texts: Encrypting messages for multiple recipients

texts:
With hybrid cryptography, I want to encrypt a message intended for multiple recipients.

This can be archived (as described here by creating a symmetric secret key, encrypt the message with this key, and then include an encrypted version of the secret key, encrypted with all of the recipients' public keys.

I wonder if it is possible to have a "master recipient" who can decrypt all messages, and then have less privileged recipients who can only decrypt messages encrypted with their specific public key. Will it be possible by some sort of hierarchical keys, to enable a master recipient able to encrypt the secret key even though the secret key is not encrypted the master recipient's own key and added to the message?

Maybe I ought to look into "attribute-based encryption"?


texts:
what should I do to make my RSA signatures secure? If "plaintext RSA" is not secure, is there some sort of "RSA on steroids" I am not aware of? Could anybody tell me what is it?

I read a Wikipedia article "Digital signature". In the "History" chapter we can see:

  ...Soon afterwards, Ronald Rivest, Adi Shamir, and Len Adleman
  invented the RSA algorithm, which could be used to produce primitive
  digital signatures (although only as a proof-of-concept – "plain"
  RSA signatures are not secure

I searched for "rsa signature is not secure" but didn't find anything legible. Does anybody know why are RSA signatures are not secure and how can I make it secure by not doing "plain" signatures? Are there any tricks? The thing is that recently I implemented RSA in my code for my project and was so excited to see that I can sign and verify things with RSA...


texts: Possible to generate a one time secret which all nodes on the distributed network can know but cannot pre compute

texts:
I have a distributed P2P network.

Everyday, I want each node to have a secret which is only valid for that day, while each of the other remaining nodes on the network will be able to calculate the same value.

However, I do not want any node to be able to precompute this; for example, if it is Monday I do not want any other node to be able to compute the secret until Thursday evening / Friday

Is this possible? What kind of scheme would be needed for this to be effective?

Edit - have to edit here as i do not have enough reputation to comment, thanks for the answers so far, it would be impossible for me to have a centralized server, as this would break my model, can we achieve this without the need of centralized servers, and as for my adversary model, currently i am assuming a network of 5,000 nodes, which anything up to 49% of computing power maybe comprised by an attacker, so a solution needs to take into account the computer power at the disposal of an attacker and cannot relay on it might take x days

Edit 2 - The network is not closed, and yes the secret would need to be known to all 5,000 + nodes, but only be able to be computed / distrubted on a specfic day and valid for that day, i have been looking at network voting systems, all nodes compute a hash based on the previous days hash (like the bitcoin hash challenge where the solution is a nonce when added to another hash has x amount of zeros first) and then the average or mean of these is the secret used for the next 24 hours


texts: Why RSA-sig authentication VPN need its own private key?

texts: In my understanding, RSA-sig authentication only requires its own Public Key so that the peer authenticates it using Root CA's public key. But, strongSwan VPN configuration requires its own private key. I can't understand it. Am I wrong about RSA-Sig authentication or is strongSwan using RSA encryption?


texts: Given PRNG $G(s)$, why is $G(s) || G(s+1)$ not a PRNG?

texts:
I have given a pseudorandom Generator $G(s)$, $|s|=n$ whose expansion $l(n)$ is $>2n$. I also know that $G^\prime(s) := G(s_1,\ldots,s_{\lfloor\frac{n}{2}\rfloor})$ is a pseudorandom generator. Now the function

$\begin{equation}L(s) := G(s) ~||~ G(s+1)\end{equation}$

with $||$ being concatenation is supposed to be no pseudorandom generator and I struggle to prove it. Intuitively, I would think that since $L$ passes two different seeds to $G$ and $G$ is pseudorandom, $L$ must be pseudorandom too. $G(s+1)$ should be unpredictably different from $G(s+1)$ for a PRNG, should it not? Could someone point me into the right direction?


texts: Perform calculation on encrypted numbers

texts:
What i am trying to achieve ?

I am developing a carpooling solution powered by Blockchain and IOT. This one is supposed to be technically convenient and without compromising on the privacy part. Driver should be able to share his location on runtime. In order to remove the privacy issue i was wondering if this is possible :-

Driver has his private key on device and shares the location in encrypted format
Passenger requests for ride and queries server with its own encrypted location
Now we have list of active rides encrypted locations and one passenger encrypted location
Server performs haversine geolocation calculation over list of available active rides and figures out the best possible match along with the distance

I want to know if this is possible and if there is any efficient library available
Any other options to achieve the desired results are also welcome

Thanks in advance


texts:
I am studying for network security exam. And in the slide about Key Management, under a heading Key Verification I see this:

Key Verification

Almost all cryptographic algorithms have some weak keys that should
not be used.
With the help of key verification procedures, these keys can be
regenerated if they occur.

This doesn't make sense to me, how some particular key in algorithm might be weaker then any other key? Does key verification mean something else? And lets just for the moment imagine that some are weaker, then why would they be generated in the first place?


texts: Security Level Estimate when Cascading/Compositing Ciphers?

texts:
Way back when, DES had a theoretical security level 56-bits. 2-key TDEA provides about 80-bits of security, and 3-key TDEA provides about 112-bits of security. Obviously, those security levels are not linear in the cascading of the underlying block cipher.

First question

How does one estimate the increase in security level when compositing?

Second question

Is it necessary that the composition is not closed so that the composite does not form a group? I.e, if A(B(C(x))) = y, then there cannot be a A' such that A'(x) = y. (I believe so).

Third question

How does this apply to Diffie-Hellman over integers? If I run the Diffie-Hellman algorithm twice with 3072 moduli (i.e., 128-bits of security each) and concatenate the two shared secrets, then how many effective bits of security are present? (Intuitively, I think its around 128-bits or 129-bits).

Fourth question

How does this apply to RSA? If I run the RSA algorithm twice with 3072 moduli (i.e., 128-bits of security each) and transport two shared secrets, then how many effective bits of security are present? (Intuitively, I think its around 128-bits or 129-bits).

Sorry to ask these questions. The back story has to do with elliptic curves and patents, and I'm trying to figure out if its feasible to exchange/agree/transport an AES-256 key in distinct pieces using traditional crypto primitives while maintaining security levels and avoiding elliptic curves.


texts: Quadratic Residues in identification setting

texts:
Suppose Alice has two primes $p$ and $q$ such that $p\equiv q \equiv 3 \pmod 4$. $n=p\cdot q$ is part of her certificate to identify her. A party say Bob, sends her a random quadratic residue ${}\bmod n$, say $x$. To identify her, Alice computes $y$, a square root of $x$ and send it to Bob. He simply verifies $y^2\equiv x\pmod n$.

This completes the verification but Bob can now impersonate Alice. I am stuck trying to find what information does calculating square root modulo $n$ leak. I am guessing it has something to do with the fact that $p\equiv q \equiv 3\pmod 4$.

My question is after this, how can Bob calculate a square root modulo $n?$ That is if someone, say Eve, sends Bob a quadratic residue ${}\bmod n$, say $z$, how can Bob calculate a square root, say $d$, i.e, $d^2\equiv z\pmod n$, i.e., how can Bob convince Eve that she is communicating with Alice?


texts: Probability for Vigenere cipher given distribution of key lengths

texts:
Given the exact same question and answer here: https://crypto.stackexchange.com/a/37212/40935.

How does one derive/figure out (using equation, combination of equations, or "knowledge") the bold marked parts in the following:

  How does one know to put 0.5 and 1/(26^2) in the following places:

  Pr[C=ff | M=dd] x Pr[M=dd] = [1/26 x 0.5 + 1/(26^2) x 0.5] x 0.2
  Pr[C=ff | M=de] x Pr[M=de] = [0 x 0.5 + 1/(26^2) x 0.5] x 0.8

I expected the conditional part calculations to be:

  Pr[C=ff | M=dd] = [1/26 x 0.5 + 1/(26) x 0.5]
  Pr[C=ff | M=de] = [0 x 0.5 + 1/(26) x 0.5]

So I would like an "equation" possibly based on the law of total probability and/or Bayes' Theorem (or something which I do not know about), such that I can see the symbolic manipulation/calculations which leads to the simple substitution of values as described above.


texts: Should I use RSA encryption since RSA is said to be broken by NSA?

texts:
I am developing a simple web app that uses asymmetric encryption, but I am not sure whether to chose RSA for the reasons mentioned above.

What are your suggestions? Also if I decided to go with RSA what is the recommended Key Size ?

Also, someone in the comment area mentioned using libraries made by others, but did not say which libraries should I use?


texts:
We can construct a 1/4 OT from 1/2 OT. Proving security for the receiver in 1/4 OT means showing a reduction to the 1/2 OT receiver's security. The protocol I am using is given on page 3 here. I am working with the simulation based definitions of security.

There are three 1/2 OT's used, meaning three reduction steps, all that will look very similar. I write the first explicitly below. R2 - real view of party one in 1/4 OT. R2' - the view of the first reduction step towards the simulator.

$$R2 \; ((m_0,m_1,m_2,m_3),(c_0,c_1)) = \lbrace(c_0,c_1), (s_0 \oplus s_2 \oplus m_0), (s_0 \oplus s_3 \oplus m_1), (s_1 \oplus s_4 \oplus m_2), (s_1 \oplus s_5 \oplus m_3), a, b, c  \rbrace$$

where $s_0, s_1, s_2, s_3, s_4, s_5$ are all coin flips - the messages are booleans also. And $$\begin{aligned} a &\leftarrow R_21/2OT ((s_0, s_1), c_0),\\ b &\leftarrow R_21/2OT ((s_2, s_3), c_1),\\ c &\leftarrow R_21/2OT ((s_4, s_5), c_1)\end{aligned}$$ are samples from the real view of party 2 from the 1/2OT.

and

$$R2' \; ((m_0,m_1,m_2,m_3),(c_0,c_1)) = \lbrace(c_0,c_1), (s_0 \oplus s_2 \oplus m_0), (s_0 \oplus s_3 \oplus m_1), (s_1 \oplus s_4 \oplus m_2), (s_1 \oplus s_5 \oplus m_3), a, b, c \rbrace$$

where $s_0, s_1, s_2, s_3, s_4, s_5$ are all coin flips - the messages are booleans also. And $$\begin{aligned} a &\leftarrow S_21/2OT (c_0) ,\\ b &\leftarrow R_21/2OT ((s_2, s_3), c_1),\\ c &\leftarrow R_21/2OT ((s_4, s_5), c_1)\text{.}\end{aligned}$$

Let us assume that the above two distributions are distinguishable, by distinguisher $D$, we need to construct an adversary $A$ that distinguishes $R_21/2OT ((m, m'),c)$ and $S_21/2OT (c)$ for some $m,m',c$. $A$ receives as input one of the views it must distinguish and $c$ and outputs a boolean value.

In essence we must reconstruct the rest of the view (that is the same in R2 and R2') and pass it to $D$. The problem being the adversary does not know the messages $(m_0,m_1,m_2,m_3)$ and so cannot reconstruct the view totally faithfully.

I may be missing something obvious but if someone could explicitly construct the adversary for me to show this first step that would be great.

For avoidance of doubt. $A$ takes in as input either the distribution $R_21/2OT$ or $S_21/2OT$ and the $c$ (input) that was used to create these distributions and must output True or False depending on which distribution it was given. It can also access the distinguisher $D$ we have assumed can distinguish $R2$ and $R2'$.


texts: I know that PGP provides an hybrid scheme of encryption which can ensure both the encryption of a message and the authentication, but how it stores the secondary data, such as the object, the sender, the receiver, time, etc. on the server? Are they encrypted or stored in plaintext?


texts: Find an example of a lattice such that LLL algorithm can't find the shortest vector of the lattice, satisfying

texts:
I want to find an example of a basis of a lattice of dimension $n$ such that LLL algorithm can't find the shortest vector of the lattice, and such that the shortest  vector of this lattice, say $b=c_1b_1+\cdots+c_nb_n$, has small $c_i$, i.e., $c_i \in \{-r,\ldots,r\}$ with small $r$.

Note that $b_i \in \mathbb{Z}^n$ and $c_i \in \mathbb{Z}$.

Such example must satisfy $\log_2(2(r+1)) \cdot n \leq 15$, say $n=5$ and $r=4$.

The idea here is to have a treatable value for $2^{\log_2(2(r+1)) \cdot n}$.

I can't find any lattice satisfying this.

Thanks in advance.


texts:
I've been tasked with defining a list of cipher suites to use.

The requirements for the cipher suites are the following:

Symmetric Algorithm: AES-256
Key Exchange: ECDH P-384, DH 3072-bit, RSA 3072-bit
Key Authentication: ECDSA P-384, RSA 3072-bit
Hash Algorithm: SHA-384

Here is the list I've come up with (in prioritized order):

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0x00C02C)
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0x00C024)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0x00C030)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0x00C028)
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x00009F)
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 (0x00C02E)
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 (0x00C026)
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 (0x00C032)
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 (0x00C02A)
TLS_RSA_WITH_AES_256_GCM_SHA384 (0x00009D)
TLS_DH_RSA_WITH_AES_256_GCM_SHA384 (0x0000A1)

Would you say I've made the correct prioritization of the cipher suites? Are any of these ciphers considered weak?


texts:
I want to ask about distinguishing attack on CBC MAC, as in the paper published by Ketting Jia, Xiaoyun Wang, Zheng Yuan, and Guangwu Xu: Distinguishing Attack and Second-Preimage Attack on the CBC-like MACs.

In that paper it is said that "if there is a collision in the structure, the MAC function is random function. Otherwise it is a CBC MAC."

What is the meaning of that statement?

As I know, random function does not have collision, but in that statement it is said that if there is a collision, it is random function.


texts: Does hashing an encrypted message suffer from any drawbacks?

texts:
I am working on this problem where the set up is like this:

There are three hosts: A, B and C. A wants to send a message to C which passes through B. At A the message is hashed, the hash is padded to the message and then the message + hash is encrypted and sent to B. B wants to check for message integrity for which it decrypts the message, extracts the hash and then verifies.

I have proposed an alternative. My point is that we should encrypt the message at A and then compute the hash of this encrypted message. Then we should send the encrypted message +hash. The advantage is that at B the message need not be decrypted. B can verify the hash on the encrypted message itself.

Is there some problem with my proposed strategy?


texts:
It might be common, but if we had to solve an equation like this $m=s^{e}$ mod $n$ where $m,e,n$ are known. How can we find $s$. What optimisations could be applied? And what would the complexity of finding $s$ be relative to $n,e$?
Moreover, if we use GNFS or anything similar what does the complexity express exactly. For example, what do we mean when we say that for 1024-bit key the complexity for factoring it is ~86.7?

Finally, why can't we reform the equation like $m=s^e$ mod $n$ => $m+k*n=s^e$ => $s=(m+k*n)^{1/e}$ and start trying different k, as long as, we just want to find an s satisfying this equation?

Thank you


texts:
I have a 128-bit input-block and the corresponding cipher-block given.
Additionally I have the last round-key given.
Is it now possible to get (calculate) the associated cipher-key? I already implemented the normal key-schedule with the rcon to generate the round-keys out of a cipher-key (like on wikipedia: https://en.wikipedia.org/wiki/Rijndael_key_schedule), but it didn't help me much for the other way...
Ist the AES Key Schedule easily invertible? I'm a bit baffled now because i thought it would be.

Thanks in advance for your answers.


texts: How to convert a Galois LFSR to a Fibonacci LFSR?

texts:
I have just found the sequence output by the Galois type LFSR, seen here.

Now I know there exists a Fibonacci-type LFSR capable of outputting this same sequence but how could I find what the first six states of this LFSR would be?


texts:
Say you have a web application that's performing AES encryption. What sorts of side channel attacks should one keep an eye out for?

Timing attacks affect RSA more than symmetric ciphers in-so-far as I know.

Any ideas?


texts:
I am reading a paper of Furukawa and Sako, "An efficient scheme for proving a shuffle" from 2001. This paper writes a protocol for verifiable shuffling in mixnets. Their protocol make use of permutation matrixes, and they consider the use of ElGamal cryptosystems. A ciphertext $(g,m)$ is shuffled to $(g',m')$ as follows:

$$(g_i',m_i')=\left(g^{r_i}\prod_{j=1}^{n}g_j^{A_{ji}},y^{r_i}\prod_{j=1}^nm_j^{A_{ji}}\right)\bmod p$$

where $r_i$ is a random number, and $A_{ji}$ is a permutation matrix.

I want to prove that for each pair $(g'_i, m'_i)$ the same $r_i$ and permutation matrix has been used. I have been told that this is a standard proof of knowledge of exponents, but I can't quite find out how this is done. I really appreciate if anyone is able to help me.


texts: Why is the permutation in AES (and other ciphers) not random or key-dependent?

texts:
If the permutation in AES (or other ciphers) were randomly generated or dependent on the key, would it not be stronger against differential attacks?

If this is so, then might we need fewer rounds for the same level of security?


texts:
I'm currently reading Menezes' "Handbook of Applied Cryptography", and in it, when describing the MDC-2 cryptographic hash function, has the following line:

  Choose the 64-bit non-secret constants $IV$, $\widehat{IV}$ (the same constants must be used for MDC verification) from a set of recommended prescribed values. A default set of prescribed values is (in hexadecimal): $IV = 0x5252525252525252, \widehat{IV} = 0x2525252525252525$.

My questions are firstly, is it OK to use these "default" values more than once (as implied by the word "default")? And secondly, is there a full list and reasoning for these prescribed values? I cannot find the MDC-2 specification and so was hoping someone here would know more about it.


texts: Practical application of lightweight block cipher

texts: Are any lightweight block cipher ciphers adopted in real-time? If yes, what cipher and which application?


texts: What are access structures in Attribute-Based Encryption?

texts:
I'm reading this article, but I could'nt figure out Definition 1 (Access Structure) on page 3, section 3.1.
It says:

Let $\{P_1, P_2,...,P_n\}$ be a set of parties. A collection $\mathbb{A} \subseteq 2^{\{P_1, P_2,...,P_n\}}$ is monotone if $\forall B,C:$ if $B \in \mathbb{A}$ and $B \subseteq C$ then $C \in \mathbb{A}$. An access structure (respectively, monotone access structure) is a collection (respectively, monotone collection) $\mathbb{A}$ of non-empty subsets of $\{P_1, P_2,...,P_n\}$, i.e., $\mathbb{A} \subseteq 2^{\{P_1, P_2,...,P_n\}}-\{\emptyset\}$. The sets in $\mathbb{A}$ are called the authorized sets, and the sets not in $\mathbb{A}$ are called the unauthorized sets.

First, what do they mean by access structure? And what is the power of a set of parties ($\mathbb{A} \subseteq 2^{\{P_1, P_2,...,P_n\}}$)? Is it meant as a power set? Could you give me an explanation about that, and/or give some examples?


texts: Does encrypting a hash of the message yield a secure MAC?

texts:
Is $mac = enc(hash(x))$ a secure MAC for hash = SHA256 and enc AES in CBC mode or ECB mode. Normally AES-CBC is malleable. But in this case I use a hash function for the one-way property.

For example, an attacker can change the iv vector:

In CBC c[0] = enc(m[0] ^ iv) an attacker chooses m'[0] and computes iv' by m[0] ^ iv = m'[0] ^ iv'. So, in this case I find 2 digests with the same MAC: hash(x) = m[0]||m[1] and hash(x') = m'[0]||m[1]. But I have found 2 digests, I can't find x' than hash(x') = m'[0]||m[1].

Is my MAC a secure MAC?


texts: Small Quantum Signatures - Reality check needed

texts:
I've been thinking a bit lately about how to get quantum resistant signatures fast and (relatively) small.

One idea I've been keen on exploring is finding a crypto PRNG that allows fast-forwarding, e.g. Calculating what the hash will be N states in the future, without the ability of moving backwards.

The grand idea being, with a large fast-fowardable sequence generator, start with random-generated state A (private key), fast forward 2^256 states to get the public key.  To sign, you would give a state in the middle, which when iterated N steps ( where N==H==the hash value of the data you're signing) forward to equal the public key.  You would need to repeat this with a second private/public pair with N=(2^256-H) to prove the H is correct.

The lovely thing about that of course is your public key could be 32 bytes long (the hash of the 2 end states), and the signature == 2*the initial start positions to reach the public end state, say 2*64 bytes == 128 bytes.

A fatal issue, aka major reason for falling down, is that while many PRNG can be "fast-fowarded" in this way, when the cycle length is known you can in effect reverse by moving ahead (cycle_length-1) steps.
Thus for system to be practical, in order to sign a 256 bit value in this way you need to know that the cycle length is >2^256, and that the cycle length is unknown (and not easily knowable)
As a side note, SHA256 may or may not have multiple cycles.  It's also unknown.

I've been looking into a few possibilities involving a vector (X,Y) multiplied into a new X,Y using a singular matrix followed by modulo. (think LCG with singular mixing). Sure enough the vector seems to have multiple/many cycles depending on the start position.

As I always do, I'm putting far too much time into this without asking the appropriate questions - can quantum computing break these methods anyway using either shors, grovers or some combinatorial magic?

Would like to humbly ask then the experts out there - What are the fatal flaws of the basic approach, based on the realities of quantum computing and math?

Many thanks.


texts: X3DH protocol - What are One-time prekeys for?

texts: I'm reading about Signal Protocol and this protocol uses the X3DH Protocol to establish a shared secret key between the two parties but I couldn't understand why we use one-time prekeys in the flow. This keys are optional and if there is any in the server, in the first message between Bob and Alice, an extra Diffie-Hellman is calculate between this prekey and ephemeral key. What is the advantage of using One-time Prekeys?


texts: Suppose I have two messages $m_1$ and $m_2$ as well as $c_1$ and $n$. It's standard RSA so $c_1 = m_1^e \ mod \ n$, $c_2 = m_2^e \ mod \ n$. Further assume the only information we have about e is that it is smaller than $2^{2048}$. Is there a way to find it? (According to this it is not)


texts: Examples of modern, widely used ciphers that suddenly fell?

texts:
RC4 and GOST are two major ciphers (defined as being widely used to encrypt large amounts of data) that fell to cryptanalysis (relatively) suddenly.  The first becoming totally broken and the second fell from $2^{256}$ bit security to $2^{99.5}$ bit security, weaker than AES-128.

Have any other modern and widely used ciphers fallen without much advance warning?

"Fallen" in this context means "become practically attackable, or close enough that use is strongly discouraged". And to limit the scope of my question, let’s please exclude antique ciphers that predate our modern understanding of cryptography.

Essentially, I am looking for one or more prominent cases where a modern cipher seemed secure and was in wide use for a substantial period of time, until suddenly it was broken (while still in wide use) and had to be abandoned due to that sudden break. One possible example of what I’m looking for would be RC4 as used in TLS, and the recent discoveries that “broke” it.

(PS: References to the cipher paper + the paper introducing the break would be a plus.)


texts: Is authentication more computationally expensive than encryption?

texts:
newbie in crypto here. I've a application that needs integrity protection. Confidentiality would be nice but has  less priority over performance throughput. So I test "openssl speed" on my laptop, and find out sha256 is actually slower than chacha20. About the same speed as chacha20+poly1305. I assume this sha256 is about the same speed as HMAC(sha256), is that correct?
Also in openssl, chacha20+poly1305 is faster than blake2b512.

Is it the general case that integrity protection  is much more computationally expensive than encryption? By using aead algorithms I get confidentiality for free?


texts: What is difference between PRG, PRF, and PRP

texts: Until what I have gotten is: A PRG is generator is a part of PRF that produces pseudo-random values for the function. PRF is semantically secure and has no worries of being invertible. Fine, then where is PRP used? What is PRP, where it comes to, how it benefits.


texts: Why is Vigenère Autokey self-synchronizing?

texts:
According to the Wikipedia, and to several of our school study materials, Vigenère autokey ciphers are considered to be self-synchronizing stream ciphers.
If I understand it correctly, the main idea of self-synchronizing ciphers is that they should re-sync in an event of missing characters in the ciphertext because the key only depends on previous N characters.
But, as far as I understand, in Vigenère autokey, every character depends on all the previous characters being in the right order, isn't that so? So, in an event of a character loss, the rest of the ciphertext after the lost character will never be deciphered correctly.
So, what am I missing? Do I misunderstand self-synchronizing ciphers, or am I missing something about the Vigenère autokey cipher?


texts: In version 2.1, GnuPG featured primitives that use elliptic curves. For encryption, one option was ECDH, which confused me. I thought ECDH was for key agreement, not public key encryption. How does GnuPG utilize a key agreement scheme for enciphering files/messages?


texts: Would possessing a string with the SHA-256 hash of all zeros lead to an attack on SHA-256?

texts:
Would possessing a string with the SHA-256 hash of all zero bits lead to an attack on SHA-256?

I could easily imagine that a specialized attack leaked knowledge of how to do it, but I could equally imagine that a bitcoin miner randomed onto one.


texts:
Is there any point in making block size less than key size in block cipher?
For example, Russian GOST symmetric cipher uses 256-bit keys to encrypt 64-bit blocks. That means there are many keys which give the same result, so why making keys so large?


texts:
I wrote a cryptographic function that encrypts a plaintext by using a series of SHA-512 hashes that are used to encrypt the data via a simple byte-to-byte XOR. In order to prevent various attacks, I implemented CBC by hashing the current hash value and the previously enciphered block together. That resulting hash is then used to encipher the next 64-byte block of plaintext via simple XOR. The initial key is a SHA-512 hash of the passphrase or other key. I added several thousand rounds of hashing, and I still need to implement a random 64-byte pad to the front of the code to eliminate some guessing, but as a method is this a sound approach?
I can't imagine it being incredibly insecure, but I am interested in the methods one would use to crack the code.


texts: Attack on textbook RSA with small messages

texts:
We learned in class that if Alice wants to send a small message $m$, such that $m < N^{\frac{1}{e}}$, so we can break the system using $e$-th square of $m^e$.

But what if Alice knows this flaw and decides to sent $2^{100}\cdot m$ as her message. Is an attacker can still break the system (I assume that the attacker knows that Alice sent $2^{100}\cdot m$)?


texts: NIST temporarily closed — will that have a negative impact on the future of cryptography?

texts:
For those who didn't notice yet, in the USA, the National Institute of Standards and Technology(NIST) has been shut down temporarily because of the poor fiscal situation of the USA.

The text at their site reads:

  NIST Closed, NIST and Affiliated Web Sites Not Available

  Due to a lapse in government funding, the National Institute of Standards and Technology (NIST) is closed and most NIST and affiliated web sites are unavailable until further notice. We sincerely regret the inconvenience.

  The National Vulnerability Database and the NIST Internet Time Service web sites will continue to be available. A limited number of other web sites may also be available.

  Notice will be posted here (www.nist.gov) once operations resume. You may also get updates on NIST's operating status by calling (301) 975-8000.

  Conferences and other events scheduled during the shutdown are postponed or cancelled. Even after NIST reopens, some NIST events may need to be rescheduled. Once access to NIST Web sites resumes, please see the Conferences and Events (http://www.nist.gov/allevents.cfm) list for updated information on specific events.

Here's a screenshot of the NIST website (2013-10-02T12:00:00Z):

On the positive side, I could imagine more people coming to Crypto.SE as a result of that.

Anyway… even though it was tempting, I want to avoid "asking for opinions" so I am not going to ask how reliable and trustworthy NIST is, when looking at the fact that government funding obviously has a huge impact on them. Still, a question remains:

What impact will the closure have on the future of cryptography? (think: "crypto-development")


texts: Is OpenPGP vulnerable to the "crypto doom principle"?

texts:
From reading RFC 2015 (MIME security with PGP), and from looking at the raw format of (GnuPG) encrypted and digitally signed email messages, it seems that first a signature is calculated from the plain text message, and then both are encrypted.

My question is why isn't this vulnerable to what Moxie Marlinspike dubs the "cryptographic doom principle" (basically, if you have to do any crypto operation before checking the signature, bad things will happen)? I suppose the reason (alongside the devil) will be in the details, in the particular way the "sign-then-encrypt" operation is implemented. But I've been unable to find (or more likely to make sense) of those details. Can anyone shed some light?


texts: Multiple NTRU public keys for the same private key?

texts:
An NTRU public key is generated essentially by multiplying the inverse of a polynomial $f$ by a polynomial $g$. The polynomial $f$ is the private key; $g$ is discarded.

My question is: Is it insecure to hand out multiple public keys for the same private key, i.e. using the same $f$ but different $g$'s?


texts:
After we've concluded that 64-bit is an insecurity for classical computers, I think many would like to know, how secure in a perspective view, is 64 quantum bits security.

As we know, the Grover's algorithm halves the security strength offered by symmetric key primitives - a 128-bit-key block cipher would effectively require only $2^{64}$ trial decryption to recover key from a pair of plaintext and ciphertext on a quantum computer.

But how to put that into perspective? On classical computers, we have massively parallel processing units and hi-speed spinning fans providing air conditioning, we can have dedicatedly fabricated ASICs for extra speed up.

Q1) What equivalent can we find on a quantum computer?

We've always heard such obstacles as "quantum decoherence", and difficulty with entangling large number of particles, and some even question the possibility of even medium scale quantum computers. So

Q2) Is quantum computer really that impossible a dark art?

When NIST started their post-quantum cryptography standardization, they at first proposed having 128-bit classical security equivalent to 64 quantum bits security, they've later changed to measuring circuit depth.

Q3) What good translation between quantum security and classical security do we currently know.

Update

Per @fgrieu, 64 quantum bits security should be defined as: require equivalent to $2^{64}$ "black-box" evaluation.


texts: Two plaintexts map to the same ciphertext in fully homomorphic encryption?

texts:
In standard symmetric encryption, we can create an encryption scheme, in which two plaintexts $x_1, x_2$ map to the same ciphertext $y$, by choosing appropriate keys $k_1,k_2$ (!).
The most simple example is the one-time pad: For any plaintext $x$ and any ciphertext $y$, we can choose a one-time pad key $k$ such that $E(x,k)=y$. Therefore,

  (*)  we can for any $x_1,x_2$ choose two one-time pad keys $k_1,k_2$ such that $E(x_1,k_1)=E(x_2,k_2)$.

(Note, I'm not claiming that finding $k_1,k_2$ is computationally tractable!)

This in itself is not interesting, but now consider fully homomorphic encryption.

In a fully homomorphic encryption scheme, we have a plaintext $x$ and key $k$, and an encrpytion function $E(x,k)=y$, but where it is now possible for an (untrusted) party for a given arbitrary computation $f$, to do computations $\tilde f$ on ciphertext $y$ without knowing the plaintext $x$, such that by decrypting $\tilde f(y)$, we get $f(x)$.

I am wondering, whether there is a similar result as (*) for fully homomorphic encryption. That is, does there exist some fully homomorphic encryption scheme that has the following property:

  given two plaintexts $x_1,x_2$, there exists two keys $k_1,k_2$, such that $E(x_1,k_1)=E(x_2,k_2)=y$, and where this encryption is fully homomorphic, i.e. we can do any arbitrary computation $f$ (actually I only care about invertible computations) on $y$, and then decrypt this such that $D(f(y),k_1)=f(x_1)$ and $D(f(y),k_2)=f(x_2)$.

Note:

I am not claiming that this is practically useful in any way.
It is ok if actually finding these keys $k_1,k_2$ is computationally intractable.
I am interested in this for theoretical purposes only.

EDIT: random (and based-on-nothing) thought: If such an encryption scheme exists, then P=NP?

EDIT2: Here is an informal argument for why it shouldn't be possible:

a fully homomorphic scheme can by definition compute any computable function $f$. so it should also be able to compute a famliy of functions $f(x,n)$ where $x$ is the plaintext, and $f$ has EXPTIME complexity w.r.t. $n\in \mathbb N$.
Denote by $T(f(x,n))$ the amount of computational steps required to compute $f(x,n)$, and by $T(key)$ the amount of steps to find the right key $k$ for $x$ such that $Enc(x,k)=y$.
Then if we want to compute $T(f(x_i,n))$ "directly" for a set $X=\{x_i\}$, then it will take $T(f(x_i,n))\cdot |X|$ steps (simply the time required to compute an instance, multiplied by the amount of instances).
But if we want to compute it by using homomorphic encryption, then it will take $T(f(x_i,n)) + T(key)\cdot |X|$.
Therefore, as we increase $n$, the computation time of the first method (direct computation) increases faster by a factor of $|X|$. We, therefore, get "free computation" in the fully homomorphic case.
Therefore, no matter what the computational complexity is of computing the keys for the $x_i$'s, there always exists a $n$ such that computing it with the fully homomorphic method is more efficient.

This conclusion does not seem to follow the "laws of computer science", (though I haven't proved it's impossible), because it seems like a general-purpose method of improving the efficiency of such problems.


texts: Plaintext XOR'd with keylength-shifted plaintext

texts:
While solving a (easy...) Project Euler cipher problem this week I repeatedly saw instructions for breaking ciphers after identifying the keylength as:

  'shift the ciphertext by that key length and XOR it with itself. This
  removes the key and leaves you with plaintext XORed with the plaintext
  shifted the length of the key'

So I can understand how this drops the key out the equation, but I don't see how plaintext XORd with plaintext shifted by keylength is any more tractable.  In the many references I saw about this, no one followed up with how to solve the plaintext^shiftedPlaintext piece.  It doesn't seem that different than plaintext^keyPhrase really.

What am I missing about why this makes the problem easier to solve? What approaches deal with this part of the problem?


texts:
I stuck on the same problem in a cryptography, as stated in this question

I found following statement in famous textbook by J. Katz (main wiki PRP article refers to this textbook)

  PROPOSITION 3.27 If F is a pseudorandom permutation and additionally
  L-input(n) >= n, then F is also a pseudorandom function.

So the question is extremely simple, but I spent hours trying to find an answer.
If Fk(x) - is a PRP which takes n-length input, uniform n-length key k, and x - as an input n-bit string. How it can be a pseudorandom function?!

Permutation means F(00000) = 00000 ? So the function just reorder given input bits in pseudorandom manner determined by key K?  If not, can someone explain what actually does a PRP? And what is the difference with PRF? Except invertibility.


texts: Plaintext Size Limit for ECIES with AES-128 CBC mode

texts: Using the ECIES (Elliptic Curve Integrated Encryption Scheme), is there a limit size of plaintext? (what is the maximum allowed number of bytes to be encrypted with ECIES).


texts: Proving an encrypted message contains (but does not 100% consist of) a plain-text message?

texts:
I have keypair (u,r), and two pieces of data, X and Y.

I reveal X publicly but keep Y secret. Y has high entropy.

I then combine X and Y, into c(X,Y) = Z.

I encrypt Z, into "encrypt(Z,u) = Q".  r is needed to decrypt Q back into Z.

Can I prove (including interactive zero-knowledge proofs) that Q contains X, without revealing r or Y?

Please help! Thank you very much.


texts: How Mutual authentication and Forward secrecy in The X3DH Key Agreement Protocol work?

texts:
Can someone explain the statement below from section 3.3 in The X3DH Key Agreement Protocol?

  DH1 = DH(IKA, SPKB)

  DH2 = DH(EKA, IKB)

  DH3 = DH(EKA, SPKB)

  DH4 = DH(EKA, OPKB)

  SK = KDF(DH1 || DH2 || DH3 || DH4)

  DH1 and DH2 provide mutual authentication, while DH3 and DH4 provide
  forward secrecy

How do DH1 and DH2 provide mutual authentication, and how do DH3 and DH4 provide forward secrecy?

Are these also providing integrity of keys in X3DH exchange between server and Alice while fetching the prekey bundle ?


texts: How do I generate a session key using the Diffie Hellman algorithm?

texts: How to generate a session key between two nodes in two different subnets when the nodes don't know each other directly, using diffie hellman algorithm?


texts: Tiny Encryption Algorithm (TEA) weakness

texts:
The Wikipedia states that different multiples of a magic constant are used to prevent simple attacks based on the symmetry of the rounds. The magic constant, 2654435769 or 0x9E3779B9 is chosen to be ⌊$2^{32}$/ϕ⌋, where ϕ is the golden ratio.

And according to the code which wiki provides.

void encrypt (uint32_t* v, uint32_t* k) {
    uint32_t v0=v[0], v1=v[1], sum=0, i;           /* set up */
    uint32_t delta=0x9e3779b9;                     /* a key schedule constant */
    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */
    for (i=0; i < 32; i++) {                       /* basic cycle start */
        sum += delta;
        v0 += ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
        v1 += ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
    }                                              /* end cycle */
    v[0]=v0; v[1]=v1;
}

Since the constant is known, how could this constant prevent attacks?
I was stuck in the description.


texts: How to convert projective to jacobian co-ordinate in ECC?

texts: I am doing a small project using elliptic curve in cryptography. My doubt is, can I directly convert a projective to a Jacobian coordinate system without using the affine conversion in elliptic curve cryptography? Actually, I am stuck at this point…


texts: What asymmetric key exchange algorithms are known besides DH?

texts: On Wikipedia, a lot of the subjects that are said to be different key exchange methods are often just protocols that incorporate the Diffie-Hellman algorithm into them. The only other key exchange algorithm I know of besides DH is Algebraic Eraser, of which I don't know much about. Are there any others? And I don't mean key exchange schemes based on symmetric key primitives.


texts:
I'm studying the CL signature that how can it works. However, I cannot understand how equation (42) is calculated. What is the last three factors?
The value T is as follows:
$$T \leftarrow(A')^{\overset\backsim e} \Biggl(\underset{j \in A_{\overset- r} \cap \mathcal{I}} \prod (R_i)^{\overset\backsim{m_j}}\Biggr)(S^{\overset\backsim v}) \space\space\space (\bmod n)$$


texts: Freely available softwares for simulating/implementing MPC protocols

texts:
I have been designing multiparty computation (MPC) protocols for functions that interest me. Although theoretically I am able to deduce the asymptotic complexity of the protocol, I wish to know as to how this protocol will perform for practical sized inputs. I came across VIFF (virtual ideal functionality framework) written in python which allows us to implement/simulate MPC protocols. However, with just basic knowledge of MPC I am finding it difficult to write programs in VIFF. My question is as follows:

Is there some nice resource/tutorial available online in regard to VIFF? If not VIFF, can you point me to any other freely available software which can be used for simulationg/implementing MPC protocols that has nice tutorials for beginners.


texts:
Given the finite cyclic, additive group (G, +), with |G| = n and generator = g, what are the computations and exchanged messages for Diffie-Hellman?

What I tried myself:

Alice chooses a private $a$ and sends $p(|G|)$ and $g$ (generator) to Bob.
Alice calculates $A = a\cdot g  \mod p (|G|)$ and sends it to Bob.
Bob chooses a private $b$ and calculates $B = b \cdot g \mod p (|G|)$ and sends it back to Alice.
Alice calculates $a \cdot B \mod p (|G|)$ which is the shared key.
Alice calculates $b \cdot A \mod p (|G|)$ which is the shared key.

Is this way of thinking correct? Because I'm not sure because the group is additive.


texts:
The average conditional min-entropy of X given Y,
$\tilde H_\infty( X | Y)$, measures, roughly speaking,
the amount of randomness that is in $X$ given as side information $Y$.

(for the formal def, https://eprint.iacr.org/2003/235)

Consider the following statement:

Let $A,B,Z$ be arbitrary random variables, let $k\in \mathbb{R}$, and let $f$ be a function
if
$\tilde H_\infty( A, B | f(A,B), Z) \geq \tilde H_\infty( A,B | Z) - k$
then
$\tilde H_\infty( A | f(A,B), Z) \geq \tilde H_\infty( A | Z) - k$

I would like to know under which circumstances the statement above is true.
Intuitively, it seems true, in the sense, if $f(A,B)$ leaks at most $k$ bits of $A,B$ when the auxiliary info $Z$ is know, then at most $f$ leaks $k$ bits of $A$.

A simple case :
If $B$ is uniformly random over $\{0,1\}^l$ and $Z$ is the empty value, then, by a simple derivation that uses the chain rule of the avg. conditional min-entropy, we can prove the statement above.
In fact:

$$ \tilde H_\infty( A| f(A,B) ) \geq
\tilde H_\infty( A,B | f(A,B) )- l \geq
H_\infty( A,B ) - k -l \geq
H_\infty( A ) - k - l + l$$

What can we say when $B$ is uniformly random and $Z = g(A,B)$ for an arbitrary function?


texts: Malleability of ElGamal and Hashed ElGamal

texts:
Question: Suppose A encrypts a number $x$ which indicates her bid on a contract, using ElGamal encryption. Say that the encryption of $x$ produces a ciphertext $c$. Explain how E can modify $c$ to make it an encryption of $100 \cdot x$.

Answer: E is exploiting the malleability of ElGamal.  She can take the ciphertext pair $(c_1,c_2)$ Where $c_1$ is $g^y$ and $c_2$ is $m * h^y$  and multiply $c_2$ by $100$ to get the desired results.  A can protect herself from this by used a hashed version of ElGamal

Is this correct?


texts: I'm trying to complete a cryptography CTF challenge in which I have a cipher I'm supposed to attain the original plaintext from. I have reason to believe it's been encrypted using AES, but I'm unaware of the typical tests to carry out to check for weak implementations. For instance, with DES you can test for use of weak/semi-weak keys, with RSA you can test for lack of padding etc etc, but as far I know there aren't options like this with AES. Where could I possibly begin looking for a bad implementation?


texts: Using a public key as a secret to authenticate the sender

texts:
Question
I have a scenario where a public key is exchanged out-of-band with exactly one person $A$ and is later used in a key-exchange scheme with $A$.
Is knowledge of the public key (i.e., producing a valid encrypted message to the public key) a good authentication of $A$?
Example
Let's say Alice wants to set up a secure channel to Bob. All cryptographic primitives are assumed to be secure, including message authentication, encryption, etc. This is obviously a simplified example. I only care about the properties of $p_{BA}$.

Bob generates a new key pair $kp_{BA}$ that is only used for this session with Alice.
Bob shares the public key $p_{BA}$ with Alice out-of-band (such that an attacker has no way of knowing $p_{BA}$)
Alice generates a symmetric key $k$
Alice sends $k$ encrypted with $p_{BA}$ to Bob.
Bob successfully decrypts $k$.
... they use $k$ to encrypt messages to each other.

Now does 5) imply that the sender could only have been Alice?
Does 4) give an attacker information about the nature of $p_{BA}$?


texts:
Let $m = 6$, and let $\mathbb{Z}_m$ denote the set $\{0,…,m-1\}$. Let $X \mod m$ denote the remainder obtained when dividing $X$ by $m$.

  (a) Consider the symmetric encryption scheme in which the encryption of message $M \in \mathbb{Z}_m$ under key $K \in \mathbb{Z}_m$ is $M+K \mod m$. Is this encryption scheme perfectly secure? Why or Why not?

I'm having a lot of trouble understanding why the "X mod m" and all of the other modulo operations are relevant. I know it says let it denote the remainder obtained when dividing $X$ by $m$, but… the remainder of what? Why would the remainder be relevant?


texts: Hardness assumptions on composite order bilinear groups

texts:
I am not at all knowledgeable in elliptic curve cryptography. So, here lies a couple of questions that I failed to find answers for to my satisfaction.

Is there any known Type-III bilinear pairing defined over composite order groups?
Do DLIN/SXDH assumptions hold in composite order groups?


texts: What is the difference between chosen-plaintext attack and adaptive-chosen-plaintext attack?

texts:
I've just dived in cryptography and would like to learn basics of this science.

Currently I can't understand the difference between these two types of attacks. As I understood from Bruce Schneier's book "Applied Cryptography", adaptive-chosen-plaintext attack is similar to chosen chosen-plaintext attack, but cryptanalyst can modify his choice (plaintext) based on previously got result.

What does this suppose to mean? In chosen-plaintext attack cryptanalyst also is choosing the plaintext. So what is the difference?


texts: How to select "good" bits which pass NIST statistical tests x% of the time?

texts:
I am trying to implement an algorithm where the first step is to select "good" bits using the NIST test suite. In particular, I have $k$ streams with $n$ bits each. The original paper Toward Sensor-Based Random Number Generation for Mobile and IoT Devices (PDF) states

  For a given bit to be ‘good’, it must pass at least 3 of the NIST tests at least 75% of the time.

What would be the best way to go about implementing this?

The NIST tests which I am using are the frequency test, frequency test within a block, runs test, longest run of ones within a block, DFT test, binary matrix rank test, and approximate entropy test.


texts: Is there any bias whatsoever in modern hash function outputs?

texts:
The following is a representative example of a common hash function:-

The asymmetry is clear, and I would  expect additional edge effects  in the A and E output words. So I'd be surprised if the probability distributions between words A to E are identical to the nth degree. The same asymmetric construction argument clearly applies to all other hash architectures.

In general cryptography and as NIST does, it's common to treat a bias $\epsilon < 2^{-64}$ as negligible.  So an $\epsilon$ is expected of some degree as our constructions are imperfect.

The question therefore is: is there any estimate of the theoretical bias across the block width of hash function outputs? Assume the limiting case of an infinite number of hash inputs. Would the output probability distributions be (say for the above example) $P_{\infty}(A) = P_{\infty}(B) = P_{\infty}(C) = P_{\infty}(D) = P_{\infty}(E)$ exactly, and $\epsilon = 0.0$?

I won't be accepting the current answer as that deals with empirical measures, but I'm asking about theoretical expectations. There is no computationally bounded adversary.  I'm just curious.

NB. I take "bias" to mean the standard NIST definition (SP 800-90B) as "A random process (or the output produced by such a process) is said to be biased with
respect to an assumed discrete set of potential outcomes (i.e., possible output values) if
some of those outcomes have a greater probability of occurring than do others."

I'm really not sure if Is any group of bits in a SHA-1 hash more/less unique than another? is similar or not.


texts: Using same key for encryption and ECBC-MAC k2

texts:
ECBC-MAC: $E_{k_2}(CBC-MAC_{k_1}(m))$

If we use same key for encryption (CTR or CFB) and k2 (end tag encryption) in ECBC-MAC in encrypt-than-MAC sheme, is it secure?


texts: How to Reduce a Quaternion Ideal into Power Smoothness?

texts:
(TL;DR) How exactly do we reduce a quaternion ideal into another powersmooth one?

Given a supersingular elliptic curve, it is known that its endomorphism ring is non-commutative. Specifically, there is Deuring correspondence associating supersingular $j$-invariant up to a twist and a maximal order of quaternion algebra $B$ ramified at $p,\infty$.

Suppose $\mathcal O\leftrightarrow j(E)$ is associated by the correspondence, i.e. $\mathsf {End}(E)=\mathcal O$ and there is a left $\mathcal O$-ideal $I\subseteq \mathcal{O}$ with norm $\mathsf {Nrd}(I)=N$ and generators $\alpha,N$. It is said that $I\sim J$ are equivalent if $\exists r\in B^\times$ that $Ir=J$. I was reading this article saying there's an efficient algorithm to find a powersmooth representative (up to $\sim$) of ideal $I$ with large norm. I couldn't understand how exactly it is performed. The main goal in the article is to solve for a $\beta,\lambda$ such that $\beta=\lambda\alpha\mod{N\mathcal O}$ in page 8. But how exactly solving $\beta$ would help one reduce the ideal norm?

Is it possible to write down the explicit procedure? If not, is there any other way to reduce the ideal norm?


texts: Is it ok to transmit an IV as a custom HTTP header?

texts: Considering an AES OFB encryption algorithm, suppose that I'm sending a message over HTTP (not HTTPS) and my message body contains the cyphertext. I'd like to know if transmitting a random initialization vector as a custom HTTP header is considered a bad practice, having into account that it's conventionally appended to the beginning of the cyphertext.


texts:
I'm trying to understand how a XOR affect traces of power consumption in a Differential Power Analysis on smartcards.

What's the difference in energy radiated in a $1 \oplus 1$ and in a $0 \oplus 1$?

If I understand correctly we have a XOR gate, and if a $1$ is xored with a $0$ then electrons in the 1 branch just continue flowing thus we still have some energy compared to a $0 \oplus 0$.


texts: Is the composition of collision resistant hash with non collision resistant hash a collision resistant hash?

texts:
Suppose $h_1$ is collision resistant, and $h_2$ isn't.

Will $h(x)=h_2(h_1(x))$ always be collision resistant?

[Edited:] the output of h2 must be uniformly distributed


texts: Factorizing a handiwork number $n$ in two prime factors

texts:
I have generated two primes $r_0$ and $s_0$ with same bit size $\le 64$, then make another two primes as follows: choose constant $k$ and define $$r_i = r_0 + \alpha_i, \quad 1 \le i \le k, \quad 0 \le \alpha_i \le 1000$$ and
$$s_i = s_0 + \beta_i, \quad  1 \le i \le k, \quad 0 \le \beta_i \le 1000$$
I have chosen $\alpha_i$ and $\beta_i$ such that both p and q are prime,
$p = 2\times r_0\times r_1\times\cdots\times r_k + 1$ and $q = 2\times s_0\times s_1\times\cdots\times s_k + 1$. Can we factor $n = p \times q$ with knowing above facts?


texts: simple algorithm to encrypt/decrypt a text file

texts:
I need to write a first program in one language that saves data in a text file, and write a second program in a second language to decrypt that file. The two languages in question don't include any crypto libraries, so I'm on my own.

Could someone recommend, point me to, or summarize a simple algorithm (pseudo code) that provides some level of basic encryption?

I don't have much experience in this area, but if you can summarize clearly in pseudo-code, I can implement it (don't assume prior knowledge).

It doesn't have to be bullet-proof, but just something that deters the user from understanding the text file. Something more secure than just a simple character-substitution (1 for 1), like perhaps a key that generates a random string used to XOR or similar complexity. I have no idea where to start.


texts: Why don't block ciphers consist of a simple XOR operation with key like Stream ciphers?

texts:
If the construction of stream ciphers is already secure why does the construction of block cipher involve pseudo permutations and complex operations that makes block ciphers less faster?
Is a construction of a block cipher defined as just Xor-ing a block of bytes with a block of key bytes (removing all permutations and other operations) not secure?


texts: Why is the El Gamal commitment scheme information theoretically binding?

texts:
I am a bit stuck on the following claim:

  The ElGamal commitment scheme is information theoretically binding

As far as I understand, an adversary $A$ would win the binding game if it is able to find an $x\prime\neq x$ such that $C(x)=C(x\prime)$.

$C(x)=C(x\prime)$ implies:

$$ (g^r,h^rx)=(g^{r\prime},h^{r\prime}x\prime)$$

How is this impossible to be found? Since generators are cyclic, it should be possible to find an $r\neq r\prime$ that with $g^r=g^{r\prime}$, or am I overseeing something?


texts: How to prove the security of block ciphers

texts:
I see very often proofs of security for asymmetric crypto algorithms, for instance, using reductions to known hard problems, or game based proofs...

In the field of protocols (like authentication) it happens too, for instance proofs using formal models...

But what about the symmetric crypto? More specifically, the blockciphers?

For example, this paper (presenting the Piccolo blockcipher) has a section named Security Analysis on which the authors just argue why they think Piccolo is secure against some knowns attacks. This is actually the opposite of the "philosophy" of the provable secure crypto, that tries to analyse the security of a primitive without exhaustively trying the known attacks, because it may exist some attack that is not know by the academic community.

Thus,

Are the blockciphers usually proved to be secure?
If yes, how is it done? If not, how the security is measured?
Is the approach of security analysis used in the paper above common on blockciphers papers?
And since the answer to the first question seems to be no, is there any blockcipher whose security analysis was done following a "provable secure like" approach?


texts: Mathematically / statistically "safe" way to differentiate between crypto and random blob?

texts:
I assume the United Kingdom will impose (as opposed to just talk about it) restrictions on crypto software that may be used within it's borders.

Me, quite the border clown (yes, I always bring a up to nine (only because I can't fit ten times 100ml plus containers into a 1000ml bag) re-sealable, see-through containers of pure tap-H2O, all of them put into a clear see-through, re-sealable plastic bag of no larger volume then 1 liter, to the airport, just to have them all individually sent through expensive-looking devices, checked for any impurities for my own safety, and only to empty all of them right after I have gotten them back from very grumpy border agents into my large mouth) and always having been a hardcore believer in the European Union and every person's unalienateable right to speak freely, privately and without any government intrusion; I would like to bring a USB thumbdrive with a few megs of /dev/random, generated by Linux with the help of a hardware PRNG, or just some concatenated hotbits.

I assume I will be questioned about the contents of the USB thumbdrive and will, truthfully, state that the contents are just random bytes. Depending on the amount of humor (in this case, humour) of the border agent I will spend some snuggly time in a holding cell thereafter.

What means do I have to prove, mathematically and statistically, that my random bits are indeed just that – random bits? What attacks (NIST-tools, chi-squared test, …) might the border agency run against my random bytes to try to prove their non-randomness? What software might he use? What software should he use?

Disclaimer: I am in no way affiliated with any nations government except casting my vote very four or five years. I might one day have to come back to this page from my suggly holding cell. See, officer, I told you.


texts: Is encryption possible without secure random numbers?

texts: All cryptographic algorithms I know of that satisfy Kerckhoffs's principle rely upon secure random number generation. Assuming the existence of a 'numerical oracle' capable of perfectly predicting the outcome of any random number generator, is a Kerckhoff-compliant algorithm possible?


texts:
In a PDF related to AES algorithm for mix column stage is written:

  The multiplication mentioned above is performed over a Galois Field.
  The mathematics behind this is beyond the scope of this paper. This
  section will instead concentrate on the implementation of the
  multiplication which can be done quite easily with the use of the
  following two tables in (HEX).

Is there a formula (suitable for programming) to do this multiplication?


texts: Hash decrypts key, key decrypts cipher... why?

texts:
I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a random key, use that to encrypt the data, then xor the key with the hash of the password and store the result within the encrypted file's header.

I can see this being useful from the perspective of wanting different keys for different files, even though the password is the same, but I can't think of any other reason. Are hashes weak as block cipher keys, or am I missing something here? Are there any additional security considerations to think about with this kind of mechanism? Also, is this mechanism superior to using keyed HMAC hashes, where the file contains the key?


texts: DH prime size required to force an attack of $2^N$ steps

texts:
Why the size of a DH prime $p$ should be about 6800 bits long to force an attacker to perform $2^{128}$ steps to attack the system?

How is this relationship 6800-128 established?


texts: Derive operations from an arbitrary number

texts:
I don't really know how to phrase this question, so I'll just mention the idea. This is partially reminiscent (at least in spirit to white box crypto): Can one derive arithmetic operations from a number? Is there a formula to do that?

So, the simplest example would be:

a = 4
ops = get_operations(a)
print(ops)

/* output:
*
* b = 2
* c = 2
* return b + c
*/

The idea is to simply have a way to "derive" a mathematical operation from a value. There are obviously more than "one" operation that could be derived from the above example. The system does not have to be complete.

The flow of such a "derivation" algorithm in my head is as such:

Get input (k)
Randomly choose an arithmetic operand (P) where y = k (P) x and store the operand (P)
Pick a random number (x) and store its value
Solve for (y) and store its value
Now, we have a combination of (P), (x), and (y) that, when solved, would yield the correct input (k).

My question is this: did someone research this and make a way better algorithm that what I could muster up here?


texts: In a additive group is it hard to calculate $bg$ given $ag, g, abg$

texts: The ECDH problem defined that given $g,ag,bg$ it is difficult to calculate $abg$. But it is also difficult to calculate $bg$ given $ag,g,abg$. where $g$ is generator and a,b are elements of group.


texts: Recover plaintext in passive attack of RSA of coprime public key

texts:
I have a situation in RSA like this.

Charles sends same message $m$ to Alice and Bob encrypted with $e_A$ and $e_B$ respectively. It happens that he they are under same modulus $n$ and $gcd(e_A, e_B)=1$. Now Eve intercepts two messages $c_A$ and $c_B$. The claim is that Eve can easily get $m$ in this situation.

My thought on this case is follows:

With $e_A$ and $e_B$ coprime, Eve can use the extended Euclidean algorithm to get solution to $1=a_1e_A+a_2e_B$. She then calculate $(c_A)^{a_1}(c_B)^{a_2} \bmod n = m \bmod n $
Now the problem is that one of $a_1$ and $a_2$ is actually negative (let's assume $a_1$). So the above $(c_A)^{a_1}$ involves calculation of an inverse modulo $n$. Yet I think $c_A$ is not necessarily be invertible.
An concrete example I can think of: $p=5$, $q=7$, $n=35$, $\phi(n)=24$, $e=11$, $m=21$, in this case, $c_A = 21$, not invetible.

I think somehow Eve must be able to recover the message. But I simply got stuck in above analysis.

Am I missing something? Please point out! Thanks so much!


texts: Create big random number from 2 smaller numbers?

texts:
If I have  2 true random numbers from atmospheric noise or a different source.
Suppose $x= 299$ and $y= 499$.
Is it possible to create a bigger number with $x$ to the power of $y$?

Can I use different sources like, pressure sensor + light sensor + movement sensor and calculate $x^{y^z}$ for a true random number?


texts: Using HKDF to derive symmetric keys from a hybrid public-key encryption scheme

texts:
RFC 5869 describes HMAC-based Extract-and-Expand Key Derivation Function (HKDF). In section 4, entitled "Applications of HKDF", it states that one of the intended uses is:

derivation of symmetric keys from a hybrid public-key encryption
scheme

However, it doesn't expand on the meaning of this. Can anyone explain how HKDF can be used in this manner?


texts: What is the lowest level of mathematics required in order to understand how encryption algorithms work?

texts:
What mathematical fields of knowledge would be required in order to get a good understanding of encryption algorithms?

Is it basic algebra, or is there a "higher education" mathematical field dedicated to encryption? I know there is the cryptography field, but what is the subset of knowledge required for cryptographers?


texts:
I see in some “Authentication schemes with biometric” papers that those authors wrote a phase as password and biometric update phase.
My question is that why we may needs biometric update phase?
Is not biometric (say finger print or iris or face and …) permanent properties?


texts:
I just got an email from a professor that included two files, with no clues about them in the message. The files are named OpenPGP_...EA.asc and OpenPGP_signature. I figured, since I asked some stuff about cryptography that he may be sending some hidden message there, but after some "research" on google I'm guessing that it's just his personal public key and his signature (?) perhaps. I'm just not sure why he included those files, so any hint about it would be nice.
Thanks!


texts: RSA - source and image - all are possible?

texts:
Given a key $e = 3$ (the public exponent for RSA) and a group of numbers, say $Z_n^*$ (the multiplicative group of $n = pq$, where $p$ and $q$ are primes as requested by RSA).

I can find the decryption key: $d = e^{-1}$

Is it correct to say than any member $a$ in $Z_n^*$ has a source such that: $source = a ^ d$?

Edit: suppose we have gcd(3,phi(n)) = 1 as requested by RSA


texts:
what is the benefit of lcm in cryptography?
and what is the effect of lcm on public key?

note *
lcm = Least common multiple

thanks


texts: Pairing-friendly curves in small characteristic fields

texts:
There are several well-known techniques to generate pairing-friendly curves of degrees 1 to 36 on prime fields GF(p): Cocks-Pinch, MNT, Brezing-Weng, and several others.

In extension fields GF(p^n), however, one is confined to supersingular curves. In characteristic 2, embedding degrees are <= 4, and in characteristic 3 they are <= 6. In general, they are <= 2.

The question is: is there any known method to generate ordinary pairing-friendly curves over small characteristic fields, with a reasonable (say, 3-20) embedding degree?


texts: Are there full cycle cryptographic/one-way hash primitives?

texts:
I'm looking for behavior similiar to that of LCGs, (i.e. input and output sizes are same). Full cycle of $2^{32}$ different inputs generates full cycle of $2^{32}$ different outputs, distribution of which depends on large key. Obviously combined LCGs (with generated parameters based on the perturb seed key) seem trivially invertible through modular inverse, but you get the idea.

The hash has to accept small input and produce never-colliding equal sized output, and is keyed with large 'salt'/'nonce' key, to make precomputing generic table of all $2^{32}$ hashes for trivial inversion infeasible. The hash has to remain one way when 'seed' key and output is known (ie input should be difficult to compute out of those, short of bruteforcing 2^31 inputs for each particular seed+output and meeting in the middle for birthday).

This exotic requirement sets it apart from classical bijective trapdoor functions (RSA, MQ et al), as the output has to be much smaller than some input parameters (ie the "salt" seed).

Is this even feasible? It does not appear to be with traditional ARX/feistel, however I suspect there are still useable trapdoors in number theory - for example FSB and SWIFFTX. However I'm not sure if those can be adapted to the requirement above.

I'm OK with security parameter well below nbits/2, as long it is still reasonably difficult to invert algebraically.

Bottom line: Albeit related, perfect hash functions are not acceptable answer as there does not seem to be examples of cryptographically secure ones, much less any working as a trapdoor.

Block ciphers such as RC6 or AES rounds show some promise (by using the 'decrypt' part as our hash), but naive implementation seems to be reversible by running the rounds backwards (remember, the cipher key, our "seed" sbox which introduces non-linearity in those is publicly known, whereas the tiny "plaintext" is what is to be protected).

I presume block ciphers which break linearity through heavy input data dependency might work, however I have no idea what candidates I should be looking for.


texts: Non-interactive public sum of private values

texts:
Suppose there is a large number of participants each with a secret value. The secret values are very large (e.g. 256-bit integers). Each participant has published a public commitment to their secret value.

Is it possible for them to determine what their values sum up to in a single round of communication but without revealing their private values?

This can also be thought of as a voting scheme: each participant holds a value with which they can vote. Knowing public commitments for the votes that have been cast, we'd like to figure out the total number of votes that was cast without the need for voters to collaborate with each other (beyond casting of the original vote).


texts: How to design a balanced LFSR with period 1023 and linear span 55?

texts:
I am trying various combination of LFSR's to try to design sequence of period 1023.
The linear span should be 55 and the output 1023 bits has to be balanced.

I have tried with five LFSR's with degree 10 and one LFSR with degree 5, XORing all ..which gives 55 as Linear span and period 1023.
However, it is not balanced.
With trial and error, I get a balanced output with XORing 9 LFSR of degree 10 and one LFSR of deg 5.

Can anyone give some idea what path to take to solve this ?


texts:
I'm reading this paper:  fips180-4-draft-aug2014

I'm on page 23 where they have two values for SHA-256: T1 and T2. While I understand the operations done, I don't understand the bigger picture. Why do we need T1 and T2 in this case? What do the values T1 and T2 represent?

The paper defines it as "T Temporary w-bit word used in the hash computation." But why go through so many shifts and other operations?


texts: Why does the hashfamily of all functions with $\{h \in H_0 | h:U \rightarrow V\}$ satisfy universal hashing?

texts:
I read in our university lecture on hashing that it would be good (even though it is way to space intensive) if we could take the set of all function from $U \rightarrow   V$ to satisfy the following universal hashing condition: for all $\forall x,y\in U$ so that $x≠y$, we have $Pr[h(x)=h(y)]≤\frac{1}{|V|}$
I actually don´t understand why the set of all functions would satisfy our condition. I can definitively see that there are some function which fit this condition, but I can think of other functions which dont meet the condition. So I would have to make a statement about average probabilty over the set of all functions, but how could something like this be defined precisely?
Or am I taking something wrong here and the Set of all functions wouldn´t meet the condition, but would actually be better that the condition taking the case that h is taking randomly from H? Even if so it seems to come down to the same problem.


texts: Using password-based encryption as a hashing scheme

texts:
Classic scheme:

Given password and hashing algorithm
Generate salt
Calculate hash=hashing(password, salt)
Separately storing hash & salt

Checking password validity: comparing stored hash with calculated test_hash=hashing(test_password, salt). If hash=test_hash - password is ok, otherwise test failed.

Proposed scheme:

Given password, cipher algorithm and predefined dictionary (e.g. set of digits {0,1,2,3,4,5,6,7,8,9})
Generate salt
Generate random test_phrase from our dictionary (e.g. only random digits, like test_phrase=32759823767865236451236647894678923897)
Calculate hash=cipher(test_phrase) with key=keygen(password,salt)
Storing hash and salt (no need to store test_phrase)

Checking password validity:

calculating test_phrase=decipher(hash) for a test_key=keygen(test_password,salt)
check if test_phrase consists only symbols/bytes of predefined dictionary (e.g. decrypted phrase are only digits, say if decrypted phrase is smth like: askjdfhasjkdfhasjkdhe-0123=jkasfhasjdfh - that means test failed, since some symbols are not digits)

Question

What do you think about pros/cons for this proposed hashing scheme?


texts: Is it possible to have a multiparty untrusted generation of the public parameters for the BCP cryptosystem (https://www.iacr.org/archive/asiacrypt2003/01_Session01/03_106/28940037.pdf), so that a minimum threshold of parties be needed to use the master key?


texts: Are lookup tables safe when they fit in a cache line?

texts:
The typical cache line size of modern x86 machines is 64 bytes.  Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly?

I was thinking about how to make a constant-time GHASH (GCM) implementation.  I want to have a table of 128x4 128-bit entries.  Each two bits of the block being multiplied would determine which of four entries is XORed into the result.  Repeat 64 times, and you've multiplied the block by $H$.

As far as I can tell, this should be immune to timing attacks, because at no time does secret data determine which cache line is read.


texts:
If I split a key $k$ into three pieces as $k1, k2$ and $k3$ how should I distribute the keys among three people such that any two of them are able to evaluate PRF, but be secure from any one of them trying to do so. The PRF is defined as
$F'((k_1,k_2,k_3),x)=F(k_1,x)⊕F(k_2,x)⊕F(k_3,x)$
It is known that the three people know what pieces they hold so in this case if I split the keys in pair as $k1, k2$ for first person, $(k1, k3)$ for second and $(k2, k3)$ for thrid person and compute
$F1((k1, k2), x) = F(k1, x) ⊕ F(k2, x)$
Now if I send this $F1$ to the second person and compute $F1 ⊕ F2$ where $F2$ is given as below then I should be able to recover the PRF $F'$. Is that correct?
$F2(k3, x) = F(k3, x)$


texts:
I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences.

What are principle differences?
When to use one and when the other?(Typical Use Cases)


texts: Detect MITM with hashed session-key — Is my protocol secure?

texts:
I have the following setup:
An app ("client") wants to communicate securely with a device I created ("server").
The client has the public key of the server (and a hashed password) preinstalled.

I use the libhydrogen crypto library (inspired by libsodium / same creator as libsodium).

First, I do a key exchange (using the N variant) to generate my session key.
Then I use secret-key authenticated encryption for my communication.

As far as I know, I'm still vulnerable to MITM attacks because the key exchange does not protect me from that.
To check if there is a MITM I would like to compare if both parties have the same symmetric session key.

Q1: If I am able to compare that the session keys and they are the same, can I assume that the connection is secure (no MITM present)?

In order to do that comparison, my idea is to send a packet containing a hash of the session key + a hashed password from the client to the server. This packet will be encrypted using the public key of the server.

 This means that only the server is able to decripty the message and will be able to verify that they use the same session key (+ I can use that to authorize the client). Because of the password, a MITM will not be able to create the same message with his false session key.

Q2: Are my assumptions correct or did I miss something?

Q3: Could I do the whole thing simpler or am I on the right track? (If I do not want to use TLS)


texts: Schnorr's signature scheme with addition of modulus secure?

texts:
In Schnorr signature scheme,$s=(k-xe)$$ s_1=(k-xe_1)$ If the same key $k$ is used, then it is possible to reveal $k$ and $x$ value by using $\frac{s-s_1}{e_1-e}$.
However, if we add $s=(k-xe) \bmod q$, $s_1=(k-xe_1) \bmod q$, $q$ is known by users. Will modulus usage prevent to reveal $k$ and $x$ value? If the modification scheme is secure, will there be more modification of Schnorr signature public key $g^x$ to something?


texts: Wrong Test Vector for HKDF with HMAC-SHA256

texts:
I have implemented HKDF by myself and it seems to work good. I managed to replicate all the test vectors listed here but... except this one:

   Test with SHA-256 and longer inputs/outputs

   Hash = SHA-256
   IKM  = 0x000102030405060708090a0b0c0d0e0f
          101112131415161718191a1b1c1d1e1f
          202122232425262728292a2b2c2d2e2f
          303132333435363738393a3b3c3d3e3f
          404142434445464748494a4b4c4d4e4f (80 octets)
   salt = 0x606162636465666768696a6b6c6d6e6f
          707172737475767778797a7b7c7d7e7f
          808182838485868788898a8b8c8d8e8f
          909192939495969798999a9b9c9d9e9f
          a0a1a2a3a4a5a6a7a8a9aaabacadaeaf (80 octets)
   info = 0xb0b1b2b3b4b5b6b7b8b9babbbcbdbebf
          c0c1c2c3c4c5c6c7c8c9cacbcccdcecf
          d0d1d2d3d4d5d6d7d8d9dadbdcdddedf
          e0e1e2e3e4e5e6e7e8e9eaebecedeeef
          f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff (80 octets)
   L    = 82

   PRK  = 0x06a6b88c5853361a06104c9ceb35b45c
          ef760014904671014a193f40c15fc244 (32 octets)
   OKM  = 0xb11e398dc80327a1c8e7f78c596a4934
          4f012eda2d4efad8a050cc4c19afa97c
          59045a99cac7827271cb41c65e590e09
          da3275600c2f09b8367793a9aca3db71
          cc30c58179ec3e87c14c01d5c1f3434f
          1d87 (82 octets)

After one hour of debug, I figured out (and I believe) that my implementation is right and that this test vector is wrong.
I don't manage to get the right OKM value and even the PRK is wrong. To discover this I did the following:

Given that PRK = HMAC-Hash(salt, IKM) (as described in the RFC), I tried to compute the HMAC and I saw that the result value was different.

Can anyone confirm that this test vector is "bugged"?


texts: How do I sign data that's been encrypted using public key? (RSA)

texts:
I've received a public key to encrypt my data for the other end to decrypt using their private key. Now, they want us to sign the data as well to ensure non-repudiation.

I thought that I should only sign using a private key (which isn't in my possession). How do I sign my encrypted data?


texts: Is precomputing AES-CTR key stream secure?

texts:
Q0 : Is the precomputed key stream vulnerable to side-channel attacks like a lookup table for exemple ?
I don't think it is because a lookup table is accesed very often, that's what makes it non constant time.
Q1 : If the precomputed key stream is very large like a few MB, it may be paged out to the disk, can another program access the key stream while it is in the disk like a file ( which will allow it to decrypt the corresponding plaintext easily ) ?
Or are these pages protected by the OS ?
Is there any other security issue with precomputing key streams ( real issues or wrong hypothesisies ) ?


texts:
As I know CBC does not provide integrity for the message, thus HMAC is used to provide integrity for CBC message. Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one is better CBC-MAC or CBC with HMAC?
And when do I need to use CBC and HMAC?


texts:
So we have the protocol:

$Bob \to Alice \Rightarrow m\ ||\ h(m, ``secretTag")$

With above scenario, a message is passed to Alice with an authentication tag to prove that the message was sent by Bob.

What is a better way of doing the tag? How could I incorporate a key into this?

A suggestion has been to use Digital signatures or HMAC, how are these better?


texts: Which RSA keys are actually attacked In practice?

texts:
I understand that it is important to check how hard it is to attack RSA keys, but I assume at some key size attackers would not even try. Real attacks are carried out by exploiting mistakes in the whole process, not the cryptography.
The maximum key size attempted would obviously depend on the value of the protected secrets, and the cost to the attacker. What key size would a rational attacker try to break, if they knew they could gain $1000 / a million dollars / a billion dollars / a trillion dollars?
(Some part of the motivation: On a recent thread it was said that if you choose two primes p, q for RSA and p=q, then this would be absolutely insecure. But if  a 2048 bit key is a square, would anyone actually bother checking this? BTW I think RSA wouldn’t “work” if p=q).
PS. The recommended link in the comment gives some answer. I would think that records set by academics don't represent what's possible, because it merely shows hardware improvements and from an academic standpoint it is quite boring. For government agencies, who would use it to detect secrets, 1,024 bit seems to be not 100% safe to protect a secret that is worth it. For a small time criminal, it would be safe.
But part of my question is: Where is the point where nobody will even try to crack it - with the result that some stupid mistake making a particular code insecure would never be detected, because nobody tries?


texts: Reproducing RSA GCD attack (common factor) - real world certificates

texts:
I'd like to reproduce common factor attack on rsa.
And wondering how to get as many as possible (milions?) real world rsa certificates.
Any ideas?


texts: Checking if a sentence is English after decryption

texts:
I wrote a program that will loop through the anagrams of a word and run each one through the decryption of a columnar transposition cipher on a document. However, for a certain word, the number of anagrams was 7! (5040) meaning I could not check each output individually.

I experimented with Google's python langdetect module and I had a look into ngrams, but it seems that the nature of the cipher causes any variation to appear English.

Would there be any other way to check the output document to check its 'English rating'? What about a combination of I.C. and ngrams?

Thanks in advance!


texts: What is the key strength reduction encrypting only 160 bits of data using RSA1024 for signatures?

texts:
I am attempting to determine the strength of an incorrectly implemented 1024 bit RSA signature scheme. The weakness in the implementation is that the padding data lacks random numbers. As a result, for every message signed, only 160 bits of data are changed (cryptographic hash).

How does one determine the resulting reduction of strength in the scheme, and how many signed messages would be necessary to make a 1024 bit private key a mathematically feasible operation to recover?


texts: Is randomsound for increasing entropy pool not doing what it is supposed to do?

texts:
I am using randomsound because I thought it would be a good idea to inject some additional entropy into the entropy pools of my linux machines (clearly those machines have a corresponding sound card).

(Un)fortunately, I am a quite paranoid person, and, therefore, I am reviewing the source of randomsound in the moment and got stuck at the following code pieces:

In randomsound.c, there is the structure

struct injector {
  int ent_count;
  int size;
  union {
    int ints[128];
    BitField bitfield[512];
  } value;
} random_injector;

which is used to transfer the noise from the sound card to /dev/random

if (ioctl(randomfd, RNDADDENTROPY, &random_injector) == -1) {
  perror("ioctl");
}

However, it is said explicitly (https://stackoverflow.com/questions/17118705/using-rndaddentropy-to-add-entropy-to-dev-random) that injector must match random.h's struct rand_pool_info.

This struct is filled with data via

for (i = 0; i < depositsize; ++i) {
  bitbuffer_extract_bits(buffered_bits, random_injector.value.bitfield + i, 8);
}

which obviously only works on injector's BitField.

So the actual problem is this ints-array in injector, which is always of size 128 int and is never used in the code. The default size of depositesize is 64. And as far as I can tell, with this configuration, the entropy pool is increased by 64*8 bit and 64 bytes are written to the entropy pool. But those bytes belong to ints which is never touched.

So my main question is: Is the default configuration of randomsound always injecting the same bytes to the entropy pool? Or am I simply wrong with my interpretation of the code.


texts: Proving the lack of Perfect Forward Secrecy

texts:
In specific regarding the NSA's Key Exchange Algorithm, I read in an analysis of the protocol that perfect forward secrecy cannot be provided.

Is there any way to prove or justify this? I couldn't find any documentation that showed why that PFS cannot be achieved.


texts: Lookup table for DSA/ECDSA/Schnorr multiplication

texts:
Something in common to [EC]DSA and related signature schemes like Schnorr is that the most expensive part of signing is calculating $r = g^k$ in the group for some per-signature $k$ of length $b$ bits.  But this is always taking the same generator to a power.

Because it's always the same base, we could precompute $\{g^1, g^2, g^4, ... g^{2^{b-1}}\}$ into a table.  Then calculating $g^k$ is multiplying by the entries in the table corresponding to the $1$ bits of $k$.  (Always do the multiply, but discard the result, for $0$ bits to stop timing and power attacks.)

This seems like it would save time, because instead of doing $b$ squares and $b$ multiplies, you'd only do $b$ multiplies.

This is most useful for signing.  For verifying, you'd need a second precomputed table for the squares of the public key $y$.  This could be stored as part of the public key, though, if the key length isn't a problem.

Existing implementations don't seem to do this optimization.  Why not?  (Or maybe I'm wrong and they do...?)


texts:
Assume Alice authenticates a message $M$ with nonce $N$ and secret key $K$, creating authenticator $A$. She then sends $A$ across the network.

The Poly1305 paper does not seem to specify whether it is possible for an adversary, whom has seen $A$, to determine whether $A$ is just random bytes or has characteristics of an output from poly1305.

For someone interested in deniability, this is an important distinction. Are poly1305 authenticators distinguishable from random data?


texts: RSA - Does knowledge of part of the ciphertext decrease encryption security for the rest of the ciphertext?

texts:
There is a language called SystemVerilog that can be protected via encryption to allow sharing/licensing code for others to use, but prevents them from seeing the code contents. This is done based on the recommendations of IEEE 1735 (paywall) and through support through the Compiler/Simulation software. If the correct keys are used, the compiler/simulator is able to read the 'shared' IP, compile, and run the protected IP.

Within IEEE 1735, it recommends RSA >=2048 for Asymmetric encryption.

I can have some code, protected by this encryption scheme, that prints text out to a log file. If the text it prints out is static text, will I need to worry about the encryption security of my file?

module my_encrypted_module;
 initial begin
    $display ("This text will be printed to log file");
 end
endmodule

The encrypted file is 1000 characters long
500 characters is a text message that will be printed to the log when running
Does knowledge from seeing the resulting print message decrease the security of the other portions of this same file, allowing someone to more easily decrypt the file?

Thanks.


texts: Is it feasible to execute a range query over tokenized data?

texts:
Suppose we have a DB with n records on it, one of the fields is numeric and considered sensitive (e.g. ID number).  If we use tokenization for said field, could we query all records between x and y?
So far the only option I have seen depicted was preserving head and tail as it is and just tokenizing the middle part. I am not so convinced by that approach since it feels like too much leakage might be going on.
As I understand it then, should we limit its usage to searching(since it is a 1:1 map)?

P.S: I got this question while reading the white paper The Cloud Encryption Handbook. Where it reads:

Data tokenization involves creating tokens for each plaintext, . . . searching for keywords and SORTING DATA on the server are possible.

The user @pg1989 has co-authored it, so maybe he has interesting inputs about it as well.


texts: Why are we not using multiple ciphers per message?

texts:
I am aware of at least rsa, elgamal-encryption, and variations of elliptic-curves relying on different problems and that those problems are considered hard.

However, if someone figures out a way to break this security, it's hard to imagine the consequences. Or what if some intelligent service published certain elliptic curves, where they knew some shortcuts to in the decrypting process?

My question is: why don't we combine these systems to avoid such crypto-catastrophy?

Consider: $C = EncryptWithRSA(EncryptWithEG(EncryptWithECC(M)))$

This could possibly be computed in parallel, so we with today's quad-core mobiles. I don't remember ever waiting for an SSL connection to come anyway, so guess I would hardly notice a threefold delay. Why are we not doing this?


texts: Making a one-way function harder to reverse

texts:
Let's suppose that for a crypto protocol a 32-byte-to-32-byte one-way function is needed. Proposals are:

$\textrm{sha256}(x)$
$\textrm{hmac}(\textrm{sha256}, x, x)$
$\textrm{hmac}(\textrm{sha256}, x, f(x))$, where $f$ is a 32-byte-to-32-byte function whose inverse is easy to compute, e.g. bytewise reverse (whose inverse is itself).

Are #2 and #3 any harder to reverse than #1 (plain SHA-256)? Is there an even harder to reverse proposal?

I understand that if the attacker has access to a generic method with which it's possible to reverse any 32-byte-to-32-byte function, then #1, #2 and #3 are equally easy to reverse, and thus they are equally secure.

Let's suppose that in the future someone finds a fast way to compute the inverse of SHA-256 on 32-byte inputs, but there is no other fast generic reversing method is available. (The attacker is highly motivated to reverse SHA-256, because doing so can possibly break many crypto protocols.) This doesn't help finding the inverse of #2 or #3, because they have an outer SHA-256 call whose input is 64 bytes.


texts: Is super encryption (aka “multiple encryption”) always good?

texts: I'm trying to use super encryption (also known as “multiple encryption”) with AES in CFB mode with IV and password salting and AES in CTR mode both without padding. I first use AES CFB and then AES in CTR mode. Will my approach compromise security in any way, or is it efficient (in terms of resource consumption, security, and speed) compared to using either one of the modes?


texts: Why are the session keys in DHKE for different values of 'a' the same?

texts:
In a DHKE scheme with the a prime p = 467. an element g = 4. The element 4 has order 233 and generates thus a subgroup with 233 elements.
after Computing the common key for
A. a=400, b=134
B. a=167, b=134
the session keys are identical = 161

Can someone tell me the answer as to why the key is the same for both schemes given different values for a ?


texts: How does one construct a 27x27 tabula recta for 2-of-3 secret sharing?

texts:
In the answer to this post at security.stackexchange, someone describes how, using pencil and paper, one can do 2-of-3 secret sharing with a tabula recta.  But I don't understand how he created his table, and although I can see some sort of pattern I wouldn't be able to reconstruct it in a pinch.

Another question I have is, is this sharing scheme information-theoretically secure?  Does any individual share, taken alone, provide any information about the secret?


texts: Is it possible to pick your Ed25519 public key?

texts: Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete logarithm problem?


texts:
I recentely faced the issue of random access decryption while AES-GCM was being used. I said this person that the underlying CTR should allow parallelization but I have no idea how authentication comes into play.

Now I know that one of the cool features of CTR is that you can decrypt any block without needing to involve any other blocks. I also know that CTR is part of the basis for GCM.

Now my question(s) are:

Can one somehow parallelize encryption of data in GCM mode (only CTR part? Parts of the MAC as well?)
Is it possible to get random access to decrypted ciphertexts (+ fast verification?) or is at least somehow possible to parallelize decryption and authentication (do either of both in parallel or internally parallelize?)?


texts:
Is use of sha3 justifiable? Is sha3 better than sha2 in (m)any aspects?

P.S. I want to use hashing for passwords in a database


texts: In  crypto papers, cryptanalysis of MLWE/RLWE/etc. is often reduced to LWE. Why can we do this? Is there strict proof of such reductions?


texts: Are bijective polynomials of degree $2 \bmod 2^m$ efficiently inverted?

texts:
Take a bijective polynomial of degree $2 \bmod 2^{64}$ like:

$m = (n(n+1)/2)\ \bmod 2^{64}$

It is bijective and can trivially be inverted for numbers up to $2^{32}$ by calculating $\lfloor\sqrt{2m}\rfloor$ . For all other numbers the inversion is not that trivial but I have the feeling it could be done without brute force.


texts:
In our project we have grpc server and clients which should satisfy mutual tls. So, there is CA and clients generate csr to sent to CA to signing it. Now I need to send csr manually to CA to sign it and also manually back to clients. If there are many clients, it becomes inconvenient.
Of course, I can add an additional server that will receive requests and send back, but I think that this is a complication and I am trying to find a generally accepted scheme.
I am new in this theme. How to organize it correctly? Or use a simple ready-made solution.


texts: Is there a way or how to predict the output size as a result of encryption?

texts: Is there a way or how to predict the output size as a result of encryption from 3DES, AES-128, AES-192 etc ? So that I know how to store them in the data in DB given a known possible clear text length.


texts:
I’m looking for suggestions on how best to handle signatures on audit records that might need to be held for many years (at least 5, maybe up to 10). Not in terms of storage - they’ll probably be written to Amazon Glacier or something like that - but in terms of the container format and how to secure the signatures.  So far the thoughts are either JSON Web Signatures (JWS) or Cryptographic Message Syntax/PKCS#7 (CMS).

The threat model we’re considering is to be able to verify that the audit record has not been tampered with, assuming an attacker is able to manipulate the stored data.

Obviously signature keys will have been rotated several times during that time frame, and best practice is to erase the private key once the key has expired, but keep the public key for verification.

JWS has the disadvantage that the algorithm is specified in the wrapper and can take the value ‘none’.  The usual mitigations for this involve the receiver of the JWS only accepting certain algorithm values, but in the long-term world an algorithm that was used a while ago might no longer be considered acceptable, so a certain amount of meta-data about algorithms and date ranges then becomes necessary.  (And this data itself needs to be signed, and updated from time to time.)

Keys can be identified by key label.  Even if we prevented the ‘none’ algorithm attack, and had a secure (signed?) set of key identifiers and public key values, if just one key pair had been compromised, an attacker could use that to sign a modified audit record, and specify the label of the compromised key.

So that suggests we need either a CRL- or OCSP-style mechanism for specifying keys that are known to be compromised.  And since that list itself needs to be signed, it probably needs to be live/online, rather than something also kept in the archive.

I don’t know CMS very well at all.  Does it provide any capabilities that make it better than JWS for this this?

Are there any (other?) standards for this kind of thing that I should be looking at?  Would a (not "the") blockchain be a better structure for this (providing historical immutability)?

Is there something that I’m missing? Am I over-thinking this?


texts:
The program Scallion can generate vanity PGP keys and .onion addresses using the following method:

  Generate RSA key using OpenSSL on the CPU
  Send the key to the GPU
  Increase the key's public exponent
  Hash the key
  If the hashed key is not a partial collision go to step 3
  If the key does not pass the sanity checks recommended by PKCS #1 v2.1 (checked on the CPU) go to step 3
  Brand new key with partial collision!

As RSA is susceptible to various attacks when its parameters are not properly selected, e.g. small difference of prime factors, does this method of iteratively increasing the public exponent yield any weaknesses in the generated keys?

Of course, it is possible to generate a key with a fingerprint you desire using gpg itself but it is much slower.


texts: Do you need a HMAC if decryption attempts are severely limited?

texts:
I am considering an application where data bandwidth is extremely limited, and considering removing message authentication codes from encrypted transmissions. The encryption method is currently AES-256-CBC.

In this particular application, decryption attempts are extremely limited. Each decryption attempt must be initiated by the user, which powers on the processor. At first decryption failure (or success), the processor is powered off.

I am assuming that the AES key is (initially) not known by any attacker.
I am also assuming that the attacker does not have physical access to the decrypting processor.

Given the above assumptions and limitations, is the encryption scheme still secure? The 16 byte overhead for HMAC are very expensive in this application.


texts: Known Plaintext Attack against 3-round SPECK48/96

texts:
I am attempting to break 3-round SPECK48/96 using a known-plaintext attack, provided with 10 PT-CT pairs. Here is a diagram:

I have seemed to almost figure this out, but I cannot figure out how the right side affects the state of the text, due to the left rotation.
Say I am trying to attack the first set of 8 bits on the left side (24...31). That means I will perform the rotr 8 and addition, then make my $sk_0$ guess on the 16...23 bits. I then XOR with the right side.

$sk_1$ will then be guessing bits 8...15 as those are the bits that were affect by $sk_0$ (due to rotr 8). However, this rotl 3 will cause the bits that were affected by the subkey to move in the other direction, so now each round's subkey guess will be affecting different parts of the plaintext (as opposed to on the left side, where I can trace the movement of these bits).

I may have not been clear but I was trying to explain my thought process...I just cannot seem to figure out how to approach this.