texts: Calculate the complexity of HKDF with a 96bit salt and a 128bit key?

texts:
I have a 128 bit Pre-Shared Key. I don't want to use it directly. I'd much rather generated a session key with HKDF(PSK, SALT) = SESSIONKEY.

I'm however under strict size limits for packet size. So I'm looking at the option of a 12 byte (96 bit) salt.

Does this significantly weaken my 128 bit PSK down to 96 bit? What is the true complexity of the resulting SESSIONKEY? I don't think I get to combine them into something greater than 128bit because the salt (derivation seed) will be transmitted in the clear for the other side to use.


texts:
I'm looking for a solution to use in a context where I need to be able to generate new asymmetric key pairs quickly (using a widely recognized algorithm, and EC-DSA is not applicable). It sounds like DSA would be the adequate solution.

According to the documentation, just generating DSA parameters once allows then to generate a large number of separate keys pairs only requiring the step of selecting a random private key 'x' for each of them. FIPS 186-3 says :

  the intended signatory shall first obtain appropriate domain
  parameters, either by generating the domain parameters itself, or by
  obtaining domain parameters that another entity has generated

Is there any security issue I'm missing before reusing the same domain parameters for a large number of keys ? How frequently ought the domain parameters be changed ? (There's some reference around to the possibility for a CA to use the same domain parameters for all the certificates it issues)


texts: Is building your own inefficient but secure cipher hard?

texts:
Everyone says you should never build your own cryptosystem. That doing so is hard and the only way you know it's secure is if it stands up to serious scrutiny.
And yet, if you are willing to go way overboard on key size, rounds cpu time, memory etc. Would it not be fairly easy for even a novice cryptographer to build something secure. Especially if using a well understood basic construction(e.g feistal network).


texts: Exercise: Attack on a Two-Round DES Cipher

texts:
Working through the exercises in Cryptography Engineering (Schneier, Ferguson & Kohno) I have stalled on the following exercise:

  Consider a new block cipher, DES2, that consists only of two rounds of
  the DES block cipher. DES2 has the same block and key size as DES. For
  this question you should consider the DES F function as a black box
  that takes two inputs, a 32-bit data segment and a 48-bit round key,
  and that produces a 32-bit output.

  Suppose you have a large number of plaintext-ciphertext pairs for DES2
  under a single, unknown key. Give an algorithm for recovering the
  48-bit round key for round 1 and the 48-bit round key for round 2. Your
  algorithm should have fewer operations than an exhaustive search for
  an entire 56-bit DES key. Can your algorithm be converted into a
  distinguishing attack against DES2?

With regards to the first sub-exercise ("Give an algorithm…"), I have proceeded in the following way:

If I assume an initial input of 64 bits giving us two 32-bit blocks $L_0$ and $R_0$, I know that after the first round we have

$L_1 = R_0$
$R_1 = L_0 \oplus F(R_0, K_0)$

Then, after the second round, we have:

$L_2 = R_1 = L_0 \oplus F(R_0, K_0)$
$R_2 = L_1 \oplus F(R_1, K_1) = L_1 ⊕ F(L_0 ⊕ F(R_0, K_0), K_1)$

My thought was that I could then XOR $L_2$ with $L_0$ which is the output of $F(R_0, K_0)$ and then use $R_0$ to retrieve $K_0$. But I'm not sure how to do that… and not at all sure whether I am on the right path.

Any thoughts would be greatly appreciated.

Added

Tylo has pointed out that the $F$ function is to be treated as a black box.

Updated

I’m afraid that I have come so close but can’t seem to get any further. I can get the output of $F(R_0, K_0)$ and I know $R_0$. But I just don’t know how, since I can’t call $F$ directly I don’t know how to get the 48-bit $K_0$.

Can anyone help?


texts: How passwords are fed to key derivation functions?

texts:
Suppose I want to encrypt data, send it over the network, and decrypt it on the receiver side.

I know the elegant way to do this is by using a symmetric key to encrypt the data and an asymmetric key to send the symmetric key to the receiver so he can decrypt the data.

But I just read about another way which is to use a password based key derivation function to calculate a key on both sides. This way, no key exchanged. But this requires both sides to use the same password in the calculation of the key, so I suppose I have to send the password to the receiver at some point so he can calculate the same key and use it to decrypt.

If what I understood is correct, then I don't see the goal of using a PBKDF since I have to send something at some point. If not, then what I'm I missing?


texts: Breaking RSA when some bits of one prime are known

texts:
RSA primes are 100 bit. You know first 80 bits of one of the primes. In this system, come up with an efficient way to decrypt the cipher-text.

This was the question on my quiz. I'm not sure how to go about it. Any hints?


texts: Computing inverse of BN256 G2 point in golang x/crypto/bn256 library

texts:
I'm trying to confirm a vulnerability in a signing scheme I'm helping with. To do this I need to simulate a rogue key attack on a BLS aggregate signature using the golang bn256 library https://godoc.org/golang.org/x/crypto/bn256 This requires computing the inverse of a public key.

I'm not a crypto expert but do have a fairly strong algebra background... So if g is the generator of order n then the inverse of p is just p^(n-1) right? But I have no idea what n is.

Any help would be greatly appreciated


texts: The importance of randomness in the creation of a key

texts:
Why does it matter what kind of random number generation is used during key generation?

E.g. this answer states 7-8 words selected truly at random make a strong password. My problem's with the "truly" here. My thinking is - whatever key I chose with whatever random number generator, the information isn't available afterwards and an attacker can never know which random number generator I used, so he cannot use that to break the key. On the other hand, I can use "just count up" or a super sophisticated hardware generator and both might come up with "12345678" as a key. Of course, an attacker would start with trying keys like "111111" or "3456789", so he will break "12345678" earlier than, say, "93298762", but "using a good random number generator" or "selecting truly randomly" does not mean I cannot get "12345678" as key.


texts: Lyra2 sponge construction and random numbers?

texts:
I have a Lyra2 project and I still have some problems understanding its principle.

I really found a problem when I read about sponge contruction. I found out that it's composed of 3 steps: absorbing, squeezing and duplexing and then we xor the (password, salt, ... ) with random numbers (state) so finally we get the password encrypted but then my problem is: it's not possible to decrypt it, isn't it? So probably I'll decrypt it using a dictionary but the thing is since I'm xoring with just random numbers then for the same word I'll have different encryption each time, won't I?


texts: How to construct a hash function into a cyclic group such that its discrete log is intractable?

texts:
From the Linkable Ring Signatures paper:

  Let $G = \langle g\rangle$  be a cyclic group of prime order $q$ such that the underlying discrete logarithm problem (DLP) is hard. Let $H_1 : {0, 1}^∗ \to \mathbb Z_q$ and $H_2 : {0, 1}^∗ \to G$ be distinct hash functions viewed as random oracles. Assume that for any $\alpha\in\{0, 1\}^*$, the discrete-log of $H_2(\alpha)$ to the base $g$ is intractable.

For that, as suggested on my previous question, I'll pick a large Sophie Germain Prime $q$ such that $2^{q} \bmod {(2q+1)} = 1$, with $2$ as the group generator. It would be tempting to define $H_2(a) = g^{H(a)}$, where $H$ is a hash function distinct from $H_1$. That would not work as intended, though, because, under that construction, $log_g(H_2(a)) = H(a)$. How can I, thus, construct an appropriate definition for $H_2$ on that problem?


texts: How can an adversary use Mac(.) with a new key to compute a tag although this is not a query to Mac oracle?

texts:
I am having some troubles understanding the power of an adversary in attack against a MAC.

In chapter 4 in Introduction of Modern Cryptography by Jonathan Katz and Yehuda Lindell, specifically in the message authentication experiment ($Mac-forge_{A,\Pi}(n)$), an adversary $A$ is given access to MAC oracle $Mac_k(\cdot)$ where $k$ is previously generated by $Gen$. So my question is: Is it right that $A$ can only access to $Mac(\cdot)$ with a fixed key $k$? Can $A$ access to $Mac(\cdot)$ with a different key $k'$ in a same experiment?
In the paper The Power of Verification Queries in Message Authentication and Authenticated Encryption, specifically in Claim 4.2, it is stated that adversary $A$ simply runs algorithm $Mac(\cdot)$ with key $L$ and message $M$ (where $L$ is a key forged by $A$). I do not understand this part.

Question: How does $A$ run the algorithm if it is not a $Mac$ query? If possible, could you please provide an example in reality?


texts:
I am learning to use ECC. i got into situation where i have $Q=abG$, where $G$ is the generator of the finite field formed on EC using a prime $p$ modulus and $a$ , $b$ are random numbers.
now suppose i know $Q$, $G$ and $a$ , calculating $bG=\text{inverse}(a)Q$ is efficient ? i know the order of the group too. i want to know whether this inverse calculation is cheap enough to be calculated as frequently as random number changes?

i tried to get material for this kind of inverse calculation but dint get as such. If anyone could provide some source to this information on ECC it'll be helpfull.

i did check this link
Thankyou


texts: More efficient and just as secure to sign message hash using Ed25519?

texts:
According to the Ed25519 paper, the (potentially long) input message is hashed twice (see Section 4 page 12 steps 1 and 3).  This webpage has a nice diagram toward the bottom that illustrates this, and I confirmed it in the reference code on Supercop (see supercop-20141124/crypto_sign/ed25519/ref/sign.c, function calls  crypto_hash_sha512(nonce, sm+32, mlen+32) and crypto_hash_sha512(hram,sm,mlen + 64)).

My question is, for long messages, wouldn't it be more efficient and just as secure to hash the entire message just once, and then use the 64 byte hash as the input to the signing algorithm?  In other words, the code would look like:

crypto_hash_sha512(mhash, m, mlen);
crypto_sign(output, mhash, 64, key);

The would seem to me to be faster for mlen > approx 128 bytes without any loss of security.

I'm I missing something here?  Is there a potential loss of security to using mhash as the signing input instead of the original message m?


texts: What is the difference between uniformly and at random in crypto definitions?

texts:
Very often in the description and analysis of a cryptographic protocol there is a need for a an element $k$ that is sampled

  uniformly AND at random.

Is there a redundancy in the definition with uniformity and randomness?

If no what is the rigorous difference of uniform and random? Does it mean that the numbers of the distribution are random (they came from PRG) and each of them are picked up uniformly--meaning with equally probability?


texts: PKCS#7 signed data structure in signed PDF document

texts:
Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data?

I mean if you want to sign PDF, you are basically adding PKCS#7 container inside the document. And if the PCKS#7 signed data contains the whole data that was signed, that doubles the lenght of the signed PDF document.

If this is not mandatory, is there any way how to remove the octet string from OID 1.2.840.113549.1.7.1? Or is PKCS#7 signed data integrity protected so no one is able to just remove this octet string?


texts: How key materials are generated in SSL V3 from master secret

texts:
The generation of key materials is given by

key_block =
        MD5(master_secret + SHA('A' + master_secret + ServerHello.random +
            ClientHello.random)) +
        MD5(master_secret + SHA('BB' + master_secret + ServerHello.random +
            ClientHello.random)) +
        MD5(master_secret + SHA('CCC' + master_secret + ServerHello.random +
            ClientHello.random)) + [...];

The document says, it is done until "enough output has been generated". I think the "+" refers to append the data generated.

We need:

client write mac secret
server write mac secret
client write key
server write key
client write IV
server write IV

So these are generated by taking appropriate number of bits from the generated hash?

I couldn't understand why the document says "enough output has been generated". Any way we need the 5 parts from the master key.


texts: Reduction of Integer factorization to Discrete logarithm problem

texts:
I was reading Eric Bach paper entitles Discrete logarithms and factoring, in which he states the following reductions:
solving the integer factorization problem suffices to solve the discrete logarithm problem and vice versa.
I could not completely understand the explanation. Could anyone explain it to me or refer me to another source.


texts: Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

texts:
I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed parameters for preventing MiTM.

I'm not fully clear on the process used with the protocol (as listed in RFC5246, appendix-F.1.1.3) with respect to authentication. I understand how Diffie-Hellman is vulnerable to such attacks when used without it, but how exactly does it prevent these attacks?

I understand that the messages are signed, so the attacker Mallory can't modify messages between Alice and Bob. Why is Mallory not able to forward say, Bob's certificate through to Alice, including any of Bob's signed parameters, and eventually intercept the negotiated session key through relaying all messages between the two parties?

Is it simply because Alice and Bob both generate their own secret keys, which means the session key isn't recoverable? (Mallory is more like an eavesdropper/Eve in this scenario?)
Additionally, does this mean if Mallory were able to recover the private key somehow, that he/she could compute 2 separate key exchanges and modify traffic as before with no authentication?

Lastly, say Mallory manages to compromise the private key and can intercept and modify traffic. Without changing the certificate/key, is there any other way to authenticate Bob in this scenario, or is this impossible?


texts: Anonymous Identity-based broadcast encryption use single common key or different keys

texts:
In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver.

In some cases, they use some function
$f(x)=k-\prod_{i=1}^{t} (x-v_{i})$ to get $k$ by replacing $v_{i}^{'}$ in place of $x$. In this case, only one function for $t$ receivers is possible.In real implementation, how to define such kind of function for unknown $x$ for $n$ receivers. However, In decryption, $$k^{'}=f(v_{i}^{'})=\sum_{j=0}^{t-1}c_{j}(v_{i}^{'})^{j}+(v_{i}^{'})^{t} mod \space q $$ where $v_{i}^{'} $ is calculated using $H_{1}(e(V,d_{i}))$. That means $v_{i}^{'} $ value is different.
If so,the same key $k$  is impossible for all receivers.
Here, $t$ different functions for $t$ receivers?If so, $t$ different W values.

Example paper: Anonymous Multi-Receiver Identity-Based Authenticated Encryption with CCA Security by Fan et al.


texts: Cryptographical formalization of computational privacy

texts:
Yesteryears problems of communication privacy has been well defined in cryptography through Asymmetric cryptography.

Due to rise in Cloud computational model , computational heavy tasks are being outsourced to a remote server for economic reasons, and  there is need for computational privacy .

Is there any crypto formalization for computational privacy ( other than homomorphic encryption ) ?


texts: Zero-knowledge proof of knowledge of a plaintext in exponential ElGamal

texts:
Consider the exponential ElGamal cryptosystem over some group $G$ with generator $g$. Let $m$ be a plaintext, and $(R, C) = (g^r, g^m \cdot y^r)$ an encryption thereof for some public key $y$.
Assume a prover $P$ wants to prove knowledge of $m$ to a verifier $V$.
To me, the $C$ of the ciphertext looks a fair bit like a Pedersen commitment to some value $m$ with randomness $r$, $E(m, r) = g^m \cdot h^r$.
Is this a reasonable comparison? If so, would it be sensible to use a ZKPK of a Pedersen commitment to prove knowledge of the plaintext?


texts: Is password-based AES encryption secure at all?

texts:
For a few years I have put all my passwords in a text file and encrypted that file with a password using a software solution (Axcrypt) which uses AES-128. The password is not really strong, but I thought AES encryption would make it strong somehow.

But it always bothered me how this can be secure and now that I have read a little about encryption it seems to me that this actually has nothing to do with AES encryption. Because when using a password instead of directly providing the key, the AES encryption becomes completely irrelevant. It doesn't matter anymore how many billion years it takes to crack AES because the only thing that now needs to be cracked is my password. The attacker finds my file, downloads Axcrypt, and bruteforce/dictionary attacks it until it's cracked. The attacker won't need to bruteforce my file with 128bit keys, he bruteforces it with passwords.

So I have two questions:

Am I right? Is it completely pointless to use passwords to AES encrypt files?
Axcrypt website recommends using a 22-characters-long password to achieve 128 bit security. Will a 22 character password be as secure as a randomly generated key? How?

(I know the actual key is derived from the password with an algorithm. I just can't understand how a password can be secure. The very existence of a password means the attacker will no longer have to deal with AES and keys, only with passwords)


texts: Can I break a random number into two smaller vectors and consider them as two random numbers?

texts:
I have a cryptographically secured RNG that uses a recommended block cipher to generate the random number. As its output, I receive the random number which is very large, but the application requires the usage of two random numbers, and both of them with smaller bit-size of the RNG output.

Can I split the random number into two smaller vectors and consider them as two random numbers? Is this a recommended practice?


texts: Where can I find useful data for cryptography/coding theory?

texts:
When implementing cryptographic/coding theory algorithms one need to use data like big prime numbers, numbers in $Z_n$ and their inverses, irreducible polynomials in $Z_n[x]$ and so on...

While sometimes it is easy to write a simple program to get simple examples of these it's handy to have a list with some non-trivial examples. Do you know where can I find such data?


texts: Is it a vulnerability (for message authentication) to have a variable iteration-count for PBKDF2?

texts:
The scenario: A user clicks on an encrypted file, and enters his password, in order to decrypt and authenticate it using HMAC (when its key is derived using PBKDF2). If the iteration-count is fixed, it's deemed secure.

What if the iteration-count is read from the file, Is it still secure? I assume that it's secure in the sense that its encryption is fine. But what about its authentication?

I'm having a hard time finding a specific vulnerability, but the fact that the key derivation "algorithm" is not completely fixed (and can be changed by an attacker) seems insecure.


texts: How to prove the PRF, $F(k,x) = (k \wedge x ) \oplus k$ is PRP?

texts:
I am trying to understand PRF's and PRP's. I have got a question where I have to decide whether $F(k,x) = (k \wedge x ) \oplus k$ (where $k$ and $x$ are simple $1$ bits (1 or 0)) is PRP or not. I am not sure if I understand PRP's correctly. As I have found:

  A Pseudo Random Permutation is a PRF that happens to have the property that every element in the input domain has a single associated member in the output co-domain and vice versa.

So what I have got in my example.

k x F(k,x)
0 0 0
0 1 0
1 0 1
1 1 0

For each couple, I have an associated member in output co-domain, but for each output 0 and 1. I do not have a unique member in the input domain. So this function is not PRP. Am I right?


texts:
I have recently read about AES cache timing attacks. More specifically, I read Daniel Bernstein paper Cache-timing attacks on AES. I have a question about the code in Appendix A:

unsigned int timestamp(void)
{
unsigned int bottom;
unsigned int top;
asm volatile(".byte15;.byte 49" : "=a"(bottom),"=d"(top));
return bottom;
}

What does timestamp methode do?


texts: Is there a truly safe signing algorithm?

texts:
After reading this question, I'm pretty shaken up. A determined attacker with $100 in loose change can crack any RSA key in a couple of hours. After believing that these algorithms would take millions of years to brute force, I'm questioning the security of everything.

What should I move to if RSA isn't safe anymore? Are Elliptic Curve signatures likely to have a similar crack in the near future?


texts: The differences between the attackers in the definitions of IND-ATK and NM-ATK

texts:
I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in the sense of IND-ATK. Let $B = \left(B_{1}, B_{2} \right)$ be an adversary attacking $\Pi$ in the sense of NM-ATK.

The inputs of $A_{1}$ and $B_{1}$ are both the public key $pk$. The output of $A_{1}$ is $(x_{0}, x_{1}, s_{A} )$ but the one of $B_{1}$ is $(M, s_{B})$.

What makes the outputs different? Why not the output of $B_{1}$ just includes two messages instead of a set of messages?

Actually, $A_{2}$ and $B_{2}$ are both used to compare two messages in some sense.


texts: Is there a name for this simple identity verification scheme?

texts:
Once, while idly wondering, I came up with a simple scheme to prove the authenticity of a chain of messages given the authenticity of the first.
It consists of putting a hash at the end of each message (but the last, if you know where the chain is going to end) and the input to the previous hash at the beginning (or anywhere really) of each subsequent message.
That's it. It's really simple but I was wondering if it had a name?


texts: When I Use a 4 digit random number(e.g. 4468) as seed for a (manual) Stream cipher and straddle it to the length of the plaintext using a lagged fibonnacci generator, can  this seed be found by brute force?


texts:
In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long.

Very importantly, each entry of that database is encrypted using a different and unique key. Would we gain any security if we switched to AES with CBC mode in this specific scenario?

Also, imagine now that we use AES in ECB mode to encrypt the data in the database, but we now use the same key to encrypt every single entry. If an attacker breaks into our database and steals our data, how many entries would he need to exploit ECB weaknesses and be able to decrypt the information?

For this last scenario, I guess that what I want to find out is if an attacker can decrypt some AES ECB encrypted data if he only has, let's say, around 10 encrypted messages.

Thanks!


texts: Word-based stream ciphers vs "regular" stream ciphers?

texts:
Could somebody explain what is the difference between "word-based" stream ciphers and the regular ones? Those last ones use pseudo-random sequences XOR'd bit by bit with the message, as far as I know. How does that change when it comes to "word-based" ciphers?

Examples of word based keystream ciphers include SNOW, PANAMA, SOBER, ORYX. I also read that word based keystream ciphers "allow greater efficiency in software than most bit based stream-ciphers".


texts:
Post-quantum cryptography is cryptography under the assumption that the attacker has a large quantum computer; post-quantum cryptosystems strive to remain secure even in this scenario.
Post-quantum cryptography like lattice-based cryptography is designed to be secure even if quantum computers are available.
The Question that pops on my head are:

How can we define post-Quantum Cryptography?
What is the specification that makes it somehow impossible to break?
Can post Quantum Cryptography makes it somehow impossible to break for a long time?


texts:
I'm trying to solve the next problem:

We have X - input vector, its length is 128 bits.
Output vector Y, its length 2048 bits. We know that Y has a proper value, if and only if "CRC" is valid, to calculate this "CRC" we have to know all bits of Y of course.
We have a function F(), which does F(X) -> Y. This function is a black box for us.
Also, it's guaranteed for us, that only one unique X is the solution.

What clear for me:

F() has many collisions (it is oblivious, because size(X) < size(Y)). But I don't see a clear way how to use this.
Brutforce is not the way, as complexity of F() is high. And the only way to understand that result is right, calculate "CRC"(additional complexity).

Task: find X which produces a proper value of Y with proper "CRC". In other words: I need to find X such that F(X) satisfies additional criteria ("CRC")
As I don't have any crypto analysis experience, my question is pretty simple, wherefrom I should start? I tried to google, but no luck, or maybe I googled it wrong. I have read a couple of articles about linear and differential cryptoanalysis, but seems to it is a different case.
Any advice is welcome! Not looking for the solution, but for the way how to figure out the problem.


texts:
I'm studying public key cryptography, but still, there's something that I'm not able to understand. I know that, in order to communicate with the server the client must use the public key of the server, but what happens when the server needs to send a message to the client?

It can't use its private key since anyone would be able to decrypt the message, so my question is:  Does the client have a public key?


texts:
I want to securely store a database table that consists of an account ID and a few columns of sensitive data. The data only has value if it can be associated with the account ID. My thinking is to hash the account ID so it can't be associated with the sensitive data.

What hashing algorithm should I used for this situation? Is there an alternative way to store the data that would provide stronger security?


texts: Equivalents of Yao's Xor lemma to rounds, or other hardness amplification methods?

texts:
Simple question:

I just learn the existence of the great Yao's Xor lemma (see a quick sum-up at the end of this post). I'd like to use a similar argument, but instead of a simple function, I've a two rounds (quantum) protocol that outputs a secret $s$ that the adversary may poorly describe. Is there any extension of Yao's Xor lemma to protocols that could let me say that there is no way to get the xor of several repetitions of the protocol? (or other any hardness amplification method that could apply to this setting?)

Bonus: and what about for quantum protocols?

More details: to give a bit more details, basically I've a quantum protocol that produces a uniform bit $s$, and using some information theory arguments I should be able to prove that there is no quantum circuit that can guess $s$ with probability better than $1/2+\mu$, with $\mu$ being a constant strictly smaller than $1/2$ (even conditioned on the case where the protocol does not abort). Note that an unbounded adversary could compute $s$ so here we really need to have a polynomially bounded quantum adversary. Now, I'd like to state that when I repeat this protocol several times and get several uniformly distributed secrets $s_i$, the adversary cannot get the xor of these $s_i$ with probability better than $1/2 + \text{negl}(n)$. ($n$ is a security parameter, that could be linked with the number of repetitions of the algorithm)

Are you aware of any generalisation of Yao Xor lemma to (quantum) protocols instead of functions? Thanks!

-- EDIT --

Here is a simplified version of Yao Xor Lemma. I chosed this simplified version as the real one is a bit harder to read because it uses lot's of notations $\varepsilon, \delta, \dots$ and the exact definition is not useful here, but the interested reader may want to read this review or this course for more details.

  Yao's xor lemma (informal/simplified): If a function $f: \{0,1\}^n \rightarrow \{0,1\}$ is hard to predict for a (computationnally) bounded adversary with probability better than $1-\delta$, then it is hard to guess the xor of several random "instances"
  $$\bigoplus_{i=1}^t f(x_i) $$
  with probability better than $1/2+(1-\delta)^t$


texts: What is the difference between key size and block size (for AES)?

texts: We are working on AES and want to develop a website which should provide an encryption facility but we are not understanding the difference between key and the block size. More appropriately what does a 128, 192 and 256 bit key mean?


texts: Is this a correct SSL explanation in layman's terms?

texts:
I'm looking to provide a basic / layman's explanation of SSLs to clients and want to be sure it is correct. My explanation is below and would appreciate any feedback / corrections.

Basically, the SSL certificate provides a secure and encrypted connection between your web site’s server and the user browsing your web site. Without an SSL the data exchanged between the web site and the user can be intercepted, which includes the web site contents and any form submission details.
The contents of a web site you visit may NOT actually be the content from the site you are on if it has been intercepted, and the form details submitted may not only go to the owner of the web site, but to the hacker intercepting the transmission. Although the likelihood of this happening is low, it is still possible.

Is this correct, or am I missing something somewhere?


texts: What is the difference between MACTripleDES and TripleDES?

texts: I was asked to encrypt/decrypt a string using MACTripleDES. Is there any difference between MACTripleDES and TripleDES? If, where exactly is the difference between both?


texts: How to perform file encryption using 128-bit AES

texts:
I am confused. How can I encrypt a file using 128-bit Advanced Encryption Standard?
Do I need only to encrypt the file name and it's content or is there something that I need to do to encrypt it? Is there something that I will need to extract to the file to encrypt it?
For example, I want to encrypt an MS Word file or a PDF file.
It is easy to encrypt a file if the file only contains text, but what if there is a image in a file? How do I go about that?


texts: What type of encryption scheme can prevent cheating in this coin flip protocol?

texts:
Consider the following protocol for two parties to flip a fair coin:

Trusted party $T$ publishes her public key $p_k$
A chooses a random bit $b_A$, encrypts it under $p_k$, and announces the ciphertext $c_A$ to $B$ and $T$
$B$ does the same and announces a ciphertext $c_B$
$T$ decrypts $c_A$ and $c_B$, and announces the results. Both parties XOR the results to obtain the random value $b_A \oplus b_B$.

Suggest what type of encryption scheme would be appropriate to prevent
$B$ from cheating.

I would say that an appropriate scheme to use here would be Cramer-Shoup or RSA+OAEP. How can we define an appropriate notion of security and prove that it achieves this definition?


texts: How do I derive the time complexity of encryption and decryption based on modular arithmetic?

texts:
I want to calculate the time complexity of two encryption and decryption algorithms.

The first one (RSA-like) has the encryption
 $$ C := M^e \bmod N $$
and decryption
 $$ M_P := C^d \bmod N. $$

Assuming $n = \log N$, $m = \log e$ and $k = \log d$, I think they have time complexities $O(n^2 · m)$ and $O(n^2 · k)$, respectively.

Are these two complexities same?

I also have another pair of algorithms, with
 $$ C := M · k \bmod N $$
and
 $$ M_P := C · k^{-1} \bmod N.$$

How does the calculation of the modular inverse $k^{-1} \bmod N$ contribute to the time complexity?


texts:
I am trying to understand fault attack on RSA-CRT, and I found some example, which I don't know how to solve it.

I know public modulus $N$, public exponent $e$, a value of faulty signature (where one of the two partial signatures was incorrect) and the value of correct signature. The message $m$ is signed by RSASSA-PKCS1-v1_5 (signature transformation is RSASP1).

I have already read the documentation of RSASSA and RSASP1, and I have also read some articles about how to attack this problem. However, I don't understand how to get a message which I need for calculating $p$, because I should get $p = \operatorname{gcd}(\text{faultySignature}^{exponent} - m, N)$

Could someone help me?


texts: how to verify subset of hashes from hash list

texts:
I need to verify a couple hashed (SHA256) integers from a list of approximately 50 hashed integers in a message.  The list can be divided into groups.  The (plain) integer data is not in the message, just the hashes, so they are not exactly signatures.

I've looked into batch verification, but it seems the aim is to check every signature of a message.  A Merkle tree is the closest I've found, but wanted to know the best approach to apply in this scenario.


texts: Why unit vectors should be encrypted bit per bit in that case?

texts: At this work at section $2.2$ concerning a possible application for the BGN cryposystem the author points out that if you want to encrypt a unit vector $\overrightarrow{u_l}$ of size $l$ then the naive way is to encrypt each bit separately. And by following the idea of BGN the size of the ciphertext is reduced to $2\sqrt{l}$ from $l$. My question is why the naive way is to encrypt each bit seperately and not encrypt at once as a number in the specified group $\mathbb{G}$ as long as the value can let you efficiently compute the $DL$ as the discrete logarithm is needed for decryption as described at the original paper?


texts: Can RSA-PSS signing be made deterministic without loss of security?

texts:
Is it possible to make RSA-PSS signing deterministic without loss of security?

Specifically, I would use Blake2b of the key and message to generate the salt.


texts:
I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it.
Can I get a very simple and clear (beginner level) explanation?
If you know of any references on the topic, those would also be useful.


texts: Formal relationship between encryption and random number generators?

texts:
Cryptographically secure random number generators seem to have similar properties to symmetric encryption:

initial seed is permuted to produce a random numbers (key and ciphertext)
given the seed, they produce a random number that cannot be linked back to the initial seed (diffusion)
changing a single value in the seed results in multiple changes in the random number (confusion)

Is there a formal relationship between symmetric encryption and SRNGs?  I.e. is one a sub-set of the other?


texts: Secure function evaluation for Boolean formulae

texts:
Under the assumption that "secure" encryption exists, secure evaluation of functions represented by Boolean circuits is possible by  Yao's garbling scheme [Y1]. My question is whether secure evaluation of functions represented by Boolean formulae is an easier problem (i.e., possible in the information theoretic setting).

(This is true, for example for secret sharing: Benaloh and Lichter [BL] gave an perfect scheme for access structures described by monotone Boolean formulae, but for monotone Boolean circuits one needs to assume secure encryption [Y2].)

References:

[BL]: Benaloh and Lichter. Generalized secret sharing and monotone functions. Crypto’88

[Y1]: Yao. How to generate and exchange secrets. FOCS’86.

[Y2]: Yao. Protocols for secure computations. FOCS'82


texts: What key is used to encrypt the certificate and certificate verify message in TLS1.3?

texts:
Which key is used to encrypt certificate and certificate verify message in TLS1.3?

I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.


texts: How to find the type of symmetric cipher?

texts:
How to find the type of symmetric cipher that was encrypted.
I have ciphertext, plaintext, key.

there is a command in openssl?


texts: Zero knowledge token for communicating files one has

texts:
Is there a method for individuals to publish a token which indicates having a file in their local set of files without revealing exactly what they have?

For these purposes we will consider a file to be a string of ones and zeros. Padding a 1 to the left maps each file an integer.

Suppose I have three files on my computer, a b and c.

A: 0x00FFA
B: 0x1
C: 0x666A

A web server wants to know if I already have file B.

Of course it could transmit a 256bit hash of B, and ask if I have it, and my computer would do a lookup and report back. But I wanted to know if there is a way to pre-publish a fixed length token which represents every file I have, so the server need not ask- instead it checks the hash of file B against the token.

My instinct is that this should not be practically possible in a fixed ( eg 256 bit) token because adding files to the set might dilute the information resource and the token will have false positives crop up quickly, but I am not sure. Perhaps there is a precise method to choose a token length for a given number of files and collision probability threshold?


texts: Why is AES encryption decryption not platform agnostic?

texts: We work on C++ code which compiles on Windows and Linux. I have been told that AES encryption/decryption is platform dependent. Is it true? If so, why is it OS dependent?


texts: Is there such thing as an order independent, updatable hash?

texts:
I have an application where I have a set of primitive units, $P = \{p_0 ... p_n\}$ (they are byte-arrays, in my application).

I want to be able to create a hash value $H(S)$ for any subset $S \subset P$, such that:

I can update a hash without knowing what it hashes. So given $H(S)$ and $T$ (where $S, T \subset P$), there is some function $f(H(S), T) = H(S \cup T)$. Note this works without knowing the contents of S, only its hash.
The hash value is independent of the order. So $f(H(S), T) = f(H(T), S)$.


texts: Can we decrypt in this order when the message is encrypted twice?

texts: If we encrypt a message twice with symmetric key $k_1$ first and then $k_2$ like $E_{k2}\{E_{k1}\{m\}\}$ , ideally we should decrypt with $k_2$ first and then $k_1$ but is it possible to decrypt with $k_1$ and then with $k_2$ ?  Using any of the AES Modes preferably ?


texts: Is $f(x) = -1.5$ a negligible function? Since it satisfies the condition for a negligible function?


texts:
Let $H_{2^n}(k,m)$ be a hash function where $k$ and $n$ are unknown and $m$ is a message in the format $(m[0], m[1], ..., m[s])$, with $m[i] < 2^n$ for all $0 < i \le s$. Define the hash as:

$H_{2^n}(k,m) = (k^s + m[1]k^{s -1}+\dots + m[s -1]k + m[s]) \;mod\;2^n$

The attacker sends a set $M = \{m_1, m_2, ..., m_a\}$ of messages and wins the game if $H_{2^n}(k,m_i) = H_{2^n}(k,m_j)$ for some $m_i,m_j \in M$ where $m_i \ne m_j$.

How can the attacker choose a set $M$ that will surely win the game?

I'm guessing there must be some trick with the last part of the message (i.e. $m[s]$), for example, if the attacker sends a set $M$ where $m_i = (0,0,\dots, 1 + 2^i)$, it's possible to ignore $k^s$ and if $M$ is big enough, than its elements will collide for sure, but I don't think this is the right way to use the argument.


texts: How can one generate pairs/triplets/.../n-ary MD5 collisions

texts: Is there a way to generate n strings with the same MD5 hash?


texts:
Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned:
Attacks:

Brute force: This one is theoretically possible but not practical
Small subgroup attacks: Pohlig Hellman and Lim Lee attacks are useless against Curve25519 mostly because of the chosen parameters.
Pollard Rho and Kangaroo attacks: Curve25519 is not immune to those attacks, but still provides enough security ( round about $2^{125}$ )
Batch discrete logarithms: Again Curve25519 is not immune but still provides enough security
Transfer attacks: Algebraic attack against which Curve25519 is pretty much resistant
Baby Step Giant Step: Is possible but the cyclic groups are too big.

Other security aspects:

Rigidity: The origin for every Curve25519 parameter is provided
Montgomery Ladder: Resistance against side channel attack
Twist: The Twist of Curve25519 is secure, too
Completeness: addition formula is complete
Indistinguishability: No difference between a random string and a key

Since Curve25519 was published about 15 years ago my question is: Are there any (newer) attacks and/or security aspects I'm missing?


texts: Question about IETF RFC6979 determinisitc (EC)DSA document section 3.6 additional data k'

texts:
In RFC6979 document
https://tools.ietf.org/html/rfc6979
page 14~15, Section 3.6 "Variants"

o. Additional data may be added to the input of HMAC, concatenated
after bits2octets(H(m)):
    K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')

 ...  In [SP800-90A] terminology, k' is the "additional
 input" that can be set as a parameter when generating pseudorandom
 bits.

The line

K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')

appears to be from step d in section 3.2 "Generation of k".
Q1:  Additional data k' is concatenated after bits2octets(H(m)) in HMAC input in step d.
May we also need to concatenate k' after bits2octets(H(m)) in HMAC input in step f?
ie step f becomes
K = HMAC_K(V || 0x01 || int2octets(x) || bits2octets(h1) || k')

Q2: As said

SP800-90A terminology, k' is the "additional input"

In SP800-90Ar1 document
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf
section 10.1.2.3 "Instantiation of HMAC_DRBG",
there is no "additional input" in "HMAC_DRBG Instantiate Process" but
k' appears to be passed as "personalization_string" as in SP800-90Ar1 section 10.1.2.3.
If k' is used as "personalization_string", then in Q1, we may also concatenate k' after bits2octets(H(m)) in HMAC input in step f, no?
Q3:

SP800-90A terminology, k' is the "additional input"

In SP800-90Ar1 document section 10.1.2.5 "Generating Pseudorandom Bits Using HMAC_DRBG",
there is an "additional_input" argument.
Is the "additional input" in RFC6979 document section 3.6 referred to the "additional_input" in
SP800-90Ar1 document section 10.1.2.5?
If so, may we need to pass additional data k' as "additional_input" also to "HMAC_DRBG_Generate Process",
ie in RFC6979 section 3.2. step h.1~h.3?
Presumably as a result, RFC6979 section 3.2. step h may become:
Inserting a new step before step h.1:
(K, V) = HMAC_DRBG_Update(k', K, V);  //step 2 of "HMAC_DRBG_Generate Process"

and the later half of step h.3 may be modified, if k is rejected and generating a new k is needed,
the original process appears to be step 6 of "HMAC_DRBG_Generate Process":
(K, V) = HMAC_DRBG_Update(null, K, V)
ie
    K = HMAC_K(V || 0x00)
    V = HMAC_K(V)

may become
(K, V) = HMAC_DRBG_Update(k', K, V)
ie
K = HMAC_K(V || 0x00 || k')
V = HMAC_K(V)
K = HMAC_K(V || 0x01 || k')
V = HMAC_K(V)

as later half of step h.3.
May such modifications be needed?


texts:
Some time ago, I asked how to encrypt small messages like e.g., four decimal digit numbers (banking PINs). I've got my answer, but also a warning like it makes no sense as it's easy to guess: Even having no information at all and bad luck implies 10000 trials only, which is nothing in crypto.
However, at an ATM you have three trials only, and a PIN encryption scheme not leaking any information makes a lot sense to me. What does the theory say?
Clarification:
I'm looking for something telling apart bad and good system for this encryption.

A bad system could be "add a constant to the PIN modulo $10^4$. The attacker with a single plaintext-ciphertext pair could decrypt any other ciphertext.
A perfect system would be "generate a permutation table with $10^4$ elements using a true RNG and a proper algorithm". Now the attacker with any number of plaintext-ciphertext pairs given an unseen-yet ciphertext knows nothing except that the corresponding plaintext is not in his collection.


texts: Thoughts on This Encryption Method, Please?

texts:
I'm very much an amateur programmer, and 90+% of the math of true encryption is way over my head. That said, I did write an encryption program once upon a time and I'd appreciate your thoughts on it.  It was written in C++ as a command line executable that accepted a filename and a password as input. To encrypt, you would enter 'N-Crypt filename password'.  What it did was almost ludicrously simple. It opened the file it was to encrypt, looked at each byte in order and converted it to a value from 0 to 256 value based on the password you specified, using each successive ASCII character value of the password in order and cycling back to the first character when it reached the end. It also alternated between adding and subtracting the character value  So, for example, if the password was 'God' and the first byte of the file had a value of 30, it would add the ASCII value of 'G' which is 71 to the 30 and return 101. If the resulting value was greater than 255, it would cycle around, so 256 would become 0. If the second byte of the file was 220, it would subtract the ASCII value of 'o', which is 111, and the result would be 109, and so on until the entire file was encrypted, then it would overwrite the original file with the encrypted version.

Ludicrously simple, yes?  But here's where I think it got interesting - you could cycle the file encryption through as many different passwords as you wanted, and there was no limit on how long the password could be (except whatever limits the command line structure had).  So, say you started with a jpeg file, and cycled it through three encryptions using three different passwords.  To decrypt the file, you had to reverse the process with the D-Crypt command line program, using the original passwords in reverse order. If you didn't get any part of the passwords correct, the decryption process would fail, producing a file of gibberish. The only way anyone could know they'd successfully decrypted the file is it come out as whatever the file originally was.

So, my question is this.  If your a highly paid NSA cryptologist and you are handed a mystery file encrypted in this manner, what are your chances of successfully decrypting it?  What methods would be useful given the encryption scheme? Some of the first issues you face include 1. Not knowing the encryption scheme. 2. Not knowing the passwords. 3. Not knowing how many passwords were used. How would your chance of decryption improve if you also had copies of the encryption and decryption programs (you still would be facing issues 2 and 3)? To my non-cryptologist's brain, my scheme seems pretty secure, but you hear about decryption methods that border on the miraculous, so I really have no clue how secure it really is.

Thank you for any reply you care to give.


texts: What is the smallest size of CAdES signature?

texts:
CAdES signatures are usually huge, they contain certificates, possible full chain, and even source data enveloped in it. This is very impractical if we want to sign every file in the system for integrity purposes.

What is the smallest possible detached and valid CAdES signature? (To keep in the log or in separate p7s files.)


texts: Symmetric encryption with partial knowledge of key

texts:
While reading Laurent Bussard's thesis, Section 4.5.1, p91 (p119 of the pdf) I wondered about the following paragraph (emphasis mine):

  the prover first picks a random symmetric key $k \in_R \{0, 1\}^m$ and uses
  it to encrypt her private key $x$ according to a publicly known
  symmetric key encryption method $\mathcal{E} : \{0, 1\}^m \rightarrow \{0, 1\}^m$. This leads
  to $e = \mathcal{E}_k (x) \in \{0, 1\}^m$. Note that as in every encryption scheme,
  only the knowledge of both $e$ and $k$ allows to compute the private key $x = \mathcal{D}_k (e)$.

  ...

  In the $i$-th interaction, the prover releases either $k[i]$ or $e[i]$
  ...
  Note that $k[i]$ (resp. $e[i]$) denotes the $i$-th bit in the binary representation of $k$ (resp. $e$)

It appears to me that only an ideal cipher achieves the required property: wouldn't knowing some bits of $k$ and the complementing bits of $e$ reveal some information on $x$ in any real-world encryption scheme such as AES? (See also property 4.3(b) in the same thesis).  Could one estimate how much information of $x$ is leaked upon multiple executions of this protocol (where an ephemeral $k$ is chosen each protocol execution)?

(Note that in section 4.7.3 he actually uses a one-time pad for encryption, which does appear to have the required property).


texts: Can someone help me in gaining an understanding of the reliability of random.org being used by a University to select student applicants to extend invitations to?


texts:
While sending an EC point we mainly have two options, send it compressed or uncompressed. The uncompressed has prefix 04 and compressed has 02 or 03 which indicates which $y$ to choose. Actually, it is costly, first find the $y$ and $-y$ from the curve equation;
$$E(K): y^2=x^3+ax+b$$ a cube and a square root is required. If the base field is prime then select according to the last bit of $y$ or $-y$. Select the one with 0 if 02 is encoded and select the one with 1 if 03 is encoded.
For 32-byte coordinates, this can save 31-byte of message size ( one byte increased, we send 65 for uncompressed due to prefix). If we consider the cost, it increases the computation, and sending 64-bye instead of 33-byte is not really a huge issue.
Now, Bernstein in their slides mentions that

Never send uncompressed $(x; y)$. Design protocols to compress one coordinate down to $1$ bit, or $0$ bits! Drastically limits possibilities for attacker to choose points.

How does sending compressed points in ECC can limit the attacker's capabilities?


texts: Is it possbile to get same set of public and private keys twice while creating CSR ? If so where does the conflict happens !?

texts:
I'm new to cryptography and please clarify if my below assumption is wrong.

Lets assume, that two different banks creating CSR and they get identical public and private key pairs of RSA.  In such scenario, how does the conflict be managed.  Will the administrator be notified about the conflict ?
will the CA check for the conflict ?

If this persist further, one of the administrator can sniff the packets of the other web server and decipher with copy of his own private key.


texts:
Monero uses a Pedersen commitment $yG + bH$ to obfuscate the value of a transaction, where $b$ is the value and $y$ is the blinding factor.
For the receiver to know both variables, it uses a Diffie-Hellman key exchange to share a secret $rK$, where $r$ is a randomness chosen by the sender and $K$ is a public key of the receiver. $R = rG$ is public and sent as part of the transaction. The sender computes the following (the $amount$ is also sent in the transaction and $H$ is a hash function):
$$ y = H(“commitment mask”, H(rK)) $$
$$ amount = b xor H("amount", H(rK)) $$
The receiver is able to compute $y$ and $b$ using $R$ and his private key $k$.
My questions are: can this be considered an encryption/decryption scheme and is it already known or is it original to Monero? If the latter, how can we prove its security?
Source: https://web.getmonero.org/library/Zero-to-Monero-2-0-0.pdf, page 45


texts: Shamir's Secret Scheme : Knowing the threshold

texts:
If I am decoding a key by applying shares, is it possible to know when the threshold has been reached, and the secret revealed, without having to be told what the threshold is?

Also, is it possible to determine if a share is a "valid" share (ie originally generated by SSS for a given secret)?


texts: Which attacks are possible against raw/textbook NTRU encryption?

texts: In the same fashion that these questions about attacks to textbook RSA and ECC, I was wondering what are the immediate drawbacks of applying NTRU Encryption directly, without any padding scheme, such as NAEP or SVES.


texts: How to prove a lemma that is based on phi-hiding assumption?

texts:
Assume that the $\phi$-hiding assumption is true, i.e. that for a composite number $m$, a PPT adversary A cannot distinguish between a prime $p_0$ that divides $\phi(m)$ and another prime $p_1$ that doesn't divide $\phi(m)$.

How to prove that a PPT adversary B cannot distinguish $q_0 = (r \cdot p_0) \bmod \phi(m)$ and $q_1 = (r \cdot p_1) \bmod \phi(m)$, where $r$ is a random integer between 1  and $\phi(m)$ inclusive?

I know the basic idea is to let A construct $q_0$ and $q_1$ and give them to B. But the issue is that A doesn't know $\phi(m)$.


texts: Arbitrary width pseudorandom permutation

texts:
An arbitrary width pseudorandom permutation seems like a very versatile secret-key cryptographic building block.  It allows for trivial (nonce-misuse-resistant!) authenticated encryption, among other things.

Are there any known constructions that are considered secure?  Are any of those efficient in practice?


texts: OMAC/CMAC constant for different block sizes

texts:
OMAC/CMAC only specifies constants for 64-bit (0x1B) and 128-bit (0x87) block size. I would like to know how to get constants for other block sizes.

http://en.wikipedia.org/wiki/CMAC says it "is the non-leading coefficients of the lexicographically first irreducible degree-b binary polynomial with the minimal number of ones.", but I'm not good at math and I don't know how to implement that.

So does anybody know how to implement that?

Thanks.


texts:
How bad is the following strategy for a password manager on a local machine?

The user wants to sign up for somesite.com where he needs a password.
The user has previously generated a secret key K which he remembers and isn't stored anywhere. Now using a good hash function the site's URL somesite.com is hashed together with K to form the password used for the site.
This way passwords are never stored and can be recalled on a per-site basis from the secret key.


texts:
Ed25519 is a signature or just elliptic curve?
EDDSA is signature, what using curve ed25519?


texts:
I was explaining MPC to a high school student. He was excited and asked me for some examples. The only ones that I could think of are by using garbled circuits. Are there some simple MPC protocols for operations such as addition, multiplication, exponentiation, max, min that I could easily explain to an high school student?

Edit: I got good responses for addition and average operations. Are there any simple protocols for other operations as well?


texts: What is best practise for salting and multiple-hashing of passwords?

texts:
I have been presented with some custom PHP code for salting passwords and applying multiple rounds of hashing.

It looks reasonable, but I fear home-grown crypto.

Is there an existing password salting and multiple hashing algorithm which I could use instead of code from a non-cryptographer.

The algorithm needs to accept a password, a salt and the number of rounds.

I've found bcrypt, which looks appropriate, but I'm concerned that it's old.


texts:
I found this paper:
https://www.researchgate.net/profile/Ganesh-Gupta-7/publication/271704029_What_is_Birthday_attack/links/54cfbdcc0cf24601c0958a1e/What-is-Birthday-attack.pdf
The following attack is outlined on page 9:
Input
-----
Two types of messages - legitimate message 1 ; fraudulent message 2 ; m bit
length; one -way hash function H

Output:
-------
1′, 2′ Is a minor modification of 1, 2 with (1′) = (2′).

1) Generate  = 2^(/2) minor modifications of 1′of 1.
2) Hash each such modified message, and store the hash-values such that they
can be subsequently searched on hash -values. This can be done in () total
time using conventional hashing.
3) Generate minor modifications 2′  2 , computing (2′) for each and checking
for any matches with any 1′ above; continue until a match is found.

I'm confused about step 3.  How would (1′) = (2′)?  I thought the birthday problem meant finding collisions such that (1) = (1′), and (2) = (2′)?


texts: How to decrypt a combination of transposition and substitution cipher text

texts: I'm having problems decrypting a cipher text that has an transposition cipher applied to it but also a substitution cipher. I don't know in which order they were applied. Does anyone know what steps I should follow to decrypt it?


texts: Digital signatures in SSL/TLS-like protocols

texts:
The TLS protocol includes an optional Server Key Exchange message that is signed by the server. It seems to me that this message is digitally signed only to prove to the client that the message originated from the server.

The general purpose of a Digital Signature is to provide a proof of origin that can be verified by anyone at any time, without any prior communication with the signer. Providing such a proof to the client regarding the origin of the Server Key Exchange message is overkill, in the sense that it might require the client and server to implement Digital Signature generation and verification algorithms that might be redundant.

Wouldn't the following alternative provide a similar proof, and in addition be reducible to the CDH problem?

Presume the client $C$ and server $S$ share a set of parameters defining a group $G$, suitable for Diffie Hellman, and that $C$ already has the public key $y \equiv g^x \in G$ of the server.

$C: $ Generates random $a,v$ and $A \equiv g^a$ and $V \equiv g^v$ and sends $A,V$.

$S: $ Generates a random $u$ and $U \equiv g^u$, calculates $premasterkey \equiv V^u$ and $k \equiv A^x$ and $H = HMAC(k,U)$ and sends $U,H$.

$C: $ Calculates $k' \equiv y^a$ and verifies that $HMAC(k',U) = H$. If OK, calculates $premasterkey' \equiv U^v$; otherwise aborts.

(Note: The random values of the Hello messages as well as the Finished messages should be added for completeness.)

The above protocol should require one less modular exponentiation calculation client side compared to the DHE_DSS cipher suites defined in TLS, would only require the implementation of the DH algorithm for $G$, but would on the other hand not allow the server to precalculate the DSA $r$ values.

Is there any other reason to use a digital signature in the Server Key Exchange message, than the order of the protocol steps being put there because it wouldn't matter much for DHE_RSA how it is done (digital signature in Server Key Exchange or an extra key transport message sent by the client earlier)?


texts: Cryptography: Oblivious Transfer with at most one transfer?

texts: I am trying find a transfer method for this problem. Suppose Alice and Bob both has access to a function $\text{F}$ with two parameters. $\text{F}(x,y)$ randomly returns $p$ to alice and $q$ to Bob  such that $x\times y=p \oplus q$. Now as per rules of Oblivious Transfer, Alice has $s_0$ and $s_1$ and Bob has $c$. Bob wants to learn $Sc$. The catch is alice can transfer at most one bit in total to bob, that means they can communicate just once. How can Bob learn $Sc$ using this function?


texts: RSA finding the inverse of the public exponent

texts:
I have a very basic doubt in RSA key generation and its usage.

In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, $\phi(N)=(p-1)(q-1)$. Now you find a number $0 < e < \phi(N)$ such that $e$ and $\phi(N)$ are coprime. {$e,N$} becomes your public key. Now you compute $d$(private key) such that $ed \equiv 1 \bmod{\phi(N)}$.

Now suppose you encrypt something (say $m$) with your the public key: $c=m^e\bmod{N}$. To decrypt with the private key, you do $c^d\bmod{N}$.

Now my doubt is that you found out the inverse of $e$ modulo $\phi(N)$, but when you are decrypting you are doing it in modulo $N$. How is this possible?


texts: Why is the tweak length 64bit in BPS FPE algorithm?

texts:
In the algorithm for BPS Format Preserving Encryption

Is this tweak always the same length (64bit)?

Why did they choose the length 64bit for the tweak?


texts: Is the "Signed on date" of a PGP Signature Verified?

texts:
I noticed that PGP signatures have a "signed on" field.  I was wondering if this is "trustworthy" information and if so how is it accomplished.

For example, I can't see how it could be trusted because someone could sign something a year ago and transmit it now or they could generate a fake date and I don't see how an outside system could tell whether it was actually signed on the specified date.

So is the signed on date to be trusted or is it just the word of the person who signed it?


texts:
I have the following ciphertext that I want to decipher:

  bnmkogt vgyhni uioopkm xswercvdf yuiogvbnm ghjy cftyhng tgeyjn
  xdrtygvc zsefx xdrgbhu tgbnmko tgbnmhyui yhnmko vbnmgyuiok

So far, what I have done:

Perform a frequency analysis. This suggests that no transposition cipher was used. I Also try all 26 ROT combinations for substitution cipher with no results.
Move to polyalphabetic ciphers. My first option is Vigenere. In that context I found that there are several trigrams , bnm, repeated and two 5-grams, bnmko, (which is probably not random and indicates that the same text is encrypted with the same part of the key).
I use the only 4-letter-word of the text, GHJY, and compare it with the most common four-letter words in English (assuming it is English...), with no good results.
I measure the distance between the 5-grams and found that is 72, which factors are 1,2,3,4,6,8,9,12,18,24,36.
I also ran an Index of Coincidence analysis which suggests that the key length is 7.

I think that I'm missing something. Any thoughts/ideas on how can I better address this cryptogram? What would you do?
Thanks!

PS. The only clue of the cryptogram says "Manual work". Apparently, it is a classic cipher...


texts: Can j-invariants be used to decide which elliptic curves are suiteable for cryptography?

texts:
The j-invariants classify the elliptic curves up to isomorphisms (if we suppose to work in the algebraic closure). Is this classification used in some way to decide whether or not an elliptic curve can be used in cryptography?

If j-invariants can not be used for classification, is there an other classification which responds to my question?
If j-invariants can be used for classification, what does the j-invariants tell us about the curve so that we know it is save to use it for cryptography?

For example: can a certain j-invariant correspond to a curve where we are sure that it has full-torsion so that it is a possible choice for Weil pairing?


texts: Is there any identification for common encoding/encryption?

texts:
I come across lots of tokens which might be simply encoded and not random, but I don't know any way to identity if they are encoded or random, how to find is there any cheatsheet for the same.

For example, I know about base64 encoding, I can tell just by looking if its base64 or not. Identification for base64 is it would be in pair of 3 so total count of the characters would be in multiple for 3, if for some reason say there are 19 characters then to make it multiple of 3 two "=" (without quotes) would be added at the end.

Like this are you aware about identification of other encoding/encryption?


texts: What's a relatively fast way of checking if a string is decrypted English?

texts:
I asked this on Stack Overflow but I was told to ask here.

I'm writing a program that decrypts text encrypted using a Vigenere cipher. It's been working very well so far, but my current issue is that I need an effective way of checking if a string is decrypted. So far, I've been checking how many times the string contains a set of the most common English words, but that doesn't work if the string has no spaces.

For example, the following "plaintext":

XPAWWALLTPJZYYZWBGSHGARECPVHDAAPLJLBGAPVTFVCWAS

contains "all", "are", "was", and "as", but it is clearly not decrypted.

What's a good way of checking if a string is decrypted?


texts: What challenge should I use in a challenge-response proof-of-work?

texts:
In order to guard against denial-of-service attacks, I want to require clients to do some work (more work than the server does fulfilling the request) before talking to them.

Client connects
Server sends a challenge, including a piece of data

"Find bytes x such that hash(challengeData + x) has n zeros at the beginning"
Client finds x, sends it to the server
Server verifies that hash(challengeData + recv()) has n zeros at the beginning
The actual request is handled

I found a few different methods to generate this "challengeData" thing, and some problems with each of them:

Random bytes

Here, the client can just exhaust the server's PRNG by repeatedly connecting to it. Which brings us back to square one (denial of service).
Current time of day

This seems like a good idea to me, but I'd like to know what attacks you could have against it.
A string involving something dependent on this particular request (like hashcash)

In order to make sure evil connections are dropped as soon as possible, I'd like to avoid handing anything about the request before making sure the client has done some work. The idea is that the client should always do much more work than the server before it starts handling the request.

I have some constraints: firstly I'd like the server to be completely stateless. I don't want to save "hashcash" and make sure it isn't spent twice, instead I want to challenge the client to do work that, inherently, can't be pre-computed. Secondly I don't want to know anything about the request itself at this stage (such as authentication). This is so the server sends and recieves as little data as possible. For instance, the current time (nanosecond or millisecond precision, depending on the OS, hardware and implementation) is 8 bytes (a double), and 2^64-1 tries (i.e. an 8-byte response) should be more than enough before resetting the connection (for the foreseeable future).

In short:

What properties does this challenge need to have?
What easily generated data has all of these properties? Is the current time any good?

As usual when I ask something about protocol-design, this may well be reinventing the wheel. If there are any existing protocols that do this, I don't know about them yet.


texts:
I wanted to programm the enigma (using C#). But it seems like i dont understand how the rotors work. Becouse if we take the first three rotors:

ekmflgdqvzntowyhxuspaibrcj
ajdksiruxblhwtmcqgznpyfvoe
bdfhjlcprtxvznyeiwgakmusqo
UKW A: ae  bj  cm  dz  fl  gy  hx  iv  kw  nr  oq  pu  st
(The meaning of the possitions are from a-z oc).

So if we take the route of A now: a-e; e-s; s-g; g-y; y-q; q-q; q-x; x= encrypted output.

Now lets go back again: x-r; r-g; g-c; c-m; m-z; z-e; e-l; l = decrypted output

So where is my logical problem?


texts: Digital Signing algorithm for a fixed set of private and public keys in broadcasting like system?

texts:
I have a broadcast kind of system. Where sender knows what to send and receivers will know what sender has sent. Now the sender will sign the message with his own private key and receivers will verify with the provided public key.

Now, all the receivers will have the same public key and the sender will have one protected private key that is being used for signing of the messages.

Keys are not going to be changed for a very long long time. So the senders and receivers will end up having same keys for eternity.

Which cryptographic approach would be suitable for this use case to make sure no one else can sign the message and send to the receivers?


texts: What is "msg = group.random(GT)" in Charm encryption schemes?

texts:
In many encryption schemes in Charm the random group message is used instead of a text-message:

msg = group.random(GT)

For example, in CP-ABE scheme, random message is used:

cpabe = CPabe_BSW07(group)
msg = group.random(GT)
attributes = ['ONE', 'TWO', 'THREE']

See link for scheme details: http://jhuisi.github.io/charm/charm/schemes/abenc/abenc_bsw07.html

Can anyone clarify for me whether I can use my own text-message instead of random ID here. I tried with a encoded byte-array but no luck. What is group.random(GT)? Can I use a custom message?


texts:
My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce?

key = random;
nonce = 0;


texts: What role does the mode of operation play in Veracrypt vs. Bitlocker?

texts:
There is this VC vs Bitlocker debate . It is always about open source and not open source , alternative algorythms , portability , etc....
That is nothing new , but once I saw someone useing the mode of operation as an argument . VC uses XTS while BitLocker uses CBC . I am not a professional and my experience with modes of operations is very limited . I know that XTS is used for Drives and partitions and CBC is like a default mode for block ciphers .
But does it really count ? Every mode of operation is secure in some way , right ?
And if CBC really is not as secure as XTS , then why does one of the bigges software companies in the world ( Microsoft ) use it in there encryption solution ?


texts: How to prove I know an x without revealing x or f(x)?

texts: Suppose a set of $u_1, u_2, ..., u_N$ users each knows an associated secret $x_1, x_2, ..., x_N$ they do not wish to reveal.  We have a public $f(x)$ such as the discrete logarithm $f(x)=g^x\,\mathrm{mod}\,p$, which produces a set of publicly available values $v = \lbrace f(x_1), f(x_2), ..., f(x_N) \rbrace$ used for verification.  Is there a way for any given $u_i$ to prove that they are in possession of $x_i$ such that $f(x_i) \in v$, without revealing which $f(x_i)$ (or $x_i$), as a means of providing anonymity?  The usual ZKP requires that $x_i$ and $f(x_i)$ are publicly associated.


texts: Pseudo-random function where the output is inverted using XOR

texts:
I'm looking to know whether or not this PRF is secure :

$$F'(k, x) = F(k, x) ⊕ 1^n$$

knowing that $F$ is already a secure PRF for

$$\{0, 1\}^n × \{0, 1\}^n → \{0, 1\}^n$$

with, for example, $n= 128$.

I would do it like this: knowing that $F$ is already a secure PRF, therefore an attacker cant know if the output of $F$ is a $0$ or a $1$.  When we have the XOR with $1^n$ , the advantage could go up to $1 \over 2$ (the attacker tries both possibilities, $0 ⊕ 1$ or $1 ⊕ 1$).

So I think this wouldn't be a secure PRF for that reason .


texts:
I've been reading up on Yubico's implementation of U2F. What I understand so far is that two things are calculated. So upon registration first you calculate a private key by

$PrivateKey = HMAC(AppID+nonce,DeviceKey)$

This is then used to simulate the encrypted private key which is sent to the server in the U2F spec:

$KeyHandle = nonce, HMAC(AppID,PrivateKey)$

with "normal" U2F, you send the encrypted private key and a public key to the server. When a user authenticates, he is sent his encrypted private key and a challenge, which is some value encrypted with the public key. If the user can decrypt the challenge by decrypting the private key and decrypting the challenge he has proven he is in fact who he claims to be.

Now this is where it gets fuzzy for me.

The keyhandle is just a nonce and HMAC concatenated, how is this
turned into a private key?
How is the public key  derived as the private key is just a hash in
this case?


texts: Why is Serpent faster than AES in this benchmark?

texts:
I have a laptop without the AES-NI CPU instructions but with SSE4.1.

I'm using Linux and tried the (in-memory) cryptsetup benchmark to get the rough tendency which returned:

#  Algorithm | Key |  Encryption |  Decryption
     aes-cbc   128b   101,4 MiB/s   159,6 MiB/s
 serpent-cbc   128b    52,7 MiB/s   203,4 MiB/s
 twofish-cbc   128b   126,4 MiB/s   176,1 MiB/s
     aes-cbc   256b   107,8 MiB/s   120,4 MiB/s
 serpent-cbc   256b    52,9 MiB/s   203,3 MiB/s
 twofish-cbc   256b   135,2 MiB/s   177,0 MiB/s
     aes-xts   256b   160,6 MiB/s   160,2 MiB/s
 serpent-xts   256b   181,2 MiB/s   188,6 MiB/s
 twofish-xts   256b   164,4 MiB/s   166,2 MiB/s
     aes-xts   512b   121,4 MiB/s   121,0 MiB/s
 serpent-xts   512b   181,4 MiB/s   188,6 MiB/s
 twofish-xts   512b   164,7 MiB/s   165,4 MiB/s

I'm very surprised:

AES has fewer rounds than Serpent so AES should be faster.
AES usage is much higher than Serpent so one could expect the Linux AES crypto module to be much more optimized than Serpent's.
There is no speed decrease with bigger key size in Serpent while there is in AES.
The tests I made 1 year ago on the same computer gave the same speed for AES but all Serpent entries were averaging at 50 MiB/s.
To my knowledge, there has been no huge enhancement of Serpent kernel module in the past year.

Would you trust this "benchmark"? If not, how would you explain the great results for Serpent?


texts: Number of rounds for constant header size in common hashes and XOFs

texts:
We compute hash $H(M_0\mathbin\|M_1)$ of size $d\ge1$ for some constant header $M_0$ of size $m_0$, and $\nu\ge1$ messages $M_1$ of random content and size $m_1$.
For Merkle-Damgård hashes, a simple optimization pre-computes the first $\left\lfloor m_0/r\right\rfloor$ rounds (where $r$ is the block size), and for some minimum extra size $\mu$, the total number of rounds computed is
$$\text{rounds}=\left\lfloor\frac{m_0}r\right\rfloor+\nu\left\lceil\frac{\left(m_0\bmod r\right)+m_1+\mu}r\right\rceil$$
with, for some hashes:
$$\begin{array}{l|rrrl|rrrl}
\text{hash} & d&r&\mu&\text{(bits)}&\tilde d&\tilde r&\tilde \mu&\text{(bytes)}\\
\hline
\operatorname{SHA-256}    & 256 &  512 &  65 && 32 &  64 &  9 \\
\operatorname{SHA-512}    & 512 & 1024 & 129 && 64 & 128 & 17 \\
\end{array}$$
Note: The right side of the table assumes quantities are expressed in byte rather than bit. The only change to the formula is that variables get a tilde, except $\nu$.
For more common hashes and XOFs¹, what are the corresponding formulas and parameters?
I'm especially interested in common variants of SHA-3 (or KECCAK if it differs from SHA-3 other than by value of padding); SHAKE; various BLAKE; and perhaps some parallelizable hashes.
Update: I have changed notation several times to align with that in KECCAK/SHAKE for $r$ and output size $d$, and used greek letters in an attempt to avoid confusion with existing hash specifications.

¹ eXtendable Output Functions essentially are hashes where the output size $d$ is a parameter rather than fixed. An example is SHAKE256 of the SHA-3 family.


texts: LFSR get output from characteristic polynomial?

texts:
Say you have a characteristic polynomial of an LFSR:

$$f(X) = X^4 + X^3 + 1$$

How can I use this function f to get the output of the LFSR, given some initial state?

Obviously I can create the LFSR diagram based on the function, since this function describes where the "taps" are (see .e.g the Wikipedia article http://en.wikipedia.org/wiki/LFSR):

|----+--------+
|    |        |
+-->[0][1][1][0]-->

Then calculate it iteratively like this: 0, 1, 1, 0, 0, ... (here the initial state is as in the diagram, 0,1,1,0).

I know you can also get this output from the equation:

$$s_j \equiv c_1s_{j-1} + c_2s_{j-2} + \dots + c_2s_{j-2} \pmod 2$$

Which gives the same result as calculating it from the diagram "by hand".

However my question is how to get this from the characteristic polynomial. Also what purpose does the characteristic polynomial have, beyond describe the taps in this way? If you give f some arbitrary argument, what are you really doing? What is the argument X?

I have a feeling this should be covered pretty well in some readily accessible online guide or tutorial that I cannot find, however I have read several such texts and searched through several more, and this is still not clear to me.


texts: AES-XTS: find key from ciphertext and plaintext

texts:
Let's say I have a plaintext, the corresponding ciphertext encrypted using AES-XTS, and the initialization vectors. Is there any way - not brute force, of course - to compute the key?

Even if there's no known way, feel free to share articles on the subject


texts: What is the difference between cfb and cfb1 and cfb8 ? ( like openssl's aria-128-cfb & aria-128-cfb1 & aria-128-cfb8 )

texts:
What is the difference between cfb and cfb1 and cfb8 ? like openssl's aria-128-cfb and aria-128-cfb1  and aria-128-cfb8

edit: interestingly enough, there's also references to a cfb128 (example)

(title says it all but CSE won't let me post a question without a message body)


texts: Is there a crytographic scheme for "ciphertext consistency verification"?

texts:
I a problem that essentially boils down to the following:

There is raw data, D, encrypted with key K (call its encrypted form E). The same raw data, D, is also encrypted with key K' (call its encrypted form E'). Given E and E', and also secure hashes of K and K', it should be verified that D was properly encrypted both times.

The use case of this would be performing client-side encryption and uploading the encrypted data. If the encryption key is changed, the server should validate that the data has not been corrupted. Is there some sort of schema that fits what I am describing? I intentionally did not specify the encryption or hashing algorithms as I assume that those would be dependent on the schema, if one exists. Thanks for the help, and sorry if this is a stupid question - I am no cryptography expert.


texts: Effect of message length on collision attacks

texts:
I know that message collisions are supposed to be hard to calculate for a good cryptographic hash.

Given 1k worth of data, it's hard to find another 1k worth of data that collides with the same hash.

But doesn't it become much easier when the message becomes variable length? I.e. it's easier to find a collision in 0-1G of data to 1k of data than it is to find one that is also exactly 1k of data.

Does knowing the intended size of the message increase the strength of USING the hashing function? I.e. a message has to be between 1k and 4k.


texts: Performance comparison between ECDSA and BLS signature schemes?

texts:
I want to choose an efficient signature scheme for implementation on a lightweight MCU. I was wondering how does the performance of ECDSA and BLS signature schemes compare in terms of signing time and signature size etc.?

Best Regards,
Ihtesham


texts: What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

texts:
SHA-1 and SHA-2 share the same structure and mathematical operation as their predecessors - SHA-0 and MD5.  Both SHA-0 and MD5 have been broken. This is one of the main reasons why SHA-1 is considered insecure and is being phased out for SHA-2.

NIST announced in 2007 a competition to produce the next generation NIST hash function: SHA-3.

What is the major difference in structure and mathematical operation between the previous SHA-1 and SHA-2 functions and SHA-3?


texts: Password cracking: What if attacker is lucky?

texts:
We have always measured password or private key strength by the amount of entropy it contains, but what if the attacker who cracks it is lucky.

Consider the following simple scenario, we have 1 bit [0,1] secret , the attacker should choose between 2 combinations, but the attacker already has a 50% chance of guessing the right one.

Now consider a 128 bit secret. It should have 2^128 combinations, so the attacker should go through 340282366920938000000000000000000000000 combinations before guessing the secret, but he actually only has to go through half of that: 170141183460469000000000000000000000000, because he probably has a 50% chance of guessing it right.

So if at each bit he has a 50% chance, that means that 1 bit is actually only half bit.

And if he is very lucky, say 90% chance, that means that 1 bit is actually only 0.1 bit.So in face of a very lucky opponent, a 128 bit password has only 12.8 bit strength.

What is your opinion about this?


texts: Are there any hashing functions where you can perform operations on the hashes without knowing the source data?

texts:
There is a file A and a file B.

If I have only HASH(A) and HASH(B) are there any non-trivial hash functions for which I could calculate both HASH(A ++ B) and HASH(B ++ A) without knowing A and B?

Can this be extended further?

Are there hash functions where, if I know HASH(A ++ B) and HASH(B), I can find HASH(A)?

(By trivial, I mean XOR, etc.  "++" is the concatenation operator.)

Are any of these functions "good"? i.e. they have a low chance of collisions for non-malicious data.

Are any of these hash functions cryptographically secure?


texts:
Let $F\colon K×K \rightarrow \{0,1\}^{128}$ be a $\mathit{PRF}$ function. Is $F'$ a $\mathit{PRF}$ ?

\begin{equation*}
 F'(x) =
  \begin{cases}
    0^{128}       & \quad \text{if $x = 0$} \\
    F_k(x)        & \quad \text{otherwise}
  \end{cases}
\end{equation*}

EDIT:
I know that a $\mathit{PRF}$ over $(K,X,Y)$ is a bijective function $F\colon K×K \rightarrow Y$ that satisfies the following properties:

Efficiency: $∀k ∈ K, x ∈ X, ∃ $ an algorithm to compute $F_k(x)$
Pseudorandomness: $∀$  $\mathit{PPT}$ $D$ algorithm, $∃$ a negligible function so that:
$|\Pr[D(r) = 1] - \Pr[D(F(.)) = 1]| < \mathit{negl}(n)$ where $r \leftarrow^R \mathrm{Func}(X,Y), k \leftarrow^RK$


texts:
I have a couple of polynomials to find. Can anybody guide me with the steps to find the feedback polynomial using berlekamp massey's algorithm.

Example:

Key fragment: 10100100001001101001011
seed: 11010000101

The online tool gives me this answer: x^11 + x^2 + 1
whereas the correct answer is:  x^10 + x^8 + 1
Thanks


texts: Which Attribute Based Encryption method is better for broadcast encryption? (KP-ABE or CP-ABE)

texts:
I have a basic understanding of public-private and symmetric crypto, but I keep struggling with the concept of ABE. I know the difference between the two variants: Key-Policy: A key is linked to a specific access policy. A cipher text is linked to certain attributes. Ciphertext-Policy: A cipher text is linked to a specific access policy. A key is linked to a certain attribute.

But I have difficulties figuring out how this would work in practice. For example;

User 1 has attributes: IsOver18, IsAlien

User 2 has attributes: IsOver18

I would encrypt something with the policy IsOver18 OR IsAlien in CP-ABE mode, how would this result in a decrypt able cipher text for User 2? Is this in fact encrypted twice with the two different attributes (thus keys)?

And if I would encrypt something with the policy IsOver18 OR IsAlien in KP-ABE mode, does this mean this would be only encrypted once, but User 2 should have received the key for the access control policy IsOver18 OR IsAlien and IsOver18 for example? What does it mean that the cipher text is linked to attributes with this access control policy? Also; does this mean that access control policies need to be pre-defined in the system, because how could User 2 otherwise decrypt such cipher text?

I'm trying to figure out what method is best for broadcast encryption, but my lack of understanding how this works in practice makes it hard for me to figure out what's the best method.


texts: Suppose I capture encrypted data that I want to decrypt. Could I use a server farm to decrypt?

texts:
For argument's sake, let's say that I'm a bad actor who produces malware. I've infected around 10,000 computers and smartphones with my malware, which runs in the background and can be used to make someone else's machine run calculations for me.

I've gotten access to some encrypted data that I'm not supposed to have. It's heavily encrypted with an asymmetric cipher, and it will theoretically take 1,000 years to crack! However, I have an array of 10,000 computers. Assuming I can use the machines to their full extent (the users are too stupid to think that anything is wrong), could I feasibly distribute the workload of hacking this encrypted data to get through it in about 37 days? Why or why not?


texts:
Just finishing an investigation into Shor's algorithm, and the following equation,
$$
O\big(\big(\log N\big)^2 \big(\log \log N\big)\big(\log \log \log N\big)\big)
$$
is given for its time complexity. However, this is negative for most small values, becoming 0 at $1\cdot 10^{10}$.
Why is this?


texts:
I have some data that I CTR-AES-256 encrypt already.  I am aware of ways to validate the integrity of the entire file (ie: a separate MAC of the plaintext, or encrypt then MAC, etc).  But none of these apply to ranges.

For example: I put a 5TB movie up into a server.  It's something crazy like 30 days of camera footage "footage1.mp4", that happens to be floating around on the internet.  Being that this file is so huge, an attacker that can't decrypt the file could simply guess that any other file of the same length must be this file.  So, attacker xors together footage1 with footage2, and xors it with the encrypted footage.  This file is so big, that I only watch it in my browser - which will range request out of it.  Heck... the attacker only overwrites the 100th Gb of the file to remove himself from the footage.  Since I never get the entire file, I won't be able to check the hash of it.

Is it possible to have this kind of integrity check with CTR mode? (The range request is why the mode was chosen)
Does GCM handle integrity checks on a subset of all the blocks?  (I didn't know anything at all about Galois Counter Mode when I started, and am not sure if this is what GCM might exist to address.)


texts: How does `d-KCA` help secure the zcash protocol?

texts:
I have been going back and forth between part 2 and part 4 of the Explaining SNARKs series.

In part 2, it is claimed that Bob has an idea about the polynomial and want to test whether Alice knows it by sending her $(g, s.g, ..., s^d.g)$ and checking the answer $P(s).g$.
In part 4, it is claimed that now Alice return 2 polynomials $a' = P(s).g$  and $b'=\alpha P(s).g$ computed from $(g, s.g, ..., s^d.g)$ and $(\alpha.g,\alpha s.g, ..., \alpha s^d.g)$. But now Bob only check that $b'=\alpha.a'$ and that if it is the case then Alice knows with high probability $(c_0,...,c_d)$.

My question:
What is the use of the d-KCA knowing that:

If Bob knows $P$ and the probability that Alice answers correctly without using P is very low, then the verifiability is ensured already.
If in the d-KCA, Alice sends back $a'=\beta .g$ and $b'=\beta \alpha .g$, we have $b'=\alpha . a'$. So if Bob only check that equality he can be fooled.

I am really wondering what I am missing...


texts: Build Encryption Method from Decryption (Reverse Modulo)

texts:
So I've been analysing some Javascript Obfuscator. I understand how the strings are decrypted, my interest is now into building the actual encryption method for those strings. I'm not going to post the full decryption method as my only concern is the actual cryptography part, but basically the algo just swap character indexes all around, so my goal is to make an encryption method that swap the characters to the proper places.
My question is related to this part:
for (var r = 0; r < x; r++) {
    var f = g * (r + 72) + (g % 30846);
    var y = g * (r + 104) + (g % 25098);
    var d = f % x;
    var l = y % x;
    var n = k[d];
    k[d] = k[l];
    k[l] = n;
    g = (f + y) % 2012852
}

It loops over all the characters, starting g value is 1245836.
After one cycle, the value of g becomes 1907150, I'm wondering how you can go from that new g value back to the original one.
What are the maths to inverse those operations:
var f = g * (r + 72) + (g % 30846);
var y = g * (r + 104) + (g % 25098);

Not looking to be spoon fed with code. I'm actually trying to understand the maths.
Thanks a lot


texts:
I hope you can help me understand the issue. I know creating my own encryption is not a thing which you should do, but I did this simple "encryption" a long time ago and discussed it with my teacher. He said that it is weak and should not be used in production, but he couldn't really explain why (or at least I didn't get it). Maybe one of you will be kind enough to help me.

The fundamental concept is to create an "endless" hash that is used to encrypt the whole plain text. I implemented the algorithm like:

A pre-shared secret and the plaintext are entered by the user
A hash is created from the secret
The plaintext is split into blocks with the size of the length of the hash
Each byte of the 1. block is aggregated to the according to byte of the hash (1. byte of block + 1. byte of hash = 1. byte of encrypted block, 2. byte of block + 2. byte of hash = 2. byte of encrypted block etc)
If there are more blocks to encrypt a new hash is generated from the last encrypted block + the last plain text block. This hash is used for encrypting the next plain text block (like step 4). This process repeats until all blocks are encrypted.
Last but not least all encrypted blocks are merged back again to one

As far as I understand, it should be secure as long as I use a secure hashing algorithm. Please help me understand why I am wrong.

You find a javascript implementation and example HTML page here: https://github.com/EdwardTivrusky/codebook


texts: Rijndael vs. Serpent vs. Twofish: General comparison

texts:
Can anyone explain (or give a link to document about) why Rijndaal won the AES, especially comparing it to other finalists (Serpent and Twofish)? What criteria were used to make decision?

Or is there detailed comparison of these algorithms including cryptographic strength, performance tests on different CPUs and maybe FPGA implementations (AFAIK i.e. Serpent's round can be fully parallelized in dataflow architectures) and also point if there are some general issues with these algorithms (i.e. attacks on AES-256 that makes it less strong than AE-S128)?


texts: Why does the PAKE ideal functionallity allow the keys to be the same when the passwords differ?

texts:
My intuition for the security a symmetric PAKE is supposed to provide comes from the example of a login page. Both the user and the server know the password (assuming unhashed passwords), and the purpose of the protocol is to authenticate both the user and the server to each other using this fact, while simultaneously generating a session key known only to them and avoiding any man-in-the-middle attacks. Specifically, I thought that one of the key properties of a PAKE is that the user and the server would get different keys if they provide different passwords, so a malicious party attempting to log in would be thwarted if it does not know the password. However, this does not seem to be the case according to the security definition.
The standard UC functionality for symmetric PAKE comes from Canetti et al.

Notice (top bullet under the $\textsf{NewKey}$ query) that if one of the parties is corrupted then the adversary gets to choose the session key $sk$, regardless of whether the two parties provided the same password. By using two queries to $\textsf{NewKey}$, the adversary can set both parties' session keys to be the same. Why would the definition be chosen to allow this? If the passwords differ, the functionality could instead have been written to give the adversary the power to choose only the compromised party's key, and not the honest party's key.


texts:
So I recently started to look into cryptography and found the following question to cryptography scheme using $T = E_{S}(S \oplus M)$

It is said that this is not secure because you can have a colliding input.

I am now not sure how to find this input, that leads to the same Hash.

Would be wonderful, if someone could help me out here.


texts: What exactly is the difference between key transport and key encapsulation? Either they seem to be used interchangeably, either I'm mixing stuff up.


texts:
Let's say we will choose some 256-bit random $b$ and we will find the smallest $d$ such that:
$\frac {2^{d}-1}{b} = s$
Now compute $z \equiv s \pmod{2^{128}}$. If I will give you only $z$ - is it possible to compute $b$ in some acceptable time? Is it hard problem? Do we know some algorithm to compute it? Is it save enough to use $z$ as a public key and $b$ as a private key?
EDIT:
I made one mistake, $z$ should be compute in another way - just take $s$ and cut all bits except $128$ least significant. So $z$ is composed of $128$ least significant bits of $s$. It does not change much, probably.


texts: Is multiple encryption using NaCL and TLS better?

texts:
In general, the idea of multiple encryption sounds interesting - for creating stronger cyphers (especially against implementation bugs), one could always get the configuration details wrong and mess it up.

So I wonder: if one starts with NaCL, which is supposed to have a default configuration that's very hard to mess up, and transmits it with TLS with a very good configuration, say from the recommendations at this Security.SE Q&A, does it improve security over TLS? What could go wrong?


texts: Is using SHA256 to extract entropy from a p-rand nonce a good way to create keying material?

texts: Using $SHA256(N)$, where $N$ is 64 bytes of output from the Microsoft Windows CryptGenRandom function. Are there any known vulnerabilities with using this method to create key material? Should $N$ be more than the SHA256 block size of 64 bytes? Aligning to block size means 2 passes through the (internal) hashing function, (block and finalize), is this enough?


texts: how can identify which cryptanalysis is used ( Indistinguishability cryptanalysis against classical ciphers)

texts:
I have 10 ciphertexts and 10 plain texts I want to know which cipher is from which plain text
how can I know this
I  know the name of substitution cipher,  transposition cipher,  Vigen`ere cipher and  case-insensitive letters-only one-time pad that are used in these 10 cipher and plain text


texts:
My question is about how difficult is for someone having compromised the PSK and sniff all (DT)LS handshake, (so getting the NONCE), to get the encryption keys?

I understand :

getting the pre-master secret is straight forward

but then, what about the master secret MS?

because MS is calculated with PRF_HMAC_SHA256 which generates different MS for each sessions , how easy can it be for an attacker to re-calculate the right MS, then the encryption keys?


texts: Security limits of password-based encryption

texts:
A reasonable way to do password-based encryption is:

put the passphrase¹ and nonce in a well-parametrized memory-hard iterated hash function like Argon2, to derive a key 128-bit or larger.
output the nonce, followed by the ciphertext per some strong authenticated encryption; AES-GCM-SIV or ChaCha20+Poly1305 comes to mind.

Legitimate decryption with the password is trivial. The best generic attack enumerates passwords from most to least common, starts to decrypt, obtains the start of the plaintext, tests it per some criteria and moves to the next password until one matches. Assume known plaintext at the start of the file².
The security depends on the good choice of password and the parametrization of the iterated hash. It's very hard to give figures, but assume 32-bit² entropy for password and a few seconds of Argon2 on one's PC. However one counts, the security in bits is far from academically acceptable levels.
Main question: Can we do better, assuming a plaintext of significant size, say $n=2^{20}$ or $2^{30}$ bits? How much better? What's the theoretical limit of the gain we can get from large $n$?
I'm thinking of using an all-or-nothing transform, perhaps approximated by 2 passes of AES-128 in PCBC mode, and two keys derived from the password, because we can at almost no cost. That idea is not new: ref1; ref2. But I still hope for an answer that takes into account memory-hardness.

Here is my work so far, very tentative. One can raise questions: criticize!
Taking the scheme at the start of the question as a reference method, let $t$ be the time (in seconds) spent in password-to-key conversion by Argon, $m$ the memory (in bits) used for that, $c$ the throughput (in bit/s) of the cipher itself, and $\ell$ the message length (in bits). The total time to encipher is thus about $T=t+\ell/c$. We do not want to wait more than that.
There is something to be gained by loading whatever of the plaintext fits in memory, and spending the time $T=t+\min(\ell,m)/c$ on password-to-key transformation while enciphering the plaintext at the same time in an hypothetical iterated-all-or-nothing memory-hard transform, performing the encryption for free; then using the key thus produced for the rest of the plaintext. If we assume there is at least 128-bit of entropy in the part of the plaintext that fits memory, which is a plausible assumption, good: that makes the rest essentially invulnerable until the password is found by crunching all the beginning.
Assuming our iterated-all-or-nothing memory-hard transform is as good at password-stretching as Argon2 is, I tentatively get as gain on "stretched password entropy" (or, more rigorously, for the base-2 log of the multiplicative factor for attacker cost):
$$\log_2\left(1+\frac{\min(\ell,m)}{c\,t}\right)\text{ bit}$$
That's next to nothing when $\min(\ell,m)\ll c\,t$, and otherwise grows with $\ell$ until reaching a maximum at $\ell=m$, then stops growing.
Assuming $t=2^2$ (4 s), $c=2^{32}$ (512 MiB/s), $m=2^{36}$ (8 GiB), we gain ≈2.32 bit. That's much less than a decimal digit in a random passcode (≈3.32 bit), and at best in the order of a character more in a passphrase.
The faster the cipher we replace, the less gain. The more RAM, and until the plaintext does not fit, the more gain.
Unless I err, asymptotically, when we double the RAM and until all the message fits in there, we seem to quadruple rather than double a memory-bound attacker's cost. I'm still scratching my head for CPU-bound.

¹ Rather call it that: it is easy, unobtrusive, and has gone miles to improve security of PGP.
² In practice, a compressibility test will do if there is even mild redundancy in the plaintext.
³ The only power of two in [28-44].