texts: Extended Euclidean Algorithm (back substitution)

texts:
I have found from the values of P (11) and Q(7) that n=77, (p-1)(q-1)=60 and that e=43 as it is relatively prime with 60.

However, I believe the value I got for d (7) is wrong. Here is my workings out:

60x + 43y = 1

60=1(43)+17
43=2(17)+9
17=1(9)+8
9=1(8)+1

Then:

1=9 - 1(8)
1=9 - 1(17 - 1[9])
1=1(9) - 1(17) + 1(1[9])
1=1(9) + 1(1[9]) - 1(17)
1=2(9) - 1(17)

1=2(43 - 2[17]) - 1(17)
1=2(43) - 4(17) - 1(17)
1=2(43) - 5(17)

1=2(43) - 5(60 - 1[43])
1=2(43) - 5(60) + 5(1[43])
1=7(43) - 5(60)

therefore d=7, right? It seems to not work in practice and I can't figure out why :(

The issue is when I apply these values into these formulas:

$$C = M^e \bmod n$$
$$M = C^d \bmod n$$

For example, when I make M=2 (for B) the result is C = 53.0009765625...
But using the formula to decrypt it doesn't return back to the original value

I would really appreciate any advice and apologies if I have worded it badly.


texts: What's the principle to design the functionality under UC framework?

texts:
Though I can get the basic idea of UC Framework, namely let the environment cannot distinguish the real protocol with the real adversary and the functionality with the simulator, I am still puzzled in details:

What's the principle to design the functionality, if it aims to a new scene that Canetti hasn't treated? Are the ability to corrupt parties (by some unknown methods) required to be written into the functionality? What else (except the normal functions) should be written into it?
It is required that the simulator must successfully deal with any adversary. So how to 'predict' the behavior of adversaries if there are some abilities of adversaries which are not listed in the functionality?
What will happen if I write an only seem-to-be-right functionality?
Why do real protocols mostly ignore the message type field (as new-session, test-password, ...) used in functionalities?
Does the environment gives some inputs to the simulator? Does the simulator need to simulate any non-corrupted parties? What information can be got by simulator?
In the real world, who controls the non-corrupted parties?
In the hybrid worlds, who controls the non-corrupted parties? Are they the worlds that exist both simulators and adversaries? Who else exists in those worlds?


texts: In R-LWE, is there any advantage to generate secret from normal distribution instead of uniform distribution

texts:
In this quote from Lattice Cryptography for the Internet (page 8), author says that we can use error distribution (the same one that we used to generate error) to generate secret. My question is considering that sampling from normal distribution is costly, is there any advantage to also use normal distribution to generate secret instead of normal approach which is generating secret from uniform distribution. I am just wondering. Is just to prove that if secret is also generated from the same normal distribution, proof works ...

Because it is confusing and it does not make sense, newHope generates secret from distribution (binomial in case of newhope) (page 3) and this key exchange protocol also uses normal distribution to generate secret (page 8).

If I understood it correctly, in LWE only error has to be generated from normal distribution, not the secret. The same goes for R-LWE and R-LWE key exchange. Sampling from normal distribution is costly and we want the error to be close to zero so we can reconcile the key but why secret should be close to zero?

  We now recall the ring-LWE probability distribution and (decisional)
  computational problem. For simplicity and convenience for our
  applications, we present the problem in its discretized, "normal"
  form, where all quantities are from $R$ or $R_q = R/qR$, and the
  secret is drawn from the (discretized) error distribution.


texts:
I am trying to see if there were any incidents in the past where using PRNG or not actual random scheme leaded to wrong conclusion in research.

For example, a lot of fields today use simulations to predict natural science results and I was wondering what are the best practices and if there were any flaws due to bad randomness in the past.

For security purposes it's clear that one has to use encrypt lib random function, but for science or simulation of physical systems I am not sure it's the case. My guts say it should be the same, but I am not sure how to justify it.

Are there flaws in (cryptographic) science/engineering/software/research due to pseudo random generators?


texts: What security is provided by a certificate?

texts:
I've been working on the topic of certificates for a little while, and here is what I understand:

A certificate is basically a public key + some data about the owner of the certificate + a signature made by the private key of the owner
When a client wants to communicate with a server, the server sends him its certificate, and so the client is able to ensure that he is communicating with the server
A server's certificate is supposed to be signed by a certification authority trusted by the client. That means that the server is trusted by someone the client trusts. If we assume that the trust is transitive, that implies the client trusts the server.

I'm OK with that if the CA has investigated the server, and then it is legitimate to tell that the server it is trustworthy.

But I saw that some CAs give certificates automatically (e.g. Let's Encrypt). Then I am wonder how the CA can ensure the server is trustworthy...

Is there something I missed ?


texts: Is this adaptation of one-time-pad still secure?

texts:
Having shared a pad of length double the length of your anticipated message, splitting it into x and y.

Then using x to encrypt the message, and using y twice to encrypt the next pad, would that be insecure (seeing as the data I'm encrypting would still be random)?


texts: Does the AES Mixcolum Matrix use a fixed or random matrix?

texts:
I understand how work the multiplication but I'm confused if the matrix to use is fixed or variable.
The site where I read how mixcolums work is this https://math.stackexchange.com/questions/248456/matrix-multiplication-in-aes-mixcolumns-step
Thanks in advance for the replies.


texts: SHA256_HMAC for deriving session keys using a counter

texts:
I need to generate some session keys from a master key that was generated from an ECDH key exchange.  The master key is 256 bits and I need 256 bit  sessions keys.

Is it safe to use SHA256_HMAC with a counter as the HMAC input to get the session keys?

skey1 = SHA256_HMAC(master_key, 1);

skey2 = SHA256_HMAC(master_key, 2);

skeyN = SHA256_HMAC(master_key, N);

The counter is meaningful to the application to know which session key to use.  I have also looked at Hashed Key Derivation Functions (HKDF) but it seems like that is more useful when you need a long random output from a given input. My output length is the same as the input length and I need to be able to generate the correct session key based on a counter value (might not be sequential calls). The counter is essentially an id.


texts: Has the security of the IBS scheme suggested by Shamir in 1984 ever been proven?

texts:
My question is about the original IBE proposal by Shamir from 1984:
https://link.springer.com/content/pdf/10.1007/3-540-39568-7_5.pdf
In addition to proposing the idea of IBE, it also proposes a concrete Identity-based Signature scheme, however without proof of security or any reduction to a known assumption. Has it ever been proven to be secure since then, or otherwise, has an attack on it been suggested?
Thanks!


texts: How to calculate RSA CRT parameters from public key and private exponent

texts: Given the public key (n, e) and private exponent (d), how to calculate CRT parameters (p, q, dP, dQ, and qInv) of this RSA key pair?


texts: can I use PBKDF2 instead of hmac as a hashing tool for sensitive data

texts:
I have read about hmac and PBKDF2.

PBKDF2 - is mainly used for password hashing. It uses hmac and iterates.

I want to hash some sensitive data and send in the response of a request.

Later that hashed sensitive data will be send back with some form data.

So in my case is it safe to use PBKDF2 as hashing tool - to hash any thing like (timestamp+sensitive_info+extra_info) with a SECRET_KEY just similar to hmac


texts:
For CCM mode of AES can anyone explain what the difference is between $B_i$'s and $m$? Is the nonce value for $B_i$'s and $A_i$'s the same?

What is $l(a)$ and $L$? What is the minimum value of size of $m$?

Does authentication process use the data of $m$?


texts: Algorithm to compute DLOG for elliptic curve $E(F_p)$ with order p

texts:
I was reading about elliptic curves in this pdf. Page 55 of the pdf states that if number of points on elliptic curve #$E(F_p) = p$, then there exists a p-adic logarithmic map that homomorphically maps points in $E(F_p)$ to $F_p$. Now, solving for discrete logarithm on $E(F_p)$ reduces to solving for discrete logarithm in $F_p$.

Can anyone please explain what is p-adic logarithmic map and how to compute it? Does the technique extend to $E(F_{p^k})$?


texts: Schnorr authentication protocol vs Schnorr signature Scheme

texts:
As I understand the schnorr authentication protocol is an interactive protocol where a prover WLOG proves to a Verifier that he possesses the discrete log to some group element.

If we use the Fiat-shamir heuristic and turn this into a non-interactive protocol, then this becomes the schnorr signature scheme.

Is the following correct:

Since Schnorr signature scheme is a signature scheme, we would like it to be unforgable, non-repudiation, etc; all the properties of a signature scheme.

Since the Schnorr authentication protocol is an interactive protocol, we need it to be complete and sound.

Our Schnorr Signature scheme does not need to be sound or complete because it does not make sense for a signature scheme.

If the non-interactive version of the schnorr authentication protocol was not a signature scheme, then we would need it to be sound and complete.


texts: Performance of Counter mode (CTR) with Ciphertext Errors

texts:
In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about Counter mode (CTR) the authors say that:

  "As a result, its performance is identical to OFB's when errors
  are introduced in the ciphertext."

What does this mean ? The authors don't explain it


texts: Is webkey a reasonably secure authentication system?

texts:
I just created Webkey in the last couple days. This should allow any website to do single-password auth with a much higher level of auth security and convenience for users (single password with potentially hours or days expiry, text-entry-less single-click authentication if the password hasn't expired yet).

It uses RSA keys generated in-browser, stored in encrypted form using aes. The user's password is never sent over the internet (even in encrypted form). This utility can be hosted entirely statically (and is currently being hosted at http://webkey-auth.github.io/guest.html ).

Is what I'm doing here theoretically secure? I think this could be a huge improvement over auth based on sending usernames and password - which is kind of the weakest link in internet security at the moment. What are potential problems with how this works?


texts: Can one claim that AES is a perfect cipher?

texts:
I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES.

Obviously AES isn't a perfect cipher, since the key length is only 256 bit at the maximum. But when talking about messages of sizes 128 bits to 256 bits, can one claim that AES is a perfect cipher?

Meaning, how can I prove that $\mathbb P(P|C) = \mathbb P(P)$, where $P$ is plaintext and $C$ is ciphertext ($\mathbb P(x)$ is probability of $x$)?


texts: Strategies for fast integrity attestation over multi party computation for large messages

texts: I am looking for ways to efficiently perform integrity attestation over large messages using multi party computation. While, hashing (SHA1, 256...) is one alternative but it's painfully slow and grows linearly in length of the message.


texts:
Assume that I want to leave an encrypted message to a group of $n$ people in a way that they can only decrypt it if they work together in the following sense:

For some fixed $k < n$ every sub-group of $k$ or more people should be able to decrypt the message while less people do not suffice.

One way to do this would be generating keys $r_1^S,\ldots,r_k^S$ for every subset $S$ of $k$ people in a way that $r_1^S,\ldots,r_{k-1}^S$ are random and $r_1^S\oplus \ldots \oplus r_k^S=q$ where $q$ is the secret key to any symmetric encryption algorithm.

If $k$ people choose to cooperate they can simply add up their keys (corresponding to that set of $k$ people) and decrypt my message.

The problem is that this procedure is very inefficient: For $n=100,k=30$ we would already need to generate $\binom{100}{30}\approx 3\cdot 10^{25}$ sets of keys. Is there any more efficient different way to solve this problem?


texts: What is the most light-weight symmetric cipher thats still usefull?

texts:
I need a very light encryption scheme which costs almost no performance during encryption (while decryption may be slow).

I found 5 algorithms: RC4, DES, LED, PRESENT, and Piccolo.

But how do I pick one that's faster than AES on my platform?


texts:
As the topic says, since when can ECC cryptography be freely used?

Is it not widely used because of patents? There is no alternative to it on embedded devices and smart cards.

Just to mention: I am not from the USA. I'm a simple user who wants ECC to be wide supported.


texts: Why can't NORX produce intermediate auth tags like Keyak can?  Keyak appears quite attractive because of this, but seems to be slow in the absence of hardware acceleration.


texts: Is there an actually an alternative to using Diffie Hellman in TLS handshake?

texts:
After looking into how TLS handshaking works it seems to inherently include the Diffie Hellman algorithm during the point where they generate a shared secret key.  However as I look into this some more I find articles such as this: https://thecybersecurityman.com/2018/04/25/https-the-tls-handshake-using-diffie-hellman-ephemeral/

  "I published a blog post several months ago illustrating a simplified step-by-step process of how https and the TLS handshake typically work. BUT! There is an alternative approach that uses a key agreement protocol called Diffie-Hellman Ephemeral (DHE). This is a process of creating a secret key in plainsight using modular arithmetic."

Looking at the blog post mentioned it seems like the client uses the servers public key to create a shared private key and sends it back.  So it looks like the burden of creating the shared key is actually on the client, and so this is different than Diffie Hellman.  Is this correct?  If so what are the pros and cons of using one or the other?


texts: Extracting $ x $ given $ g^x, g^{x + y}, y $

texts:
Given a cyclic group $ G $ of prime order $ q $ with generator $ g $ in which computing the discrete logarithm is hard.

Is it (still) hard to find the discrete logarithm $ dlog_g(g^x) = x $ if the
values $ g, g^x, g^{x + y} $, $ y $ are known?


texts: Protocol that generates keys every 2 minutes using KDC

texts:
I am using a Key Distributed Center (KDC) and a key distribution protocol such as Kerberos. In order to limit the amount of ciphertext produced with the same
key, I want to renew the session keys every 2 minutes. However, for performance reasons I only want to involve the KDC once per hour.

I thought about extending this protocol by making use of the Diffie-Hellman key exchange but this would require generating a new alpha and a prime number each time which is quite expensive, considering it has to be carried out once every two minutes.

Any suggestion how I can extend this protocol in an efficient way please?


texts:
I am trying to solve the well-known $g^x = y \pmod{N}$
but in this case only $g$ is unknown. What I know :

$x$ is a prime : $2^{16} + 1$
$y$ is known
$N$ is a large number that I managed to factor to two "less large" primes (like 38 figures each)

I found various methods to deal with discrete logarithm but it seems they are always intended to solve $x$. Maybe the answer is not that hard to find but this is a bit beyond my mathematical skill at this point :) Any help is appreciated.


texts: Is a LFSR sufficient for post-processing a biased TRNG?

texts:
I am building a TRNG on a FPGA based on ring oscillators. I found out that Linear Feedback Shift Registers (LFSRs) are commonly used for the post-processing of TRNGs. Here is my initial design:

Let's say that the TRNG core block produces a biased output (e.g. more 1s than 0s or the value is more likely to transition between samples). Is the LFSR sufficient to unbias the input? Would unbiasing the input with e.g. a Von Neumann extractor be beneficial?
A related question is—since a biased input have less entropy—is the LSFR able to extract randomness over time by performing more shifts? If yes, how can we estimate the amount of bits that must be fed into the LFSR from a weakly random entropy source in order to have a strong output?
Edit: Clk is a clock which is slower, independent to the ring oscillator oscillating speed.


texts:
I know that a 128 bit key for AES yields a (around?) 128 bit of security. That means the best attack against the AES scheme is as strong as just brute forcing the key?

What is the intuitively reasoning for this fact?  I think there are mathematical structure in place that should help to find the key easier...

In fact there are symmetric schemes whose security level does not equal the length of the key.


texts:
I recently stumbled across "How to Run Turing Machines on Encrypted Data".

Given that it's now possible to run turing machines on encrypted data, what open problems remain in the realm of Functional Encryption?

(It seems like for every problem in Functional Encryption, one would just say: well, design a TM to compute the function, encrypt the data, then use the above scheme.)


texts: Coefficients in Shamir's Secret Sharing Scheme

texts: Sorry if this is a stupid question, but: in Shamir's scheme, we construct a polynomial and make our secret $S$ the zero-th coefficient $a_0$. What, if anything, necessitates this - in other words, can we make include $S$ as $a_1$ or any other coefficient?


texts: zero knowledge framework for c programs - how to prove correct C program execution with private inputs

texts:
I am looking for a zk framework that could be used for proving correct execution of programs written in C (or any other high level language) such as:

 I know x s.t. SHA-256(x) = y (y is public, x is prover's private input)

or in pseude code:

 void compute(_ *prover_input, _ *verifier_input, _ *output){
    *output = sha256(*prover_input) == *verifier_input;
 }

So far I found pepper project which seems pretty close but it lacks the prover's private input part/zero knowledge part.

I also want to compute more functions than sha and combine them in one proof.


texts:
Consider a stream cipher $E(k)$ which takes a key $k$ to produce a pseudo random keystream.

It should have the property that you can easily generate a set of at least 3 different keys $\{k_m, k_0, k_1, \cdots\}$ such that the key stream generated by the master key $E(k_m)$ is the same as XOR-ing all key streams of the other keys $E(k_0) \oplus E(k_1) \oplus \cdots$

Is this property a security risk by itself, or could such a cipher be used to speed up an encryption scheme with nested encryption, like onion routing?

If it could be secure, are there already any ciphers with such a property?


texts: Why is this signature independent of the message?

texts:
Assume that we have the following signature scheme CL Signature:

Choose a cyclic group $G = \langle g \rangle$ of order $q$.
Uniformly and randomly choose two elements $x,y \in \mathbb{Z}_q$, and compute $X = g^x$ and $Y = g^y$.
The secret key is $sk = (x,y)$, while the public key is $pk = (q, G, g, X, Y)$.
On input a message $m \in \mathbb{Z}_q$, secret key $sk$ and public key $pk$, choose a random $a \in G$ and output the signature: $$\sigma = (a, a^y, a^{x + xym}).$$

In the same paper, they ensure that $\sigma$ is NOT information-theoretically independent of the message $m$ being signed and propose an alternative that achieves this independent notion $$\sigma = (a, a^z, a^y, a^{zy}, a^{x + xy(m + zr)}),$$ where $z,r \in \mathbb{Z}_q$ are another uniformly random elements such that $Z = g^z$ is also part of the public key $pk$.
Several questions arises on that:

What exactly means to be information-theoretically independent?
Why it is not achieved by the first scheme?
What happens if we change $a^{x + xy(m + zr)}$ with $a^{x + xy(m + r)}$?

Intuitively, I think that being information-theoretically independent means that the signature reveals no information about the message $m$. Then, why the first one reveals something about the message $m$?


texts: Brute forcing the secret key in Elgamal encryption

texts:
Crypto noob here, I am attempting to do this programming challenge. I do not have the secret key that is used to decrypt the message. However, the key is small enough for a brute force approach. I am attempting to write a function that will solve for the secret key with other variables used in the process.

  She tells Bob values of $p$ and $pe \equiv p^e \pmod{n}$ (p raised to power of e mod n)
  as her public key. Meanwhile the value e remains her secret key (there
  is no easy way to calculate it from $p$ and $p^e$).

I have $pe$, $p$, and $n$. Here is some code written in java.

static int findE(int n, int p, int pe) {
    for(int e = 0; e < n; e++) {
        if(modular_pow(p, e, n) == pe)
            return e;
    }
    return -1;
}

static int modular_pow(int base, int exponent, int modulus) {
    int c = 1;

    for(int i = 0; i < exponent; i++) {
        c = (c * base) % modulus;
    }
    return c;
}

I calculate $p^e \pmod{n}$ for all possible values, but my "findE" function always returns -1. I have tested my modular_pow function and am certain that is not the problem. Maybe I am misunderstanding the instructions. Thanks for any help!


texts: LFSR Output Sampling for Berlekamp-Massey

texts:
Looking at the use of Linear Feedback Shift Registers in cryptographic algorithms, I have learned that the Berlekamp-Massey algorithm can be used to find the (shortest) LFSR that generates a given sequence.

But I am not sure if I have really understood things correctly.

Since an LFSR function always returns a copy of its (current) state, one only has to collect enough outputs to be able to construct an LFSR that produces the same binary sequence like the attacked LFSR produces. In a sense this could be interpreted as "collect enough samples/output" to be able to create a function that allows to reconstruct the same binary sequence. (Hope that's correct so far?)

Now, what I am unsure about:

correct LFSR output sampling for Berlekamp-Massey

To be able to successfully apply the Berlekamp-Massey algorithm, does it matter if the collected samples/output are collected "in sequence", or is it enough to do "random sampling"?

Differently asked (to ensure you get what I'm trying to ask), which one of the following is correct:

Start by fetching a random output and continue collecting several follow-up outputs until enough outputs/samples have been collected. (what I called "in sequence")
Skipping/missing a few outputs during sampling does not represent a problem, because it does not have to be a series of follow-up outputs; as long as the total number of collected random samples/outputs suffices. (what I called "random sampling")

expected info to be able to calculate the minimum number of needed samples

I've seen some formulas which seemed to point at the calculation, but I do not yet understand them well enough to deduct an answer to the following: Can the minimum number of to-be-collected samples be deducted from a single LFSR sample/output, or would one need more than a single sample/output to calculate the the minimum number of to-be-collected samples/outputs (which would be needed to successfully apply the Berlekamp-Massey algorithm)?

Please don't misinterpret my questions. I'm "doing my research" and I have been reading a whole slew of academic papers that I found in relation to Berlekamp-Massey, but that doesn't mean I'm confident in the fact that I am interpreting those papers correctly. Also, search engines aren't always the best place to find good references. If you know about a specific paper that I should definitely be reading (in relation to Berlekamp-Massey and related LFSR attacks/breaks), I would be grateful if you'ld point me to it.


texts: All-or-nothing transform that doesn't increase message size?

texts: All of the AON transforms I've read about involve generating a key, which increases the message by a few bytes. Is there an AON transform that preserves the message size while still having avalanche properties?


texts: Encryption vs. decryption of same plaintext

texts:
Does the same encryption algorithm given the same plaintext always produces the same ciphertext?

Does this cause any security flaws?


texts: Forgery Attack Against RSA Digital Signature

texts:
I have been reading about attacks against RSA Digital Signature in a book

  The attacker chooses the signature first and then computes the
  message. As a consequence, he cannot control the semantics of the
  message x

why the attacker can't control the message??
Let's say that e=115 ,n=11021 and the attacker want to send the message 3
Can't he just search for a value x in the space n such that x^e=3??

And what if Oscar send to Alice his public key instead of bob's   ?? How dose the RSA Digital Signature protect against such an attack??


texts: Does knowledge of SHA256(secret ∥ known constant) in addition to SHA256(secret) give any information about the secret?

texts: Does knowledge of SHA256(secret) and SHA256(secret ∥ known constant) give any more information about the secret than just knowledge of SHA256(secret)?


texts: Does one time pad randomness help brute force attacks?

texts:
I understand that attempting to brute force the decryption of a message coded with a one time pad results in generating every possible message.  The Wikipedia example is that decoding "EQNVZ" with key "XMCKL" produces "HELLO", but the key "TQURI" produces equally plausible "LATER".

However, a "more random" one time pad is supposedly better than a "less random" one time pad.  So there's a way to compare the randomness of two pads, right?

If key TQURI is "measured" as less random than XMCKL, doesn't the likelihood the pad is as random as possible mean HELLO is the more likely message?

Say a coded message consists of only plain English.  A 50-character message could decode to a huge number of possible messages using the same huge number of possible keys.  As we decode character-by-character we can discard anything that isn't obvious English.  That would still leave a large number of possible messages (I have no idea how to estimate how many), but we would simultaneously be increasing the length of the supposedly random key.

If one possible decoding begins ATTACK AT DAWN using the key GJXWHELZYHWLXE while another decoding begins SEND MONEY NOW using the key AABBCCDDEEFFGG, we can probably discard the latter since a pad would never use such a repetitive key.

Therefore, the rule would be to only retain the English decodings for the "most random" keys.  (I have no idea how to pick such a cutoff.)  Could that possibly reduce the potential messages to a reasonable number of candidates?  (I imagine longer keys let you determine their degree of randomness with greater confidence, but I don't know how to calculate that kind of stuff.)

Another possibility would be to retain only messages that parse reasonably well.  BATTALION ALPHA ATTACKS AT DAWN makes sense, but SUNSET DOGGY COOKIE FLOOR can probably be discarded.

Even if individual messages generate a large number of decoded candidates with sufficiently random keys, it would seem a sequence of messages would establish a context that hints at which decodings are valid.  For example, if Message 1 "equally" (because of key randomness) decodes to the candidates

A. WHEN DO WE ATTACK
B. SHOES GREENER ARE
C. MASHED ROOF CARRY

and Message 2 in reply "equally" decodes to

A. ATTACK AT DAWN
B. LEAVE PARLANCE
C. DOG ALPHA MODE

then it seems the "conversation" is probably WHEN DO WE ATTACK/ATTACK AT DAWN.  (Granted, the reply would also decode to ATTACK AT 0100, ATTACK AT 0200, ATTACK AT DUSK, etc., but we're picking the solutions with the "most random" keys.  And even if the keys for ATTACK AT 0100 and ATTACK AT DUSK tied at an equal level of randomness, it's still useful to know an attack is imminent.)  It would seem the more messages you have, the easier it is to guess (or apply some AI regarding) the general thread being discussed.

Therefore, a modified brute force approach would prune away possible but unlikely decodings by (1) discarding invalid and nonsensical content within messages, (2) abandoning decodings with keys not meeting a required threshold of randomness, and (3) abandoning decodings that don't fit intermessage context.  Pruning would have to be done as each new message character is input, to avoid wasting time and space on futile branches.

Would that kind of approach still leave an astronomical number of possible decodings?  Or could it reduce the candidates to a resonably small enough number that NSA computers might possibly be willing to take a stab at predicting (at some level of confidence) what a set of coded messages is probably talking about?

Wikipedia's entry on brute force says a one time pad attack

  ...would eventually reveal every... character string possible, including
  the correct answer – but of all the answers given, there would be no
  way of knowing which was the correct one.

But it seems like some answers could be computed as more likely than others.  Can the set of possible answers be reduced to a reasonable number, especially when the randomness of the required key is taken into account?


texts: Lightweight block ciphers that support decryption with minimal overhead?

texts:
Lightweight block ciphers are mostly expressed for encryption routine and efforts are made to keep it as light as possible mostly in terms of gates count and power usage although some try to keep latency and critical path in consideration. The designers assume that such lightweight block ciphers will be used in a mode of operation which does not need the decryption routine like Counter mode. However, a few innovative designs also support the decryption routine with minimal overhead in terms of gate count like PRINCE and Piccolo block cipher.

Piccolo needs just 60 extra gates to support decryption on top of encryption circuitry.

Why is there a need for a lightweight block cipher to support decryption routine?
What all other lightweight block ciphers support decryption with minimal overhead in terms of gate count?

I know feistel structures do support decryption by using round keys in reverse order, but we are talking here about lightweight block ciphers. These are implemented in resource constrained devices and really small implementations of these lightweight block ciphers often cant afford to store expanded keys so even feistel structures do need extra gates to manage these issues for supporting decyption.

I do know modes other than Counter like CBC needs implementation of decryption methods, but what practical scenarios force this to happen. Cant the implementers just use counter mode.


texts:
I'm working on small RSA project in university.
At this moment I have done this:

An array of prime numbers is generated from selected range.
$p$ and $q$ selected randomly from this array
$n$ calculated
$\phi(n)$ calculated
$e$ calculated
$d$ calculated

What do you think about $e$ and $d$ in that case?

$p = 29$
$q = 53$
$n = 1537$
$\phi(n) = 1456$
$e = 545$
$d = 545$


texts: Range query on array of encrypted data using homomorphic encryption

texts: Given an array or database entries of encrypted data is it possible given a min/mix value to get a range of encrypted entries? The min and max values would also be encrypted.


texts: Is the ring learning with errors problem still hard if the errors are drawn from some subspace?

texts:
Let $R=\mathbb{Z}_p[x]/x^n+1$ be the ring used in normal RLWE, which is linear space over $\mathbb{Z}_p$ with dimension of $n$, let $S$ be a linear subspace of $R$ which described by linear independent vectors $r_1,r_2,\cdots,r_m\in R$ where $m<n$. My question is:

  Let $s\overset{\$}{\leftarrow} R$, is it hard to extract $s$ by given $\{(a_i,a_i*s+e_i)\}_i$ where $a_i\overset{\$}{\leftarrow}R$ and $e_i\overset{\chi}{\leftarrow}S$ for some distribution $\chi$?

Or

  Is the distribution $\{(a_i,a_i*s+e_i)\}_i$ computational indistinguishable with $\{(a_i,b_i)\}_i$ where $b_i\overset{\$}{\leftarrow} \text{Span}(a_i*s, S)$?

You may assume $m\sim n$ if necessary (it is the normal RLWE problem when $m=n$).


texts: Offline authenticated encryption for pub/sub

texts:
Requirements:

only publisher can create messages
publisher & subscriber can both read messages and authenticate the publisher
offline message transfer
messages can't be read by non-participants
subscribers can be mobile platforms (Android, iPhone), i.e. less powerful processors
messages lifetime target is 15 years
messages are small, a few dozen bytes

I was looking at ECIES with ECDSA but I cannot seem to find a reference using ECIES where the sender has the static key and the receiver is using an ephemeral key. https://en.wikipedia.org/wiki/Integrated_Encryption_Scheme#Informal_description seems typical, but in my scenario Alice wants to send a message and have any of Bob and his friends read it and know that it is from her.

I know that RSA can do this by encrypting a message specific key using a private key and decrypting using the public key (waving hands over some details here) but the exact same construction doesn't seem to work with ECs. Is there an EC construction that has similar properties? I don't want mobile devices to have to suffer 4k RSA keys (to make them hopefully secure into the 2030s).


texts: Encrypting text file line by line with stable encryption

texts:
I want to store files in a secure manner (i.e. no one should be able to decrypt the contents of the file without the secret key) but I also want a diff tool to be able to show me which lines changed (let's assume that you can't learn anything about the content of the file by seeing which lines have changed).

The idea is to encrypt each line individually and convert the result to hex or BASE64 and then write each line into one file. A line with a certain content should always return the same output, no matter where it is in the file.

Specifically, I want a version control tool like Git or Mercurial to be able to efficiently handle the files as text. At the same time, a (self written) UI should be able to show a decrypted diff without the need of decrypting the data inside of the version control tool (git diff would show me the line numbers which I could then decrypt in my app to display them myself).

Is that possible? Do you know where I can find more information how to do this?


texts: What is wrong with my Elgamal signature example?

texts:
I want to construct an Elgamal signature scheme with the group $\mathbb{Z}_{23}^{\star}$ and then to compute the signature for the message $m$ with $h(m)=4$, where $h$ is the hash function that we are using. I want to describe also the verification of the signature.

The algorithm to sign a message $m$ is the following:

Choose a $k \in_{R} \mathbb{Z}_q^{\ast}$ ($1 \leq k \leq q-1 $).
Compute $r=g^k $.
Compute $ s=k^{-1} (h(m)+f(r)x) \pmod{q} $.

$f: G \to \mathbb{Z}_q $

Signature for $m$: $(r,s)$.

The verification is $r^s=g^{h(m)}\cdot y^{f(r)}$.

I have done the following:

A generator of $\mathbb{Z}_{23}^{\star}$ is $5$, $\mathbb{Z}_{23}^{\star}=\langle 5\rangle$.

To construct an Elgamal signature scheme we have to determine the private key $x$ and the function $f(r)$.

Let $x=5\in \mathbb{Z}_{23}$ and $f(r)=r$.

The public key is therefore $y=g^x=5^5\equiv 20\pmod {23}$.

We apply the algorithm for the signature and we get the following:

Let $k=18\in \mathbb{Z}_{23}^{\star}$.
We have that $r=g^k=5^{18}\equiv 6\pmod {23} $.
We have that \begin{align*} s&= k^{-1} (h(m)+rx) \pmod{23} \\ & =18^{-1}\cdot (4+6\cdot 5)\pmod {23} \\ & =9\cdot 34\pmod {23} \\ & = 9\cdot 11\pmod {23} \\ & = 7\pmod {23}\end{align*}

The signature for the message $m$ with $h(m)=4$ is $(r,s)=(6,7)$.

For the verification we have to check if it holds that $r^s=g^{h(m)}\cdot y^r$.

We have that $r^s=6^7\equiv 3\pmod {23}$ and $g^{h(m)}\cdot y^r=5^4\cdot 20^6\equiv 4\cdot 16\pmod {23}\equiv 18\pmod {23}$.

The verification is therefore not satisfied. What have I done wrong?

Example: We consider the group $\mathbb{F}_{47}^{\times}$.

The order of the group is $47-1=2\cdot 23$.

We find that the element $g=2$ has order $q=23$.

Suppose that  the private key is $a=14$, so we compute the public key $y=2^{14}\pmod {47}=28$.

We want to sign the message $m=32$. We choose $k=8$ and we compute $r=2^8\pmod {47}=21$.

We suppose that $h(m)=h(32)=20$.

We compute $s=k^{-1}(h(m)+ar)\pmod q=3\cdot (20+14\cdot 21)\pmod {23}=22$.

So, the signature for the message $m=32$ is $(s,r)=(22,21)$.

To verify the signature we compute $r^s=21^{22}\pmod {47}=9$, $g^{h(m)}=2^{20}\pmod {47}=6$ and $y^r=28^{21}\pmod {47}=25$ and check that $9\equiv 6\cdot 25\pmod {47}$.

So in order to use the function $f(r)$ we have to compute the signature modulo $p$ where $q-1=2p$, and $q$ is the order of the group we are considering, right?


texts: Multiparty computation on circuits that perform group operations

texts:
I see that a lot of multiparty computation and garbling protocols are implemented for circuits like AES or SHA256.
For my project, I would like to garble a circuit that performs some group operations on elliptic curves and RSA groups.
Are there any circuit compiler libraries or garbling libraries that support this? Are there any estimates on the size of a circuit that performs one group operation?


texts: Continuous stream of strong randomness from limited entropy?

texts:
I need a continuous (infinite) strong random generator, but I've only got limited entropy as seed. I know there's already a contradiction there, but I'm looking for a practical approach.

Suppose I have a piece of 1024 bit strong random entropy (a one time constant for this particular stream), and a cryptographically secure hash function, say Sha512 or Sha3-512.

Would this generate a proper stream of random data:

Next block of random bits = hash( unix or system time || entropy || last block of random bits )

Fundamentally I know there is no more real entropy in this than the initial 1024 bits. Plus maybe one bit or so per round from the unix or system time (maybe a few more if we take microseconds) but that's very predictable.

Yet considering the hash to be a CSPRNG, I'd say the output would be totally unpredictable, and good enough for all reasonable purposes? Or am I overlooking something?

As long as the initial seed remains hidden, would this 'leak' or impose any security risks when using this stream of randomness to extract encryption keys, for example? (which are supposed to be independent)


texts:
Let $E(m)$ a be the encryption  operation using Paillier encryption scheme. Let $N$ be the public key and $p$ be a large prime number, such that $p<N$.

Question: Is there any protocol, that given $E(m)$ can compute homomorphic $\mod p$, so after decryption we would a message in $\mathbb{F}_p$?

Or is there any multi-party computation protocol that can do it?


texts: Are the asymmetric roles of the two keys in the elliptical curves the same (as for RSA)? Can they be interchanged indifferently?

texts: More precisely, and as for RSA, is it really true that it is not feasible to recirculate one of the keys knowing ONLY the other with the Elliptic Curves, as for RSA?  Or does ECs work differently on this issue? I mean only mathematically (I'm not talking here about OpenSSL's deceptive abilities to keep items in a file to facilitate public key regeneration).


texts:
I am using OpenSSL libs to generate signatures. Internally, I learn that a signature is a hash of the message with some padding added to it.
I am trying to understand the structure of a signature. If I use SHA1 as the digest algorithm for the signature, and say a 1024 bit Key, can you please tell me how the signature format looks like?

My code snippet:

   const EVP_MD *md = EVP_get_digestbyname("SHA1");
   EVP_SignInit(ctx, md);
   EVP_SignUpdate(ctx, plaintext, plaintext_len));
   EVP_SignFinal(ctx, sig, &siglen, pkey));

From the source code I am trying to understand how 'signing' works.  What exactly is added to the hash value before actually "encrypting" it with the RSA key? Assuming the RSA signing takes the RSA_PKCS1_PADDING as default(?),How many bytes of this 'padding' does it append and how does it vary with the digest algorithm?

If I dissect such a signature, how should the bytes look like?


texts:
You put an input and the hash value comes as an output then when someone puts the input the hash function it is applied to see if it is the same hash original value is stored in some database , that is how it works if I remember it correctly.

However  I am having some trouble understanding timestamps now,
I have just used a timestamp service, univerisign.

I sent the file to timestamp it and I believe the input is the  file and the date and by using sha512 it creates  a document signature, this is exactly what has done:
My document was example.pdf:

  Title

  testing the document.

and after using the service, it appears example.pdf:

  Title

  04_02-2012

  testing the document.

It also comes a file called example.pdf.ers wich I believe It is the hash value but
How can I prove the validity of a document timestamped by Universign?

This is how the web answers it:

  Universign uses the timestamp protocol defined by the IETF RFC 3161
  standard. You can use any software compliant with this standard to
  check your timestamp seal.

What does this mean?

How different is my example.pdf document from a fake one fake.pdf with the same date written on it?
Does my example.pdf have any security characteristic or is it just a normal pdf document and all the verification information it is stored in example.pdf.ers?

I think that if universign was able to gave me a proof of the document, a smart one could easily create a fake proof of the document by giving  the fake input including the date,
maybe It is got to do with the credentials of the organization in this case universign as not all timestamps are valid and probably example.pdf.ers is saved in universign.eu database and that is why it is valid.

Note that my question although long it is specific I just tried to answer it while formulating it, It is all about understanding the verification of timestamps.


texts: How does Ring Learning with Errors work?

texts:
I read that Google want to integrate this into HTTPS because it is safe against quantum computers.

However, the Wikipedia article might as well be written in Latin because it makes very little sense to me.

How does Ring Learning with Errors work and why is the algorithm safe from quantum computers?

Edit: there's a question like this about how public key encryption works, so I figured that this would be good too but it seems that it's too complicated to explain in simple terms.


texts: References for combining LFSRs with different lengths and taps?

texts:
I started learning streams ciphers with the use of LFSRs. Therefore, I tried to simulate what I am learning in a C sourcecode, which combines three registers and XOR with function $X$ to get stream keys – but I couldn't find examples or resources which illustrate the same thing to help me do so.

Are there any guidelines which can show me how to achieve the above, or any references codes which explain or maybe even simulate that scenario?


texts: Can someone randomly guess the key to AES 256 bit encryption?

texts: Is it possible that someone can randomly input a key to AES 256 bit encryption and it is correct? What are the chances of this happening? Is it even possible or not?


texts: Counter Mode in Advanced Encryption Standard(AES) Algorithm

texts:
In Advanced Encryption Standard, if I used "Counter Mode", how should I handle the nonce? Should I divide the nonce value into two? For example: I have 128-bit of nonce, should I divide it so I get two parts with 64-bit each?

The first 64-bit is my chosen nonce value (for example a0a1a2a3a4a5a6a7) and the second 64-bit is the counter (for example 0000000000000001). Is this correct?

In the sequence of the counter, does it work like the following?

0000000000000001,
0000000000000002,
...
000000000000000f,
0000000000000010,
0000000000000011,
...
00000000000000ff

And… after 00000000000000ff, what is the next counter value? Is it 000000000000ff00, followed up like this?

000000000000ff01
000000000000ff02
000000000000ff03
000000000000ff04


texts: WOTS+: Why does it XOR before running data through the hash function?

texts:
I'm implementing WOTS+ in a new language and I can't seem to wrap my head around the fact that WOTS+ XOR's their input with its mask right before hashing it.

I tried to look for any reasoning but so far haven't found any. In my mind I also can't seem to come up with the logic that would make this more secure. For instance, this source says:

  In each iteration, PRF is used to
     generate a key for F and a bitmask that is XORed to the intermediate
     result before it is processed by F.

But it doesn't explain why this XOR is so important. Why is there a random mask needed in the first place? As far as I can understand, you are supposed to disclose the mask along with the signature and the message in order to get to the final public key that signed it.


texts: A question regarding relevance of vulnerability of MD5 when linking multiple records together

texts:
I have been studying a Supreme Court case "IMS Health vs Sorrel".
In this case a Friend of Court brief filled by "Electronic Privacy Information Center" states that use of MD5 hash function to link multiple records together is suspect, since MD5 is broken.
I find this argument incorrect, the only use of MD5 (it is unknown whether it is salted or not) is to compute a hash to protect patient identity and not for signing purpose. Thus the usual arguments against use of MD5 do not apply.
Here is the quote from the brief http://epic.org/amicus/sorrell/EPIC_amicus_Sorrell_final.pdf

The first is the deidentification of the patient’s actual identity through a cryptographic technique known as “hashing.”
In ideal circumstances, a record containing the hashed representation of the patient’s actual identity could never be linked to the actual patient. But the cryptographic technique chosen to protect patient privacy in this matter has been suspect for at least 15 years, can now be broken using nothing more than an ordinary desktop computer, and is considered unsuitable for further use by the federal government.
Vlastimil Klima, Finding MD5 Collisions – A Toy For a Notebook (Mar. 5, 2005);9 Chad Dougherty, Vulnerability Note VU#836068: MD5 Vulnerable to Collision Attacks, United States Computer Emergency Readiness Team (Dec. 31, 2008).10 See generally, Wikipedia, “MD5,” (“. . .
it has been shown that MD5 is not collision resistant; as such, MD5 is not suitable for applications like SSL certificates or digital signatures that rely on this property. . . . The security of the MD5 hash function is severely compromised.”)11


texts: What is the difference in designing an MPC protocol by ring or field?

texts:
To the best of my knowledge, most of the MPC protocol's are built on a ring $\mathbb{Z}_{2^\ell}$(usually $\mathbb{Z}_{2^{64}}$) or field $\mathbb{Z}_p$ ($p$ is a big prime), why? What is the difference between them?
Examples:

Ring examples such as ABY, SecureML.

Field example such as SecureGWAS.

Update:
This paper says that SS-MPC over the ring cannot easily construct the constant-round protocol due to a lack of the multiplicative inverse.


texts:
Given a public key on the P-256 Curve is it correct to say that the public key is 64 bytes long ie. (x,y)?

Secondly is the private key 32 bytes long? if so, how is the private key generated and why is it shorter than the public key?


texts: If OWF were to exist, do we know for sure that one of the candidate OWF would indeed be a OWF?

texts:
We have several candidates for OWF, like multiplication/factoring and discrete exponencial/logarithm. What I am asking is:
Does the existence of one way functions imply that our candidate functions are indeed one way functions?
Is there a candidate one way function whose one wayness is directly tied to the existance of OWF?


texts:
I'm doing some comparison on hash-based signature schemes. I am reading about one of the most recent schemes, XMSS^MT, and trying to figure out its actual public and private key sizes for concrete parameters.

I found this paper which has some numbers for a variety of parameters, however it does not say what's the size of the private key (even in terms of XMSS parameters). Has anyone figured this out?


texts: The Salsa20 core preserves diagonal shifts?

texts:
What do we mean by

  the Salsa core preserves diagonal shifts


texts: Security of Fast Two-Party ECDSA Signing

texts:
The paper "Fast Secure Two-Party ECDSA Signing" by Yehuda Lindell describes a system in which two parties, $P_1$ (with 1/2 of a share of a long-term ECDSA signing key $x_1$) and $P_2$ (with the other 1/2 share, $x_2$), cooperate in order to produce an ECDSA signature, $P_1$ being the party that actually outputs the final signature.

In Section 3.2, describing the process for distributed signing, it is said that a hypothetical attack by $P_2$ implies sending a malicious message such that if $x_1 \bmod 2 = 0$ then the final signature is incorrect (and hence $P_1$ will not output a signature), and if $x_1 \bmod 2 = 1$, then the final signature is correct (and hence $P_1$ will output a signature). The author refers then to the security proof for details on how to handle this.

If I am not mistaken, it is in Section 4.1, pages 20-22, where this is addressed (there is an alternative security proof in Section 5, but I am focusing on the one in Section 4). In this section, security is proven by reducing to the security of ECDSA (i.e., if we have an attacker $A$ that breaks the 2-party ECDSA, then we can build an attacker that breaks ECDSA).
Specifically, for the matter at hand, the strategy is to have the simulator simulate $P_1$ aborting at some random point. This makes the simulated view be indistinguishable to the real view with non-negligible probability, so we can use $A$ to break the 2-party ECDSA, then use this to break ECDSA, and so on.

Now, my doubt is: how does this demonstrate that a malicious $P_2$ is prevented from learning the LSB of $x_1$ if the hypothetical attack mentioned in Section 3.2 were possible. Or does this imply that, in practice, we would actually need to force $P_1$ to abort randomly? In that case, is this realistic in practice?


texts:
Is Schnorr's protocol for proving knowledge for a discrete logarithm, truly an interactive proof or is it an interactive argument? If we let P to be unbounded, after she generates the commitment $t$ and receives the challenge $c$ she can try all $r$ such that $h^r=t \cdot z^c$(where $h$ is the generator of the cyclic group and $z=h^x$)

In addition, how can we make any security guarantees if the prover is unbounded?

I know how to extract the witness from two transcripts. My intuition as to why this extraction argument is sufficient for proving soundness is something like this(correct me if I am wrong):
If the prover can somehow cheat and produce two accepting transcripts, then she can extract $x$. This implies(by taking the contrapositive of that statement) that if she does not know $x$, then she cannot produce a transcript. Therefore, the protocol is sound.

However, in some sense we had to ignore the infinite computational power P has, while proving that statement. If she has infinite computational power, then she will always know the discrete log(because she can compute it). I guess my question is what is the purpose then for not bounding P?


texts: Can a self-signed certificate's signature algorithm be changed?

texts:
I've a large number of self-signed certificates that are currently being used by multiple clients which were signed with the SHA1 ('SHA1WITHRSA' as it appears in the cert) algorithm at the time they were created.

My boss has asked me to look into 're-signing' these with SHA2 (256) instead rather than re-generate a new key that would then be self-signed with SHA2 as this would be a logistical nightmare. We used to be our own CA, which would've made this possible if all keys were signed by us, but we ceased doing that and just started giving out self-signed certs.

I'm not sure if this is possible.  We can easily get access to the private key(s) on the client sites that were used to generate the original (self) signature, however, since I'm not a crypto expert, I don't know if, once a (public) key is self-signed, whether it is possible to somehow 1) detach that signature and 2) replace it with a newly generated one from the same private key which we have just as it was done the first time the key was generated and signed.

Can someone more versed in crypto shed some light on this?


texts:
Can someone please help me with the question below?

Explain why 0 ⊕ x ≠ 1 ⊕ x, whatever the value of the bit x.
Hence, explain why flipping a bit in the plaintext produces a predictable
change in the ciphertext when using a stream cipher that XORs the
plaintext with the keystream to produce a ciphertext.

What is the name of the circle in the middle ?


texts:
I haven't been able to find a clear explanation on this (and I'm probably just confused in general).  I have the following parameters of ElGamal signatures:

$p$ = safe prime
$q = (p-1)/2$
$g$ = an element of $F_p$ with order $q$.
$r$ = random $1 < r < q $
$s$ = private key
$Y$ = public key, $Y = g^s$

My question is, is there an easy way to generate a $g$ value, or should I just generate a random value, then check that it is in the group?


texts: PGP digital signature vs SHA256 HMAC Comparison

texts:
First let me admit that I am not a mathematician or a cryptographer.
I am responsible for assisting in making a recommendation on a project that is consolidating payment processes within a company's internal network.

We have payment files which are being created by various applications; Several legacy applications are using PGP to digitally sign the payment files (sign only - no encryption. The hash algorithm is SHA1 and the digital signature algo is RSA 1024).  Several newer applications are protecting the payment files using SHA256 HMAC (using a 256 bit random private key).

Regardless of whether we decide on public key cryptography (PGP) or secret key cryptography (HMAC), we will replace the keys periodically and feel reasonably assured that we can protect the private key and passphrase or the secret key for HMAC.

The question has been raised questioning the relative strength of SHA256 HMAC vs. PGP digital signature.  We know that the PGP digital signature is appended to each payment file, and network admins and others can easily copy signed payment files (but they cannot get to the PGP keys folder nor the passphrase).  Similarly, the SHA256 HMAC hashtag value and the original plaintext payment file can be accessed by admins, but not the secret key.

Given that in both sets of applications a potential adversary can get the original plaintext and the digital signature or HMAC Hashtag, which of these two scenarios would be least vulnerable to brute force or other attacks that attempt to derive the private or secret key?  Based on current computing power, how long should we have reasonable assurance that either technology would be relatively secure?


texts: What is the proper usage of GCM nonce in TLS1.2?

texts:
I have written a program with the help of the bouncy castle for C# library.

I am monitoring the traffic which is send between the client and the server and found something (i find) strange. The client sends application data to the server using the following ciphersuite: TLS_PSK_WITH_AES_128_GCM_SHA256. The GCM nonce starts at 1, then the server sends data back with nonce 1, then client sends data with nonce 2, server sends back with nonce 2, etc.

Is this correct? shouldn't the nonce never be the same twice? so shouldn't the server respond with nonce 2 instead of 1?


texts: Can you find the salt if you have the original password in plaintext and the hashed version?

texts: Suppose that I have a password in plaintext. I also have the hashed version of the password. Say it uses MD5. Is it possible to find out what the salt is given the above information? I'm guessing not?


texts: Determining a cryptographic algorithm by description

texts:
I found a signing algorithm while analyzing obfuscated source code.

I only have a basic knowledge about cryptography.  I want any clue that can help me to figure out if is a known and named cryptographic algorithm or a variant, if is strong and breakable, or how the signer generates the signature.

The point is if this is a case of an unbreakable algorithm stop and not try anything, or continue my work trying to break.

The Algorithm:

Having $\mathit{message}$ and $\mathit{signature}$ clearly separated in a file:

First calculate a $\mathit{message\_digest}$:

$\mathit{message\_digest} = \mathrm{padding} \mathop\Vert \operatorname{SHA-1}(\mathit{message})$

Where
$\mathrm{padding} = 0001 \mathop\Vert \mathrm{ff}(105\ \mathrm{times}) \mathop\Vert 00 = $
0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00

And then check if this expression is true:

$\mathit{signature}^3 \equiv \mathit{message\_digest} \pmod{\mathit{key}}$

Where $\mathit{key} =$
C01D9FD2747B89681255F0C934610183CB45E2C57E511DBB4D651D2AD1F9B4E91D31169D3D444F91074A8EAF3F688EEC9E0E5E76F52CAF61A6ECC4A5A2154997755754E68D7C6BC1EE9C2B64B03C3157E83242A8AA8311371354363FAE8D0D5C843CEB0844FB2C3C499E1C41313A729000550038363AEF2BF8E20346B36C6B65

I have also found the follow signed message in the source code that I analise:

For a message that i know  with $\mathit{message\_digest} = $
1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF008CBB319AB06BA3F4E05625984ED2D89E42C51813

The $\mathit{signature}\ =$
5D3C1672CC314D8E50D302790D3BE9FB0CC5286A0D050BD83EA920B0F90C8E86A95E471CD34C3F81DDA89A14DE03781266F623975BD8B9CB95608EAFDE8426A7E0AEFA60DD80E76A652397D466674E439EADB30103F9A15F4EE6022DFCB8D36CBFABE1D922BBE5C7011242AE5DBAB7A35BF7C970BB1B45563176A5CFE3CBC23A


texts: Any reason to use Shamir given faster XOR threshold secret sharing algos?

texts:
TL;DR:

Is the Kurihara algorithm really what it purports to be (dramatically faster but equally secure replacement for Shamir Secret Sharing)?

https://scholar.google.com/scholar?q=kurihara+secret+sharing

Background

Shamir's secret sharing algorithm has the desirable properties of information theoretic security (possessing shares fewer than the threshold is no better than random data) and minimal storage (each distributed share is the same size as the original secret).  However, it's very slow to compute, to the point that when dispersing a large file with Shamir you would typically use ordinary symmetric encryption for the file at large and protect only the symmetric key with Shamir.

As of around the year 2007 industrial researchers in Japan (Kurihara et alia at KDDI and others at Toshiba) and academics in China (Chunli et alia) have published papers showing how to use random numbers with simple XOR operations to accomplish the same level of information theoretic security and minimal storage, with performance hundreds of times better than Shamir Secret Sharing.  Some of the algorithms offer arbitrary "(k, n)", aka "(threshold, sharecount)" flexibility, as Shamir also does.

Is there any reason to continue using Shamir versus the new XOR based threshold secret sharing algorithms?


texts: Can quantum computers break quantum cryptography?

texts: I happened to learn that encryption by quantum cryptography would be impossible to break as it's state changes the instant of an eavesdropping event(by non-quantum systems) occurs. But I'm not sure if it's still held in the case of the eavesdropper using a quantum computer(not sure how that works either) as well. Couldn't find the answer on Google so felt the community could shed some light on this.


texts: Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?

texts:
I am looking for a faster alternative to RSA with OAEP as a IND-CCA2 public key scheme. Elliptic Curve Integrated Encryption Scheme might be a candidate, but I am not sure if it provides IND-CCA2 security.

So the question is if ECIES offers IND-CCA2 security by default? If not, what should be changed so that it does offer it?


texts: Block cipher birthday bound and a KDF workaround

texts:
Can the birthday bound arising from a block cipher’s block size be worked around by deriving different keys from the master key with a KBKDF using a tweak?

For example consider the following scheme, which assumes

K is a 256-bit key
tweak is an integer we can increment before 2^64 blocks have been encrypted with the current generation

and then encrypts as follows:

IV = random 256 bits
EffectiveKey = KDF(K, context=tweak)
ciphertext = KeyGeneration || IV || AES-CBC(IV, EffectiveKey, plain)

Would this scheme be secure for encrypting more than 2^64 blocks?

Asked in order to learn more about the birthday bound.

EDIT - this has similarities to the construction used in the Better Bounds for Block Cipher Modes of Operation via
Nonce-Based Key Derivation paper (great talk too by Yehuda Lindell), which also introduces AES-GCM-SIV.


texts:
People say "hash and salt", but aren't you supposed to salt password the first, and then hash it?

So that means its called "salt and hash" right?


texts: hill cipher encryption way 1x3 plaintext matrix

texts:
Can someone help me with a Hill cipher?

When do I have to use:

1x3 plain text matrix (p1, p2, p3) * 3x3 key matrix
3x3 key matrix * 3x1 plain text matrix

Or they are both correct?

I tried to search the internet, but found nothing useful.


texts: AES S-Box Affine Mapping - how to do it?

texts: For the byte substitution layer in AES how do we determine B(i)?  I follow how to use the multiplicative inverse table and using that to get B`(i), but how do I actually calculate the affine mapping?  Is this normal matrix multiplication?


texts:
I need an untrusted client to generate a random public/private keypair (in particular, an Ed25519 keypair, which can be generated really fast), but I'm only allowed to see the public key. The randomness is important because the public key is used in attack-sensitive ways such that being able to influence it more than a few bits is a security risk.

I had the following idea:

Create a nonce and send it to the client.
Let the client create a public/private keypair such that hash(public_key + nonce) starts with at least n zero bits and send it back.
If the client returns a public/private keypair after t seconds, reject it.

Is this a correct scheme to ensure randomness of the keypair, given an appropriately chosen n and t?


texts: Does $i^n=j^n$ for $i, j \in GF(2^q)$ and $i \neq j$ for some $n<2^q-1$

texts:
Let $i, j \in GF(2^q)$ and $i \neq j$ and $i,j\neq0$.

Is that possible that $i^n=j^n$ for some $n$ such that $0 < n < 2^q-1$?

I am looking for a proof if the answer is no, or for a method to find $n$ if the answer is yes.


texts: Concepts for realization in applied cryptography

texts:
I'm a computer science student (not a mathematican) and I'm gonna to write a master degree diploma on applied cryptography. Specifically, I'd like to create a realization of some cryptographic stuff that is not widely deployed or even lacks of realizations by some reason (maybe because it's really new or it's just not very useful in practice for now). I know some concepts that I think meets my situation: Honey encryption, Format-preserving encryption, Deniable encryption, Chaffing and winnowing, Key derivation functions (sometimes they lacks of realizations on GPU/FPGA/ASIC), Post-quantum cryptography. Sorry, I can't post more than one link in question due to lack of reputation.

Maybe, I missed some new directions in cryptography today that needs one more realization or even first realization? Please tell me.


texts: Difference between Pedersen commitment and commitment based on ElGamal

texts:
Does any of you know what is the difference between the Pedersen commitment and the commitment that uses the ElGamal encryption scheme?

For the sake of completeness, I recall what both of them look like.

Given two public and large primes $p$ and $q$ such that $q∣(p−1)$, and a (also public) generator $g$ of the order-$q$ subgroup $G \subset \mathbb{Z}^{⋆}_p$, and given two random (secret) values $a,r \in \mathbb Z_q$, we have that in order to commit to a message $m \in \mathbb{Z}_q$, we just have to compute the commitment $c=g^m h^r \pmod{p}$, where $h=g^a \pmod{p}$. Then, to open the commitment, we need the values $m$ and $r$ to be revealed, so that the commitment receiver can verify the commitment.

In the ElGamal encryption (for example, in the exponential version, which looks more like the Pedersen commitment) we also have a generator $g$ of a multiplicative group $G$ of order $q$, a private $x \in \mathbb{Z}_q$, and a public $h=g^x$. In order to encrypt a message $m$, we take a random $r \in \mathbb{Z}_q$ and compute $(g^r, g^m h^r)$. To me, the second part of the tuple looks very much like the Pedersen commitment.

The fact that any encryption scheme can be used as a commitment scheme is well-known. However, I often see the Pedersen commitment mentioned as something completely different to the commitment that uses an ElGamal encryption, and I was wondering whether here is any difference between the two, or they are actually the same.


texts: Why does nobody use (or break) the Camellia Cipher?

texts:
If Camellia is of equivalent security and speed to AES, concerns arise.

First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does that mean that Camellia is currently more secure than AES, or is this a result of the lack of research on the cryptanalysis of the cipher?


texts: Proving membership of a group without revealing identity?

texts:
I have an interesting problem for which I've failed, so far, to find an elegant solution.

Imagine that a user needs to repeatedly prove to public observers that they are a member of a trusted set but the proof needs to be different each time so that they can't be tracked.

My initial thought was that the set owner publishes the value of an RSA Accumulator which includes all the members and each member possesses the corresponding witness value. They can then reveal the witness, and an observer can confirm that they are indeed included in the accumulator. The problem with this is the witness (proof) is constant so every time they assert their membership, observers can infer their identity. Also any observer can then steal their proof and use it themselves. I don't want the member to have to contact the set owner before each assertion e.g. get them to blind sign each new assertion.

I've also looked at Paillier based homomorphic encryption where the user could deliberately blind a value by adding to it but, here the keys are the wrong way around i.e. public encrypts and private decrypts. The set owner would need the private key. So what I really need is a homomorphic signature where the owner can give the user a signed value which can be blinded for each use.

What would you recommend to solve this problem?


texts:
I've been trying to reverse engineer Mega's (mega.co.nz) API calls. And stopped on the step where client needs to decrypt session id with provided RSA key. I can get key data, but I have no idea how to convert this data into actual key.

Here is my Base64 encoded private key:

BACLkf9qj1yTiX+Jrc7nlp8GMbTh9XnksdQgImr1kRazEsWy28hgOOqjPrsUTe0HtG7UKJzltzBd
1cDQI40qWmmCfsRmKiwNJazfCpDgI21LMveudU9O5djvqgGz8YNVVaOhg//IFAppnb6NHlY51qnP
tEJef47K/2rWMFXUZ8DjrQQA7TTQIUYutrF83GidNT2Od1d+v5hrcCLKzjBYbUIIX1ntI3gFmJyu
TnWL/x5ftzlPhADqdjnmHP1R0MmUheE2EngZvh7H8GumpPnuxhbS7zWAMFHRsagrw8rN4pWtnH1Q
9sZ3mmFTuVvqz547cc2d++7Od7s/hUGZvZEKBQgD4McH/i2kzsuiWCLsyJ74PcQTcQnkZeHsV53T
6s4pAUV9yyfz0VYu+84W1SKclSnhAkZNOFDz56oG7BQZqkP4uJoX6Uf3woikjDdGEYMh1nAJj5KR
G+8WhrvUftSCOMJdgfoFpZZGAIZfvrBjRaevvceh10YzNb8l+fd3ucF9v9IPj3/XMMoWNltDm7YC
gA1PZj6aU3hum47PZu2oQnsCtSER004lwHC28rHgJP2QVl22W7A7hd7/Tn/MMYXmhC8sKu6cVVew
rx0T3yBVmpILpQ2MRFHHwucXBQLPfvgxiC/c1Pnr1GqZf6FgpZSSbUhLkkfpchRyQyzhNaA5NhsN
V2+PCCEEAJTTXts5/Emt/84BEzXC5gg7o0kdR0Z3NxnkLTILpY0IxhnRA6wxO4pDRbsqc85DzSnO
obTWb2tOkw/AdpEzcH3HCPNaKjMuCMHyItv69426NqMVSruqHniNxafCNeHGTofYsKky05Wiv+G0
DWOBnGYf2A+sLAgoGFGBZ53QaI90LS0tLS0tLS0=

From what I understand, it consists of four parts(big integers): p, q, d, u.
I know that to get generate private key we need modulus(p*q) and private exponent (d)

So I'm wondering, is there standard private key format for this key, or they just using some internal encoding?


texts: Nonmembership witness in universal accumulator

texts: We can say that when compared to a Merkle tree, inclusion proofs are constant size by membership witness. Can we say that also for exclusion proof bu nonmembership witness? Is there any advantage of nonmembership witness in an accumulator?


texts:
I would like to understand better what happens during establishment of SSL/TLS secure connection.

The Client wants to establish a connection - ClientHello
The server answers with a ServerHello. This includes a randomly generated number and a server certificate
The client creates a "pre master secret" and sends it encrypted to the server using its public key.
Both parties create a session key from random number and pre master secret.

The question:

Is this the same as Diffie-Hellman key agreement? During DH key agreement both parties send a random key to the partner from which the session key is finally generated. DH is (in principle) completely symmetric. Why is the random number from the client called "pre-master-secret" and from the server just "random number"?


texts: it is possible to use quantum algorithm search (Grover's algorithm) for new searching strategies for differential and linear attacks

texts:
I am trying to use Grover's algorithm to find  Differential characteristic of Feistel and SPN structures block ciphers. basically, which is Finding a good differential characteristic with high probability in the (related-key) differential attack

For example, using  Matsui’s Algorithm to Search for related-key differential
characteristics in DES-like ciphers by Alex Biryukov, Ivica Nikolic.:  FSE 2011

also using Integer programming-based method ( Differential and linear cryptanalysis using mixed-integer linear Programming ) by Nicky Mouha, Qingju Wang, Dawu Gu, Bart Preneel Inscrypt 2011.

my question

can construct Grover's algorithm to find  Differential characteristic of Feistel and SPN structures block ciphers?


texts: Is encryption time greater than decryption time?

texts: Is encryption time always greater than decryption time for all encryption techniques (AES / DES / RSA / DSA), or is there a mistake somewhere in my implementation?


texts: Why does RFC8032#8.7 state that the IUF hash API should not be used for Ed25519?

texts:
RFC8032 (section 8.7) states that IUF (Init, Update, Finish) should not be used in Ed25519 API:

  Avoid signing large amounts of data at once (where "large" depends on the expected verifier). In particular, unless the underlying protocol does not require it, the receiver MUST buffer the entire message (or enough information to reconstruct it, e.g., compressed or encrypted version) to be verified.

  This is needed because most of the time, it is unsafe to process unverified data, and verifying the signature makes a pass through the whole message, causing ultimately at least two passes through.

  As an API consideration, this means that any Initialize Update Finalize (IFU) verification interface is prone to misuse.

  It is a bad idea to modify Ed25519 or Ed448 signing to be able to create valid Ed25519/Ed448 signatures using an IUF interface with only constant buffering.  Pretty much any error in such would cause catastrophic security failure.

Why? What implications does it have?


texts: Derive cipher IV and cipher Key using PBKDF2 with random salt?

texts:
It is said that cipher IV does not have to be secret and the only secret component of the encryption scheme should be a cipher key.

Question: is it safe to generate IV using PBKDF2 function, which takes password and randomly generated salt as input (Scheme 2)? Or do I have to use only completely random IV which has no relationship to password whatsoever (Scheme 1)? In other words, is Scheme 2 less secure, equally secure or more secure than Scheme 1?

NOTE: To generate entropy based on password/salt I use a hybrid PBKDF2/HKDF approach described here, where PBKDF2 generates PRK which has the same length as used hash function (SHA-2) and then expands PRK to obtain sufficient entropy to populate KEY (Scheme 1) or IV + KEY (Scheme 2).

Example of Encryption Scheme 1 - traditional approach:

Input data: Password and Message (e.g. plaintext to encrypt).
Generate completely random SALT (using system entropy provider).
Generate completely random IV (using system entropy provider).
Use Password and SALT as input for PBKDF2/HKDF function, which generates and expands entropy based on input data.
Use obtained entropy to set cipher KEY, use IV that was generated in step 3.
Encrypt Message, send SALT + IV + cipher text to the receiver.

Example of Encryption Scheme 2 - generating IV with PBKDF2:

Input data: Password and Message (e.g. plaintext to encrypt)
Generate completely random SALT (using system entropy provider).
Use Password and SALT as input for PBKDF2/HKDF function, which generates and expands entropy based on input data.
Use obtained entropy to set cipher IV and KEY.
Encrypt Message, send SALT + cipher text to the receiver.

For decrypting, we use received SALT (and possibly, IV - if Scheme 2 is used), setup cipher according to the used scheme and decrypt message.

So, is Scheme 2 less secure, equally secure or more secure than Scheme 1? In my opinion, it should not be less secure, since for every message SALT, IV and KEY are going to be completely different. Besides, IV is unpredictable, since to generate it, we use SALT - which is unpredictable, since it is considered to be completely random. It is probably more secure, since in Scheme 1, SALT and IV are known to an attacker, and in Scheme 2 an attacker knows only SALT. Even if it is said that IV does not have to be secret, is it not better to try to reveal to an attacker as little information as possible?

Can Scheme 2 help an attacker to determine password more easily than in Scheme 1?


texts: Does CPA attack assumption requires the oracle to have the key?

texts:
In CPA model, we assume Eve has access to an oracle who has the correct key and Eve can send query to the oracle to encrypt in CPA the data.

Assume this encryption algorithm is a plain ECB mode AES and eve knows about it, i.e., if Eve plug in a key to AES-ECB and apply the same data for encryption twice, Eve will be able to distinguish that the ciphertext is not random across two encrytions with the same key.

However, let's say Eve can gain a few ciphertexts that is encrypted with the real key from the cipher oracle and he knows the plaintexts corresponding to these ciphertexts. However, Eve cannot control the plaintext value. Then the key is removed from the cipher oracle and the cipher oracle will never encrypt anymore plaintexts.

But Eve can plug in any key Eve likes after the real key is removed. So do we still say such a system is subject to CPA attack?
NOTE: his goal is to obtain information about the plaintext.


texts: Can we use witnesses generated by OpenSSL's Rabin-Miller primality test to help factorization?

texts: If I have a 2048 bit value used as the modulus for an RSA exchange, and OpenSSL's BN_is_prime() has determined that that value is not a prime, does that mean that OpenSSL has found a strong Rabin-Miller witness?  If so, if we could get OpenSSL to output the witness(es), how might that help us in the factorization of the value?


texts: How to rigorously prove that $Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$ is CPA secure assuming $\Pi$ is?

texts:
Assume $\Pi$ is a CPA secure scheme. Let $\Pi'$ be a derived scheme, such
that the encryption of a message $M$ is as follows:

$Enc_{\Pi'(k)}(M) = Enc_{\Pi(k)}(M) || LSB(k)$, where

$LSB(k)$ is the least significant bit of the randomly chosen key.

Can someone help me to finish my proof that the $\Pi'$ scheme is also CPA secure?

My proof:

Assume the contrary, $\Pi'$ is not CPA secure. Then the adversary can find two messages $M_0$ and $M_1$, such that whenever a challenger returns him $C'_b = Enc_{\Pi'(k)}(M_b)$, he can guess correctly the randomly chosen bit $b$ with the probability higher than $\frac{1}{2} + 2\epsilon_{fixed}$.

Now the adversary wants to win a game for $\Pi$ against me. He sends me those two messages $M_0$ and $M_1$. He asks me to randomly pick a bit b and return $C_b = Enc_{\Pi(k)}(M_b)$. The adversary then guesses the LSB(k):

With probability $\frac{1}{2}$ he will have guessed the LSB(k) correctly. Thus, he knows the value of $C'_b$ and can guess the bit $b$ with probability higher than $\frac{1}{2} + 2\epsilon_{fixed}$
With probability $\frac{1}{2}$ he will have guessed the LSB(k) incorrectly.
In this case, he will guess the bit b with probability 1/2. // Why?

Hence, the adversary can guess the bit b correctly with probability
$p > \frac{1}{2}(\frac{1}{2} + 2\epsilon_{fixed}) + \frac{1}{2}(\frac{1}{2}) = \frac{1}{2} + \epsilon_{fixed}$. This contradicts the assumption that $\Pi$ is CPA secure.

$\square$

The part I struggle to prove is why when the adversary has guessed the wrong $LSB(k)$ bit, he can still guess the correct $b$ with probablity $\frac{1}{2}$. For example, suppose the adversary runs an algorithm $\alpha$ to guess a bit $b$ when being challenged to win a game for $\Pi'$:

If we return him $C$ that equals $Enc_{\Pi'(k)}(M_b)$, then $\alpha$ guesses correct $b$ with probability 0.6
If we return him $C$ that differs from $Enc_{\Pi'(k)}(M_b)$ in the last bit, then $\alpha$ guesses correct $b$ with probability 0.

So now the adversary with the $\alpha$ algorithm would win the CPA game for $\Pi'$, because the game rules force us to send the correct ciphertext $C$. However, $\alpha$ used in the way described in the proof will not win the CPA game for $\Pi$ because
$\frac{1}{2} 0.6 + \frac{1}{2} 0 < \frac{1}{2}$

So what I want to ask is why we can always find a better algorithm than $\alpha$?


texts:
The recent SHA1 collision got me thinking.. why do we always throw out the baby with the bathwater when moving to more modern hashing algorithms?

When GIT was written, they went with SHA1 hashes because MD5 was too old and had verified collisions. It is inevitable that given enough time and effort, any current and future algorithms will have problems and eventually demonstrable collisions.

So why not just choose to combine hashing algorithms, preferably the most modern, with the second most modern? Naturally, the hash length in bits would be longer, but seems to be a better way of future-proofing a system than just "use the best at the time of writing"

Is SHA1 hash concatenated with MD5 hash more or less likely to introduce a collision?


texts: Tls protocols: is the simple diffie hellman key exchange still used these days?

texts: Or did it mostly get replaced by ecdh for key exchange and rsa for authentication ?


texts: Adding and multiplication in jacobian coordinates

texts: How can I derive formulas for adding 2 points and multiplication by a scalar in Jacobian coordinates $(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$ over an elliptic curve?


texts:
In the process of trying to answer this question, I ended up getting stuck. I found a paper which seems to solve their issue: its authors define a process which yields a pseudorandom permutation generator $h$ when applied to a pseudorandom function $f$ and the resulting $g$ composed twice onto itself:

Let $f=\{f\}^n$ be a pseudorandom function generator where the key length function is $l(n)$. Define a function generator $g=\{g\}^n$ in terms of $f$ as follows. Let $k$ be a string of length $l(n)$, let $k'$ be a string of length $l(n+1)$, let $L$, $R$, and $L'$ be strings of length $n$, and let $R$ be a string of length $n+1$. Then $$g_{k}^{2n}(L\bullet R)=R\bullet[L\oplus f_k^n(R)]$$ $$g_{k'}^{2n+1}=R'\bullet[L'\oplus\text{first }n\text{ bits of }f_{k'}^{n+1}(R')]$$
…
Let $h=g\circ g\circ g$. … Theorem 1 shows that $h$ is pseudorandom if $f$ is pseudorandom… [however, note that] $h=g\circ g$ is not at all pseudorandom[.]

– Michael Luby and Charles Rackoff, How to construct pseudorandom permutations from pseudorandom functions.
However, as I'm implementing it, it seems not to be actually yielding a rearrangement of the input bits. I'll show an example where I provide an input with a hamming weight of 4, but it returns a string with a hamming weight of 15 -- so, clearly not a permutation of the input.

Parameters:

$f$ = SHAKE256
$m = 00001000\ 00000100\ 00000010\ 00000001$
$n = 32$
$l(n) = 0 \Rightarrow k = \text{‘’}$

So, going through it step-by-step:

$g_{k}^{n}(g_{k}^{n}(g_{k}^{n}(m)))$

$g_{k}^{n}(g_{k}^{n}(g_{k}^{n}(00001000\ 00000100\bullet 00000010\ 00000001)))$

$g_{k}^{n}(g_{k}^{n}(00000010\ 00000001\bullet[00001000\ 00000100\oplus f_k^{n/2}(00000010\ 00000001)]))$

Python: Crypto.Hash.SHAKE256.new(k).update(b'\x02\x01').read( (n//2) // 8 )

$g_{k}^{n}(g_{k}^{n}(00000010\ 00000001\bullet[00001000\ 00000100\oplus 10111101\ 00000101]))$

$g_{k}^{n}(g_{k}^{n}(00000010\ 00000001\bullet 10110101\ 00000001))$

$g_{k}^{n}(10110101\ 00000001\bullet[00000010\ 00000001\oplus f_k^{n/2}(10110101\ 00000001)])$

Python: Crypto.Hash.SHAKE256.new(k).update(b'\xb5\x01').read( (n//2) // 8 )

$g_{k}^{n}(10110101\ 00000001\bullet[00000010\ 00000001\oplus 10100111\ 01010000])$

$g_{k}^{n}(10110101\ 00000001\bullet 10100101\ 01010001)$

$10100101\ 01010001\bullet[10110101\ 00000001\oplus f_k^{n/2}(10100101\ 01010001)]$

Python: Crypto.Hash.SHAKE256.new(k).update(b'\xa5\x51').read( (n//2) // 8 )

$10100101\ 01010001\bullet [10110101\ 00000001\oplus 10000010\ 01010011]$

$10100101\ 01010001\ 00110111\ 01010010$

Since this has not yielded a permutation of $m$, how do the authors actually intend this composition to be done? Am I misinterpreting $\bullet$? Am I botching the composition? Should I be splitting $m$ differently? I did not see any special requirements on $f$ other than it be able to output $n$ bits (and even that looked non-strict, being croppable when an odd number of bits is required), so what am I missing here?


texts:
I've read that if the IVs for SHA256 were arbitrary and / or unknown (secret) than a backdoor to predict outputs would be possible.

How do the values chosen for the IVs / publishing the values prevent such a backdoor and if the values were arbitrary / secret, how would such a backdoor work?


texts:
While reading some cryptographic RFCs, came across the Diffie Hellman prime computation formula:

2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 }

I am curious what the expression [2^894 pi] means here. The part specifically confusing me is the space between 2^894 and pi. It cannot be a multiplication operation as that does not give me the correct result. I am sure the answer is straightforward for someone with mathematical background...


texts: Why use two affine transformations in Multivariate Cryptography?

texts:
I'm reading Multivariate Cryptography and would like to know why we use two affine transformations to scramble the central map?

Why not use only one?


texts: Is cryptanalysis of CTB-Locker really impossible?

texts:
It seems that CTB-Locker make a lot of victims nowadays, and yet, the full encryption scheme of it is now publicly known [1,2].

Would any of you could find a weakness to exploit in this encryption scheme that would be able to take it down once for all ? The point would be to recover the Master key or a way to circumvent the encryption.

See also:

« Where to find a full analysis of the encryption scheme of CTB-Locker? » on Reverse-engineering Stack-Exchange.
« Decrypt files with original file CTB-Locker », another question about CTB-Locker on Cryptography Stack-Exchange.


texts: How to solve high exponent attack for same message in RSA

texts: I know Håstad's broadcast attack when e = 3, but what if e = getPrime(randint(350))?


texts: Why use an OTP if you already have a secure channel

texts: Let's say I have some sensitive information, and I want to encrypt it with a OTP and send it to the FBI or something. Now, in order for the recipient to successfully decrypt the message, he needs to know the OTP key as well. But, you don't just send the key as plain text to the recipient, this is fairly obvious since an adversary can obtain it with ease. So then what? You use a secure communication channel to share the key. This is where my brains stop working. Why share the key of a OTP through a secure channel, and not just share the sensitive information itself through that secure channel?


texts: Is this a structural weakness of Feistel networks?

texts:
I'm doing a lot of reading about Feistel networks. Something occurred to me a bit ago that I hadn't realized previously, namely that in any Feistel construction there are bits of the plaintext that are never given as input to the round function without having been mixed with the previous round function's output.

For example, in the first round of a balanced Feistel network $L_0$ is XORed with $F_k(R_0)$ to get $R_1$. Thus, $L_0$ is never used by itself as input to $F_k$, which could violate the diffusion property of the cipher.

Is it even possible to get around this limitation, perhaps with a modified first round?

I don't think this is a real vulnerability in e.g. DES or Blowfish, for the record. Rather, I'm wondering whether this could be used to craft a successful attacker in a game against a reduced-round variant of these kinds of ciphers.


texts: Transposition cipher - brute-force-attack - expected value

texts: how do I calculate the expected value of a brute-force-attack on a transposition cipher? For example, for the text "HELLO", there are 5! = 120 possibilities. Is the expected value to break the transposition cipher with brute-force therefore 120? Or is it 120/2 = 60? Or something else?


texts: How difficult is it to practically detect a forgery in a cryptosystem?

texts:
If the encryption key that you use doesn't correspond to the decryption key used by the crypto system, it is assumed that it will not be possible to decrypt the message or you'll know that there has been some mischief.
I wanted to know how will one know that the decrypted text is not correct? My point is that whether the decryption was successful or not can be checked by seeing if the either the decrypted text is same as what we expected it to be or follows the syntax of the language in which it was expected. Otherwise you will defintiely get SOME decrypted string. So how does a computer know that the decrypted string was not correct? Is it left to the programmer to check the correctness of the output?


texts: Artificial abort in Adaptively-secure Lattice IBE in [ABB10]

texts:
I have read the paper [ABB10] several times but I still cannot understand thoroughly the "artificial abort" in the security proof of the adaptively-secure IBE in the paper. So my questions are:

What is exactly the $\gamma(\cdot)$ function in the Artificial Abort step? From what I found in this paper (on page 14), it seems that $\gamma(\cdot)$ is the $\alpha(\cdot)$ function in [ABB10]. I do not understand why they define a new function for the same purpose.
I have trouble proving the assertion on page 25 in [ABB10] which is $$\epsilon_\max-\epsilon_\min< \alpha_\min|\mathrm{Pr}[W_1]-\frac{1}{2}|$$ where $\epsilon_\min$ and $\epsilon_\max$ are the lower and upper bound of the probability of abort (either by abort check or artificial abort) for all set of queries issued by the adversary; and $\alpha_\min$ is the lower bound for the abort-resistant hash function in the paper.
I tried to calculate the abort probability, then lower and upper bound it, as follows: $$\mathrm{Pr}[\mathsf{abort}]=\mathrm{Pr}[\mathsf{abortcheck}]+\mathrm{Pr}[\mathsf{artificialabort}]\mathrm{Pr}[\mathsf{abortcheck}]=1-\alpha(\mathbf{I})+\alpha(\mathbf{I})^2$$ where $\mathbf{I}=(\mathsf{id}^*,\mathsf{id}_1,\dots,\mathsf{id}_Q)$ is the set of challenge identity and $Q$ identity-queries from the adversary. Here I assumed that $\gamma$ is $\alpha$ and then I use the lower\upper bound for $\alpha(\mathbf{I})$ to bound this. I think that I did it wrong because the difference is not negligible. But I cannot see where I was wrong and a connection with the quantity $|\mathrm{Pr}[W_1]-1/2|$.

Can you point out the wrongs and give me ideas on how to fix this? Thank you so much.


texts: Why use CBC-MAC? Why not just apply hash function on the whole message?

texts: Why not just apply hash function on the whole message? Why convert that message into blocks and hash those blocks? To avoid collisions?


texts:
I understand that there are non-interactive (static) ZK proofs for every language in BPP, but I am not sure I fully understand this.

Can someone give an example of a Zero Knowledge Proof in BPP?


texts: Fast algorithm for reduction modulo a prime

texts: If the prime is $p=2^a\cdot3^b+1$ , is there any fast reduction technique modulo this prime?


texts: How is the recommended NIST modulus for DLP chosen/calculated?

texts:
NIST recommends a 256-bit private key exponent for DLP with a 3072-bit modulus. From this answer it appears that the range of private key numbers is derived by calculating a prime modulus via $2⋅p$ where $p$ is a 256-bit prime and then adding $1$ to the result (e.g. $2p+1$). If the result $n$ is a prime number and $a$ in $a^2 \pmod{n} \ne 1$, then we can use $n$ as the modulus.

I believe the difference in the recommended size between the private key (256-bit) and the modulus (3072-bit) has to do with the General Number Field Sieve Attack which has to do with the size of the modulus and not the size of the private key exponent. So the modulus needs to be much larger than the private key exponent.

My question is how the 3072 modulus derived? Not to implement my own of course, but to understand how it works. For example, does one simply choose a 3071-bit prime, multiply it by $2$ and add $1$, testing for whether the result is prime? If it is prime then check whether $a^2 \pmod{n} \ne 1$, and if it's not, then we can choose $2$ for the base a random private key exponent that's at least 256-bits and know that the best attacks will still require $\sqrt{2^{256}}$ brute force exponentiations to determine the private key exponent?


texts: How secure is a 128 bit ideal substitution cipher

texts:
A 128 bit ideal substitution block cipher substitutes 128 bit blocks with randomly assigned 128 bit blocks using a key table.

How secure is this type of algorithm?

Is this practical?

Thanks!


texts: What is the need of having a key schedule before executing AES

texts: Can someone explain to me why does using a key schedule make's AES more secure if instead of calculating and adding your round key's, you just keep on adding the cipher key. ?


texts: Data decrypted, but unwanted characters in the beginning

texts:
I am a bit new at cryptography, I tried to recover data from an old app database, I got the key and the type of encryption, it says "AES/CBC/PKCS5Padding", I used this online tool http://8gwifi.org/CipherFunctions.jsp to decrypt some strings, it decrypted but I got some characters at the beginning of my data, for example:

2cjABhgd?????samsung

?9??kj`?D g?GALAXY S5

In that case I should only get "samsung" and "GALAXY S5", but for some reason I get characters at the beginning. I want to know why this happens and how can I automatically get rid off those characters of the beginning, because I have hundreds of lines of data that decrypts like this.


texts:
If $p$ is an odd prime and $n$ natural,it is known that the group $Z^*_{p^n}$ is cyclic.Explain why the selection-choice of the group $Z^*_{{3^{1000}}}$ for the construction of a cryptosystem ElGamal it's not good.

Can anyone explain me why this happens?


texts: Given plain text of given cipher text, can AES key be uncovered?

texts:
How difficult is it to find the AES key if attacker has IV and ciphertext of a known plain text?

I am assuming 128 bit key size.


texts: Is it possible to generate a secure permutation F over 32-bit integers even if F(0) ... F(n) is public knowledge?

texts:
I'm currently interested in the problem of generating random-looking URLs from sequential database IDs, like how they do it in link shorteners. One way to do this is to encrypt the sequential database ids using a 32 bit block cypher and base62 encode the result so it can be written to the URL.

For example:

foo.com/1       foo.com/2        -- Original sequential IDs
foo.com/142365  foo.com/226340   -- Encrypt IDs using a permutation function
foo.com/b2D     foo.com/wse      -- Encode in base62 format - looks random + compact.

Now here is the catch: Whenever we encrypt the a new database ID and publish the URL, that plaintext-ciphertext pair become public knowledge. Is it possible to create an encryption system that makes it hard to guess what will be the next URL we will generate? That is, can we make it so the attacker can't guess the value of $F(1000000)$ even if he knows the values of $F(n)$ for $n \leq 999999$?

Some things that I think are important to note:

The cypher must have a 32 bit block size. Otherwise, the resulting URLs get too long.
The secret key is allowed to be any size.
Each number is only be encrypted once and all the messages I encrypt are 32 bits in length. (None of the stream-cypher stuff applies)

My actual use case – and most people's, to be honest – won't really need that kind of security. A bijective mapping from sequential IDs to URLs that looks scrambled at first glance is good enough. However, I am now curious if that unpredictability requirement is possible to achieve. In my searches, I found a lot of people saying that 32 bit blocks are too small due to the birthday problem but I am not sure that caveat applies here. On the other hand, none of the 32-bit block cyphers I found say anything about their resistance to known cyphertext attacks…


texts: Linear Approximation and Linear Probability of Camellia Sbox

texts:
In this article,Analysis of Camellia (para 2. Differential and linear cryptanalysis, page 3), it says

  The maximum bias of a linear approximation through one S-box is $2^{-4}$
  , which gives a linear probability of $2^{-6}$

what does this mean? isn't the linear approximation probability $2^{-4}$?

See This Question Too


texts:
This question is related to this one in intention, and this one in scope.

Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together?

I am thinking of using the Fortuna PRNG together with AES in counter mode, each initialised by a different source of entropy (now exactly what the two sources will be is an open problem). The output of each will be combined with the XOR operation, they will run on a separate thread and computational power is not a problem.

My (informal) thinking is that, as long as one function remains unpredictable (in polytime), the output is secure (in polytime).

The answers may address Fortuna or AES specifically, or they may treat the generators as abstract functions. Is there a flaw in this design?


texts: What is the name of this kind of protocol

texts:
There is a communication protocol that I believe creates the equivalent of a one time pad, with the downside that the secret message must be transferred multiple times.  The protocol is so simple that I imagine that it has a name but I can't find a protocol which matches its description.

Assumptions:

A client C wants to send a password P of L bytes to a Server S.
A function Z(P,M) exists whereby both P and M are L bytes and

Z(P,M)= P[i] xor M[i]; for all i < L

Thus the protocol would work as follows:

C generates a random string of L bytes called CM. C sends to S: Q0 where Q0=Z(P,CM)
S generates a random string of L bytes called SM. S sends to C: Q1 where Q1=Z(Q0,SM)
C reapplies the CM mask to Q1. C sends to S Q2 where Q2=Z(Q1,CM).
S reapplies the SM mask to Q2. Q gets P from P=Z(Q2,SM)

The protocol is taking advantage of the fact that the xor operation is both associative and commutative.