key, $\mathbb{M}$ compares it to the revealed key. If they are the same, $\mathbb{M}$ decides that the
challenge is a correct key for the test session and if different, $\mathbb{M}$ decides that the challenge key was chosen at random. The demonstrated attack breaks AKE security against a weak adversary (who can only reveal session keys)."

The thing that I don't understand in the attack description above, is the notion of "challenge key". It is said that the attacker $\mathbb{M}$ reveals a session key of one of the sessions, and then pick a challenge key to guess the key of the test session. But, I thought the key is the same in the two sessions so I don't understand what $\mathbb{M}$ want to guess? Secrets $a$ and $b$?

I think I am missing something, if someone could describe me in detail the attack it would be very nice. Thank you in advance.


texts: Length of message in RSA and splitting of long messages

texts:
If I understand correctly in (unpadded) RSA the length of message M must be shorter than modulus n.

Encryption gives ciphertext that is also shorter than n.

Let's say I want to send a message of 2.5x length of n.

Is the split of message into chunks inferred somehow, or is that encoded somehow within ASN.1 keys? What are the different options/standards for this?

EDIT: Probably RSA is not used for messages longer than n but symmetric keys are generated with RSA and then they are used for longer messages?


texts: Oblivious transfer with trusted third party Trent

texts:
I am trying to solve this exercise.

Assume an oblivious transfer protocol that uses a trusted third party Trent.

Alice's messages $M_0$ and $M_1$ are binary values of length $k$. Bob's message selection bit is $m$.

Trent -> Alice: $R_0, R_1$ where $R_0, R_1$ are random binary values each of length $k$
Trent -> Bob : $t, R_t $ where $t$ is a random bit
Bob -> Alice : $ b = t \oplus m$
Alice -> Bob : $C_0, C_1 $

How should Alice compute $C_0$ and $C_1$? How should Bob compute $M_m$?

I guess that Alice has to compute $K_0, K_1$ as keys (probably inserted into a hash function) and then encrypt $C_0$, $C_1$ like $C_M = E_{k_m}(M_m)$. Bob then can compute $M_m$ by $M_m = D_{k_m}(C_m)$ where $K_m$ is related to $R_t$ in some way. Does anyone have an idea? Thank you


texts: Is there a symmetric-key algorithm which we can use for creating a signature?

texts: I know that in the asymmetric-key algorithm the RSA signature exists but what about the symmetrical ones?


texts:
Does the AES-256 encryption standart
have a max input length?

If not, does it mean we can even translate a book to it? Like md5 doesnt care max input length?


texts: What does the minimal number of round of "nr" use Keccak to avoid “collision attack”?

texts:
What does the minimal number of round of "nr" use Keccak to avoid collision attack?

$$nr = 12+2L$$


texts: With Encrypt-then-MAC, and flexible protocols, do I need to authenticate the authentication?

texts:
Sorry, the question is not easy to state (or wasn't for me, anyhow).

So I'm writing a very flexible format for security. It allows for full choice of cipher, key size, and so on, along with key confirmation and derivation. All of this is communicated in objects with Protocol Buffers serialisation. Now, I get that I need to authenticate the cipher configuration (using Encrypt-then-MAC), but in my protocol, the authentication method itself is highly configurable just like the rest. Is this a situation where I need to NOT provide flexibility, or can I actually NOT "authenticate the authentication"? I would prefer retaining the flexibility, but not at the cost of security.

The high level description of a PayloadItem (the format that defines how to write/read an item to/from the payload) is, with their types:

Type (string)
Name (string)
ExternalLength (long)
InternalLength (long)
Encryption (SymmetricCipherConfiguration)
KeyConfirmation (VerificationFunctionConfiguration)
KeyDerivation (VerificationFunctionConfiguration)

And I am thinking of adding EncryptionAuthentication (as a VerificationFunctionConfiguration) ... it seems to me that I cannot authenticate KeyConfirmation or KeyDerivation (I do not have the key at this point, yet, after all), too. Please help me through the security implications of this. I have already thought about the problem a good deal but would like some thoughts from others.

The key confirmation works by accepting a set of possible keys a receiver holds for a sender, and iterating through them, testing for equality with a verified output. The confirmation method is configured by its configuration object, which allows use of a MAC or KDF, with salt.

Similarly the key derivation is configured by its configuration object, allowing a selection of functions.

Is it okay if I just make sure that I do NOT use short-circuiting comparisons?


texts: Are cryptographies based on bitwise operations considered secure?

texts:
I have recently been reading (and writing) a lot off ECC on top of TCP via pythons sockets. I've stubbled across a couple of things mentioning how elliptical curves are more secure with the same key length as other algorithms. Just to humor myself I made a simple associate/communicative function and used it to with a 'base point' and played around making some public, private, and shared keys. The operation I was using is as follows:

"(x, y) => x | y"

I based my process around having a base point as a domain parameter (call it 'g') and creating a private key 'd' with its public key partner 'dg' (found by plugging d and g into the function above). Then one can encrypt by picking a new private key 'n' and using 'ndg' or 'dng' as the shared secret. Just slap 'ng' at the front of the message and the decrypter can go ahead and use their secret key to go from 'ng' to 'dng' which can be used as a shared secret for something like Rabbit. All these public and private keys can just be integers of some length.

What is insecure in this system?


texts:
I ran into an issue with my server that made me ask a question - is AES-256 encryption reliably consistent?

So my node server, to avoid DDOS vulnerabilities while keeping user data anonymous, takes an IP from the request, encrypts it, and stores the number of times it has made a request in the last 24 hours.

It checks if the user had made a request in the last 24 hours by re-encrypting the IP using the exact same password. It then, takes that and matches it with the first stored IP.

But then:

Error: Can't find data: /ipcount/d00c526612cec9e5d3e201af35993c75. Stopped at ipcount

d00c526612cec9e5d3e201af35993c75 should be the encrypted string, but the database is acting like it's never seen it before. So can I have it encrypt consistently with the same password?

Thanks in advance.


texts: What is the Lord of the Ring(s): Side Channel Attack and What are the results

texts:
A recent Paper to appear on USENIX Security 2021 titled as
Lord of the Ring(s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical by Riccardo Paccagnella Licheng Luo Christopher W. Fletcher
They were able to use the ring interconnect’s functioning of Intel CPUs previously exploited. They claim to extract RSA and EdDSA keys and key-stroke timings.

How does this attack work on the high level?
What are the mitigations against his attack?
What are the consequences of this attack?
Are secure implementations affected by this attack?

bonus part:

How does this attack works on the low level?


texts:
In many source codes that implement ECDH, there is a function that multiplies the base point of that curve with a constant. This function usually takes as arguments the constant and just one coordinate of the point.  All formulas for multiplying a point on an elliptic curve with a constant involves both coordinates of that point. Can anybody explain how those functions do their job?
For example, look here.
The function curve25519_generic multiplies the base point of curve25519 with the scalar. A point on curve25519 has both coordinates on 32 bytes, but the function takes just the x as an argument.


texts: Can we use Shamir secret sharing conversely?

texts: In Shamir secret sharing scheme, we have a secret and then the shares are generated based on the secret. The question is can we generate the shares before knowing the 'secret' (which is uniformly random). Specifically, suppose $n$ users choose random numbers $r_1,r_2,\dots, r_n$, can we reconstruct a secret (random number) using $t$ of them with Shamir's technique?


texts: GCM optimisation using $M_0$ and $R$ tables - Calculation of $R$

texts:
I'm implementing GCM in C as a way to learn about it. In the paper titled as The Galois/Counter Mode of Operation (GCM) by McGrew and Viega on chapter 4.1, page 11, 12, they talk about the optimisation of GCM via usage of the tables $M_0$ and $R$. What I'm not understanding is how to calculate the table $R$, which shall contain the products of $x \cdot P^{128}$.

The Paper doesn't go more in depth about it, can some of you help me with my understanding of it?


texts: We are all familiar with the standard decentralized ID system, the web of trust, e.g. for PGP keys. However, normal web of trust systems are unable to guarantee uniqueness — there's no practical limit on the number of public keys I can register under aliases that appear to be seperate individuals. These systems are thus unsuited for applications like voting where uniqueness is paramount. My question is: are there any ID systems that are both decentralized, i.e. do not rely on trust in a single individual or group, and at the same time guarantee with high probability that any two given IDs belong to unique individuals?


texts: Do we have to consider the cryptographic properties of the decryption, if we're only using the encryption?

texts:
Treyfer for example has slower diffusion in decryption. It has full diffusion between words in 2 rounds for encryption and 7 rounds for decryption.

Do we have to consider the (bad) cryptographic properties of the decryption algorithm, if we're only using the encryption algorithm? (For example we are using Treyfer in CTR mode.)

Differently worded: Do we have to consider the bad cryptographic properties of the decryption algorithm if the encryption algorithm can be considered strong as we're usually only using the encryption algorithm?


texts: Is there any way to change a password using a PAKE-like algorithm, without the server getting the plaintext of either the old or new password?


texts: Is there any advantage in using raw public keys (RFC 7250) in comparison with pre-shared keys (RFC 4279) in TLS, when I need client authentication and have an unique key per client deployed to them out of band?


texts: How important is the size of the public key (for a given security level)?

texts:
I've read about different signature schemes which for the same bits of security differ largely in the size of the public key: The ones proven in the standard oracle model perform worse than the ones proven in the random oracle model. I understand that a difference in the size of a signature is important in case the signature is sent along the data which was signed.

However, what are the negative effects of a large public key? What comes to my mind is that this could be an issue in embedded hardware which is limited in storing capacity. Might this be an issue in other scenarios as well? E.g. are there protocols in which public keys are included in packets and thus take up important space?


texts: Relationship between CCA/CPA-security and PRFs

texts:
I'm a bit confused about the relationship between CCA/CPA-security and PRFs and particularly when do we think of encryption and decryption as a PRF. Assume we have an encryption scheme $\Pi = (Enc, Dec, Gen)$ to be a CPA-secure. Can we say that:

$Enc$ must be a PRF?
$Dec$ must be a PRF?

What about the case when $\Pi$ is CCA-Secure?

My intuition is that we can have $Dec$ to be a PRF for both cases since it's deterministic, but not sure if that is actually required?

For $Enc$, it cannot be a PRF since otherwise, $\Pi$ won't be CPA-secure.

Thanks!


texts: Elligator-2 against curves over Fq, q mod 4 = 3

texts:
It appears that the conditions for applicability of Elligator-2 against many of the SaveCurves curves, where $q \mod 4 = 3$ will inevitably poke a hole in the bit-string set over $(0, 1, .. (q-1)/2)$.

There are two conditions for use of the decoding of a bit string to a point on the curve: $(1 + u \cdot r^2) \neq 0$ and $A^2 \cdot ur^2 \neq B(1 + ur^2)^2$, where $r$ is the numeric equivalent of the bit string, $A,B$ come from curve equation: $y^2 = x^3 + Ax^2 + B \cdot x$, and $u$ is non-square over the field $F_q$.

And when $q \mod 4 = 3$, these conditions will be violated for some valid bit string representation(s) in the set $(0, 1, ... (q-1)/2)$.

Conversely, when $q \mod 4 = 1$, it can be shown that there are no holes in the mapping from bit strings to curve points, and all valid bit strings in the set $(0, 1, ... (q-1)/2)$ map to curve points.

Hence, it becomes clear to me that the intent of Elligator mappings was never to allow arbitrary bit strings to map to curve points, but rather to support a compressed encoding for selected random curve points to bit strings that mimic uniformly random bit strings. The effect is near full coverage of the bit space, but not totally. And it can be shown that Decode(Encode(pt)) = pt. It cannot always hold true for the inverse case: Encode(Decode(bits)) = bits, when $q \mod 4 = 3$, which is the case of many, or most, of the SafeCurves.

The stated purpose of such obfuscation was to avoid censorship from unfriendly authorities who could otherwise spot the use of EC points, even compressed representations of points, during transactions such as ECDH key exchange or ElGamal encryption.

So… the question is:

If the authorities have the wherewithal to spot the use of EC points, or compressed representations of points, then why would one expect that the authorities could not also detect the Elligator obfuscations? They have access to the Elligator equations just as we do. And they could run the decodings for themselves to see if a curve is being referenced.


texts: Finding the prime factors of $n'$ given the previous $n$ and its prime factors $p$ and $q$

texts:
Say I have a very large number $n$ = $pq$ where $p$ and $q$ are prime.

A new number $n'$ is generated by increasing these prime factors. How can I find this new number's prime factors?


texts:
I was asked about the following variant of $ElGamal$ Encryption Scheme (Preparing for exam):
Instead of encrypting $(g^r,h^r*m)$, encrypt $(g^r,h^r+m)$. And the question is whether the new variant CPA secure? In addition, is it Homomorphic in relation to addition or multiplication?
Regarding the question of whether is it CPA secure, i'm think that no Because of the fact that i can build an $Adversary$ who is sent to the Challenger $m0,m1$ and gets back $Cb$ and compute $Cb$ $-$ $m0$ - if the result in G output 0, else output 1. Is this the right way? Plus I can't figure out how to analyze the probability here.
Regarding the question of is it Homomorphic in relation to addition or multiplication, my answer is no.
I would love to get help in better understanding things, any help would be appreciated.


texts: Difference between Pseudo Mersenne primes and Generalized Mersenne primes

texts:
The field prime numbers $p$ proposed by the NIST standards are referred to as Generalized Mersenne prime numbers [1] and as Pseudo Mersenne prime numbers [2].

Is there a difference between Pseudo Mersenne and Generalized Mersenne prime numbers? A lot of papers I recently read do claim that the primes proposed by the NIST standards are Pseudo Mersenne primes. However, other papers define them as Generalized Mersenne primes. Since those two prime families have different properties, applied in an ECC system, I am confused.

Section 7.1. NIST Discussion

Comparing Elliptic Curve Cryptography and
RSA on 8-bit CPUs


texts: What's the differences among Blind Computation, Secure Multi-Party Computation, Secure Circuit Evaluation and Homomorphic Encryption

texts: We know that Blind Computation,  Secure Multi-Party Computation, Secure Circuit Evaluation and Homomorphic Encryption all can process the encrypted data, but I am puzzled by them. What are their differences?


texts: Supersingular Isogeny Key Exchange Software

texts: Are there any optimised implementations of the Supersingular Isogeny Key Exchange by Defeo, Jao, and Plut.  It seems like this would be a great drop-in replacement for Diffie-Hellman in both OpenSSL and GPG.  I'm wondering if that code is available or if someone is working on it.


texts:
I saw that an RSA key, created by OpenSSL, contains the following HEX string:

  2a 86 48 86 f7 0d 01 01 01

that HEX string gets interpreted as Object ID:

  1.2.840.113549.1.1.1

It is obvious 01 01 01 is 1.1.1, but how does 2a 86 48 86 f7 0d get interpreted (parsed) as 1.2.840.113549?


texts: Is there any more information on this RSA backdoor?

texts:
Someone posted an article on Reddit a few days ago, and I haven't found much about it except for links back to the same page.

And for a brief summary, essentially, it's possible to introduce a backdoor during RSA key generation. For example, to generate a backdoored RSA-1024 key. (Assuming $\text{getPrime}(x)$ will return a random $x$-bit prime number)

\begin{align}
A &= \text{genPrime}(384)\\
P^\prime &= \text{genPrime}(128)\\
Q^\prime &= \text{genPrime}(128)\\
P &= Ak_1 + P^\prime
\end{align}

Where $k_1$ is incremented until $P$ is prime, starting with $k_1 = P^\prime$.

\begin{align}
Q = Ak_2 + Q^\prime
\end{align}

$k_2$ is is calculated similarly for $Q^\prime$.
$P$ and $Q$ are then used as the prime numbers for the rest of the key generation algorithm, and $A$ is kept as the backdoor key. $A$ can be generated based off of a predictable per-user value, like a MAC address or user ID.

To use the backdoor, the attacker (or in this case, developer) recalculates $A$ in the same way it was originally calculated (or just looks it up in a database) and then calculates $N^\prime = N \mod A$ and then factors $N^\prime$ into $P^\prime$ and $Q^\prime$. This will take the complexity of factoring a 256-bit number, which is well within reach of most organisations concerned with implementing backdoors. $P^\prime$ and $Q^\prime$ can then be used to calculate $P$ and $Q$ in the same way as above, and thus generate the entire private key.

Is there any more information about this? Possible attacks? (besides the obvious one in the case that $A$ is leaked) It seems intuitive that this would lower the security of RSA, considering it's lowering the key space from 1024-bit to 256-bit, but I don't see how it can be broken without knowing $A$.


texts:
I am not trying to create my own encryption (I am just interested in the math and possibility of this form of "encryption"). I apoligize if this post does not fit in, it is my first time posting.

A Caesar cipher is probably the most basic form of encryption, but what if we were to step it up?

We take a password key
We hash it through a SHA256 algorithm and save the result
We hash the result multiple times saving the result each time
We take all of the results and stack them (using simple numbers for example)

123 < Hash
 321 < Hash 2
 221 < Hash 3
We add up the values of each column

1  2  3 < Hash 1
  3  2  1 < Hash 2
  2  2  1 < Hash 3
 (6)(6)(5) < Final result
We apply the resulting numbers to our text to be encrypted through a Caesar cipher
When we get to the last digit in the ROT, we continue steps 3-6 untill complete

Decryption would be as simple as entering a password to hash over and over and undo the Caesar cipher

What is the practicality of this; does it exist/what would be potential flaws?

Here is an example of this encryption in python. Run the program and you will see what I am trying to explain.


texts: I'm trying a Birthday Attack to randomly generated strings and its $\mathop{SHA-1}$ hashes using a Mapped table of values in order to find a collision on only the first 8 bytes. With the first 4 or 5 bytes it was easy, but the problem now with 8 bytes is I'm running out of RAM memory as I'm storing the values, and I don't think generating all the possible hashes and storing them in a file is a solution. Any ideas to make it memory-efficient/faster?


texts: plaintext decrypted form a cipher text using key = 3 in Caesar Cipher and that plain text with the following ciphertext to get the key

texts: how to use the plaintext from that was decrypted form a cipher text using key = 3 in Caesar Cipher and using that plain text with the following ciphertext to get the key.


texts:
Is there any specific method to use AES-256-CTR correctly? I heard a Playstation 3 security vulnerability was exploited due to a CTR error. I would like to avoid this.

How Do I Use AES-256-CTR Correctly?

Currently I am using PHP with OpenSSL. I have a key specified as well as the contents of the unencrypted data but I feel there is something else I should add. If it makes a difference, the key and the data will be different each time.


texts: Why is proving "parties' views are simulatable" enough in semi-honest model?

texts:
To prove a protocol is secure in semi-honest model, we have to prove: the view of each party, on each possible pair of inputs, can be efficiently simulated based solely on its own input and and output.

So let's consider this example, Alice holds $x$ and Bob holds $y$, they wants to compute $f(x, y)$ without revealing their inputs. I constructs a protocol which is insecure: Bob simply sends $y$ to Alice, and Alice outputs $f(x,y)$.

But it seems it can be proved according to the definition of semi-honext model. Let's assume Bob is honest, we construct a simulator for Alice. The simulator feeds Bob with a random $y'$, Alice cannot distinguish $y$ and $y'$. So Alice's view can be simulatable. But the protocol is of course not secure.


texts: Why does the Signal protocol use AES/CBC instead of AES/GCM?

texts:
AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC can be found in source 1 and source 2.
Now, most protocols still use AES/CBC. I understand this in case a KDF is not used. But currently, I am reading about the Signal Protocol which also uses AES/CBC with HKDF as the KDF.
So my question is: Why would Signal Protocol use AES/CBC when AES/GCM obviously has better performance?
EDIT
I just tested (using JMH) AES/CBC vs AES/GCM on a Java implementation and AES/CBC actually beat AES/GCM in performance.
I am aware now why Signal Protocol uses AES/CBC but I don't understand how. Signal documentation (section 3.3 after the image) says
"Alice then calculates an "associated data" byte sequence AD that contains identity information for both parties".
And later says Alice sends "An initial ciphertext encrypted with some AEAD encryption scheme 4 using AD as associated data and using an encryption key which is either SK or the output from some cryptographic PRF keyed by SK."
Now I downloaded the Signal Protocol source (Java implementation) and did a search they never call updateAAD (a java function to set the additional authenticated data).


texts: In SKE, can we assume without loss that the ciphers of a fixed plaintext distribute identically?

texts:
Let $(KG,D,E)$ be a symmetric encryption scheme. Fix $sk\gets KG(\lambda)$ and an arbitrary plaintext $m$.
Generally speaking, $E_{sk}$ is not deterministic, so that $E_{sk}(m)$ is a random variable, which could distribute in many different ways.
Is there a way to generically transform such a scheme to a scheme in which, for any $m$ and $sk$, $E_{sk}(m)$ distributes uniformly on its support (or at least it is indistinguishable from uniform)? Is this possible without using any cryptographic assumptions which don't already follow from the existence of an IND-CCA1 secure SKE?


texts: Role of primitive roots in Pollard's P-1 factorization algorithm

texts:
I have recently been reading about different factorization algorithms and I came across this paper that discusses the Pollard's P-1 algorithm. In the footnote of the first page, it states...

  For example, note that 2^8 = 256 ≡ 1 mod 17 even though 2 is relatively prime to 17 and 8 ≠ 0.
  The point here is that this cannot happen if a is a primitive root modulo q. But a sizeable number of integers are primitive roots
  modulo q, and even if a is not a primitive root it’s not guaranteed that we necessarily have to run into this situation, so choosing a
  different a should work.

However I am a little confused and don't get exactly what it's saying. Can someone explain the role of primitive roots in Pollard's P-1 factorization.


texts: What is the meaning of "probabilistic encryption algorithm"?

texts:
I am learning cryptography by myself, and I am not able to understand the meaning of "probabilistic encryption algorithm".

How is it different from "deterministic encryption algorithm"? How can the output of a probabilistic algorithm be different for the same pair of plain text and key when used two different times? Doesn't the cipher text depend only on key and plain text?


texts: Will using a 32 character key for Blowfish make it a 32 bit encryption?

texts:
I am sorry if it sounds naive but I have been searching and searching regarding what kind of encryption we end up with if we use a key of length 32 characters?

This article https://www.embedded.com/design/configurable-systems/4024599/Encrypting-data-with-the-Blowfish-algorithm explains how the algorithm works on the plaintext quite clearly but nowhere do I find the difference a key length will make.

=========Edit==========
An example of key is 996b352b-beb9-5628-a61d-4f0fbb72844e


texts: What are some good references for the implementation weaknesses in RSA

texts:
I'm pretty sure I understand textbook RSA.

Choose p and q, large primes, and compute n=pq.
Choose e such that $gcd(\phi(n),e)=1.$
Publish n and e.
Compute d such that $de=1$ (mod $\phi(n)$).
To encrypt a message M, compute E=M^e (mod n).
To decrypt, compute D=E^d (mod n), which will equal M.

There are obvious things we need to do to make this not obviously insecure, such as choose p and q large enough, but not too close together.  It also helps if the ratio between p and q is not a simple rational like 2/3 or 4/7.  We also need the private exponent d to be similarly large.

But there are less obvious precautions needed.  A simple example is that we need to pad M, but there are others.

What is a good reference to understand the other attacks on (implementations of) RSA, and how RSA can be hardened against them?

Thanks.


texts: Could completely public passphrase hashes ever be reliably secure?

texts:
This is a hypothetical question and I only have a basic understanding of Cryptography.

If one were to follow the very best cryptographic practices for storing passphrases, could it ever be possible to publish literally all information (the usernames, the hashes, the salts, the algorithms used) and still be reasonably certain that no-one could crack them?

I'm assuming there would have to be a minimum-length constraint - like 12, or maybe 16 characters minimum - and obviously if someone were to choose "1111111111111111" then it would be easily guessable, but assuming people choose sensible passphrases, like "correct horse battery staple", could this work?


texts:
I'm failing to see why 2 can never be used and what weaknesses would be associated with doing so.

There's a similar question asking why it has to be in the form of $2^n$+1 but why not $2^n$


texts: What type of groups does Microsoft's U-Prove use (Schnorr... etc?)

texts:
I'm trying to learn more about the Subgroups implementation of Microsoft UProve.   I'm unsure if they are Schnorr Groups or use a different foundation?

Can anyone point me to the technical reading required to understand the implementation?  (anything appropriate for a determined, yet fledgling novice would be appreciated)


texts: How can I plot graphs of CP-ABE scheme using charm crypto?

texts:
Can I use charm crypto tool to run it over my datasets for CPABE scheme and plot graphs using its Benchmarking tool ?
Or, how can I use Charm Crypto tool with CPABE toolkit ?


texts: Breaking linear blockcipher - expanding recursive formula

texts:
I am trying to break a block cipher that can be defined as follows:
We have 12 rounds and at each round, we perform the following operation.
We split 64 bit data into 2 parts each 32-bits, $\ x_r$ and $y_r$ and compute:
$x_{r+1} = M * (x_r \oplus y_r) \oplus k_0 $
$y_{r+1} = M * (x_{r+1} \oplus y_r) \oplus k_1$
Where $k_0,k_1$ are 32-bit keys that repeat at each round.
$M$ is a cyclic shift matrix that is always shifting 7 to left.
Encryption can be defined as $E(x_0 || y_0,k_0,k_1) = x_{12} || y_{12}$.
I understand that the cipher is completely linear. Therefore, it can be easily broken.
However, I am trying to find the easiest way of finding an equation that will take only $x_{12}, y_{12}, x_0, y_0, k_0, k_1$. Which is basically unrolling the recursiveness. After that, I can solve the equation with one plaintext/ciphertext pair and retrieve the key.
So my question is what is the best tool to perform such "unrolling" as well as the expansion. I understand that I need to do some kind of symbolic computation, such that I get 2 linear equations at the end and to solve them and retrieve the key.


texts: Impossible to construct collision resistant hash function from one way function

texts:
[Simon 98] showed that it is impossible to construct collision resistant hash function from one way functions in a black-box way. I read the paper but barely understood it. Is there any source, where I can find a simpler explanation of the result?
I would appreciate if you could provide me some papers that explain any other black-box impossibility results in a simple to understand way.


texts: Would requiring reciprocal signatures create a stronger Web of Trust?

texts:
In this post on Cryptome it's noted that a person called Michael Vario is willy-nilly signing people's public key's and uploading those signatures. He is effectively forging a web of trust. I'm sure this kind of thing has been done before.

It occurred to me that if the public key servers could be asked to return public keys with only those signatures that are reciprocal we would perhaps have a more realistic picture of who trusts who. With this feature enabled Vario's signatures wouldn't appear in any of the keys that he's signed and his effort would be for naught.

Would this key server feature be useful?

Would we also need some additional options/messages in GnuPG to make it clear when you might be looking at an "unauthenticated" signature?


texts: Proof possession of private key in libsodium

texts:
I would like to proof that I am in possession of private key sk for public key pk using libsodium.

Therefore I am signing a constant message m using libsodium's crypto_sign function. The signed message (signature + m) is then published.

libsodium crypto_sign uses Ed25519 as digital signature scheme.

Questions:

Does the reuse of a constant message might introduce any attack vectors?
The libsodium documentation on crypto_sing states:

  Verifiers need to already know and ultimately trust a public key before messages signed using it can be verified.

https://libsodium.gitbook.io/doc/public-key_cryptography/public-key_signatures#purpose

Is that information relevant for my case as I actually do not want to verify the message, but want to proof the possession of sk?


texts: Extract one unique SBox from Canonical Representative

texts:
In paper https://eprint.iacr.org/2011/218.pdf, the author has examined 16! different 4 bit SBoxes and at the end of investigation, introduced an  optimal class which named "Golden SBoxes". How can I extract one SBoxes from this class?

I mean by knowing the canonical representation of Golden SBoxes as "035869C7DAE41FB2","03586CB79EADF214","03586AF4ED9217CB" and "03586CB7A49EF12D"(table 4 of paper),

how can I extract the golden sboxes such as Serpent S-Box S3, Hummingbird-1  SBoxes S1, S2, and S3 and Hummingbird-2 SBoxes S0 and S1?


texts: Attacks on one-time pad, given a property of keys

texts:
An adversary $A$, eavesdrops $n$ cipher-texts, $c_{1}, c_{2} ..., c{_n}$. It also knows a value $v$ and a function $f$ such that $$f(k_{1}, k_{2}, ..., k_{n}) = v$$ where, $k_{i}$ is used to encrypt $m_{i}$ to obtain $c_{i}$, $\forall i| 1\leqslant i\leqslant n $.

As a concrete example say, $A$ listens to three cipher texts, $c_{1}, c_{2} \text{ and } c_{3}$, and knows that $k_{1} \oplus\ k_{2} \oplus\ k_{3} = 1^l $, where cipher $c$, message $m$ and key $k$ are of the same bit length $l$.

In the concrete case, how could $A$ use this information in guessing $m_{1}, m_{2} \text{ and } m_{3}$ ? In the general case, are there any well known methods that I should be aware of? Where can I learn about such general techniques in detail?

Assume, messages are drawn uniformly at random (frequency analysis is not possible).


texts: Guarding against cryptanalytic breakthroughs: combining multiple hash functions

texts:
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography make my old data insecure.

If I use only one hash algorithm, I can have bad luck to pick just the one which will be broken after some years.

For example, MD4 (published 1990) had first collision attacks in 1995, and as of 2007 these are even cheaper than calculating the hash itself.

So, the idea would be to combine multiple such algorithms in a way that breaking just one (or some) of them does not compromise the security of the combined construct - breaking all of them would be necessary.

I do not care about efficiency loss from calculating multiple hashes instead of one, I just want to be sure against better cryptanalysis.

So, if I have hash functions $H_1$, $H_2$, ..., $H_n$. How to combine them to form a hash function which is as secure as any of them?

Two basic ideas, which do not work as intended:

simple concatenate the outputs:  $H_1(m) || H_2(m) || ... || H_n(m)$.

This should be quite secure against collision attacks, but is only as
secure to preimage attacks as the weakest of them (and the other ones
then can be used to check if I found the right preimage).
chaining the functions: $H_1(H_2(...(H_n(m)...))$

For preimage attacks, you would now need to break all of them. But a
collision in Hn trivially leads to a collision in the result, too.
(Collisions in the others are less easy to exploit, as you then need
to have to get preimages in the previous ones.)

Any better ways of combining them? Or is this a stupid idea at all?

To clarify: I do not really need more security than the hardest of the component functions, but I want at least that much. (And using more space is not really a problem here.)

And for preimages, I'm now mainly concerned about someone finding the original preimage (which is around the size of the hashes output),  and it looks like this will be at most as difficult as for the weakest hash, in the case of simple concatenation.
I'm not so much concerned about someone constructing a new one - this sounds quite difficult, but is not so much, if the size of the message can grow as needed (one block per bit of hash or such) and we have collision attacks on the compression function, as Joux shows.


texts:
Quoting a blog authored by Vitalik Buterin regarding ZKP and Ethereum

  One natural use case for the technology is in identity systems. For
  example, suppose that you want to prove to a system that you are (i) a
  citizen of a given country, and (ii) over 19 years old. Suppose that
  your government is technologically progressive, and issues
  cryptographically signed digital passports, which include a person’s
  name and date of birth as well as a private and public key. You would
  construct a function which takes a digital passport and a signature
  signed by the private key in the passport as input, and outputs 1 if
  both (i) the date of birth is before 1996, (ii) the passport was
  signed with the government’s public key, and (iii) the signature is
  correct, and outputs 0 otherwise. You would then make a zero-knowledge
  proof showing that you have an input that, when passed through this
  function, returns 1, and sign the proof with another private key that
  you want to use for your future interactions with this service. The
  service would verify the proof, and if the proof is correct it would
  accept messages signed with your private key as valid.

I don't quite get why this would be considered a ZKP and not "simple key pair"


texts: Security of BLS under additional information on the secret key

texts:
Question A
Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, namely it also knows some value $ v = g_1 \, sk \in \mathbb{G}_1 $?
E.g. is the adversary able to forge signatures under $ sk $ or even able to obtain $ sk $?

Question B
If the answer to question A is that the scheme is still secure. How can I prove such a fact formally?

Definitions
$ \mathbb{G}_1 $, $ \mathbb{G}_2 $... elliptic curve groups of prime order $ q $
$ g_1 \in \mathbb{G}_1 $ and $ g_2 \in \mathbb{G}_2 $... generators of the groups $ \mathbb{G}_1 $, $ \mathbb{G}_2 $
$ e: \mathbb{G}_1 \times \mathbb{G}_2 \to \mathbb{G}_T $... an efficiently computable, bilinear and non-degenerable map (a pairing)
$ H_1: \mathcal{M} \to \mathbb{G}_1 $... an hash function mapping messages elements from group $ \mathbb{G}_1 $

$ keygen() $... a probabilistic algorithm returning a private/public key pair $ \langle sk, pk \rangle $
with $ sk \in \mathbb{Z}_q $ and $ pk = sk \, g_2 \in \mathbb{G}_2 $

$ sign: \mathbb{Z}_q \times \mathcal{M} \to \mathbb{G}_1 $... the signing algorithm mapping the secret key $ sk $ and message $ m $ to a point in $ \mathbb{G}_1 $, i.e. $ sign_{sk}(m) = H_1(m) \, sk $

$ verify: \mathbb{G}_2 \times \mathcal{M} \times \mathbb{G}_1 \to \{ \textsf{valid}, \textsf{invalid} \} $... the signature verification algorithm taking the public key $ pk $, message $ m $ and signature $ \sigma $ and returning $ \textsf{valid} $
iff $ e(\sigma, g_2) = e(H_1(m), pk) $ holds


texts: homomorphic division with scaling/Paillier

texts:
Let's say that I have to use fractions instead of integers and I am using Paillier cryptosystem. So, I use scaling to obtain integers. Assume that I have a secure division protocol. What happens if the result of the division is not an integer?

Scenario:

The scaling factor is 10.

$x = E(10)$ // encryption of 1
$y = E(3)$ // encryption of 0.3
$z = E(10/3)$ // with a secure division protocol

Let's say that I choose parameters accordingly and 3 has inverse. Then, when I multiply 10 with 3 inverse homomorphically (interactive multiplication), I will see something different than 3.3. I cannot get this problem solved on my mind.


texts:
The security of RSA is based on the integer factorization problem, which is a very well defined and understood mathematical problem. This problem must be solved in order to fundamentally break RSA.

What about AES (and others based on the same idea)?
Why is it difficult to break?
Is there any mathematical principle that ensures its security?


texts: Is there any theory to measures and determine the strength of an encryption protocol?

texts:
To determine the strength of an encryption protocol, there are elements like key size, Strength of an algorithm, Performance of an algorithm or etc, I have studied these topics but I could not find the answer I am looking for.
Is there any mathematical explanation in this topic, like a "theory of everything" that makes it possible for every encryption protocol.


texts: Is there any benefit of changing the AES-CCM encryption key periodically even if the Nonce space is not exhausted yet?

texts:
I would like an answer that could be sustained by a mathematical proof.

Let's say I'm using AES-CCM to encrypt a lot of messages, and I always use a different nonce.

I know that when the nonce space gets exhausted, the encryption key needs to be changed.

The question is: even though my encryption key has not been compromised and the nonce space is not exhausted, do I have any benefit from changing the encryption key at random times?

My intuition is that whenever I encrypt some data and someone can see the result of the encryption, I somehow "lose" a tiny bit of entropy, even though I change the nonce every time. So, by changing the encryption key at some point, it feels like I'm gaining because the attacker has never seen messages encrypted with this key before.

Is it really worth the effort of changing the key periodically or is assuring an unique nonce really enough?


texts: Understanding the definition of Schnorrs identification protocol

texts:
I have some trouble in understanding the definition of Schnorr's Identification protocol. The is the definition that I received:

Prover and verifier agree on a cyclic group $G$ of prime order $q$ generated by $g$.

The prover sends $r=g^k$ for a random $k$
The verifier sends $e \in_R Z_q$
The prover sends $s=k+xe$
The verifier now verifies if $r=g^sy^{-e}$

Now I don't understand why $r$ and $e$ have different formulas. As far as I understand, $r$ is an element of the cyclic group $G$, and $e$ also. What is the difference between:

$\in_RZ_q$

and

$g^k$ for a random $k$

mean?


texts: Do hand-based hash functions / MACs exist?

texts:
Is there research on a hash function or a MAC that can be executed without computers?

I know there's a lot of history on hand-based ciphers and the OTP can easily be excecuted by hand. (By using numbers / letters) But modern cryptography requires authentication as well as encryption.

Now I'm asking myself, is there a (simple) well-studied hash function or a similar MAC that can be executed by hand and operates on letters rather than bits?

Reformulation: Is there a "classical" analogon for hash functions to the classical ciphers.

Note: Resistance against computer-based attacks isn't a neccessary requirement (just like classical ciphers do not resist such attacks).


texts: Is it safe to hold key file's hash in application

texts:
Title says all; Is it safe to hold key file's hash (MD5 or SHA1) in application (hard-coded)?

Thanks


texts: What is a (smooth) projective hash function?

texts: I recently came across the term "smooth projective hash function", and I see that there are many constructions nowadays that rely on them, especially some PAKE constructions. But, I didn't exactly understand them. What are they? And why are they so useful?


texts: A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt

texts:
I want a key stretching system that's as strong as the stronger of scrypt and PBKDF2.  The consensus now is that scrypt is by far the better system, but that might change if in the future, a weakness is found in Salsa20. Here is a proposed system that I dreamed up, does it seem like a good idea?

First run scrypt and produce twice as much key material as needed. Use $N$, $r$ and $p$ parameters as normal.

$k_0 = \mathrm{scrypt}(\mathrm{key},\mathrm{salt},2 \cdot \mathrm{len},N,r,p)$

Then split the key $k_0$ into to equal pieces, $k_1$, and $k_2$.  Now run PBKDF2, picking a sizable $c$ parameter:

$k_3 = \mathrm{PBKDF2}(k_2, \mathrm{salt}, \mathrm{len}, c)$

Finally, output $k_1 \oplus k_3$.

I was thinking that advantage of this construction over a more naive one (or just turning up the $c$ parameter in the PBKDF2 final round of scrypt) is that the original key isn't used as an input to the weaker PBKDF2, and that the output of PBKDF2 can't weaken the output of scrypt.  However, if scrypt turns out to be easier than expected due to a Salsa20 weakness, then it still is necessary to brute-force PBKDF2.


texts: Why are $\{0,1\}$-matrices almost-MDS only when n is 2, 3, or 4?

texts:
In this paper authors claim that $\{0,1\}$-matrices are almost-MDS (have branch number $n - 1$) on when $n$ is $2, 3,$ or $4$.
For example, how can this two matrices have the same branch number?
$$\begin{pmatrix}0&1&1&1\\
1&0&1&1\\
1&1&0&1\\
1&1&1&0\end{pmatrix}$$
$$\begin{pmatrix}0&1&1&1&1\\
1&0&1&1&1\\
1&1&0&1&1\\
1&1&1&0&1\\
1&1&1&1&0\end{pmatrix}$$
Why branch number doesn't scale up with matrix size?
I'm math dummy. It seems to me that bigger (more 1s) should be better for diffusion. Is there simple logical plain English explanation?


texts: With the random numbers generated, can I know which RNG seed was used?

texts: My teacher challenged us to find out which seed was used to generate some random numbers. I would like to know if it is possible to decipher the seed using the generated numbers (break the linear congruence algorithm). If possible, I ask you to explain how to do it.


texts:
I'm thinking of implementing rainbow tables for a specific blowfish problem, but I have trouble thinking of the proper way to apply the original paper (and its application to hash functions) to blowfish.

Say we have a not too clever password hashing function, which just uses the password as a key to blowfish-encrypt a known plaintext of size $n$. I want to build a rainbow table enabling me to quickly find which key (where the key belongs to a space of size $N$) gave an encrypted text.

From what I understand of the rainbow tables original paper and wikipedia page, I should choose a number $k$ to be the length of my chains, and build them :

Given a starting key $x_0$, calculate $h_0 = \text{blowfish}_{x_0}(\text{plainText})$
Define $x_1 = R_0 (h_0)$ where $R_0$ is my first reduction function.
Keep doing that, calculating $x_{k+1} = R_k(\text{blowfish}_{x_k}(\text{plainText}))$

I understand the principle of building these chains, I understand how/why I'll be able to do a not-too-slow lookup on the sorted chains, but there are several things I still don't understand in this case :

How many starting keys should I choose ? If I just use $N/k$, my intuition would be that all the keys should end up being tested in one chain, but can we be sure of that ? To me blowfish is bijective (since reversible) on the plaintext, but how can I be sure that two keys won't give the same encrypted text ?
What reduction functions should I use ? It seems to me like this would play a crucial role in making sure that all of my search space has been done.
If the two assumptions above don't hold, is there an efficient way to know which keys still haven't been tested to make sure they are used to generate new chains ?

I hope my questions won't look too dumb, feel free to point me to other papers/proofs, I'd be happy to understand this fully.
Thanks a lot


texts: what actually the function for e(g,g)^xy

texts:
I doing a project using ABE "Attribute-Based-Encryption" but i didn't understand what actually the function for $e(g,g)^xy$.
Just tell what's the calculation need to perform here. I gone through no of publications and thesis but i didn't understand this.

$PK = (T_1 = g ^{t_1} , ..., T_{|u|} = g^ {t|U|} , Y = e(g, g)^ y )$

Using the above values how can i calculate PK.

Thanks in advance


texts: What are the safe ways to derive HMAC key using block cipher?

texts:
Suppose we have a state of block cipher initialized with some key unknown to us, that is, we have the state after running key schedule, but we have no access to actual key or subkeys, all we can do is encrypt and decrypt data with this state. How to safely derive an HMAC key from it that we can use to authenticate data encrypted with the same state?

If we use CTR mode to encrypt data, it's probably safe to use the first $n$ bytes of keystream as HMAC key, and then use the other $n + i$ bytes for the actual encryption (at least, that's what NaCl do to derive Poly1305 key from XSalsa20 stream).

What is the best way to do this if we use CBC mode to encrypt data?


texts:
First of all I want to say that I have exactly 0 knowledge how I can write something in Python. But I have some knowledge in math especially finite fields.
That's why I want to learn more in writing tools for a Project.

This is the list what the tool should do:

generating random private keys.
in a range ( which I can change )
give out the hex X Point
compare with given X Point

Now the question: is that too difficult for a newbie? And is C++ better for that instead of Python?


texts: How the FHE encrypts a k-bit message just with one-bit encryption scheme?

texts:
I'm reading "Fully Homomorphic Encryption over the Integers"——the first generation of FHE. However, this paper seems to detail a scheme to encrypt each bit in a message. I'm very confused about how to implement homomorphic encryption of the whole k-bits message. More specifically,

if I want to achieve homomorphic addition of ciphertexts, such as encryption(3)+encrpytion(3)=encrpytion(6), just using the one-bit FHE scheme seems insufficient.

My question is there any approach to implement that likes the function of carry bits. Or homomorphic encryption of boolean functions, which is capable of extending one-bit homomorphic arithmetic operations to k-bit homomorphic arithmetic operations.

Any references or answers will be much appreciated!


texts: What is it known about the hardness of the factorization search problem in non-commutative crypto?

texts:
The factorization search is an interesting problem in non-commutative crypto that can be defined as:

Given an element $c$ of a group $G$, two subgroups $A,B \leqslant G$. Find two elements $a\in A$ and $b \in B$ such that $c=ab$.

In the case of $A=B$ we can see that any element $a'\in A$ will give us $b' \in B$, since $b'= a'^{-1}c$, because the resulting element is in the same subgroup.

If $A$ and $B$ commute element-wise then pick $b'\in B$ and compute the commutator $[c,b'] = [ab, b'] = b^{-1}a^{-1}b'^{-1}abb'$. Since $[a^{-1}, b'^{-1}] = 1$ then $[ab,b'] = (b'^{-1})^b b'$. Finally multiply by the inverse of $b'$ to obtain $(b'^{-1})^b$. This is a reduction to the conjugacy search problem (CSP).

Q: What is the situation about the factorization search problem?

Q: What reductions exist to known problems on Group Theory, if any?

Q: Is there any protocol based on this problem?


texts: What exactly is the purpose of the multi-tree variant in hash-based schemes?

texts: In hash-based signature schemes that use Merkle trees (e.g. XMSS), what is exactly the purpose of the multi-tree variant? Seems like the same number of keys can be represented by a single larger tree? Am I missing something?


texts: Homomorphic Encryption with Addition and Exponentiation

texts:
Is there any homomorphic encryption scheme which supports addition and power over cipher text ? Paillier is close but it supports addition and multiplication with a constant.

I am getting an output like this:

1 0 1 0 -1 1

My goal is to make -1 positive by any means. As it will encrypted so I cannot know if it is -1 or 1. This (similar) output is being generated by subtracting binary streams.

For example:

101101 -- A1
111001 --- A2
----------------------------
2 1 2 1 1 0 2 --- A+A2=A3
----------------------------
1 0 1 0 -1 1 ---- A3-1

A1 and A2 bits can be replaced to any other integers.
Also, can I perform AND operation in additive mode ?
Please note that this question is link to my previous question

Primary Objective:
To be able to check any of following

How many same bits occurs that is 1ns in A1 and A2 in the same position
How many zero bits on the same positions in A1 and A2
How many different bit locations in A1 and A2