texts: Specification of the scream stream cipher is unclear

texts:
I am implementing in C++ the Scream stream cipher. The Scream family is composed of Scream-0, Scream-S and Scream-F. For this question, assume that I'm using Scream-S.

The specifications of the Scream cipher are given in the paper "Scream: a software-efficient stream cipher", but  I didn't find a reference sourcecode for this cipher which could have helped me.

Maybe because the specs include many notations, I have some questions about the scream cipher:

In section 2 about the two 2X2 matrices : Am I right to say that $x$ and $x+1$ (from the $GaloisField(256)$) are replaced respectively by $2$ and $3$?
In section 3, it's possible to implement the function $F$ to optimize it. The author didn't define the multiplication ($u0 = M1(0,0) . S1[x]$). Is it a multiplication following $GF(256)$ with the polynomial $x^8 + x^7 + x^6 + x + 1$ (0x1C3) ?
In the algorithm of $F$ in section 3, they write 'byte0'. Does $byte_0$ refer to the MSB or LSB of an integer ?

Since $F$ is the core of the algorithm, it's important for me to know and understand these kind of details.


texts:
I try to find out the structure of encrypted office files (I'd like to implement something like a carving tool for finding certain encrypted file types). I try to understand the Office Document Cryptography Structure Specification but this seems to be very hard, probably because this is too MS specific. What I found out is that when encrypting DOCX-Files, the file header changes from 50 4B 03 04 (typical docx-header) to D0 CF 11 E0 (typical doc header). Within the file I found a XML-File describing the used algorithm, key length, MACs, etc (XmlEncryptionDescriptor). Does anybody know the general structure and how it changes when encrypting?

I hope this question is not too specific.


texts: Is there any OPRF (oblibivious pseudo random random functions) between one receiver (1 input) and n senders (n inputs)? any references to read?

texts:
I am looking for some references for multi-party / distributed Oblivious pseudorandom Functions.

I found two party OPRF protocols between a sender $S$ and a receiver $R$ for securely computing a pseudorandom function $f_k()$ relying on the key $k$ computed by $S$ and on input $x$ contributed by $R$, such that $R$ learns only the value $f_k(x)$ while $S$ learns nothing from the interaction.

I am looking for a function, such that the resulting output gathered by $R$ is defined such that $f_{h(n, k)} (x)$, where $h(n,k)$ is function that depends on the $n$ secret inputs of n senders.
Thanks,


texts: Do all AEAD implementations use symmetric key ciphers in practice?

texts: Everything I've seen so far in modern implementations (the Linux Kernel AEAD API, JVM crypto provider (AES-GCM), RFC 8439, libsodium, etc) seems to imply that only symmetric key block ciphers are used in practice for AEAD.  Are there asymmetric key algorithms that ensure authenticated encryption?


texts: Question about the location of the r-torsion in the quotient group used in the Tate pairing

texts:
I'm working through Pairings for Beginners by Craig Costello, and am trying to understand the Tate pairing.

He defines $rE = \{r*P | P \in E(\mathbb{F}_{q^k})\}$ and then forms the quotient group $E(\mathbb{F}_{q^k})/rE$. He then claims:

  if $r^2 || \#E(\mathbb{F}_{q^k})$, then $E[r] \cap rE = \{\mathcal{O}\}$.

where $\cdot||\cdot$ means divides, but just once, and $E[r]$ is the r-torsion.

My question

Why is this true? I definitely agree that $\mathcal{O}$ is in this intersection, since $r[P] = \mathcal{O}$ for any $P$ in $E[r]$, but I don't see why this should be the only element in the intersection. Moreover, if there were some point $Q \neq \mathcal{O}$ in $E[r] \cap rE$, then $Q$ would have order $r^2$, which by Lagrange's Theorem, would be possible under the assumption that $r^2 || \#E(\mathbb{F}_{q^k})$.


texts: Possible to determine equivalence of hash codes from different hashing functions?

texts:
Let $H_{1}(x)$, $H_{2}(x)$, ..., $H_{n}(x)$ be a list of $n$ secure one-way hash functions such that for a given input $x$ each $H_{i}(x) \neq H_{j}(x)$ when $i \neq j$.  Give one hash function to each of $n$ people.  No person should be able to reproduce the output of any other person's hash function.

For any inputs $x,y$ with $x \neq y$, is it possible to define a comparison function $F$ such that $F(H_{i}(x),H_{j}(x)) = true$ and $F(H_{i}(x),H_{j}(y)) = false$?

In other words if each person creates hash codes of the same inputs using different secure one-way hash functions, can I tell what hash codes were derived from the same input?


texts: Block cipher to encrypt 8 bytes/64 bits - Use 64 or 128 bit cipher?

texts:
Here's the problem: I have a transport stream that I have been requested to encrypt between the transmitter and receiver. The data size is at most 8 bytes so it seems I can only use ECB as I only have a single block - the most I can do is pad to 8 bytes if its less, which I intend to do with random data (the receiver can figure out the correct length from the decrypted data).

I've been looking for 64-bit ciphers and came up with the most popular: DES, 3DES, TEA, XTEA, XXTEA, Blowfish. I've discounted DES, 3DES and Blowfish due to their code size (not enough space to implement it, and concerns over speed of encryption/decryption on the embedded platform we are using)

I'd rather not use TEA, as it seems insecure from what I've read.

Is there another 64-bit cipher that is more secure than TEA, but doesn't require lots of code space plus lots of constant data like Blowfish does?

Is it possible to use a 128-bit cipher and "trim" the result to 64-bits?


texts: Swapping a single bit inside a 40 bytes inputs fed to keccak256. Is it safe to assume no change in the first 20 bytes can result in the same hash?


texts: Generating the Backup Exec AES-256 GCM key used to encrypt/decrypt LTO5 tape drive data

texts:
I've got an LTO5 tape that was backed up using Backup Exec (BE), which used hardware compression when writing to the tape. I've been given the passphrase that BE used to create the actual encryption key, so I can access and restore the tape's file backup sessions without any issues. But there are online database sessions on there too, and these are not so easily restored without replicating the original database environment.

Now, I have 3rd party tools that will do the job for me, but they won't work with encrypted tapes. So I want to use Linux' stenc utility to enable me to read the decrypted data from the tape so I can copy the tape to an unencrypted one, but to do so I need to give stenc the actual key that BE uses.... but BE stores keys in encrypted form and will not export them.

I know LTO drives use AES-256 GCM encryption. Every key generator I've seen uses a "salt" along with the passphrase to generate AES-256 keys. The various versions of BE that I've used will all read the tape once I've used their key management process to create the key using the passphrase, so this implies (to me, at least) that either they're generating the key without a salt, or are using the same salt across installations.

Is there a way to generate a key for AES GCM without a salt? I must admit that I'm an encryption newb so forgive me if this is a nonsensical question.


texts: Quadratic residuosity problem reduction to integer factorization

texts: How can one show how to reduce the quadratic residuosity problem to an integer factorization?


texts: Applications of machine learning in classical ciphers?

texts: Machine learning is definitely applicable in analyzing simple shift ciphers like Caesar and affine ciphers, as well as substitution ciphers like Vigenère, but is it possible for machine learning to solve problems involving more complex ciphers such as Hill ciphers, where characters are mixed up and ruin frequency analysis?


texts: Key generation in Digital Signature Algorithm

texts:
In DSA, one needs to generate two primes $p$ and $q$ such that $q$ is $256$-bit and $p$ is $3072$-bit and $p-1$ is a multiple of $q$.

Question: How to generate such $p$ and $q$.

Attempt: First, use a random number generator to generate $256$-bit number, say $q$. Then test whether it is a prime. If it is not, generate again until a prime is obtained.

After that, generate a random number $\alpha$ such that $\alpha$ is $(3072-256)=2816$ bits and $\alpha q +1$. Test whether $\alpha q+1$ is prime. If it is not, then generate $\alpha$ again. If yes, then we are done as we have two primes $p$ and $q$ which satisfy the conditions above.

Does the key generation above work?


texts: Parity checking on DES key if using ASCII chars

texts:
This is my first question here, so if I ask it to the wrong group or otherwise infringing the (written or unwritten) rules of the community, please bear with me.

My problem is this: In an exercise in futility, I am trying to write a small program (in C) that implements the DES (FIPS 46-3) standard. I stumbled upon that part in which, from each byte in the 8 byte key, the LSB is used for (odd) parity checking, and eventually discarded.

That, I assume, means that a key like "aaaaaaac" (ASCII encoding) is invalid, since "c" (0x63) has even parity.

Now, either this is correct (and my question would be how commercial / publicly - available packages treat this, since I believe I saw plain ASCII used as key) OR it is a wrong train of thoughts, in which case I would like to know what I am missing.

Thanks a lot in advance.


texts: How is the password sent across for verification?

texts:
I am familiar with Challenge-Response Authentication scheme.
However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel.

When the user enters the password, is the password encrypted and sent, or is the hash of the password encrypted and sent? Is a time-stamp or a nonce used? If the digest of the password is sent, when is the salt added?

Typical scenarios would be login without https.


texts: Why does FS&K's SHAd-256 construction zero-prefix the inner message?

texts:
Ferguson, Schneier and Kohno's Cryptography Engineering §5.4.2 describes a construction, $\operatorname{SHA}_d\text-X(m)$, which is just $\operatorname{SHA-\!}X(\operatorname{SHA-\!}X(0^b\mathbin\|m))$ (where $\operatorname{SHA-\!}X$ is any particular SHA-2 hash, and $0^b$ represents a full input block of zero bits).

I understand that the second hash is necessary to prevent length-extension attacks.

What I don't understand, and cannot find adequate explanation for, is the rationale for zero-prefixing the inner message $m$.  The book's hand-wavy explanation is that:

  Prepending the message with a block of zeros makes it so that, unless something unusual happens, the first block input to the inner hash function in $h_d$ is different than the input to the outer hash function.

But that is as far as it goes to explain the zero block.

A related but distinct question, "Understanding double hash and 0 block prepending to mitigate length extension attacks," has a partial answer from fgrieu:

  If the $0^b$ in the question's construction was absent, as in $H'(m)=H(H(m))$, we'd have the property: $\forall m,H'(H(m))=H(H'(m))$. We can construct some (largely artificial) protocols which would be secure for $H$, but are insecure for $H'$ due to that property; and correspondingly, that property makes some security proofs hairy, impossible, or weaker. With $H'(m)=H(H(0^b\mathbin\|m))$, that or similar properties do not hold, which is good for simpler/stronger security proofs.

What protocols would be insecure for $\operatorname{SHA}_d\text-X'(m)=\operatorname{SHA-\!}X(\operatorname{SHA-\!}X(m))$?  (To be clear: such a $\operatorname{SHA}_d\text-256'$ construction would not be susceptible to length-extension attacks, right?)  Does the difference matter for any "real-world" protocols that use the $\operatorname{SHA}_d$ construction today?

Is there a good name for this property ($\forall m,H'(H(m))=H(H'(m))$) that I can search the literature for?


texts: Why are huge prime numbers important in cryptography?

texts:
I read an article the other day about the search for prime numbers.  According to the article and several online sources the biggest prime number is over 17 million digits!  This made me wonder why anyone would want a prime number that big.  The article went on to say that there is a $250k reward for who ever find the first billion+ digit prime.  The article said that primes are used in cryptography and explained briefly why.  But my question is why is there such a demand for these "super primes" which seem extremely bulky and unnecessarily big(a text file holding a billion digits would be over 1gb of data).

EDIT: I know that similar questions have been asked about primes place in cryptology but I'm wondering specifically about these massive primes that people are paying big bucks for.


texts:
Assume I have a perfect source of entropy, which is unknown to me, and is used to generate a private key (also unknown to me, but usable).

If I make a signature with this unknown private key on a constant piece of data (e.g. hash('foo')) and then hash that signature, is the original entropy preserved?

Put another way, does an elliptic curve signature's output probability distribution function resemble that of a perfect hash function (i.e. uniform), or do the outputs concentrate in some other function throughout the space?


texts: Can we determine a security parameter in the hybrid argument where the number of hybrids is polynomially bounded but not known?

texts:
Let $\lambda$ be a statistical security parameter. Consider a security proof that is based on hybrid argument, where there are polynomially many (say, $n = p(\lambda)$) hybrids, $H_1, ..., H_n$. Any two hybrids $H_i$ and $H_{i + 1}$ can only be efficiently distinguished with probability $2^{-\lambda}$. So, by iterating through all the hybrids, it seems to me that the probability that $H_1$ and $H_n$ can be efficiently distinguished is bounded by $(p(\lambda) - 1) \cdot 2^{-\lambda}$ using union bound. Asymptotically, this probability is negligible in $\lambda$.
My question is that, when $n = p(\lambda)$ is polynomially bounded with respect to $\lambda$ but not known, it seems impossible to choose a reasonable $\lambda$ such that $(p(\lambda) - 1) \cdot 2^{-\lambda}$ is sufficiently small (e.g., $< 2^{-40}$). I think that the same issue may exist as well when it comes to some computational security parameter $\kappa$. It would be appreciated if someone could give me any hint on this question. Many thanks.


texts:
I have $n,e$ and $c$, $p$ and $q$ are prime, but $q$ is the inverse multiplication of $e$ and $p$ so $$q = e^{-1} \bmod p$$
How can $i$ get $p$ and $q$ back?


texts: How to to calculate the hash of an unordered set

texts:
Suppose I have a set of elements, with known hash (e.g. SHA-2). How can I calculate the hash of the set? With it I mean an unordered set, so the order of elements is undefined and shall not play any role in determining the hash of the set.

In theory any commutative operation applied to the hashes should be fine, but I have the strong feeling that XORing all of them together is quite unsafe. An attacker could add an element to the set to produce a hash collision, although finding an element with that wanted hash is as hard as breaking the hash of the whole set.

Anything better solution than the trivial one of sorting the elements into a list, calculating their hashes and then calculating the hash of the hash list?

I think Merkle trees can't help here if they are based on some sort of ordering of the elements.


texts: Why aren't stream ciphers extremely secure?

texts:
The way I understand it, stream ciphers are pretty much one time pads off-sourced to a PRNG (the seed is the key that generates the fake one time pad).

So why not just use one or more CSPRNGs (concatenated seeds, xored pad streams)?

Wouldn't breaking such a stream cipher be equivalent to breaking every single CSPRNG used?

Yet we have things like RC4 riddled with vulnerabilities, is it because performance is a concern? There are many applications where it's not, why not have something like I described for those cases?


texts: What would be the most recommended AES && RSA Keys for production?

texts:
While I am a front-end developer and not a security expert programmer, I am worry about the keys I am using for my AES && RSA encryption. Please help me to understand:

Is the following keys are secure ?
Is the following keys are performant and fast ?
I don't have any IV, is it good still without it ?
If IV is good and wont affect the performance then How can I add it ?

RSA KEY
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
keyGen.initialize(1024);
KeyPair pair =keyGen.generateKeyPair();
PrivateKey privateKey = pair.getPrivate();
PublicKey publicKey = pair.getPublic();

AES KEY
SecureRandom random = new SecureRandom();
byte [] key = new byte [16];
random.nextBytes(key);
SecretKeySpec secretKey = new SecretKeySpec(key, "AES");
cipher.init(Cipher.ENCRYPT_MODE, secretKey);


texts: Linear Approximation Table of S-Box for SPN

texts:
I havejust gotten to Linear Cryptanalysis and I'm studying some material on Linear Attack's against SPN.

I see here http://www.cs.bc.edu/~straubin/crypto2017/heys.pdf on page 11

that they calculate the Linear Approximation Table but I am completely lost how they got the values in the table.

Could someone give me an example of how one of those values are calculated? I understand it has something to do with the bias, but I have yet to see any actual example of someone calculating a value in that table which I would like to see.


texts: Is it possible to figure out the public key from encrypted text?

texts:
Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key.

Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public key just by observing the encrypted messages?

And if so, approximately how much data would it take for Eve to discover the public key?

(assume that the public key used is the same throughout, and that Eve can potentially grab as many encrypted messages as she desires)


texts: Security of Diffie Hellman in specific cyclic group

texts:
For some $k$, let's say $p = 1+ \prod_{j=1}^k q( j)$, where $q(1)=2$, $q(2)=3$,
if $p$ is prime, the diffie-hellman key exchange is not secure in cyclic group $Z^*_p$. Why?


texts:
I would like to understand the mechanism behind wpa/wpa2 algorithm. Is there any script that can put this theory:(Key = PBKDF2(HMAC−SHA1, passphrase, ssid, 4096, 256)) into action to test it ? I made a capture of my own router with all necessary details,
should this default Wifi password  be the Key in this equation?


texts: OCB-AES: Ambiguous definition of "Encipher" in RFC document

texts:
I'm implementing an OCB-AES cipher (which is described in RFC 7253), now I have to call the AES encipher function (I'll refer to that as AES-256, described in FIPS 197)

Pre-summary: I'm not sure which encipher function FIPS 197 refers to. Of course, it should be the cipher function; however, the function parameters are different.

Here's an excerpt from OCB's "associated data hash function":

   Function name:
     HASH
   Input:
     K, string of KEYLEN bits                      // Key
     A, string of any length                       // Associated data
   Output:
     Sum, string of 128 bits                       // Hash result
   Sum is defined as follows.
     //
     // Key-dependent variables
     //
     L_* = ENCIPHER(K, zeros(128))
     L_$ = double(L_*)
     ...

Another excerpt from OCB:

To be complete, the algorithms in this document require ... a blockcipher operating on 128-bit blocks...

...

ENCIPHER(K,P)  The blockcipher function mapping 128-bit plaintext block P to its corresponding ciphertext block using KEYLEN-bit [256-bit] key K.

So, I jumped to FIPS 197. Here's the cipher function:

Cipher(byte in[4*Nb], byte out[4*Nb], word w[Nb*(Nr+1)])
begin
    byte state[4,Nb]
    state = in
    AddRoundKey(state, w[0, Nb-1])
    // See Sec. 5.1.4
    for round = 1 step 1 to Nr–1
        SubBytes(state)
        // See Sec. 5.1.1
        ShiftRows(state)
        // See Sec. 5.1.2
        MixColumns(state)
        // See Sec. 5.1.3
        AddRoundKey(state, w[round*Nb, (round+1)*Nb-1])
    end for
    SubBytes(state)
    ShiftRows(state)
    AddRoundKey(state, w[Nr*Nb, (Nr+1)*Nb-1])
    out = state
end

After looking at the table  (where $1 \text{ words} = 4 \text{ bytes}$)

$$\begin{array}{|c|c|c|c|}& \text{Key length }(Nk \text{ words)} & \text{Block size } (Nb \text{ words)} & \text{Number of rounds }(Nr)\\\text{AES }128&4&4&10 \\\text{AES }192&6&4&12\\\text{AES }256&8&4&14\end{array}$$

Paraphrasing only the input parameters for $256$:

void cipher(char in[16], char w[240]);

Here's the main point: The first excerpt wants me to call AES-256 cipher with 1) the key 2) zeros of 16 bytes. How can I pass the 256-bit key and 128-bit zero? One parameter has $240$ bytes and the other has $16$? Is my "function prototype" for the cipher wrong, or do I need to use key expansion, etc..., somehow?


texts: Attack of an RSA signature scheme using PKCS#1 v1.5 encryption padding

texts:
My best interpretation of this question is that Java's crypto API has been subverted to perform RSA signature using PKCS#1 v1.5 encryption padding.

Assume the signature $S$ of a message $M$ is obtained by:

hashing $M$ using SHA-1, yielding the 20-byte $H$;
generating a 105-byte uniformly (true) random $R$;
forming the 128-byte $P=\text{0x00}||\text{0x02}||R||\text{0x00}||H$;
forming the 128-byte $S=P^d\bmod N$ where $(N,d)$ is a 1024-bit RSA private key.

I assume that verification of an alleged signature $S$ of alleged message $M$ is as follows:

rejecting the signature unless $S$ is 128-byte with $S<N$;
forming the 128-byte $P=S^e\bmod N$ where $(N,e)$ is the 1024-bit RSA publickey;
hashing $M$ using SHA-1, yielding the 20-byte $H$;
accepting the signature when the left 2 bytes of $P$ are $\text{0x00}||\text{0x02}$, and the 21th byte from the right of $P$ is $\text{0x00}$, and the right 20 bytes of $P$ are $H$.

Note: conversion from bytestring to number, and vice-versa, is per the big-endian convention.

What attacks are there on this scheme, easier than factoring the public modulus?


texts: How does re-hashing affects security strength?

texts:
I am currently saving hashed passwords for my website. Passwords are salted and then hashed using SHA3-512. I understand the security level of SHA3-512, as it is for all Keccak algorithms, is half the capacity (as it is explained here) , so 512 bits in this case.

My question is, how does re-hashing the resulting hash n times affect the security? Is there a way to effectively compute that? In the scenario of someone stealing the database, what difference would it make having the password hashed, say, 500 times vs just once?

I have seen a similar discussion about entropy after re-hashing here, but they don't address security.


texts: Explain same encryption time for two files of different sizes

texts:
I am encrypting files in a two layered fashion as follows:

Inner layer is 128 bit AES-CTR encryption
Outer/Second layer is a simple one time padding with a particular key.

While testing the running times I noticed that it takes same time to encrypt a 100kB file as it takes to encrypt a 10kB file. Logically it seems wrong to me, is it something that I am missing ?


texts: I was wondering what "securely realizes" means. I see this in some cryptographic papers but I don't know what it means for a protocol to "securely realize" a function $F$.  Is it just a fancy way of saying "uses" or does it mean something else?


texts: Why doesn't HElib support floating point operations?

texts:
NB: what I meant is with implementation of the BGV-cryptosystem, not the CKKS cryptosystem which is designed with floating point arithmetic in mind.
HElib as I understand it only supports fixed-point arithmetic (or binary arithmetic). Why is this the case when everyone who works with computation uses floating point representation?
Is it that it is difficult to implement the rounding that has to occur in floating point operations? Is it slower to compute in floating point representation? Or is it some other hard barrier which comes from working with the specific cryptosystem?
Any insights is welcome.


texts: Average/approximate difference in value between valid consecutive $x$ coordinates in ECC?

texts:
From my basic understanding not all values of $x$ coordinates can satisfy a given elliptic curve equation, i.e. some $x$ coordinate values are not valid points on the curve because $x^3+ax+b$ is not a square.

Therefore, I would like to know what the average/approximate difference $d$ in value between any two valid consecutive $x$-coordinate integers is; if e.g. $x_1$ and $x_2$ are two consecutive valid $x$ coordinate integers on a given curve then in general, what is average/approximate difference value $d = x_2-x_1$?


texts:
Is there a safe way to uniquely identify a symmetric key?  I know with asymmetric keys you typically use a hash of the public key, but I assume that using a hash of a symmetric key would reveal too much information.  Would you simply have to assign a GUID to each key and ensure that those GUID/key pairs never get lost or mixed up?

I'm just wondering, because if you have hundreds of keys stored someplace, how do you know which one to use?


texts: Why Merkle Tree doesn't suffer Birthday attack?

texts:
I am trying to understand why Merkle Tree doesn't suffer the birthday attack?

Can you help me?


texts: With wrong IV at receiver side, the CFB in better than OFB?

texts:
Assume the receiver have a wrong IV (initialization vector), in the CFB mode only the first block of plaintext is wrong but in OFB mode the second and all blocks will be affected.

Is that correct? If it is, what is the meaning of the OFB mode compared with CFB mode?


texts: mixing two asymmetrical random number generator streams

texts:
Knuth describes in "the art of computer programming part 2" an algorithm called "M" for mixing two streams of random numbers. This can be used to mix random number streams giving the assurance that the result is still random even if one (but only one) of the streams suddenly becomes predictable.

Now I have a situation where I do have two streams but they're asymmetrical: one produces +/- 800 bytes per second, the other +/- 340.

My question now is: what can I do so that I can still combine these two and accomplish the same as Knuth's algorithm?

I was thinking of "just feeding them to a hash" and use that result.
What do you think?


texts: Method for creating any involutive permutation

texts: The Fisher-Yates shuffle can produce any permutation of a set of $n$ elements. Is there anything that can do the same for creating an involutive permutation of $n$ elements where $n$ is an even number? This could be used to create involutive S-boxes.


texts: Difference between stream cipher and block cipher

texts:
I read that

  A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time.

(Source: Cryptography and Network Security, William Stallings.)

A block cipher encrypts one block at a time. The block may be of size one byte or more or less. That means we can also encrypt a block of one byte by help of a stream cipher as a stream.

So, what exactly is the difference between a stream cipher and a block cipher?


texts: How can C rand() be exploited if a secure seed is used?

texts:
I've just started doing a research project on CSPRNGs and I would like to know what kind of vulnerabilities a regular PRNG has with a secure seed. For example, if I generate a random number using LavaRnd to seed srand(), then generate some big key with rand(), what can an attacker do to resolve that key, or otherwise find critical information?

I have seen a lot of people with similar questions, but the answer usually boils down to "the result will not have enough randomness", then there is a lot of hand-waving about the specifics. But what does that mean for a real world implementation? What actual vulnerabilities or attacks can be mounted on an insecure pseudorandom number generator using a secure seed?


texts: Pollard's $(p - 1)$ factorization method runtime

texts:
Wondering if anyone knows a good reference for Pollard's $p-1$ algorithm's runtime? I was looking on the Wikipedia page and the runtime cited there is $\mathcal{O}(B\cdot \log B\cdot \log^2 n)$. However, I can't find any reference on the Wikipedia page to this.

Where / how is this result proven?


texts: Luby-Rackoff theorem for Generalized Feistel

texts:
I was reading about Luby-Rackoff theorem from various sources: [1], [2], [3], which says you need at least 3 rounds of a $2$-branch Feistel network to get a PRP if the underlying $f$ function is a PRF. I also came to know about the Generalized Feistel Network which has more than two branches.

What will be the minimum number of rounds to get a PRP from a generalized $n~(>2)$ branch Feistel network, given the underlying function $f$ is a PRF?


texts:
I'm trying to program a Cardan grille, but I can't find requirements for grille. In my case, grille is square matrix A with $N$ x $N$ size, and elements are $0$ or $1$ (where $1$ means that it is hole).

I realized that if $N$ is odd, central element of matrix can not be $1$.

But what are the other requirements?

UPD 30.09.13

Wiki article in russian describes that, if matrix is square, it can be rotated four times around the center.

For example (If I understand correctly):
HELLO and matrix 3x3 with two holes

  1 0 0 | H 0 0 0 0 0 | 0 0 0 0 1 0 | 0 E 0

  0 0 1 | H 0 L 1 0 0 | L 0 0 0 0 0 | 0 E 0

  0 1 0 | H O L 0 0 0 | L 0 0 0 0 1 | 0 E 0

  0 0 0 0 0 1 1 0 0

In this expamle three rotations are enough.

As result we have matrix

  H O L L 0 0 0 E 0

And 0 will be replaced by the symbols A-Z.
It isn't Cardan grille? What it is name of these method?

If we have central element 1, that symbol well be replaced by other.

  1 0 0 | H 0 0  0 1 0 | 0 E 0  0 0 0 | 0 0 0

  0 0 1 | H 0 L  0 1 0 | 0 L 0  0 0 0 | 0 0 0

  ...

So, matrix has some requirements, which I'm trying to find.


texts: XORing a nonce with a ciphertext vs XORing a nonce with plain text and then encrypt

texts:
Consider a situation where a symmetric key encryption (such as AES) is used to encrypt the plain text. Moreover, a nonce is used to ensure that old communication cannot be used to perform a replay attack. In this scenario:

Is it better to XOR the nonce with the plain text and then encrypted the output to produce a cipher? Or XOR the nonce with the output cipher produced by encrypting the plain text? Which one would be more secure?

In my opinion, scheme 1- XORing the nonce with plain text and then encrypting the output seems to be a better option as it would produce a different cipher every time even if the plain text remains the same. Moreover, since the (nonce XOR plain text) goes through the permutation and substitution operations, the information about the nonce remains more secret. On the other hand, scheme 2 seems to be relatively less secure as the output (nonce XOR cipher) might give away some information about the generation of nonce (or about the PRNG or CSPRNG) if the attacker is able to collect enough cipher texts.

What do you think is the better way?


texts: Finding the IV values of SHA-256 given all message blocks

texts:
Given all message blocks $w[i],i \in 0:63$ and assume that $n<128$ (arbitrary) bits $x_1,x_2,...,x_n$ of the IV values are unknown (e.g., $h_7$ bits are unknown) while other IV values coincide with those in the SHA-256 algorithm. Let $h_{i}^{j}$ denotes $i$-th hash of $j$-th round that is $$(h_{0}^{0},h_{1}^{0},...,h_{7}^{0})\overbrace{\mapsto}^{SHA256}(h_{0}^{1},h_{1}^{1},...,h_{7}^{1})\overbrace{\mapsto}^{SHA256} ...\overbrace{\mapsto}^{SHA256}(h_{0}^{64},h_{1}^{64},...,h_{7}^{64}),$$ and $(h_{0}^{64},h_{1}^{64},...,h_{7}^{64})$ depends on $n$ unknown IV bits. Now let us take $n$ (arbitrary) bits $y_1,y_2,...,y_n$ of $(h_{0}^{64},h_{1}^{64},...,h_{7}^{64})$ and assign values to them.

Question: Is there a possibility to find $x_1,x_2,...,x_n$ giving the assigned values of $y_1,y_2,...,y_n$ faster than exhaustive search?

Remark. One can notice that for the fixed $w$ the function

$\operatorname{SHA256}_{w}^{-64}(h_{0}^{64},h_{1}^{64},...,h_{7}^{64}) = (h_{0}^{0},h_{1}^{0},...,h_{7}^{0})$ can be constructed analytically, so if all the bits of $(h_{0}^{64},h_{1}^{64},...,h_{7}^{64})$ are known, it is easy to obtain IV values. However, if only $n<128$ bits are assigned it is needed to find $2^{256-n}$ preimages in the worst case.


texts: Can you have partial cryptographic obfuscation (without a trusted setup)?

texts:
Cryptographic Obfuscation is a powerful cryptographic technique. My question is, can you do it partially?

Instead of obfuscating an algorithm completely, you can have an algorithm with a couple of constants, such that an outside observer can verify the algorithm, except for those constants.

One way to do this is to create an algorithm $O$ which takes an algorithm $A$ and constants $c$, and creates a document with obfuscated algorithm $A(c)$ along with a plaintext copy of $A$, and then signs it. So as not to leak the signing key, $O$ is also obfuscated. The problem is that this requires a trusted setup. Namely, $O$ could place a backdoor in the obfuscated copy of $A$. Since $O$ is obfuscated, there is no way to verify its source. It's a catch-22! Literally all the trust needs to be placed in the obfuscator of $O$.


texts: For enciphering messages with AES in CTR mode, do I need a different key for each message?

texts:
I have written a program to run AES in CTR mode with keys of 128,192 or 256 bits and checked it gives correct results with the data given in section F.5 at http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf

The program chooses a different nonce for each message that is enciphered. Do I need a different key for every message as well? or will a single key with a differing nonce provide all the security that is needed?


texts: Does using a verifiable secret sharing scheme ensure robustness of a protocol if it is secure under the semi-honest adversarial model

texts: Consider a protocol $\pi$ which uses a linear secret sharing scheme like that of Shamir secret sharing. Further assume that the protocol $\pi$ has been proven to be secure (correctness and privacy) under the semi-honest adversarial model. If we replace the secret sharing scheme with a verifiable secret sharing scheme, will the protocol $\pi$ then be secure even under the malicious adversarial model? That is, can we say that the robustness of $\pi$ is implicit?  If yes, please provide a reference. If no, please help me understand as to in which cases will the above not be true.


texts: Why probabilistic syntax for encryption schemes?

texts:
In Foundations of Cryptography II, Goldreich, the basic mechanism of encryption schemes is written as follows:

  Definition 5.1.1 (encryption scheme): An encryption scheme is a triple, $(G,E,D)$, of probabilistic polynomial-time algorithms satisfying the following two conditions:

  On input $1^n$, algorithm $G$ (called the key-generator) outputs a pair of bit strings.
  For every pair $(e,d)$ in the range of $G(1^n)$, and for every $\alpha\in\{0,1\}^*$, algorithms $E$ (encryption) and $D$ (decryption) satisfy

  Pr$[D(d,E(e,\alpha)) = \alpha] = 1$

  where the probability is taken over the internal coin tosses of algorithms $E$ and $D$.

I repeated this definition in my own work without too much thought for why the definition was given in probabilistic terms. It was posed to me that it is unnecessary, as written here, for probability to be included and that one could just as well write the consistency equation as $D(d,E(e,\alpha)) = \alpha$.

I read later in the book that this definition may have the probability bound relaxed to allow for some negligible chance that decryption is not possible, and that this may be necessary for certain public-key encryption schemes.

My question is whether this definition is better, tighter or more complete than one that does not consider the probability of the decryption succeeding? Why is the mechanism of encryption formulated in this way?


texts: Polynomial representation of the affine part of the AES S-box

texts:
I have been reading up on the polynomial representation of the AES Sbox (PDF: “Essential Algebraic Structure Within the AES”  by Murphy and Robshaw) and I can't get it to produce the correct output.

Maybe I have a thinking mistake somewhere along the way, so here's what I did:

I picked a random byte: 10010101. This corresponds to $x^7 + x^4 + x^2 + 1$ in the AES-field, or $95_{16}$ in hexadecimal
I used the lookup table at Wikipedia to see what the solution should be: $2a_{16}$, or in binary 00101010 ( $ x^5 + x^3 + x $ ). I also computed it by hand with the matrix to get intermediate results and such.
I converted the coefficients of the interpolation polynomial from hex to bytes to polynomials and computed the interpolation polynomial mod the Rijndael polynomial. I used Sage to do this… my code is at the very bottom.
The result I get from this is not the result the Sbox yields. It's also not an intermediate result, nor do I get the right result when I use an intermediate result as input.

Where did I go wrong?

Sage code:

$R.<x>$=PolynomialRing(Integers(2))
f = x^8 + x^4 + x^3 + x + 1
a = x^7 + x^4 + x^2 + 1
l0 = x^2 + 1
l1 = x^3 + 1
l2 = x^7 + x^6 + x^5 + x^4 + x^3 + 1
l3 = x^5 + x^2 + 1
l4 = x^7 + x^6 + x^5 + x^4 + x^2
l5 = 1
l6 = x^7 + x^5 + x^4 + x^2 + 1
l7 = x^7 + x^3 + x^2 + x + 1
l8 = x^6 + x^5 + x + 1
s = l0*a + l1*(a^2) + l2*(a^4) + l3*(a^8) + l4*(a^16) + l5*(a^32) + l6*(a^64) * l7*(a^128)
q = s % f
print(q)


texts: Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure

texts:
Any thoughts on how this can be done?

  Let $\Pi_1 = (\mathrm{Gen}_1, \mathrm{Enc}_1, \mathrm{Dec}_1)$ and $\Pi_2 = (\mathrm{Gen}_2, \mathrm{Enc}_2, \mathrm{Dec}_2)$ be two encryption schemes for which it is known that at least one is CPA-secure. The problem is that you don't know which one is CPA-secure and which one may not be. Show how to construct an encryption scheme $\Pi$ that is guaranteed to be CPA-secure as long as at least one of $\Pi_1$ or $\Pi_2$ is CPA-secure.

Problem 3.21 - Jonathan Katz, Yehuda Lindell - Introduction to Modern Cryptography: Principles and Protocols.


texts: How to create two partly similar plaintexts with same MD5 hash value?

texts:
The problem I'd like to solve looks like this:

There are two plaintexts which differ in length and letters, but contain a few common strings. The first few words and the last few words are the same, and there are some common words in the middle as well (sometimes in the same order). The two texts have pretty much the opposite meaning.

The goal is to modify these syntactically but not semantically, and achieve the variants' MD5 hash (or at least the hash values' first 4 bytes) to be the same.
I know, that MD5 hash collisions can occur, but how could I implement it in a programming language (e.g. Python) which is not brute force? Is there any way to check which letters to change?


texts: Encrypting a 160-bit plaintext into a 160 bit ciphertext with a 128-bit Block Cipher

texts: So I have a kind of interesting issue. I have a field in my data store which must take exactly 160 bits of information. Some users will choose to make this data encrypted, some won't, so some of those 160 bit fields will be ciphertext some will be plaintext. A boolean will indicate which one the user is using. The important thing here is that I need this field to be exactly 160 bits long. However, a 128-bit cipher will mean I have to put in 256 bits in as plaintext, which is fine, just use a buffer string, but this means that the output is 256 bits when what is stored must be exactly 160 bits. And I can't simply cut off the ciphertext or that would mess up the decryption. So how can I use a 128-bit block cipher like AES (note it MUST be a 128 bit block cipher, I can't change that) to encrypt 160 bits into 160 bits such that it can be decrypted back into the original 128 bits.


texts: Determining interval(s) containing the smallest prime $p$ of an RSA modulus?

texts:
Are there any results that have determined interval(s) $$b\sqrt{n}<p\leq a\sqrt{n},$$ where $0<b<1$, $0<a\le 1$, and $p<q$ are primes such that $n=pq$,

thus allowing us to narrow the search for $p$?


texts: Why is MAC encrypted in TLS data transmission?

texts:
Referring the slide 16 from this link:

I want to ask why is MAC encrypted along with the data to be transmitted. Why isn't MAC just appended at the end of encrypted data ?


texts: Is encrypting multiple message with same key and iv secure for this case?

texts:
AES256, CBC

IV is sha512 of key.

Ek[random padding | message | random padding]

How much information would be leaked from the use of the same IV & key in this way, assuming the adversary has complete access to the system, design, iv, and all information, the AES Object itself, etc etc, except the key?


texts:
In ECC, it is apparently easy to verify the final point given the starting point and the number of hops. But it is difficult to compute the number of hops given just the starting point and the final point.

Can anyone explain in regular English why this is the case (no intense math, please).

From my understanding, hopping along the curve is analogous to addition, and thus the iterative hopping is analogous to multiplication. I've read that the reason it's faster to compute the final point given the number of hops is that we can use exponentiation by squaring to make logN computations as opposed to N.

My question is this: wouldn't there still be a large number of points to hop in between two squares?

E.g. if the number of hops is 1524, then we would compute 2, 4, 8, 16, ..., 512, 1024 — but then we'd still need to do 500 hops after getting to 1024. Or would we use squaring again to get from 1024 to 1524?


texts:
Can we make subtraction result of cipher texts encrypted by Pascal Paillier absolute. Just like we use method Math.abs() in Java ?
For example, if we subtract 0 from 1: 1-0 = 1, it is positive but 0-1 = -1. My requirement is that this subtraction should always be positive like:

   1 - 0 = 1
   0 - 1 = 1

Is there anyway i can achieve it please?


texts: HD (Hierarchical Deterministic) Keys using Safe Curves?

texts:
Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be derived from a master key, each which can have additional keys derived from it. In addition, some of hierarchy can be 'hardened' to prevent further children from being created.

Bitcoin's HD Keys allow for some fairly powerful functionality in Bitcoin and address a number of important use cases, including key storage UX innovations, auditability, etc. There are also related schemes such as 'pay to contract' that use similar cryptographic approaches that HD keys use.

However, Bitcoin's curve (secp256k1) is not considered to be fully 'safe'.

The most popular safe curve 25519 unfortunately requires secret keys to have specific bits to be set and unset, making them incompatible with the linearity that BIP32 and related schemes (pay to contract) require.

Are any of the other 'safe' curves linear and thus allow for HD Key functionality?


texts: Is the EdDSA signature scheme provable security?

texts: The EdDSA signature scheme is a deterministic scheme. So could it be proven provable security in Random oracle model?


texts: OFB mode and CFB mode error propagation in 64bits

texts: I am trying to understand (in simple terms), how error propagation works in the transmission of ciphertext in both OFB and CFB using a 64bit mode. I am having a hard time understanding the mathematical concepts put into simple terms. Thanks.


texts:
I am implementing client-side encryption for data stored in AWS DynamoDB, and was wondering about the correct use of AWS KMS for key management in addition to using AES/GCM.

I am using the master key stored in AWS KMS to generate a data key used for encryption. I am also using AWS KMS to generate a random number for initializing the IV.

My code looks roughly like so:

GenerateDataKeyResult dataKeyResult =
            kmsClient.generateDataKey(
                    new GenerateDataKeyRequest()
                            .withKeyId("masterKeyId")
                            .withKeySpec(DataKeySpec.AES_128)
                            .addEncryptionContextEntry("encContext", "aValue"));

ByteBuffer plaintextKey = dataKeyResult.getPlaintext();
ByteBuffer encryptedKey = dataKeyResult.getCiphertextBlob();

GenerateRandomRequest randomRequest = new GenerateRandomRequest().withNumberOfBytes(12);
GenerateRandomResult randomResult = kmsClient.generateRandom(randomRequest);
byte[] nonce = randomResult.getPlaintext().array();

GCMParameterSpec spec = new GCMParameterSpec(16 * 8, nonce);
SecretKeySpec secretKeySpec = new SecretKeySpec(plaintextKey.array(), "AES");

Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding", "BC");
cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec, spec);

byte[] aad = "Whatever I like".getBytes();
cipher.updateAAD(aad);

String data = "Hello, World!";

byte[] cipherText = cipher.doFinal(data.getBytes());

In theory that seems to work, but I am not fully confident in that I am using it correctly. In particular:

I will store the encryptedKey with the encrypted data, but can I use the same key for all rows or do I need to generate a new one for each one?
How does the AAD factor into this? Do I need to store it? Does it need to be unique per row?
Do I need to generate a new nonce for each row of data? Can I store it together with the data?

So far my assumptions are:

I can reuse the same key for all rows
I need to generate a new nonce for each row
I will store the nonce with each row, and additionally store the encryptedKey
The AAD is the same for all rows and I can generate it in a deterministic way so I do not need to store it

Am I in the ballpark regarding my assumptions?

(I also do apologize if the belongs in StackOverflow, I was a bit unsure of where to post this)


texts:
Looking at this presentation, Boneh says that elliptic curves could be defined over $\mathbb{Z}/n\mathbb{Z}$ and not necessarily over a prime field $\mathbb{F}_p$ and hence we could define pairings here as usual.

Assume that $n = pq$ for $p,q$ primes. I agree with him when he says that the pairing is not computable because the elliptic curve group order is hard to find ($p,q$ are secret), hence we cannot apply Miller's algorithm.

Very trivial idea: Keep $p,q$ still secret but publicly expose the order of the elliptic curve group (which can be found by the one that knows $p,q$).

What would be the problem in this case?


texts: Secret-sharing scheme that can be "audited" without auditing code?

texts:
I am designing an app that allows (among other things...) users to divide a secret into 2 shards and was planning to use Shamir Secret Sharing (SSS) to do so.

However, I want to allow users of my app (who may not be coders...) to double-check--without having to audit my code--that my implementation of SSS is not flawed.

In other words, using another implementation of SSS available elsewhere (e.g. on the web or on GitHub), users of my app should ideally be able to obtain the same 2 shards as the ones provided by my app. I understand that, considering the random data used in SSS to compute the shards, this request may not even make sense at all since it may simply be impossible by design...

If that is indeed the case, which other reliable public solution/algorithm could my app use to:
a) separate a secret into 2 shards,
b) allow anyone to recompute these 2 shards outside of my app.

Thanks a lot for your kind support!


texts: I cannot understand the concept of a divisor for an elliptic curve

texts:
I am trying to understand ABE for a project of mine. I've grasped the concept of elliptic curves, but could not understand the meaning of divisors for functions on them.

Could anyone help me with this? I mean, why would we want to define functions on an elliptic?  What is the benefit?


texts: what does the leading byte represent for the initial point G?

texts:
Per SEC 2, the base point $G$ for secp192r1 is as follows:

G = 04 188DA80E B03090F6 7CBF20EB 43A18800 F4FF0AFD 82FF1012
07192B95 FFC8DA78 631011ED 6B24CDD5 73F977A1 1E794811

According to this JavaScript ECDH Key Exchange Demo, when you click the secp192r1 button, the $(x, y)$ coordinates for $G$ are as follows:

x = 602046282375688656758213480587526111916698976636884684818
y = 174050332293622031404857552280219410364023488927386650641

$x$ is equal to what you'd get if you converted 188DA80E B03090F6 7CBF20EB 43A18800 F4FF0AFD 82FF1012 from hex to decimal. Same thing for 07192B95 FFC8DA78 631011ED 6B24CDD5 73F977A1 1E794811.

But what does the 04 at the beginning mean?


texts: Using same key pairs in several different encryption tools and version

texts:
can we use the same key pairs created by an encryption tool, for encryption decryption,

in another encryption tool ? for ex, created by hypercrypt, but being used in cryptermite,
or maybe within the same tool, but different version ? for ex, different version of cryfs,

as long as the tool and version support the algorithm ?


texts: Should I salt an AES password at each encryption?

texts:
I saw a sample code where the same password is salted with a different value (using PBKDF2) for each encryption. That means that the salt must be stored for each encrypted message.

I don't understand why they do that since AES is used here in CBC mode with a random IV at each encryption, so a same plaintext will not produce the same ciphertext.

My understanding is to use a unique key for all the encryptions made with a same password. That key is produced by salting the password and I store the salt somewhere in cleartext. I though it was enough to do that because salting the password ensures the same password does not generate the same key. So the combination of the salted password and the unique IV are enough.

So my question is: is it a better behaviour to re-salt a password at each encryption?


texts:
I am trying to find out some disadvantages of ElGamal cryptography but I'm not able to figure out what's wrong with the algorithm. The only one I found is that a known-plain text attack is possible in ElGamal if the same $r$ is used twice during encryption.

Are there any other disadvantages of ElGamal encryption?


texts:
Questions are as following:

Is 3DES still feasible (in terms of security and
performance) to use?
Is 3DES safe to use in ECB mode?
Every time on giving the same input (plain text) to encrypt via 3DES
results same output (cipher text). What would the reason be for
that?  For example: Every time I gave input plain text 'wealth'
the output generated was 'VxDfWEQA'. Or is that even possible?
If one would want to discourage a company to not to use 3DES with
cipher mode ECB and padding PKCS7 what would that reason
would be and why?
If a company/entity still insists to use 3DES. What configuration
would be the most suitable to be set for it e.g. cipher mode and
padding.

Would like to have the answer of third question considering all possible scenario's if applicable e.g. considering all 3 keys for 3DES were same.


texts: Under the assumption that there exists a real-world implementation of the McEliece scheme, could it be applied to streaming data as is? By that I mean in 'block cipher mode'? I've read that McEliece is very fast in encryption and decryption, hence calculating a session key for a symmetric stream cipher might be unnecessary. Since random errors are introduced into the plaintext while encrypting, could it then be used in 'block cipher mode'?


texts: How can a collision attack using MD5 be used to break WOTS

texts:
It is stated in
Winternitz One time signature security that MD5 is not safe for Winternitz due to collision attack. Given that WOTS generates multiple, say 32 private keys then hashing them a number of times to obtain 32 public keys. How does a collision attack from MD5 break the Winternitz OTS?  Does this mean I have to find 32 collisions of MD5 ?


texts: How is "post-quantum security" proven/shown?

texts:
Due to growing concerns over the threat of quantum computing to asymmetric cryptography (RSA, ECC, etc), a number of "quantum resistant" replacements have been proposed (SPHINCS, McBits, and many more).  How are these cryptosystems proven (or argued) to be secure in the presence of quantum computers?

Are the schemes only proven secure against some finite set of quantum algorithms (Shor's algorithm, Grover's algorithm, etc), or are they proven secure against all quantum algorithms possible in some theoretical model of quantum computing?


texts:
In elementary concepts, mostly scalar exponents shows up in group operations:

$g^x$

As one may encounter in more advanced papers, there are rational exponents over generators. Simply seems like:

$g^{1/x}$

For example, it can be seen at the fouth definition in the paper: q-weak Diffie Hellman assumption

Q1: How should we interpret rational exponents on generators?
Q2: What is elliptic curve notation of the rational multiplicators? $(1/x)G$ ?
Q3: What is relationship between $g^{x}$ and $g^{1/x}$?

Thank you.


texts:
Given $F$ a secure PRF with input size $\lambda$. Define $F'$ as

$F'(k,x||x') = F(k, 0||x)\oplus F(k, 1||x')$

with $x$ and $x'$ of $\lambda-1$ bits.

Is $F'$ a secure PRF?


texts: While reading on block ciphers and DES I read that two-round Feistel network is not a secure PRP? Is there any easy to understand proof to explain the intuition behind this statement. I did search around and also reviewed this question but wasn't really able to understand why it isn't secure PRP. Any help would be much appreciated!


texts: Zero-knowledge problem of Pinocchio (verifiable computation)

texts:
This is a similar (and further) question of
Verification of Pinocchio (verifiable computation)

In Section 2.1, it said

  the outsourced computation is a function, $F(u,w)$, of two inputs: the client’s input $u$ and an auxiliary input $w$ from the worker. A VC scheme is zeroknowledge if the client learns nothing about the worker’s input

But in section 3.1, Protocol 2, the verification function requires all the elements $c_k$, which I think contain the value of all the input wires (including $w$). So how can it hide $w$ from the client?  The Zero Knowledge section said that the GGPR’s rerandomization technique could be used, but the rerandomization is only added to $v(x),w(x),r(x)$, and I guess the client still have to know all the $c_k$?

I've been confused on this for days. Can anyone please help me to understand how the ZK is done?


texts:
The RSA cryptosystem makes use of $n=pq$ where $p, q$ are large prime numbers.
With quantum computing, factorization might become easier, so it will probably be useful to use much much bigger $p$, $q$ in the future.
If I remember correctly, the source of large prime numbers $p$, $q$ in today's most commons RSA implementations is: probabilistic primalty tests.
In a concrete manner, what could be a possible source of much much larger primer numbers (several order of magnitudes bigger than the $p$, $q$ used today)?


texts: Are KDFs such as PKDF2 and HKDF vulnerable to side-channel attacks such as static and dynamic power analysis including the hash type used internally?


texts: Cryptographic Challenge: How to Say Something Confidentially to Snowden?

texts:
The Snowden situation raises an intereting cryptograpic problem. At present, how can something be sent confidentially to Snowden?

Claim:

I have no particular political orientation. The above question is merely a cryptographic challenge. The meta assumption is…

You trust someone, denoted as Snowden, but Snowden does not trust anyone and you do not know any further information about Snowden, except his name or identity.
You should be careful that someone, say FBI, might impersonate Snowden to you.

Objective:

How to build a global and secure communication channel between you and Snowden from scratch, without resorting to trusting any third party?
Snowden does not trust anyone at the beginning, but he wants to find someone whom he can trust, via the secure channel built (if possible) in Step 1. How is this done?

Is this possible to do by using cryptography?

For convenience, let us call this challenge the Snowden challenge. How do we model the security objectives for Snowden and you?


texts: What are the malleability properties of block device encryption with multiple modes of operation?

texts:
When encrypting a block device with a given symmetric cipher with a 128-bit block size in CBC mode, every second plaintext block in a sector can be changed to contain arbitrary data, with the blocks in between being corrupted. When encrypting with XTS mode on the other hand, an attacker has the ability to corrupt an arbitrary block of data.

Now my question is, what do the properties become when encrypting once with XTS, and once with CBC as in aes-xts(aes-cbc(plaintext)), assuming mutually independent keys? Is it limited to the least malleable mode (XTS in this case), so that this chain would have the same malleability properties as XTS, or is the interaction more complicated?


texts: Is there a quick way to know the length of a message hashed using SHA3?

texts:
Let M be the message that has been padded for use into the SHA3 (standardized Keccak) hash function.
Is there a way, like it's the case for SHA1, to know the total length of the message M just by looking at the last block?

For example, in SHA1, I can give you the last block (that was padded) and you can extract the total length of the message (I'm not worried about security here).

Is there anything similar with SHA3 or do I need to count each block separately?


texts: Is There an Opensource Manual Calculation of AES-128 bit?

texts:
Is There an Opensource Manual Calculation of AES-128 bit as in Cronos

I have to learn calculations manually.


texts: Verification in Threshold RSA or Threshold Paillier

texts:
In the key generation of the threshold version of RSA or the threshold version of the Paillier cryptosystem (e.g. "Shoup - 2000 - Practical threshold signatures" or "Fouque et al. - 2000 - Sharing decryption in the context of voting or lotteries") a square $v$ in $\mathbb{Z}_N^*$ ($\mathbb{Z}_{N^2}^*$ respectively) is used for the verification of the private key shares. For a private key share $s_i$ the public verification key $v_i$ is then $v_i = v^{s_i}$, where $v$ is an element of the cyclic subgroup of squares in $\mathbb{Z}_N^*$.

My question is, why does $v$ has to be a square?


texts: Does a Finite Field of 36 elements exist?

texts:
I'm having a little trouble understanding the finite fields theory, so I'm sorry if my question would seem a little stupid.

I wanted to know if a finite field of 36 elements could exist.
Basically, I thought of the field $\mathbb{F}_{37}$, which has 37 elements. But does for example the invertibles of $\mathbb{F}_{37}$ form a field of 36 elements or not? Since all elements are invertible and we have 36 invertibles in $\mathbb{F}_{37}$.


texts: Group for which computing inverse is hard

texts:
Is there any group in which not only discrete logarithm and finding square root are believed to be hard, but also finding the inverse of a given element?

Thank you.


texts: Do any NIST PQC have "homomorphic" public keys, in the sense that any two pubkeys derive a combination pubkey?

texts:
Background:

The MathMesh crypto platform (refs at the bottom) is a newly-proposed technology stack which has been somewhat cheekily called a "Grand Unified Theory of Security on the Internet". Its "Meta Cryptography" module relies on the following property of Discrete-log Diffie-Hellman:

$privKey: x, pubKey: X = x.P$

$privKey: y, pubKey: Y = y.P$

Therefore you can derive "combination keys" by either combining two public keys or two private keys.

$Z=X \oplus Y = (x \otimes y).P$

for some appropriate definition of $\oplus$ and $\otimes$.

Question:

Will this survive the transition to post-quantum asymmetric KEMs? More specifically, how likely is it that there is some definition of $\oplus$ and $\otimes$ that allows "combining" of public keys and private keys in this way for lattice, code, multivariate and/or SIKE keys?

References:

https://mathmesh.com/
7 hours of youtube video
IETF 106 slides, specifically see slides 23-27.


texts: I am learning about crytography and the differences between the public and private keys encryption examples and I was wondering if it is possible to have a private key encryption scheme that is completely insecure? I have not been able to find what that could look like but I'm curious? Or is this not possible? Is the encryption scheme always secure with private keys?


texts:
I have a direct question
Is there any practical attacks on the AES cryptosystem (128-192-256 keys)


texts: Collision-free one-wayish function mapping 32 bit to 32 bit

texts:
As simple as it may sound, I was unable to find a collsion free one-way(ish) function which takes 32 bits of input and produces 32 bits of output. I apologize if I just didn't knew the right keywords to find the function.

Of course, $2^{32}$ is within a range which can be easily bruteforced within a couple of seconds on modern mid to high end retail PC's but the goal is to not let attackers find the input in a way faster than bruteforce.

Also the function should be proven to be collision free, which can be achieved by bruteforcing each $2^{32}$ input. I'm willing to take that task upon me if someone hasn't got the time to do so (or just doesn't want to).

EDIT: I forgot to mention the attack scenario and already discarded ideas:

The function will run in a white-box enviroment so I'd rather not use functions relying on keys to be secure (like Pseudo-Random-Permutations).

I also tried turncating hash functions like SHA-2, Keccak or the underlying hash function of ChaCha. Sadly, all of them have collision when being truncated to 32 bit.

The function will be used to obfuscate if-statements by comparing the outputs of the function.


texts: How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

texts: What kind of quantum computer would be required, if it is possible to break such ciphers?


texts:
What is the minimum number of unique pairs of digests and inputs to a one-time pass needed to verify that a secret is equal to a given s where the output is an integer with of at most digits base-10 digits.

My back-of-a-napkin calculation is the ceiling of:

  log(cardinality(s)) ÷ log10(digits)

For example, in the case where the secret is a 64 bit integer (264 cardinality) and the number of base-10 digits is 6 (106 cardinality), then ceiling(64/6) = 11 pairs of unique inputs that result in the same known digests indicates that the secrets are equal.

Similarly, if s is from the ASCII set and a maximum length of 100 characters then the cardinality would be 127100 and there are 6 base-10 digits then the number of digest/input pairs needed to verify equality of secrets be ~ 127100 / 106 (i.e. "hard")?

I might be way off in my calculations here, but I was just curious.

Edit: Here is my rationale for the napkin calculation.

With every successive input that equals a digest we can reduce the space of the secret accordingly. The question is whether the space decreases linearly, exponentially, polynomially, or otherwise.

Where the cardinality of both the secret and output are the same, then we can verify that we have the secret with one pair of input and output.

If the cardinality of the secret is an iota larger than the output, we need two pairs.

If the cardinality of the secret is double the cardinality of the output, we still need two pairs.

If the cardinality of the secret is double plus an iota, we need three pairs.

And so on.

It would seem to be provable inductively.

In other words, there is an homomorphism from each pair of (input, digest) that maps to a space the size of the output cardinality on the secret space. Each pair therefore reduces the secret space by the size of the homomorphism (i.e. the cardinality of the output).

So the calculation to be answered is how many times the cardinality must be reduced in order to cover the entire secret space, and my thinking is:  cardinality(s) / 10digits?

This is just a brute-force method; there are ways to reduce the space by examining the hash algorithm (which in the case linked above, for Google Authenticator, is SHA1 – with known weaknesses).

EDIT
Upon consideration the cardinality of the secret is at most the cardinality of the resultant hash, which for the OTP linked example is SHA1 and known to be reducible to around 261.

Thus the napkin-based complexity, if correct, would be log2(2^60) ÷ log10(6) ~= 10.167.

The answer then to the specific example of the OTP linked (the one used by Google Authenticator and others) is: One will need eleven inputs and digests to confirm that one has the secret-as-hashed.


texts: Composition of an injective/surjective function and a one way function is still a one way function

texts:
recently I have been reading about OWF and realized that composition of two OWFs g,f are not necessarily a OWF. However if I modify the question a little bit and fix g to be a injective function, and f still being a OWF, is their composition g(f(x)) a one way function? Thanks.

I now understand the intuition thanks to the comments, what if g is no longer one to one, can we prove that composition of g and f are not always a one way function in a same way as how we proved that $f^2(x)$ is not necessarily a OWF here Thanks!


texts: What's the least computationally expensive way to verify a message is from who they say they are?

texts: We're building an ingame GPS system where only 5 lines of code are executed a second. We're starting to face problems with people spoofing the satellites we use to triangulate. Is it feasible to filter out these messages with such low computing power, and if so, how?


texts: How are the constants found in the AVX2 implementation of CRYSTALS-KYBER round 2 generated?

texts:
The post-quantum lattice-based cryptosystem CRYSTALS-KYBER which has made it to the second round of NIST PQC includes two implementations: 1) a baseline reference implementation in C and 2) an optimized AVX2 implementation. The code repository can be found here.

The AVX2 implementation includes some precomputed constants in consts.c such as _ZETAS_EXP and _ZETAS_INV_EXP. I understand that these precomputed constants are used in Number Theoretic Transform (NTT) and its inverse. I also understand how their counterparts - found in the reference implementation -
 have been generated thanks to this question. However, I am not able to understand how they have been generated in the AVX2 implementation? And why some of them are not even reduced modulo q in [0, q-1]?

I read the following papers (listed below) in order to understand that, but I could not find detailed information related to my questions. The only information that might be relevant can be found in Section 4 in 3, which I include below for convenience:

  Precomputed roots. Instead of loading single precomputed roots and
  populating the vector registers with broadcast and various shuffling
  instructions, which is slow, we precompute vectors of roots that can
  be loaded into a vector register with one aligned load instruction
  vmovdqa only.

The following papers describe the initial development of Kyber and how it has evolved:

Initial implementation - round 1 submission is described here and here.
A faster AVX2 implementation is described here.
A more optimized version (with smaller modulus reduced from q = 7681 to q = 3329) uses some ideas from this paper.

I appreciate if someone could explain or refer to other sources which can help understand how these constants are generated.


texts: ElGamal scheme attack when one message is known and ciphertexts are intercepted

texts:
Let $G$ be a finite cyclic group of order $p$ and let $pk = (g, h=g^a)$ and $sk=(g,a)$ be Bob's ElGamal public/secret key pair in $G$. To encrypt a message $m$, a random number $r$ is selected and a ciphertext is set to: $Enc(m):=(g^r,mh^r)$.

ALice uses an PRNG which generates outputs: $r_i$ and encrypts messages $m_1,...,m_k$ obtaining ciphertexts $c_i=(g^{r_i},m_ih^{r_i})$ which are sent to Bob. Every message is intercepted to Eve. Some time later, Eve finds out that $r_{2i}=2r_i$. Moreover she convinces Bob to reveal message $m_j$ ($1\leq j\leq k$). Can she learn a content of any other message? How she can do that? If Eve is able to pick $j$, how many messages she can read? Which one?

Could you help me?

Let's assume that Eve picked $j=J$. She knows about:

$g$, $h$ (parts of public key)
$(g^{r_1},m_1h^{r_1}), \cdots, (g^{r_k},m_kh^{r_k})$ (intercepted ciphertexts)
$m_J$
$r_{2i}=2r_i$

She knows $m_J$ ---> how can she retrieves $r_J$?

I guess that she needs to pick $j=1$. Then she can decrypt $m_1, m_2, m_4, m_8, \cdots, m^{\log{k}}$  ($O(\lg{k})$ messages)

EDIT:
I have some idea without calculating $r_J$. Let

$(c_J,c'_J)=(g^{r_J},m_Jh^{r_J})$

then

$(c_{2J},c'_{2J})=(g^{r_{2J}},m_{2J}h^{r_{2J}})=(g^{r_{2J}},m_{2J}h^{2r_{J}})=(g^{r_{2J}},m_{2J}(h^{r_{J}})^2)$

Let's compute $m_J^{-1} \mod k$. Then:

$h^{r_J} = c'_J m_J^{-1}$

and:

$m_{2J} = c'_{2J} (h^{r_J})^{-2}$

and go on, and go on... am I right?


texts: Proving knowledge of a preimage of a hash without disclosing it?

texts:
We consider a public hash function $H$, assumed collision-resistant and preimage-resistant (for both first and second preimage), similar in construction to SHA-1 or SHA-256.
Alice discloses a value $h$, claiming that she (or/and parties she can communicate with or/and devices they have access to) knows a message $m$ such that $H(m)=h$. Can some protocol convince Bob of this claim without help of a third party/device that Bob trusts, nor allowing Bob to find $m$?
At Crypto 98 rump session, Hal Finney made a 7-minutes presentation A zero-knowledge proof of possession of a pre-image of a SHA-1 hash which seems to be intended for that. This remarkable result is occasionally stated as fact, including recently here and next door. But I do not get how it is supposed to work.
Update: This talk mentions using the protocol in the Crypto'98 paper of Ronald Cramer and
Ivan B. Damgård: Zero-Knowledge Proofs for Finite Field Arithmetic or: Can Zero-Knowledge be for Free? (this version is very similar, or there is this earlier, longer version).


texts: I didn't get the hash length extension attacks

texts:
I was trying to solve a cryptography challenge and the problem was about "hash length key extension". After some reading in different topics, I don't know why I still didn't solve the challenge.

I read this page. From what I understood, we have the MAC which is $\mathrm{md5}(\mathrm{secret}||\mathrm{data})$.  We want to append some string at the end, so we will have the new hash $\mathrm{md5}(\mathrm{secret}||\mathrm{data}||\mathrm{append})$.

When I run $\mathrm{md5}(\mathtt{secretdata})$, I get 6036708eba0d11f6ef52ad44e8b74d5b like in the tutorial.
But when I compute $\mathrm{md5}(\mathtt{secretdataappend})$, I get 81efe001a23d41765fa7323d22861558. However, the tutorial says it should be 6ee582a1669ce442f3719c47430dadee.

In other tutorials it is the same hash value, so I am probably doing something wrong. My instinct is that I have to guess the value of $\mathrm{secret}||\mathrm{data}||\mathrm{append}$, without knowing $\mathrm{secret}$. I only know the length of $\mathrm{secret}$.

Why do I get the wrong hash when trying to perform this attack?


texts: How a collision for a function can be for another one

texts:
We have two bit strings  $x\in\{0,1\}^q$ , $y\in\{0,1\}^w$ of length $q$ bits, and $w$ bits.  The notation $x\mathbin\|y$ means $(q+w)$ bits long concatenation,
And the functions: $H∶\ \{0,1\}^* \to \{0,1\}^n$
and $F∶\ \{0,1\}^* \to \{0,1\}^{n+6}$ defined in terms of $H$ as
$$F(x) = 000\mathbin\|H(1\mathbin\|x)\mathbin\|111$$
How can a collision $(x_1, x_2)$ for $F$ be turned into a collision for $H$ ?
Can any one please explain why, is it because $F$ has also $H(1\|x)$ in it and $F$ implies $H$ ? Or are any collision for $F$ will be a collision for $H$ also ?


texts:
I have tried to look online in various sites and texts and tried to use several youtube tutorials but I still cannot grasp it correctly.

could someone please help me understand a simple case including mathematics so I could better understand it?

For simplicity's sake, there are 3 trust levels: 1, 2, 3. to recover S you need either two users from group 1, OR one user from group 1 along with three users from group 2 and five users from group 3 (offsets of 2 for simplicity).

how a secret can be shared in such a case?

if you can, please elaborate mathematically so I can better understand the words and then begin to exercise with it to understand it better.

EDIT: my attempt, i don't understand how to it, but this is what i got:

To recover a secret S:

Assume that group 1 consists of j participants, group 2 of k participants, group 3 l participants. and groups are denoted as a,b,c accordingly for clarity.

1)2 users from group 1: we needed 2 out of j so we choose one positive integer, so $y=s_0+a_1x+a_2x^2+...a(j-2)x^{j-2}$. to recover we use a straight line(threshold of 2) for  $(a,f(a)), (b,f(b))$

2)A user from group 1, 3 from group 2 and 5 from group 3: $y=s_0+a_1x+a_2x^2+...a(j-1)x^{j-1}+b_1x+b_2x^2+...+b(k-3)x^{k-3}+l_1x+l_2x^2+...+l(k-5)^{k-5}$. it is really complicated for me, but i think that choose the following: $(a,f(a)),(b_1,f(b_1)),...,(b_3,f(b_3)),(c_1,f(c_1)),...,(c_5,f(c_5))$, then since $f(x)=\sum_{i=1}^ty_i\prod\frac{x-x_j}{x_i-x_j}$, we set x=0 to calculate the secret, $f(0)$, and we get: $\frac{f(a)*b_1*b_2}{(a-b_1)(a-b_2)}+...+\frac{f(c_5)*c_3*c_4}{(c_5-c_3)(c_5-c_4)}$

would appreciate corrections so i can fix my mistakes. thank you very much


texts:
I'm looking for a scheme that a prover can commit to a value $d$, via a commitment $C$, while also provide ZK-proof that this value $d$, together with a public key $e$, are RSA pairs. (i.e private and public key respectively).

Thanks.


texts: How to choose parameters for Argon2 for password vault

texts:
I'm creating a password vault and I'm planning on using Argon2id to derive the master key from the master password. For encryption I'm planning on using XChaCha20 with Poly1305.
To be clear: a set of multiple passwords and usernames will be encrypted using XChaCha20 and authenticated using Poly1305, using (a random 192-bit IV and) a 256-bit key derived from a master password using Argon2id (the version that tries to both resist GPU cracking attacks and side-channel attacks) (using 256-bit secure random salt; although I might actually just use 128-bit salt because that should also be plenty). (If there's any issues with this setup, such as with using the id version of Argon2 or using XChaCha20, also tell me, but I think these should be suitable.)
Eventually, I'd like to make the password vault usable on both desktop(/laptop) and mobile devices.
Now I want to determine good secure-but-not-overkill default parameters to use for Argon2id, that are both suited for modern mobile phones and normal computers. The parameters to choose are the following:

Time cost (number of iterations)
Memory cost (number of KiBs to use)
Parallelism (number of threads to use; also influences the output)

The Argon2 draft RFC just tells us to first choose the maximum memory cost and parallelism you can afford and increase the time cost until the function takes longer than you can afford.
Another page references multiple sources, such as the libsodium documentation, which has multiple recommendations:

"For interactive, online operations, crypto_pwhash_OPSLIMIT_INTERACTIVE and crypto_pwhash_MEMLIMIT_INTERACTIVE provide base line for these two parameters"

Currently this means 2 iterations and 64 MiB RAM (see crypto_pwhash_argon2id.h)

"Alternatively, crypto_pwhash_OPSLIMIT_MODERATE and crypto_pwhash_MEMLIMIT_MODERATE can be used"

Currently 3 iterations and 256 MiB RAM

"For highly sensitive data and non-interactive operations, crypto_pwhash_OPSLIMIT_SENSITIVE and crypto_pwhash_MEMLIMIT_SENSITIVE can be used"

Currently 4 iterations and 1 GiB RAM

(In all cases just one thread is used.)
A quick benchmark on my laptop tells me that the function just takes 3.9 seconds with the last set of parameters (using the original Argon2id implementation), which I think is more than acceptable because I prefer having a secure system. However, on my phone this takes 8 seconds (using argon2kt), which is a bit longer than I'd prefer, not to mention that 1 GiB is quite a lot of memory.
For reference I took a look at the source code of password vault KeePass, and it seems they use Argon2d (so less side-channel protection) with 2 iterations with just 1 MiB of memory (but 2 threads) by default: [excerpt from KeePassLib.Cryptography.KeyDerivation.Argon2Kdf:]
internal const ulong DefaultIterations = 2;
internal const ulong DefaultMemory = 1024 * 1024; // 1 MB
internal const uint DefaultParallelism = 2;

It it just me, or is that a bit on the insecure side??
Also, what role does the parallelism parameter play in countering attacks? Is this not as important, as libsodium just keeps it at 1?
Concluding, I think this all is a bit vague and I'd like to have some minimum secure values for the 3 parameters, because what if I take small parameters because I just have a slow phone, while the attacker has a bunch of fast GPUs? Then my vault would be utterly useless.
Also, I imagine one can also go overboard and choose values way larger than necessary; is there some limit after which directly cracking the symmetric key is faster than guessing passwords?


texts: Do identical strings always have the same SHA-256 value?

texts:
If you hash a string using SHA-256 on your computer, and I hash the same string using SHA-256 on my computer, will we generate the same value? Does the algorithm depend on a seed (so we'd both need the same seed) or some other such parameter?

edit:
To clarify, by 'string' I meant 'the same byte input', which as the comments and @ispiro's answer point out, may be different for the same character string depending on the encoding.


texts: How to solve the system of linear equations to recover original file using "Erasure Coding"?

texts:
Following article explains a simplified version of Erasure Coding:

Link to the article

  here is the recipe:

  Take a file of size M.
  Split the file into k chunks, each of the same size M/k.
  Now, apply the (n, k) code on these k chunks to get n chunks, each of the same size M/k.
  Now the effective size is nM/k. Thus the file is expanded n/k times. We need n to be greater than or equal to k, so n/k is at least 1. If n equals k, you have just split the file and there is no coding performed.
  Any k chunks out of the n chunks can be used to get back the file.

  So this also means that the code can tolerate upto (n - k) erasures.
  The following figure shows this recipe being followed for a (4, 2)
  code.

  Without really wondering how do actually add files, the following
  example illustrates one particular case of designing a (4, 2) code.

  Lets say you have four computers (aka nodes) that you can use to store
  files. Instead of putting all the eggs in the same basket, you will want to
  spread it out and in this case, store the file twice by doing
  something like this:

  where X1 is the first block of file A and X2 the second. Another way
  is to store the coded blocks:

  Now if you lose nodes 1 and 3, in the case when you store uncoded
  blocks, X1 is lost permanently, so the file A gets corrupted. Whereas
  in the case when you store coded blocks, even when those two nodes
  fail, it is possible to recover X1 and X2 and thus A from A2 and A4.
  This is because A2 = X2 and A4 = X1 + 2*X2. So one can solve these
  equations and get back X1 and X2! Neat, isn’t it?

And my question is related to the last sentence:

How to solve these equations and get back X1 and X2 ?

We have two equations:

(1) A2 = X2
(2) A4 = X1 + 2*X2

AFAIK: We are able to solve an equation, if the number of equations is equal or more than the number of unknown variables.

Based on this:

Which ones are know and which ones are unknown in two above equations? A2 and A4 are unknown? Or X1 and X2 are unknown ?
If X1 and X2 are known, then we are able to find A4 and A2 even by a single equation.so, we do not need two!
If X1 and X2 are unknown, then they will be found based on A2 and A4. In this case, how is it feasible to recover the original file by two coded values A2 and A4 ?

How to solve this system of linear equations ?

It is NOT clear to me which one is known and which one is unknown:

A2 and A4 are unknown?

Or

X1 and X2 are unknown?


texts: Defending hybrid encryption schemes against padding oracle attacks

texts:
I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server.

Key encapsulation: a 128-bit symmetric key is generated and asymmetrically encrypted.

Data encapsulation: a 96-bit IV is generated, the plaintext is encrypted with AES-GCM using the generated key and IV. The IV is prepended to the ciphertext.

The key is disposed of at the end of transmission and never reused.
The response to the client is not a decipherment of the ciphertext.

It is my understanding that the encapsulated data portion isn't susceptible to padding oracle attacks by virtue of it being based on authenticated encryption.

I am concerned about key encapsulation, though:
1) is RSA-OAEP susceptible to padding oracle attacks?
2) if I were to use textbook RSA encrypt the concatenation of the key its MAC, would that be better or worse than RSA-OAEP?
3) which elliptic curve based asymmetric encryption scheme is adequate for my use case?

Thanks!

This 2001 paper(.ps) describes a variation on DHIES that provides PKAE (public key authenticated encryption).

The scheme is called DHETM:
1) A shared secret key is derived from client and server key pairs.
2) The key is halved into an encryption key and mac key.
3) We encrypt, then MAC

Any third party attempt to forge requests will almost certainly fail MAC verification.

Is this scheme accepted as secure?
Is this DLP/EC scheme preferable to RSA for the purposes I describe?

To sum things up so far:
1) Being based on DH, DHETM as I described it is indeed public key cryptography but can't really be considered asymmetric encryption -- The sender doesn't blind itself to the content of the message after encryption.
2) @CodesInChaos suggests (noise boxes)[https://github.com/trevp/noise/wiki/Overview] as an NaCl-inspired one-way encryption
3) @RichieFrame suggests encrypting a block-sized random message and forgoing padding. The symmetric key is derived by hashing the message down to the desired size. Is EC ElGamal adequate for this purpose?


texts:
What is the probability that two separate RSA public moduli are the same? For example, consider a 2048-bit modulus. The number seems to be huge, but the choice for prime factors p and q is much more restrictive: They both should be 1024-bit in size, not too close to $\sqrt{p*q}$ and the most significant bit should remain set. Even if $2^{1023}$ seems like a lot of numbers, not every integer in this set suits the RSA scheme.
Since public exponent $e$ should be set to $0x010001$, if I find a collision for the RSA modulus, have I also found a collision for the RSA private exponent?
Is it possible to treat the public RSA components (e.g. represented as $H(modulus, exponent)$) as a unique value for identification purposes?


texts: What is the meaning of "trapdoor" in cryptography?

texts:
I do not really understand the meaning of a "trapdoor" in cryptography, so here are my questions:

What is the meaning of trapdoor and how can I convert a word or string using a trapdoor in cryptography?
Is a hash function considered to be a trapdoor function, or is a trapdoor function some kind of encryption?
What is the result of trapdoor function, a numeric or a string result?
What does trapdoor itself mean? Does it mean a private key is used in a trapdoor function or does it point to the string after transmission?

It would be nice if you could explain with examples.


texts: What are the advantages of SM3 and SM4 compared to NIST-approved algorithms (SHA3 and AES)

texts:
Armv8.4-A will add extended support for more cryptographic primitives, to include SM3, which is a cryptographic hash function used in the Chinese National Standard; and SM4, a 128-bit block cipher; along with SHA2-512 and SHA3. 1

I am just curious as to why Armv8.4-A added support for SM3 and SM4? It's odd, especially since SHA3 is slightly more secure than SM3 (in collision attacks, but SM3 is more secure in distinguishing attacks). 2 The SM3 cryptographic hash function and AES offer better security than SM4. 3

Question:
Is there any advantage in using SM3 or SM4 over NIST-approved algorithms?


texts: Common cyphers where the plaintext is the same length as the cyphertext

texts:
What are the common cyphers where the cyphertext is always the same length as the plaintext?

I can think of XOR cyphers, and letter-substitution cyphers, what others are there?


texts: RSA exhibits symmetrical properties — is it possible to form a cryptanalytic attack?

texts:
This question is broken into two sections really:

Symmetry in RSA

I have been analyzing raw RSA and I have noticed some interesting symmetrical properties of the algorithm.

Assume that $M$ is a positive integer between $2$ and $N\over2$, ($N$ is the RSA modulus). Then:

$$
   M_s = N - M
\\ C = M^e \pmod N
\\ C_s = M_s^e \pmod N
$$

This means that $C + C_s = N$, $M + M_s = N$, $C - M = C_s - M_s$ and  therefore $C_s = N - C$. Also,
$$(N-M)^e \mod N = N - (M^e \mod N)$$

Let the RSA modulus ($N$) be the circumference of a circle radius $r$. Converting each $M$ value from $1$ through to $N - 1$ into segments of the circumference, each with an equal angle between segments, then it will be possible to convert each $M$ and its corresponding $C$ into Cartesian coordinates ($X, Y$) using the formula:

$$ (X,Y)= \left(r \cdot \cos({M\over360}) , r \cdot \sin({M\over360}) \right) $$

Using $X$ and $Y$ to plot a line across the circle from $M$ to its corresponding $C$ value. In some cases when calculating $C$, $C$ will be equal to $M$ (for example when $M = 1$). In these cases draw a loop back to $M$.

In all cases the end diagram will be symmetrical through the diameter of the circle from 0 to 180 degrees.

Example: RSA using $P=11 and Q=7$

(These small numbers were chosen deliberately in order to show the symmetrical pattern. The symmetrical property is the same with large primes, but because there are so many more $M$ values the image becomes a blur of lines, which are indistiguishable from one another. It is also impossible to spot the loop backs (see below)).

This also means the one can accurately predict the cipher text of a symmetric partner of $M$.

Inherently weak primes and RSA

Some prime numbers are very weak with regards to RSA. Examples include $P = 257$ or $Q = 193$. This is because $P-1$ is smooth, e.g. $P-1$ is smooth to $2$ ($2^8$), $Q-1$ is smooth to $3$ ($2^6, 3^1$). When these two primes are combined as $N=PQ=49601$, this produces $16705$ “loop backs” (where $C = M$). The interesting thing about this is the value of $M$ when the “loop back” occurs. For this combination the first ten loop backs are:
$$1, 3, 8, 9, 11, 13, 14, 20, 23, 24$$

Why is this significant?

If $Z = C \pmod M$ then in most cases $Z = M$. Where this doesn’t happen we can say that:

If $Z = 0$ then $T_1 = C$ else $T_1 = Z$

This means that in most cases $T_1 = M$. Thus we can say:

If $T_1 \neq M$ then $T_2 = \gcd(T_1, N)$
If $T_2 = 1$ then $T_3 = M – C$

In most cases $T_3 = P$ or $Q$. When $T_3 \neq P$ and $T_3\neq Q$:
 - $T_4 = GCD(T_3, N)$
 - $T_4$ will be either $P$ or $Q$.

$T_5 = {T_3 \over T_4}$.

The value of $T_5$ will always be one of the loop back $M$ values, e.g. $1, 3, 8, 9, 11, 13, 14, 20, 23, 24, \dots$

Although this is easy to demonstrate with small value weak prime numbers, the same case is applicable to large value RSA with strong primes. These are harder and more time consuming to calculate because of the vast size of the data to be collected. To perform this analysis one must iterate over every $M$ value between $2$ and $N – 1$.

Example: Loop back image for $P=257, Q= 193$

My question:

Is it possible to use any of this information to form a cryptanalytic attack against RSA?


texts: Questions about Key Derivation Functions

texts:
My understanding is that a KDF is a function that takes a master secret and generates multiple keys. It is secure as long as the keys are "independent". If this is true, the following definition would generate a secure KDF, right?

  Assuming we have access to a completely random function, $R:
\mathcal{K} \rightarrow \mathcal{K}$, we can define  a $KDF :
\mathcal{K} \rightarrow \mathcal{K}^n$ that on input $S \in \mathcal{K}$ performs
  the following.
  $$K_1 = R(S \oplus 1)$$ $$K_2 = R(S \oplus 2)$$ $$\vdots$$ $$K_n = R(S
\oplus n)$$
  Output $(K_1, K_2, ..., K_n).$

Now of course, we cannot construct random functions so what we do instead is to replace $R$ by a pseudorandom function that no "efficient" adversary can distinguish from random.

Questions:

Does this mean that replacing $R$ by, e.g. $AES(k, \cdot)$, where $k$ is fixed would also give a secure KDF? Does $k$ need to be chosen with some care or can it be any value? Would $AES(\cdot, m)$ for a fixed $m$ be equivalent?
Does this mean that replacing $R$ by any secure hash function would also give a secure KDF? If that is the case, why does some KDF-suggestions use HMAC instead? Is this only to get a larger "security margin", and to be less depending on the security of the used hash function? Would replacing XOR above with concatenation (which is possible for the hash-function case but not for block cipher case) affect security?
If I want to implement a secure KDF, and already have access to AES, SHA1-512, and HMAC, how would I do it such that it is simple but yet secure?


texts: How can finding a collision help an attacker with tampering messages with HMAC

texts:
As stated in the HMAC RFC (RFC 2104):

  The strongest attack known against HMAC is based on the frequency of collisions for the hash function H.

How can a collision benefit an attacker? I would have thought that the strongest attack would be a brute force attack aimed at discovering the secret key.


texts: In what cases might PRESENT be implemented as encryption-only?

texts:
In the paper, under section 4.1 Goals and environment of use we read:

In applications that demand the most efficient use of space, the block cipher will often only be implemented as encryption-only.

I presume this is NOT the same as one-way encryption (perhaps I should say hash?) as used for passwords.

So in what cases might we need only encryption but not decryption? It seems strange we would encrypt something that does not need decrypting at some point.

Furthermore, the quote above continues with ...

In this way it can be used in challenge-response authentication protocols and, with some careful management, it could be used for both encryption and decryption ...

This just added to my confusion.

It seems PRESENT can decrypt a ciphertext by running it in reverse. So why the need for some careful management for PRESENT to be used for both encryption and decryption?


texts:
Alphabet: [A-Z] = [0-25]

Plaintext = HELLO = 7 4 11 11 14

// QUESTION: do this key must be as long as plaintext?

KEY: [QWERT]
KEY = 16 23 4 17 19

Plaintext + Key = 23 27 15 28 33

Plaintext + Key (mod 26) = 23 1 15 2 7

Cyphertext: XBPCH

So is it correct that IF plaintext = "HELLO!" THEN the key must be six characters long, such as "QWERTY"?


texts: How to compare the size of two shared secrets?

texts: Suppose there are two secrets x and y which are split as $[[x]]=x_1+x_2+\cdots+x_n$ and $[[y]]=y_1+y_2+\cdots+y_n$. Is there anyway to generate a bit [[x > y]] with additional assumptions?


texts: Where did they get numbers for RSA factoring challenge?


texts: Send a message to an entire group of recipients

texts:
I'm attempting to send a message to a group of recipients, through an untrusted intermediary.

Each of the recipients will have been invited to the group by someone who already has a trusted public key from them.

The best solution I've come up with so far is that a shared secret is created by the first member of the group, and that is sent encrypted to each of the future recipients by whoever invited them. All messages addressed to the group will be encrypted with the shared secret.

Are there any major flaws with this approach? Is there a better, more well known approach?


texts: SSL certificate / SSL configuration - FIPS-197 compliance

texts:
What does it mean when we talk about FIPS-197 compliance in the context of SSL certificates, their deployment and usage ?

I am almost certain that the FIPS-197 compliance in the context of SSL configuration is not about how the certificate is generated and signed but rather about how the web server / application server(Eg: Jetty / Apache / Nginx / JBOSS etc) are configured. By configured, I mean to say - the SSL / TLS version that is being used and specifically the CipherSuites that are in the allowed list and their order.

This document has the recommended CipherSuites. My understanding says that if we ensure that the client and Server negotiate a CipherSuite that uses AES for confidentiality (Eg: TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA) then SSL configuration is FIPS-197 compliant. Is my understanding correct ?

OR Is there anything required during the certificate generation process as well to ensure compliance with FIPS-197.

I am kind of confident about my understanding but just want to be sure.


texts: I read the zcash paper recently. But I have been puzzled by a question. How did the authors prove that the coin commitment appears as a leaf of a Merkle tree with root rt? Apparently, the authors provided authentication paths for a commitment. But how to provide them in a private way?


texts: Curves intended for both signing and key agreement

texts:
I need some guidance on elliptic curves that support signing and key agreement.

I am trying to develop a protocol for sending encrypted, deniably authenticated messages. To do this I will sign the message with a 2-key ring signature using the sender's signing key and the recipient's encryption key.

Is there a sensible elliptic curve to use for this? Ideally it would meet the safe curves standards and provide the same level of security as Curve25519 (i.e. 256 bit length / 128 bit security).

Ed448-Goldilocks looks like it fits the bill as a curve intended to support both functions but is there anything more lightweight?


texts: What kind of decryption is used in this example?

texts:
I stumbled upon an encrypted text on a website, to which Google had brought me, showing me the plain text also. So does anyone know what kind of encryption was used here and how to decrypt it, so I can decrypt the rest of the text?

Encrypted text:

  Deälldllod Lokl Koih, dg emlll ld kmd Llshlloosdelädhkhoa Lühhoslo ha Melhi hlhmoolslslhlo, dgiill kll shllll Hmomhdmeohll kld M8-Modhmod

Plain text:

  Spätestens Ende Juli, so hatte es das Regierungspräsidium Tübingen im April bekanntgegeben, sollte der vierte Bauabschnitt des A8-Ausbaus

First it looked to me like a substitution cipher, but there are multiple letters which translate to l. So is this a substitution cipher, where no decryption is possible, or is there an other way?

I look forward to your suggestions.


texts: Using ECDSA to sign a ECDiffieHellman-derived key

texts:
Assuming that Alice and Bob know the hash of each other's public key, take this method:

Use ECDiffieHellman with temporary private keys each time to generate a per-session shared symmetric key
Create an AES connection secured with the shared key (unique IVs for each message, verified with HMAC)
Send their public keys along with their signatures of that particular session key over the encrypted connection to authenticate each other (by verifying that the public key matches the stored hash, and that the signature was signed by the public key).

Is this a safe way to create a secure and authenticated session? Are there any better ways that do not require pre-existing knowledge of the private key (or trust in a centralised certificate authority). I know that you should always try to use standard libraries, but I am interested in understanding more about cryptography - this will not be used in any critical software.

Thanks very much for your help.


texts: Does the exact distribution of padding bytes in PKCSv1.5 type 1 matter?

texts:
[Disclaimer: I am fully aware PKCSv1.5 is horrible and should die (though tell that to the TLS v1.2 specification). I am asking this question for my own edification.]

PKCSv1.5 encryption padding (as seen for instance in RFC 3447) formats the RSA message representative as

EM = 0x00 || 0x02 || PS || 0x00 || M

Where PS is at least 11 bytes taken from $[1...255]$ (i.e., no zero bytes are allowed). In most implementations I have seen, this is done by rejection sampling, i.e. the RNG is sampled repeatedly and bytes consisting of $\texttt{0x00}$ are skipped.

My question is the following: if PS is generated from a non-uniform distribution, are there any security issues that arise? As a concrete example, take PS to be the output of a CSPRNG but whenever the RNG outputs a $\texttt{0x00}$, instead of resampling the RNG just take $\texttt{0x01}$ as the output instead. So $\texttt{0x01}$ bytes will appear twice as often as normal. Yet this statistical abnormality in the padding does not seem to lead to any practical attack I am aware of.

References to any attacks in this line are welcome. For example if the padding bytes are derived using a LCRNG, does that cause any problem? (It certainly seems like a horrible idea, but again I'm not aware of any specific attack.)