texts: Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?

texts:
I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that.

public static void main(String [] args) throws Exception {
    Security.insertProviderAt(new BouncyCastleProvider(), 1);
    String ciphertext = Base64.encode(encrypt(plaintext));
    String recoveredPlaintext = decrypt(Base64.decode(ciphertext));
}

private static byte [] encrypt(String plaintext) throws Exception {
    KeyStore keyStore = getKeyStore();
    Certificate[] certs = keyStore.getCertificateChain("oaep");
    Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPwithSHA1andMGF1Padding","BC");
    cipher.init(Cipher.ENCRYPT_MODE, certs[0].getPublicKey());
    return cipher.doFinal(plaintext.getBytes());
}

private static String decrypt(byte [] ciphertext) throws Exception {
    KeyStore keyStore = getKeyStore();
    PrivateKey privateKey = (PrivateKey) keyStore.getKey("oaep",
            "oaep".toCharArray());
    Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPwithSHA1andMGF1Padding","BC");
    cipher.init(Cipher.DECRYPT_MODE, privateKey);
    byte[] cipherbyte=cipher.doFinal(ciphertext);
    return new String(cipherbyte);
}

When I am googling I stumbled upon this blog post; which says that the RSA+OAEP is vulnerable to “Manger’s attack”.

I wanted to know whether my code is effected with this vulnerability, if so how can I check that?
There are several PKCS#1 versions. Which version's implementation has been used in the bouncycastle and how can I get to know the exact version (2.0,2.1,2.2) of PKCS# 1?


texts: PBKDF2 with SHA-256/512 for low entropy input?

texts:
Is there any reason to use something stronger than SHA-1 with PBKDF2 if my input is fairly low entropy?  I.e. if the passwords being hashed are only about 30-bits of entropy.

I can't find it now, but someone stated if you want to preserve the entropy of high entropy intput, then use PBKDF2 with a higher SHA.  So I'm wondering if the inverse is true, that there is no real gain to using SHA-512 if your input is low entropy.

I've seen one case mention that using SHA-512 would increase the memory requirements for attackers.  In some cases, I know that increasing memory requirements will make GPU hashing less effective.  Not sure if that's true in this case.  https://cryptosense.com/blog/parameter-choice-for-pbkdf2/


texts: Will the complement of a 64-bit key and message produce the complement ciphertext if ECB is used in DES?

texts:
Say I have a 64-bit message/key:

P1: 1011.......
K1: 0101.......

I run this message/key pair through DES in ECB mode and obtain some cipher that looks like the following:

C1: 1001.......

Now I take a new message/key pair that is the bitwise complement of the first and put it through the same algorithm:

P2: 0100..........
K2: 1010..........

Will it produce the complement ciphertext?

C2: 0110..........

I'm assuming it will due to ECB's deterministic property, but can anyone verify?


texts: Verification of identity by certification authority

texts:
I have question about how a user's identity is verified by a Certification Authority.

As I understand it, the process works as follows:

User generates his private key and (with the help of private key) generates his public key.
Now user want to register his public key. For this, he has to send the public key to CA.
User send Certificate request to the CA.

How will the CA know the user's identity for registration?

Can someone please explain it mathematically?


texts: Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?

texts:
I have seen in many papers and even in communications from NIST that the ongoing standardization is a "procedure" or a "process". They carefully refrain from using the term competition like AES. I was wondering what is the reason for this? Is there any functional difference on how this process is conducted?
Thanks in advance.


texts: I realize servers such as Google, Yahoo,  which use RSA has 2048 bits public key. After comparing those keys, I realize that the public keys share a common property, that is first 9 bytes and last 5 bytes are always the same. Since those public keys have 270 bytes altogether, this means there are only 256 useful bytes, which is 2048 bits. Is this 2048 bits of key secure? I google online and found that it takes a very long time to break 2048 bits of key as mentioned here. But I am not convincing enough. Can anyone explain to me?


texts: Service match-up over encrypted channel by hashing service description and session ID?

texts:
I'm trying to set up a 'view anywhere' telemetry service over a WebRTC RTCDataChannel with on one end a browser and on the other end an embedded system using libdatachannel. The encrypted peer-to-peer part of the session is based on DTLS-SRTP, which means it's established using two self-signed certificates, (seemingly) randomly generated per session. Standard authentication is done by a trusted third party verifying both peers. I would like to instead do mutual authentication for two reasons: 1. To not be dependent on an external server needing to be aware of all service types and 2. to allow multiplexing multiple services which can be negotiated and authenticated on demand.
The fingerprint of the self-signed certificate can be accessed both in the browser and client, giving two unique session IDs for peers A and B.
Peer A would create a hash for each [service description (a string / collection of) + it's own session ID] and sends those hashes to peer B.
Peer B would send a similar hashes generated with it's own ID.
Peer A creates a list of hashes for it's services, but now based on B's ID and compares this with the hashes received to determine which services should connect.
Peer B does the same.
The service description would be more or less a pre-shared key, but on service level.
Example use-case: An embedded computer / PLC managing a machine (A). It would offer 3 services: (1) A stream of sensor data, (2) a video feed and (3) an input stream for control commands. Some viewer, peer (B) would have the proper service descriptors for only (1) and (2), but not (3). Preventing control while allowing viewing. Another peer (C) would have access to all three.
Is above scheme foolproof enough to ensure neither party is an imposter?


texts: I have read about Feistel network and so far only advantages have been listed. Are there any disadvantages to the design? Please could you explain in fairly basic terms?


texts: How to derive a key from an existing AES key?

texts:
Currently, the code I am staring at uses the CKM_EXTRACT_KEY_FROM_KEY mechanism.  That has been disabled in our hardware module, so I need a different mechanism to derive a new key from an existing aes key.  I don't want to change too much code as I don't know what the ramifications will be.  I could use C_CopyObject, but that is no more secure that the mechanism it would replace, from my very limited understanding of crypto stuff.

What alternatives exist to derive a key from an existing AES key?


texts:
The wikipedia page about sha-2 states:

  Currently, the best public attacks break preimage resistance for 52 out of 64 rounds of SHA-256 or 57 out of 80 rounds of SHA-512

How exactly is the sha-256 algorithm with fewer rounds defined? I am wondering in particular about the message schedule array $W$, since in round $i$ of the $64$ round sha-256 algorithm, $W[i]$ is accessed. Does 52 round sha-256 simply ignore the elements $53..64$ of $W$?


texts:
I've seen a lot of 2-party applications that derive a shared key from distinct keys created by each party.

Why is this technique employed? Would it not be better to use those two distinct keys for each party (where both parties know both keys, but each key is used to encrypt and decrypt the messages of the party who created it)?

As an example, I've seen socket servers that use this. Assume 2 servers are running. Both servers send a random 256-bit key, encrypted with the other's RSA public key to each other. This leads to 2 distinct keys that both servers now know. Then both servers XOR these two keys together to derive a common key. Why this is done instead of using both keys in the way I described above?


texts: Is using the same IV in AES similar to not using an IV in the first place?

texts:
So if I understand how an IV works with AES, I'm supposed to generate a different IV for every message because using only a key, I will get the same encryption if the message was encrypted twice (which is not secure) thus we use the IV which is some kind of a salt (some random bytes added to the encrypted message so 2 messages with the same value won't have the same encryption).

Now my question, is using the same IV for all of my messages the same as not using an IV at all? Or is it slightly better?


texts: Using variable length CBC-MAC, can some block cipher with a fixed k be used as a cryptographic hash function?

texts: If a variable length CBC-MAC is used with a block cipher (a.k.a. pseudorandom permutation), does there exist a block cipher such that implementation of this CBC-MAC may be used as a cryptographic hash function, provided that k is fixed?


texts: Diffe-Helman Exchange result is always 1

texts:
I watched a video on Khan Academy explaining the Diffe-Hellman exchange. When I try to do an example problem, I get 1 all the time. Does the generator and prime modulus (or base on Wikipedia) have to somehow be related for the key exchange to work?

Here is my example:

Generator: 47
Prime modulus: 23
Alice's private number: 6
Bob's private number: 19

Alice's public number: 47^6 mod23 = 1
Bob's public number: 47^19 mod23 = 1

Shared number: 1^6 mod23 = 1
Shared number: 1^19 mod23 = 1


texts: Does the discrete log assumption hold if k > p

texts: In discrete log cryptosystems like ElGamal it is noted that the "private key" $k$ should be chosen as any element of the group $G$ i.e. $k < p-1$. Does the integrity of the cryptosystem rely on $k$ being an element of the group or can it be larger as well (always assuming that $g^k \bmod{p}$ will be published in the public key)? If yes, can it be any arbitrarily selected number larger than the group?


texts: Simulation-based proof in a particular scenario

texts:
Suppose we have a two-party protocol in the semi-honest model, which is based on an additive homomorphic cryptosystem like Paillier.(P2 will generate the public and private key and publish the public key to P1)

P2 will compute $R_1, ..., R_n$ using some operations and then send the vector $V=(R_1, ..., R_n)$ to P1. Since P1 has access to the private key, it will decrypt $R_1$ up to $R_n$.

In case where P1 is corrupted, to simulate the received message $V=(R_1, ..., R_n)$, is it suffice to just consider $n$ different dummy values and then encrypt them using the public key in order to make indistinguishable values? Or, when we want to prove the security in this case, we should necessarily show the operations P2 performed on its side? (I mean whether it is important to demonstrate how the simulator has reached to these dummy values($R'_1, ..., R'_n$)?


texts: Any advantage of multiple salts/keys for single password when using PBKDF for multiple secrets?

texts:
Background: I'm putting together a personal project to store multiple short message protected by a master password. This is more to learn and demonstrate that I understand how to use some standard cryptographic primitives than for practical use.

I am using HMAC_SHA256 inside a standard pbkdf2 function (part of OpenSSL). I have ended up with a choice between two designs for data model when it comes to deriving an AES key from a master password:

Store a pbkdf2 salt for each message, and derive a different AES key for each one.
Store a single pbkdf2 salt for the whole database, and derive a single AES key used for all the messages.

I am using a cryptographic RNG for salts and for initial values in AES 256 CBC. I store the salts and ivs in the clear in the database, the threat model is attacker has copy of all encrypted text, salts and ivs, but not the master password. Attacker is not able to request encryption, but they may observe any existing encryptions and may correctly guess one or more plaintexts.

As far as I can tell, both schemes have the same level of secrecy for the data at rest. The use of random initial values and the short messages mean that there is no real need to have a different key per message. There is no known plaintext attack that could take advantage of the fact that the key is shared in scheme 2. Both schemes support re-keying without changing the password, although I don't think that is particularly useful.

I think scheme 2 offers some advantages in performance - the costly pbkdf2 is only used once for multiple messages. It doesn't make brute-forcing the password any easier. It does mean ignoring the password and brute-forcing the key is potentially more damaging, but I think that is entirely unrealistic for AES 256, and that the password is the most vulnerable to attack secret in my project.

Have I missed anything? Is there some additional reason why I would choose one approach over the other?


texts: Noisiest RF band for random number generation

texts:
I've been looking into the difference between PRNGs and proper RNG techniques. One that I particularly like is the idea of tuning a radio to a certain frequency and bandwidth and just listening to the noise. Every so often (or continuously) pick a sample out of the noise and build a random number out of the samples.

There are a few obvious frequency ranges to avoid for this purpose:

Actual AM/FM radio stations (very predictable, not noisy at all)
TV stations (as above)
Protected RF bands (government, cellular, etc)

Based on noise-generating natural (and digital) phenomena, my question is: what frequency ranges are likely to be the noisiest and thus carry the most entropy for the purpose of a true random number generator?


texts: How to prove identity without revealing identity

texts:
Let us say Alice publishes a book under the name of Claire. The book becomes wildly popular and now Bob comes along, claiming to be Claire, to reap all the success. How does Alice prove that she wrote the book (and Bob did not) as Claire without revealing that she is Alice? More specifically: what information can she include in her book to be able to later prove this?

I came across "zero-knowledge proof of knowledge" which sounds relevant, but I am not familiar enough with cryptography to understand if this is what I am looking for.

Also, can you point me to any usable implementations of such a scheme?


texts:
Suppose implement the Shamir secret sharing as following: we select a degree $d$ polynomial $P$ with a zero coefficient of 0, and all other coefficents selected randomly from $Z_p$; and to this polynomial $P$, we add the secret as a constant term $Q = P + secret$.  If we use $Q$ as the polynomial in our Secret Sharing scheme, this is precisely equivalent to Shamir's scheme.

Now my question is : what if we multiply instead of add?  That is, what if we select $P$ as above, except with a random 0th coefficient as well, and compute $Q = P \times secret$? This  makes the original polynomial recover harder, but my main concern is about the (semantically) security of the scheme.


texts: Given a ciphertext $c$ and a public string, how do we check whether $c$ encrypts something that is roughly equal to the string without decryption?

texts:
Let $$ be an encryption function, then we have $c = f(m)$ for some bit string $$. Here, we also have pattern matching function $(,′)$ which returns true whether $$ matches roughly with $′$ in terms of some criteria. Given $$ and $′$ (some public string), we want to clarify whether $$ encrypts $$ such that $(,′)=$ without decrypting it.

How can we do that?
I'm not looking for solutions based only on homomorphic encryption since the result will never be revealed without decryption.

Does ZKP help this?


texts: Is CAST5 still a secure algorithm to use?

texts:
I just installed GnuPG for Windows. The documentation says the default symmetric cipher is CAST5. In PGP also, default cipher was CAST5.

Is CAST5 secure to use? Any known attacks reported on this algorithm?


texts:
I came across this question regarding the security of Quadruple DES (hypothetically DES done four times) in CBC encryption mode vs security of AES-128 in CBC encryption mode.
What parameters help to decide the security, assuming 4 different keys (or other case with k1, k2, k3, k1) so the key length would be 224bits (3DES provides 100-bit security level) vs 128bits for AES.


texts:
I'd like to understand a bit more about the AES key schedule if anyone would mind explaining that. For instance, why is the way the schedule generated (with recursive xors and occasional substitutions) more secure than say, using pbkdf2 on the key, then using it on the result, and on until there is enough data?

The reason I ask is because I'd like to experiment with an extended AES implementations, with more rounds, but need to devise a way to generate the extra sub keys.


texts: How to identify RSASSA-PSS from rsaEncryption OID?

texts:
Following the RFC 8446 it states that:

  RSASSA-PSS RSAE algorithms:  Indicates a signature algorithm using
        RSASSA-PSS [RFC8017] with mask generation function 1.  The digest
        used in the mask generation function and the digest being signed
        are both the corresponding hash algorithm as defined in [SHS].
        The length of the Salt MUST be equal to the length of the output
        of the digest algorithm.  If the public key is carried in an X.509
        certificate, it MUST use the rsaEncryption OID [RFC5280].

And from RFC 4055 it's stated that:

  The rsaEncryption object identifier continues to identify the subject
     public key when the RSA private key owner does not wish to limit the
     use of the public key exclusively to either RSASSA-PSS or RSAES-OAEP.
     In this case, the rsaEncryption object identifier MUST be used in the
     algorithm field within the subject public key information, and the
     parameters field MUST contain NULL.

It got me confused when trying to verify certificate signature, how can I know which algorithm was used if the OID is rsaEncryption and furthermore with what hash? (PSS or not)

Because the params field is NULL, and there's only the OID info, so from where can I derive the relevant information such as signature and hash algorithm with it?


texts: How many times does a hash function have to be evaluated?

texts:
I have the following homework assignment:

  $n$ is an even number, $1^n$ and $0^n$ are $n$-bit strings and $x$, $y$ and $z$ are arbitrary strings of length $n$.

  How many evaluations of hash function $h= does solving the following evaluation require?

  $$h(1^n || h(x) || h(y) || h(x \oplus y \oplus h(y \oplus h(y)))) = h(0^n || h(z)||0^n||0^n)$$

I know it requires $n^{(n/2)}$ executions to find a collision. Within the outer hash functions, there are 4 distinct hash evaluations.

Am I correct in assuming the answer is $4 \times n^{(n/2)}$?


texts:
I am trying to do some ElGamal encryption but having a different encryption formula.
For that I doing the following steps:
The key generator:

Choosing value $p = 107$ and $a = 2$
Random number $d = 67$, and $b = a^d \bmod p$ where $b = 2^{67} \bmod 107 = 94$
$k_{priv} = 67$ and $k_{pub} = (p,a,b) = (107,2,94)$

Encryption

Random value $v = 45$ and $C_1 = a^v \bmod p = 2^{45} \bmod 107 = 28$
We have the message $m = 66$; $C_2 = m \cdot b^v \cdot a^v \bmod 107 = 66 \cdot 94^{45} \cdot 2^{45} \bmod 107 = 38$
Finally, $C = (C_1, C_2)$

My problem comes when I try to decrypt the message, maybe I am totally wrong. But I am doing:
$C_1 = a^v$
$C_2 = m \cdot a^v \cdot (a^d)^v$
$C_2 = m \cdot C_1 \cdot (a^d)^v$
I trying to do that is where I am a little bit lost. If someone can help me with a clue to decrypt the message I would be nice


texts:
Currently I'm developing an application where users generate their own pair RSA keys in order to achieve a secure communication with my server. Also clients are able to communicate directly, sending signatures (proving authentication, as PGP does), therefore I cannot use Diffie-Hellman for this scheme.

Indeed, I'm aware of some techniques of storage of private keys. I thought on enciphering them with AES-256 asking the user an alternative password since using their personal/client password could be a risk if my server gets compromised and the attacker counts with clients private key's ciphertext somehow.

I was thinking about https://en.wikipedia.org/wiki/Zeroisation. Just decipher the ciphered private key and delete it from memory when not needed. Also I read some info about TPM, but I'm afraid this only concerns cryptographically secure hardware equipment and other devices based on vendor's signature verification before booting (maybe I'm not right with it).

I would want to know which is the "best way" for storing private keys in the clients computer, because I cannot store them in my server.


texts:
I have a CKKS ciphertext containing [a, b, c, d] and I want to get these 4 ciphertexts : [a, a, a, a]; [b, b, b, b]; [c, c, c, c]; [d, d, d, d].
Is there a more efficient way than repeating the following process for each slot:

multiplying it with a binary mask [1, 0, 0, 0] to obtain [a, 0, 0, 0]
(rotate & add) 3 times each the multiplied ciphertext to get [a, a, a, a]

I was advised to look at multiplication with a specific polynomial, do you have some ideas ?
Thank you in advance
NB: I called it ciphertext extension as I didn't came up with a more precise term.. :/


texts: Understanding Lindell's proof of (semi-honest) oblivous transfer

texts:
In Lindell's tutorial "How to simulate it" [2016/046], section 4.3, he gives a semi-honest protocol for oblivious transfer, based on enhanced trapdoor permutations and a corresponding hard-core predicate. I don't understand some details in the proof and hope somebody can explain it to me.
He gives the following definition: $B$ is a hard-core predicate of a trapdoor permutation $f_\alpha$ if:

for every non-uniform PPT adversary $A$ there exists a negligible function $\mu(n)$ such that for all $n$:
$$
\Pr[A(1^n, \alpha, r) = B(\alpha, f_\alpha^{-1}(S(\alpha; r)))] \leq \frac{1}{2} + \mu(n),
$$

where $\alpha$ is an index in the collection of functions $\{f_
\alpha\}$ and $S$ samples (almost uniformly) in the range/domain of $f_\alpha$.
Protocol 4.2 computes OT-functionality $((b_0,b_1), \sigma) \mapsto (\lambda, b_\sigma)$ as follows:

$P_1$ sends index $\alpha$ of a trapdoor function $f_\alpha$, where $P_1$ knows the trapdoor but $P_2$ does not.
$P_2$ samples random $x_\sigma$ and $y_{1-\sigma}$, computes $y_\sigma=f_\alpha(x_\sigma)$, and sends $(y_0, y_1)$.
$P_1$ uses the trapdoor to compute $x_0$ and $x_1$, then sends $B(\alpha, x_0) \oplus b_0$ and $B(\alpha, x_1) \oplus b_1$.
$P_2$ computes $B(\alpha, x_\sigma)$ and can therefore output $b_\sigma$.

Part of the proof of security (Theorem 4.3) constructs a simulator $S_2$ for corrupt party $P_2$ (the recipient), by showing that if you can distinguish the output of $S_2$ from that of $P_2$, you can use that to construct an algorithm $A$ that breaks the assumption that $B$ is a hard-core predicate, summarized as follows:

Algorithm $A$ [...] receives $(1^n, \alpha, r)$ for input. $A$'s aim is to guess $B(\alpha, S(\alpha; r))$.

However, there is no guessing because you can simply compute $B(\alpha, S(\alpha; r))$, right?
The final equation of the proof computes $\Pr[A(1^n, \alpha, r) = B(\alpha, x)]$, but it is unclear to me here what $x$ is in this expression (the preceding paragraph only mentions how to sample $x_\sigma$).
Given the definition of the hard-core predicate, I would have expected to see $f_\alpha^{-1}$ in this part of the proof.


texts: Is using Ed25519 parameters in ECDSA safe?

texts:
I recently discovered the Curve25519 key exchange lib and the Ed25519 signature lib. Due to the speculations about NIST-designed curves, there is a chance that I ditch them and use the curves above instead.

If I take the curve parameters from these two libs and use them in ECDH/ECIES and ECDSA respectively, will it be safe? If yes, is it as safe as if I used Ed25519 directly?


texts: Is it safe to generate two 256-bit ECC keys from 128 bits of entropy?

texts:
Apparently it is perfectly safe to use 128 bits of entropy to generate a single 256 bit ECC key. Can I use 128 bits of entropy and a KDF to make a 256-bit ECC key?

I assume this is because 256 bit ECC keys have a bit strength of 128 bits according to How many bits of entropy does an elliptic curve key of length n provide?

The first article linked above however stipulates that if more than one 256-bit ECC key was being generated from the 128-bits of entropy, there might be the possiblitity of a 'multi target attack'.

Consider the following scenario:

128 bits of entropy are passed through keccak-256 to generate a 256-bit ECC private key. A second ECC private key would then be generated by hashing the first 256-bit ECC private key.

Would this be liable to such a 'multi target attack'? If so, how would that attack work? Can this situation be resolved by increasing the initial entropy above 128 bits, and if so, how much higher would it need to be to allow for the two ECC private keys to be safely generated?

This question is applicable to Monero, where it is the case that 256 bits of entropy are used for a wallet's private spend key. That key is then hashed with keccak-256 to generate the wallet's private view key. The necessity of 256 bits of entropy has been questioned.


texts: Scheme to verify AES key was correctly encrypted for public key recipient

texts:
In our file sharing scenario there are three participants: $A$, $B$ and $C$. Each participant has a public-private key pair (let's assume RSA for now). $A$ wants to share a symmetric AES key $k$ with the other participants. $B$ is given access to the file for free, while $C$ has to pay a fee for it. Thus, $A$ may potentially cheat $C$ by providing a wrong key $k'$, and $B$ should be able to act as an arbitrator in case of dispute.

The sequence is as follows:

$A$ first shares the AES key $k$ with $B$ by encrypting it with $B$'s
public key and makes it available to $B$. Now $A$ and $B$ have access
to the symmetric AES key.
Then, $A$ shares the same key $k$ with $C$ by encrypting it with
$C$'s public key, making the ciphertext available to all
participants.
$B$ should now be able to prove that the ciphertext
provided to $C$ is indeed the key $k$ encrypted with $C$'s public
key.

This would be possible by using textbook RSA, where the ciphertext is deterministic. Since textbook RSA is insecure, this is not an option. I take it that this is similar to key escrow schemes/verifiable encryption, but I've been unable to figure out a scheme/crypto implementation for the proposed scenario.


texts: Is this algorithm demonstrating "proof of work"

texts:
Is this algorithm demonstrating proof of work? This is a algorithm where a "token" is combined with a time stamp and then a cryptographic hash is generated from the combination, next the objective is to find a token whose hash will collide with N digits of the timestamp+token hash.

This operation is computationally intensive and requires work by the client. The resulting token is time sensitive and expires. This could possibly be used to deter a denial of service attack. or other brute force attacks.

What is this algorithm called? Is something similar in use? is it a demonstration of "proof of work"?

Here is a demonstration of the algorithm in python.

import hashlib
import time
import os
import base64

# Number of digits that should collide
dificulty = 4
my_token = "nTDKIHbBus1O5cyebXQfFw=="
the_time = str(int(time.time()))
temporary_token = the_time+my_token

hash_stamp = hashlib.sha256(temporary_token).hexdigest()
collison_to_find = hash_stamp[:dificulty]
the_hash = ""

# Find a hash where the first N digits collide
while the_hash[:dificulty] != collison_to_find:
    # Generate a random token
    access_token = base64.b64encode(os.urandom(16))
    the_hash = hashlib.sha256(access_token).hexdigest()

print "temporary_token: ", temporary_token
print "access_token: ", access_token

This is the output

temorary_token:  1387573427nTDKIHbBus1O5cyebXQfFw==
access_token:  UwwSWGw14GK262rVPLPSOQ==

the first 4 digits of the token's hash will collide.

6095e4f38cd5f8e4581531fc29910614ecc54b8359ea8640bc5967d60ae1b043

609549c931eac0934d1fbb49d0dca7f2e4a621832251a8d786e60936a8761f41


texts: What is the main difference between anonymous authentication and using an anonymous credential?

texts: What is the main difference between anonymous authentication and the use of an anonymous credential? And when we should use them?


texts: OpenSSL: How to maintain padding from encryption after decryption?

texts:
One of my professors mentioned in class that there is a way of using PKCS#7 padding to have the padding persistent after decryption.

For example, if I encrypt a 20-byte file using

openssl enc -aes-128-ecb -in input.txt -out encrypted.txt -K 0123456789 -v

I obviously get the padded difference of:

bytes read   :       20
bytes written:       32

So 12 bytes of padding was added.

After decryption of the file, I want the padding to remain.

The only method I could think of was making the bytes in the original input.txt file the same character that PKCS#7 uses to pad, so that when it's time to unpad, it doesn't know what to unpad.  I haven't been able to find exactly which character it uses, or if it's not a character.  I've read some about the standard here and here, but with no real luck.

I'm still reading on it, but I haven't had any eureka moments yet.

An example of what I'm looking for would be if I gave it a 4-byte file such as:

AAAA

And it encrypted it, but added 12 bytes of C at the end, I'd want the decrypted file to be:

AAAACCCCCCCCCCCC


texts: How hard/easy will be to break a SHA-1 or SHA-256 hash if the attacker knows part of the original text?

texts:
I'm creating an algorithm to hash some text variables (20/30 characters long) to send them across an insecure channel. I'm not dealing with high security data, so no credits card numbers or any other very sensitive information.

The original text variable is composed like this:

{secret-client-code,public-random-code}

Then that is hashed and sent across the channel. However, the public random code is sent raw in the channel, so an attacker will know it. Does this make my hashing vulnerable to an attacker considering that the random code is about 30% of the whole variable? (I can change this if needed.)


texts: Statistical tests for PRNG that generates a sequence which is not binary

texts: Is there a pratical application to PRNG that generates a sequence which is not a binary one? A ternary, quaternary sequence, for instance. If so, how can we test this? Is there any alternative test suite, like NIST test suite in order to test the randomness for non-binary sequences? For example, what if I generate a sequence in modulo 255 and then use it to encrypt an image in one-time pad manner via adding the values of pixels by the generated sequence in modulo 255 ?


texts:
the answer to this question suggests that the x-coordinate of an ECDH shared secret is itself usable as an encryption key without apply a KDF....  if so, then what additional security is provided by the KDF???

i'm operating in a very resource-constrained embedded environment, where eliminating code normally used in a KDF (eg., SHA256) is critical...  i should also add that ECDH private key is generated from a truly random 256-bit seed....

i'm already using 128-bit AES-CCM for encryption/authentication....  perhaps i can use the AES engine in some manner to "hash" the shared secret if that is advantageous....

that gives me three choices to produce a 128-bit AES key from my ECDH shared secret:

use the secret's x-coordinate (trimming its size)
applying a SHA-256 hash
using AES-CCM for hashing (with some known key/IV)

what are the tradeoffs here and are there any other options worth considering???


texts: Why exactly Blowfish max key length is 448

texts: Could anyone, please, tell me history of birth of Blowfish algorithm? Specifically, what is substantiation of Blowfish key length to be in range from 32 till 448 bits? Why, for example, it wasn't 64-512 so it's minimal key could be 2 times shorter than AES and maximal key could be exactly 4 times taller than AES with 256 bit key?


texts: RSA PKCS#1 OAEP Padding Schema - padding 0 for first octet?

texts:
In this document, it shows the EM will have one zero octet padding prefixed.
                     +----------+---------+-------+
                DB = |  lHash   |    PS   |   M   |
                     +----------+---------+-------+
                                    |
          +----------+              V
          |   seed   |--> MGF ---> xor
          +----------+              |
                |                   |
       +--+     V                   |
       |00|    xor <----- MGF <-----|
       +--+     |                   |
         |      |                   |
         V      V                   V
       +--+----------+----------------------------+
 EM =  |00|maskedSeed|          maskedDB          |
       +--+----------+----------------------------+

However, in this document, page 37, it does not have this 00 octet.
For the standard (or the implementation of openssl) RSA PKCS#1 OAEP padding, which one (with 00 octet or without octet) is the standard/correct?
In fact, I've done the following tests:

I use RSA_public_encrypt(RSA_PKCS1_OAEP_PADDING) and find out the
max message length is 214, which should be yielded by 256-20*2-2(k - 2hLen - 2).However, per https://www.openssl.org/docs/man1.0.2/man3/RSA_private_decrypt.html, it mentions "EME-OAEP as defined in PKCS #1 v2.0" so I think it should be based on rfc2437. But the max length for rfc2437 is "emLen-1-2hLen", which is a conflict?

I use RSA_public_encrypt(RSA_PKCS1_OAEP_PADDING) to encrypt a
message(8 bytes only) and then use
RSA_public_decrypt(RSA_NO_PADDING) to decrypt it to see the output. I notice there always be a leading 00 octet padded. This suggests it is based on rfc3447(v2.1). I also have no idea about this.


texts: Truth table for the Boolean function $f(x,y) = x \oplus xy$ - Conflict with answer computed by sagemath

texts:
By hand, I computed $f(x,y) = x \oplus xy = (0, 0, 1, 0)$ since, in ascending (lexicographical) order,
$f(0,0) = 0 \\ f(0,1) = 0 \\f(1,0) = 1 \\ f(1,1) =  0$
However, using the following code on sagemath
R.<x,y> = BooleanPolynomialRing(2)
B = BooleanFunction( x+x*y)
B.truth_table(format='int')

The answer is (0, 1, 0, 0). I tried with other Boolean functions of two variables and I'm getting different answers from what I calculate by hand. Another example is $f(x,y) = x$. By hand, the answer is $f = (0,0,1,1)$ but using sage, it is $(0, 1, 0, 1)$.
Is it that the order in which the bits are calculated is incorrect?
A few details for context
I'm specifically interested in the convention regarding Boolean functions. For example, there are tasks that ask to find the ANF of a boolean function given in the $f = (b_1,b_2, \ldots , b_n)$ where $b_i$ is either $0$ or $1$. In the textbooks I have checked, it is often assumed that these values are in ascending order.
In this answer, for instance, the truth table was calculated in ascending order


texts:
I have been working on a challenge i found on the internet. It is as follows:

  You've stumbled onto a significant vulnerability in a commonly used cryptographic library. It turns out that the random number generator it uses frequently produces the same primes when it is generating keys.

  Exploit this knowledge to factor the (hexadecimal) keys below, and enter your answer as the last six digits of the largest factor you find (in decimal).

  Key 1: 1c7bb1ae67670f7e6769b515c174414278e16c27e95b43a789099a1c7d55c717b2f0a0442a7d49503ee09552588ed9bb6eda4af738a02fb31576d78ff72b2499b347e49fef1028182f158182a0ba504902996ea161311fe62b86e6ccb02a9307d932f7fa94cde410619927677f94c571ea39c7f4105fae00415dd7d

  Key 2:
   2710e45014ed7d2550aac9887cc18b6858b978c2409e86f80bad4b59ebcbd90ed18790fc56f53ffabc0e4a021da2e906072404a8b3c5555f64f279a21ebb60655e4d61f4a18be9ad389d8ff05b994bb4c194d8803537ac6cd9f708e0dd12d1857554e41c9cbef98f61c5751b796e5b37d338f5d9b3ec3202b37a32f

These seem to be common RSA 1024-bit keys.

My approach to the problem was to implement Pollard's rho algorithm to find factors, then once a factor is found, try dividing the decimal form of the keys by that factor until it is not divisible anymore. Iterate.

Now, i used Pollard's rho and tried to divide until the key is not divided anymore because of the information the problem gave: the keys are not completely random.

But here comes the question: assuming the algorithm generates two primes and multiplies them to get a co-prime, which is the key, the low randomness doesn't help much, does it? I mean, even if both keys share a common factor, finding it the first time would take the regular-impractical-exponential time.

That seems to be the case, as my Python algorithm is running for about 5 hours now and has not found any factor to the second key, which i decided to start with.

As it is a challenge, i assume there is a practical way of finding the answer.
So what im i doing wrong? Is just the algorithm choice wrong, as Pollard's rho is intended mainly for integer with small factors? Is my assumption that i can only use the lack of randomness after i find the first of the four factor, to then try to break the other key with the same factor, wrong?

I would like if someone could just point me in right direction, instead of just giving the answer. Thank you.


texts:
I was implementing Fuzzy Extractor on two close (noisy data). It's straight forward to use it to reconcile two close sets as per implementation given in https://www.cs.bu.edu/~reyzin/code/fuzzy.html, given contents of set are decimal number because:
 1. It compares sets, hence position of numbers in set does not matter.
 If I have two binary sequence extracted from close secrets can I use this extractor to correct two close binary sequence, say 10% of bits are mismatching?

As per documentation of Pinsketch we cannot use $0s$. Since set matters,
$[10011]$ and $[01011]$ will match as contents are same except order of $0$ and $1$.

Papers like [LLYM17] report of using Binary bit stream but I cannot find how this implementation based on works of Dodis et.al can be used here.

[LLYM17]: Xinghua Li, Jiajia Liu, Qingsong Yao, Jianfeng Ma, Efficient and Consistent Key Extraction Based on Received Signal Strength for Vehicular Ad Hoc Networks, in IEEE Access 2017.


texts:
Let e be a bilinear pairing function and $g_1$ and $g_2$ be the generators of $G_1$ and $G_2$
Given $e(a,g_2^x), e(b,g_2^y), g_2^x,g_2^y$ is there a way to find out if $a = b$?


texts: Should a company ever implement a (recent) published cryptographic protocol

texts:
I understand that you should never, EVER, EVER implement your own unpublished cryptographic protocols. This topic has been well discussed in many places, e.g. here.

However, once a protocol has been published, peer-reviewed and been around for a few years, what are the general guidelines about implementing this protocol for yourself?

The general advice I've heard is don't. (e.g. SEJPM's comment to this question). Instead, use a pre-existing open source implementation that has been well reviewed such as SSL. But this has a few problems:

There may be restrictions on the use of such implementations.
Sometimes no implementation exists. The protocol may be only have been implemented 1-2 years ago, and no-one has got round to implementing it yet.
An implementation you find may also be faulty. Of particular concern, it is possible the authors may be aware of the fault (such as a backdoor).

And it seems that companies do implement crypto protocols without publishing the implementation, such as the product "Sharemind".

So, should a company ever implement a published protocol for a commercial product? And if so, what guidelines should they follow?


texts: Fixed size output hash from varying input

texts:
To begin with I need to say I have no experience in cryptography (I'm a software developer) and found this place trying to figure out how to solve this, Here is the problem I need to solve in my job:

Input: an integer varying from 1 up to 8 digits (i.e. 12345678, 2352, 76543)
Output: a fixed size 6 digits code that could contain any alphanumeric and symbols (a-z, A-Z, 0-9, !@#$%*()|-_=+^/?)
The operation must be reversible, so given a code it should decode back to the original integer
There's no need for the output code to be cryptographicaly safe

From my research I think I need some encryption algorithm to achieve this, but I couldn't find one that allow me to set the output size. Is it possible to be done?
I need to implement this code in NodeJS so any lib that could handle this job is appreciated


texts: What is the difference between SHA-3 and SHA-256?

texts:
I am new about cryptography,
I learned that SHA-3 (Secure Hash Algorithm 3) is the latest member of the Secure Hash Algorithm family of standards, released by NIST.

But I recently saw SHA-256 but I don't get what is it in comparison to SHA-3 ?


texts:
Newbie here, so forgive me if this is a stupid question.
In math class we learned about RSA encryption (as a practical application of what we learned about the Euler phi function and Fermats little theorem), and I wondered that since the same input always yields the same output, if eve had a couple of guesses for what the message is (for instance a yes or a no), she could try encoding them herself and compare that to the ciphertext. I googled how to get around this, and I gathered that a process can be non-deterministic, meaning it yields different results if done repeatedly. However, when I looked into how this was possible, I never really understood the explanations, they got really complicated really fast.

So what I'm asking is, can anyone explain fairly simply (high-school level math) how a ciphertext can be generated with an element of randomness, but still be decipherable. Surely the receiver can't easily undo those random changes, if the same message could come in in many different forms?


texts:
Let $f$ be a length-preserving one-way function, and let $\text{hc}$ be a hard-core predicate of $f$. Define $G$ as $G(x)=f(x)\|\text{hc}(x)$. Is $G$ necessarily a pseudorandom generator?

The answer is yes if $f$ is a pseudorandom permutation according to theorem 7.6 in the book. I am fairly certain that the answer is no if $f$ is no longer bijective. Intuitively, the first part of the string $G(x)$ is no longer uniformly distributed if we choose a uniformly random $x$, so $G$ should generally not be pseudorandom. However, I think it may depend on how far $f$ strays from bijectivity, as demonstrated by the following two extreme cases:

If $f$ were constant (taking a value $y_0$), then an obvious distinguisher would be the done that outputs $1$ if the first part of the string $G(x)$ is $y_0$. This has advantage $1-2^{-n+1}$, which is not negligible. The issue, of course, is that $f$ is clearly not a one-way function.
If $f$ misses precisely one point of its codomain, then there is some $y_0$ which is hit exactly twice. Then the distinguisher from the above example has advantage $2\cdot 2^{-n+1}-2^{-n+1} = 2^{-n+1}$, which is negligible. I can't think of a better distinguisher either.


texts: I am working on creating an RSA Algorithm and learned that OAEP is a padding scheme that is commonly used before encrypting using RSA. Is this step necessary? Will it harm the integrity/security of the encrypted text?


texts: Removing Padded Value in Decrypted Message

texts:
How to remove padded value in Decrypted Message?

I am using AES Algorithm.

Let's take this as the decrypted message:

"abcdefghijklmn  "

There is a 2 space in that decrypted message which is equivalent to 0x00.
how can I removed that value? during decryption to show the exact message before it was encrypted.

I am using ECB Mode, I know that ECB mode is not secured, but I only want to know how to remove padded value in my decrypted message.


texts: What are the prerequisites for understanding Lattice based Cryptography, LWE or RLWE based on SVP?

texts:
I'm new to Quantum Resistant Cryptography, so, I thought of diving into Lattice based crypto, LWE and ring LWE. I realise that the hard problem involving them is the "shortest vector problem". But I don't understand why it is a hard problem, or comprehend its hardness. The only sources that I can find on the internet, speak language that only advanced mathematicians/computer scientists can understand. Currently, I only know of Lattices from Linear Algebra and also, I realise that we are working on descrete fields.
It would be kind, if someone, could show me sources, or explain how LWE, or RLWE  works, and why the problem is hard for both Quantum as well as Classical computers. I would love to build a solid foundation on the understanding of this new crypto, and I hope this post will serve as a starting point for many beginners interested in Lattice Based Cryptography.
Every help, answer, advice or comment will be greatly appreciated!


texts:
Is there a definied keysize to be used with the "AES_256-CBC" method in PHP, and what is the size?

Some background:

I want to store encrypted text into a PostgreSQL database. The user who posts the data has a key (stored in db) which gets appended to a generic private key hard coded in the library.

$key = $genericKey . $userKey;

The used encryption method is "AES-256-CBC" with an iv_size of 16. The IV gets prepended to the encrypted string

$return = $iv.$encrypted

This is then stored in the database.

It appears that if I produce an extremely large generic key, then store some data with $userkey1, and then decrypt it with $userkey2, the data just gets decoded. If I rerun it with a small generic key and small user key, it does not get decoded. To me, it looks as if the big key gets truncated somehow.

Could someone confirm this and tell me what the max keysize is? What is the best-practice to make sure the set key doesn't exceed the key_size* E.g.: md5($key) because this produces a "fixed" amount of characters.

update

Because apparently php has its own implementation of the AES, this is the way I implement it in my own Class:

class Crypto {

function __construct(){
  $this->iv_size = 16;
  $this->sleutel = 'somelongkey';
  $this->encryptionMethod  = 'AES-256-CBC';
}

    private function encrypt($str){
 $sleutel = $this->sleutel . $this->userKey;
 $iv = $this->generateRandomString($this->iv_size);
 $cipher = openssl_encrypt($str, $this->encryptionMethod, $sleutel, 0, $iv);
 return $iv.$cipher;
    }
    public function decrypt($data){
        $iv = substr($data, 0, $this->iv_size);
 $sleutel = $this->sleutel . $this->userKey;

        return openssl_decrypt(substr($data, $this->iv_size), $this->encryptionMethod, $sleutel, 0, $iv);

    }
}


texts: How to implement correctly an Integrated Encryption Scheme?

texts:
I am developing a REST client (from an Android Point Of Sale) where I'm given a public RSA 2048-bit key and I need to encrypt transaction information. Since that single block cannot be encrypted (and AFAIK it should not) with the public key, we need to encrypt it using AES 128-bit. So we generate a random key (using KeyGenerator class), encrypt the info and send the AES key encrypted under their public key. AES is in ECB mode for their requirement which I know is insecure.

So the question would be: what pitfalls (apart from ECB) this method has?

My idea was to implement a kind of ECIES (but without Elliptic Curve) where a key derivation function is used (altough I'm a noob and don't know how to implement it) and using an authenticated encryption method like AES-GCM.

To extend the question I will like some context as I think I have sparse information and need to "connect altogether".


texts: Authenticated EC key exchange without a signing/signature scheme?

texts:
From my little understanding of EC-based authenticated key exchange protocols,  I believe that it is not possible for authenticated key exchange without a signing/signature scheme. Is this correct?
Consider a scenario where neither client nor server have any certificates, and server has the pre-shared secret of User/client. In this scenario, what is the technique/protocol for using ECDHE-based authenticated key exchange?


texts:
According to this page, Edward's curve point doubling can be represented in a different way by assuming $c=1$ and $d = r^2$.

It then says we can represent $x y$ as $Y Z$ satisfying $r\cdot y = \frac Y Z$

I am a bit confused. How would I then calculate the $x$ coordinate? For example, they have provided the following explicit formula:

YY = Y12
ZZ = r*Z12
V = s*(ZZ-YY)2
W = (ZZ+YY)2
Y3 = W-V
Z3 = W+V

So after obtaining $Y_3$ and $Z_3$, how would I revert back to affine coordinates and calculate $x$ and $y$?


texts: What was used for symmetric message authentication before HMAC was invented?

texts:
Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else?

I know about NIST FIPS 113 "Data Authentication Algorithm" which was CBC-MAC with DES as the block cipher, from 1985. Was that actually used? Even if yes, what was used before 1985? When did people start using a MAC, and how did that early MAC work? (I think Enigma didn't have a MAC, right?)


texts: Is there a concept of Pedersen commitment "in the base"?

texts:
This question Can Elgamal be made additively homomorphic and how could it be used for E-voting?
says ElGamal can be made homomorphic over multiplication. So you can have $(g^r, h^r g^m)$ (i.e., encrypting $g^m$) vice $(g^r, h^r m)$.
Then in this question Difference between Pedersen commitment and commitment based on ElGamal they point out that the Pedersen commitment looks a whole lot like the second item in the tuple.
So of course I wonder:

Is there a version of Pedersen where you just commit to a base, and will it be unconditionally hiding? I.e. is $P = u h^r$ a hiding commitment for the value $u$?
I know that taking a variation on Schnorr's protocol, you can prove you know the opening of a commitment $g^mh^r$. If the answer to the first question is yes, is there a variation where you can prove you know $u, r$ from commitment $P$? I think the answer is yes, if you just do the appropriate shift from exponentiation to multiplication to addition but I don't know if there is any security issue which would crop up as a result.
Finally, what groups would this work for/does the security assumption remain the same? I believe regular Pedersen just requires discrete log to be hard (so I was thinking $\mathbb{Z}^*_p$ for the generator where $p$ is a prime). Would that still work?


texts: Finding repeated groups of letters in the Kasiski examination

texts: While doing the Kasiski examination I came to a problem. If there is the following group of letters in the cipher: AA and later on a group AAA is found. Does it count as two repeats or just one? And if one, then when does it start, with the first A or with the second?


texts: CAESAR finalists: Lightweight case (Ascon vs ACORN)

texts:
The Ascon cipher has been selected as the first choice in lightweight case and ACORN as the second. However according to Face-off between the CAESAR Lightweight Finalists: ACORN vs. Ascon paper, the winner of the face-off is ACORN.

They mentioned that

ACORN-1 and Ascon-small have 18% and 74%, respectively, the area of AES-GCM.
ACORN- 32 and Ascon-large are 23.3 and 2.5 times faster (respectively) than AES-GCM.
ACORN-1, is the most efficient side-channel resistant CAESAR lightweight finalist, in terms of low area, power, and external randomness

Question: What are the strengths of Ascon over ACORN?


texts: Soft question: What are examples of beautiful proofs in cryptography?

texts:
These may include any proofs, reductions, constructions, etc. For example, simple solutions to problems which at first sight seem difficult. Elegant construction that hide deep mathematical concepts, but once presented are easy to use.

Anything which you deem elegant and clever.

Proofs with nice graphics are especially welcome.

(preferably ones that can fit reasonably into a StackExchange answer).


texts:
From what I understand after testing the Crypto-JS file here:

http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/aes.js

AES creates encrypted strings that contained letters, both capitalized and lowercase, as well as numbers, division characters, addition characters and equal sign characters.

Do AES encryption strings only contain the characters mentioned above, or can they contain any character from UTF-8?

Thanks in advance. I know this question might seem a bit dumb, but I haven't been able to find the answer after online research.


texts: How well analyzed are giant block length ciphers?

texts:
I have heard about ciphers that have a block length of 256 megabytes... That is huge.
How well are they understood  by the encryption community?
I'm referring to PMC Ciphers.

Has anyone used such a cipher in a real world application?


texts: Are there benefits for using Static Diffie-Hellman over Ephemeral Diffie-Hellman?

texts:
TL;DR - Are there any benefits to using static DH over ephemeral DH?

I'm reading about the differences between static DH & ephemeral DH  and I am trying to think of one logical reason to use static(-static) DH over ephemeral(-ephemeral) DH.

My understanding of DHE is that it provides Forward Secrecy which is something we want, is it not? FS ensures that if the server private key were to get leaked past communication would be secure correct?

So why would we still want to use static DH? Are there any benefits to this? I would presume that computation is perhaps one factor?


texts: Knowing you can combine 2 signatures, Is it possible to remove part of the signature?

texts:
Since my last post I've been more interested into RSA cryptography, but I'm questioning one thing.

Lets say we are using standard textbook RSA with no padding and with the standard signature generation in lets say the Microsoft crypto API and you got the part you want to remove by itself is it possible to remove that from another signature with the same thing on the beginning or end?


texts: Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

texts:
As you may know, PKCS#1 defines two different padding in it's v1.5 : one for signature and one for encryption. Here they are :

The middle part is refered as PS in the standard.

There is only one thing bothering me : why does PS differ between signature and encryption ? I can't see any reason ti fixe PS to a '0xFF' string for both padding.


texts: Find prime $p$ such that $a^x\equiv b\pmod p$ for many $x\in[1,p)$

texts:
Given haphazard large integers $a$ and $b$ (like few thousand bits), can we efficiently find (and how) some integer triplet $(p,x,k)$ with

$p$ a large prime (like a thousand bits)
$a^x\equiv b\pmod p$
$k$ sizable (say of 10 bits or more if possible) and dividing $p-1$
$a^{(p-1)/k}\equiv 1\pmod p$

These conditions match the title, since $x_j\gets j\,(p-1)/k+(x\bmod((p-1)/k))$ gives $k$ distinct $x_j\in[1,p)$ with $a^{x_j}\equiv b\pmod p$.

Late addition: in a variant with reduced applicability, one of $a$ or $b$ would be an output instead of a given, with the constraint that it should be unremarkable modulo $p$ (at least not among $0$, $1$, $p-1$) when the other is haphazard.


texts:
I am trying to understand Ethereum's hash algorithm Keccak. Keccak uses permutations in the hashing process. Could anyone explain me what this permutation looks like or how it works ? I only know permutation from mathematics, is it the same here?
A permutation of "abc" is: abc, acb, cab, bac, bca, cba
Is the same logic applied in Keccak?


texts: How to perform a known plaintext attack?

texts:
I have got the following documents:
(1) The plaintext
(2) The ciphertext
(3) The python program used to encrypt/decrypt the text
My goal is to find the key that was used to encrypt the plaintext into the ciphertext. I have tried using pkcrack on my MAC OSX machine (which took a few hours to run), however that failed and the key was not identified. I was thinking that there may be an alternate way considering I have the python code that was used to encrypt the text. For reference, it is not possible to brute force this key (well, at least not recommended)
Thank you!


texts: how to decrypt AES CBC 256 : while you have the Key and the IV

texts:
I've been working on a forensics challenge , and I'm in the last step , i have an AES CBC 256 encrypted string and i need to decrypt it .. is there's and well known tool , or a script of some kind 'python' or 'C' ?

and if there's other resources to learn about this specefic type of encryption

note : i find a python script for the AES but it doesn't include the CBC "IV"

this is what im trying to decrypt ..

  KEY = 7869686966766E6C6F697570756E707100000000000000000000000000000000

  IV = 6C7579796E6171726E7371627368616C

  Encrypted data: N3xlOTgnywpPupc1VXbP9FbOXb1pK+S+CzQOo4KtqGz/hVMQ6ki6rNoBkKik733j


texts: Any algorithm with a master key for decrypting private key encrypted messages?

texts:
Are there any algorithm out there that implements following scenario?

Create a master private key
Create a private/public key #1 based on the master key
Create a private/public key #2 based on the master key
Encrypt data #1 with public key #1
Encrypt data #2 with public key #2
Possible to decrypt data #1 with both private key #1 and master key
Possible to decrypt data #2 with both private key #2 and master key
Impossible to decrypt data #1 with private key #2
Impossible to decrypt data #2 with private key #1


texts: Retrieving ElGamal message with negative exponent value

texts:
Although the ElGamal scheme states that the message $M$ must be $1 \le M \le p-1$ in this paper: A Secure and Optimally Efficient
Multi-Authority Election Scheme they propose a method where the message can be $-l \le M \le l$ where $|\ l\ | \lt p/2$. This is stated in page 9.

The idea behind the paper is that for 2-way voting system the available options are encoded as $m_0=1,\ m_1=-1$ and when doing additive ElGamal the result could possibly be $g^{-4}$ or any negative exponent.

I know that for computing the message in the final stage of ElGamal we execute a loop for each possible value of $M$ but in this case, although this is what the paper proposes as well, I don't see how it is done.


texts: Does "double RC4" exhibit the same weaknesses as standard RC4?

texts:
I know that RC4 is weak.  However, I don't know if two RC4 streams XORed with each other can be attacked in the same way that one can, especially if $n$ bytes are dropped.

Assume keys and IVs are independent and random.

(This is purely theoretical, I don't plan on using it in practice).


texts: Symmetric key as proof of ownership of a session?

texts:
I have a question, or rather multiple questions that all relate to the same topic.
I am building an application with both a frontend (FE) and a backend (BE). All communication between FE and BE is protected with TLS. The BE contains an endpoint on which the frontend can register a new session. When setting up such a new session, a few things happen:

FE sends a request (TLS protected) to BE, sharing a Curve25519 public key from a freshly generated Curve25519 keypair.
BE receives this request. Creates a new Curve25519 keypair, uses HKDF to calculate a shared secret (using as input FE public key, BE private key and a salt) and ultimately create a new symmetric session key (ChaCha20-Poly1305)
BE creates a new 32-byte (256-bit) session ID and keeps it in memory together with the session key.
BE sends back the session ID + salt + public key from freshly generated Curve25519 keypair.
FE uses BE public key + salt + FE private key to calculate same secret and create the session key.

Again I want to emphasise all of the above communication (so the request + response) happens over TLS. For all future communication, FE will encrypt all requests using the session key. The encrypted request is encoded to base64, and put in a JSON request body together with the unencrypted sessionID:
{
    "sessionID": "SomeString",
    "encryptedRequest: "base64 encrypted request"
}

These requests are then send (along with the unencrypted session ID) over a TLS connection, resulting in double encryption. When BE receives these requests, it will lookup the required session key by using the provided session ID. Then, it will decrypt the encryptedRequest field and forward it to the appropriate endpoint.
Some questions I have with this setup are:

Because all requests are encrypted with the session key, can that act as a form of proof that the client is the real owner of the session ID? e.g. If the session ID somehow is stolen, it can still not be used to communicate to the backend as you still would need to have ownership over the shared secret.
How much added security does this setup give if for some reason the TLS connection is broken into? (e.g. due to MITM, or because the TLS-level encryption is broken)
Does this setup aid in API obfuscation? E.g. client-side you can install software that - prior to TLS encryption occurring - can inspect all incoming and outgoing traffic. For my application, they would only see requests that are already encrypted. Is it easy to work around this?

I'm curious about what you guys think. I've been experimenting a bit with these topics (i'm by no means a cryptography expert) and I would love to learn more.


texts: What if the hash code of the genesis block (first block in the block chain) is changed?

texts: If so, what would happen? And if not, what are some limitations to it? The reason I am asking is because I just started getting into the cryptocurrency and am very interested in the cybersecurity aspect of it. Also, it's important to mention I don't have much experience in either but am willing to learn. Could someone advise some books/articles/guides? Greatly appreciated!


texts:
I'm new to security stuff and I have some questions about the keys of transposition cryptography.

If I'm given the encoding key to a transposition cipher, how do I get the decoding key for it? I tried googling but couldn't find any steps on the calculation for it. For example, on several crypto-related websites there are these nifty tools where, when I enter 4 3 1 6 2 5 I would get 3 5 2 1 6 4… but why and how?


texts:
I read that AES can be broken by solving a Linear Integer Program (IP).

From a given encrypted text, how can one construct this IP?
How big is the system?


texts: How do you determine the recorded value of a cipher when using the shift key?

texts: I am taking a cryptography class and having a hard time understanding how to utilize Ceasar Cipher and how to determine the shift key values. Is it based on many characters are in the cipher or is it something different?


texts: Can a low density subset sum problem be intractable?

texts:
Hardness of a subset sum problem depends on it's density.

Is it possible for a subset sum problem to be intractable even if it's density is less than 0.9408?


texts:
Through my reading about the generation of one-time password (OTP) I found that there are many algorithms that generate OTP and they are either based on time such as TOTP or based on mathematical computation such as HOTP and S/Key.

The problem is they do not depend on some parameters to generate OTP.

What I would like to know is which one I can use to generate OTP using hash function and some session tokens (IP address, etc.).  These tokens will be used as parameters of the hash function. Of course, I would prefer options that are secure and hard to break.


texts: How to ensure that a "received value" is not altered?

texts:
I have a program (whereby people can download and run on their own computers) that will calculate a couple of unknown values each day. For simplicity sake, let's assume that the calculation is simply Rand(0, 1). The program will run and the user will get a value e.g. 0.230957203975.

He will then broadcast this value to anyone interested. He will say "my number today is 0.230957203975!". The problem is that the user can simply lie about the number.

How can we make it such that the user cannot lie? Or rather, how we can detect it if he lies?

I've came up with a solution, but it's sub-par and will be easily defeated. My solution is to broadcast the value 0.230957203975 along with a verification-value calculated as such:

verification_value = SHA2(MD5(RIPEMD(SHA2(HAVAL(GOST(MD5(0.230957203975)))))))

The problem is that the user can examine the machine code, and know the obscure mixture of hash functions used, enabling him to calculate the verification-value himself and lie about the number he had gotten.

I've browsed through Applied Cryptography, but none of the protocols mentioned there seems to have a solution. Is cryptography able to solve this problem?


texts: Easy explanation of "IND-" security notions?

texts:
There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security.

The most common ones are the "IND-" ones, advertising security against specific classes of attackers.
Now these notion may not be that well-understood by many people so I ask hereby for a canonical answer, that explains what the following security notions mean. A (simple) description of the formal attack scenario is preferred.
Please don't restrict the answer to "you can chose this and if you can break it with this it isn't IND-CCA2". Please at least outline the formal attack (like f.ex. real-or-random). Relations between the "IND-" are explained (f.ex. IND-CCA implies IND-CPA).
The notions in question are:

IND-CPA
IND-CCA
IND-CCA1
IND-CCA2
IND-CCA3


texts: Secure multi-party computation for digital signature

texts:
Is there any practical algorithm that will allow to use public key cryptography (RSA or ECC) in the following way

There are N parties. Up to M are malicious adversaries (were trusted, but got taken over silently). I will be happy with solution for any N and M = 1.
Parties can communicate securely. No eavesdropping.
Private key K is somehow split and shared between all N parties. Maybe something like Shamir's Secret Sharing. No party can recover K without other N-1 parties data.
All parties receive some data S.
Parties should be able to encrypt S (actually hash of S, I need digital signature) with K, but without revealing any useful information about K to malicious adversary; or should detect that there are too many malicious adversaries and abort.


texts: Chrome TLS 1.3 no TLS resumption with not secure connections

texts:
I am testing TLS 1.3 on a slower IoT device (120Mhz ARM). In my tests Chrome with TLS 1.3 will not allow TLS resumption (Session Tickets) when you have an not secure connection e.g. because of an user accepted self-signed certificate. Additionally you will see almost the doubled number of TCP connections when loading from the website that has an invalid certificate (wrong alternate name or root not trusted).

Has anybody an idea, if that is intended by Chrome? There is no TLS resumption problem with TLS 1.2, or Firefox TLS 1.3.


texts: Hardness of Short Interger Solution in lattices

texts:
Short Integer Solution ($SIS_{n,m,q,\beta}$) is defined as

Given a matrix $A \in \mathbb{Z}_{q}^{n \times m}$, find a non-zero vector $x \in \mathbb{Z}^{m}$ such that $A \cdot x = 0\mod q$ and $||x|| \le \beta $.

In paper Trapdoors for hard lattices and new Cryptographic Constructions, SIS is proved to be hard by reducing standard worst-case lattice problem approx. SIVP to SIS i.e., if we solve a random instance of SIS, then any instance of approx. SIVP is solved.

In paper On the complexity of computing short Linearly Independent Vectors and Short Bases in a lattice, approx. SIVP is proved to be NP-COMPLETE.

By this, can we say Short Integer Solution (SIS) problem in lattices is NP-Complete?


texts: Why would someone want a 20ns block encryption completion on a 1us bus?

texts: I was reading the NIST 8114 draft and there's an example of a profile, Sample Profile #2, that shows that 20ns (50MHz) for a block completion for encryption on a CANBUS.  The bus is serial and maxes out at 1us (1MHz).   Is there some standard somewhere that specifies a 20ns completion time for a block cipher?  I cannot figure out, from a hardware standpoint, where that 20ns came from.


texts: How can I implement the elliptic curve MOV attack myself?

texts:
I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves.

Even though I understand the mathematical notation and terms of group theory, I'm a programmer by trade, not a mathematician or cryptographer.  When I read descriptions of the MOV attack, though, I'm completely lost.  The notation and terms are way beyond anything I understand, so I have no idea how to implement MOV.

I understand what $F_p$ and $F_{p^k}$ are about.  I also understand that the idea is to make a function $e()$ of domain $F_p$ and range $F_{p^k}$ in such a way that sets up $x^y = z \pmod {p^k}$, where $y$ happens to be the scalar by which your generator point was point-multiplied.  Then, since this is a traditional multiplication modulo a composite with known prime factorization group, you can do index calculus to get y instead of being limited to slower methods that work on elliptic curve groups.

But how the heck do I calculate this $e()$ function?  I don't understand these "torsion point" and "div() function" concepts at all, especially not in a way that would allow me to write Python code to implement them.


texts: GCM mode GHASH sensitivity to timing attacks

texts:
In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary?

If the timing varies according to the AAD/ciphertext data, it looks as though that doesn't matter because that data is public anyway. But if the timing varies according to the GHASH key, does that reduce security?


texts: What about using AES-ECB with random IV?

texts: Let P1P2...Pn be n blocks plaintext, and M0 be a random IV. Then a n+1 blocks message M0M1...Mn can be constructed by setting Mi+1 = Mi xor Pi+1. Finally, we use AES-ECB to encrypt this message. Is it as secure as using AES-CBC?


texts: Transcript collisions and hash collisions in (password) key exchange protocol

texts:
In New Security Results on Encrypted Key Exchange, there is a Game 2 as follows:
Game $G_{2}$: For an easier analysis in the following, we cancel games in which some (unlikely) collisions appear:

collisions on the partial transcripts $((A, X^{*}), (S, Y))$. Note that transcripts involve at least one honest party, and thus one of $X^{*}$ or $Y$ is truly uniformly distributed;

collisions on the output of $\mathcal{G}$.

Both probabilities are bounded by the birthday paradox:
$Pr[Coll_{2}]\leq \frac{(q_{p}+q_{s})^{2}}{2q} +\frac{(q_{g})^{2}}{2q}$.
My questions are:

Why the authors design such a game to rule out the collisions of transcript and random oracle in this game? I do not know what is the meaning of this game?

Why the authors just rule out the collisions of random oracle $\mathcal{G}$ but not $H_{1}$ and $H_{2}$?


texts:
Basically the idea is to split a key into three parts ($key_a, key_b, key_c$) of which any 2 of the 3 parts can be used to recreate the original key

$key_a$: a random number smaller then our original key
$key_b$: another number which when added to $key_a$ will result in the original key
$key_c$: two components:

$xor_a$: xor of the original key and $key_a$
$xor_b$: xor of the original key and $key_b$

Is this a good way of splitting a private key into a 2 of 3 scheme?

Here's a Github gist showing a Python example of what I described above.


texts: Assumption of difficulty of attack in restricted short time

texts:
As well known, different assumptions of difficulty of some problems are used in provable security. E.g., if some crypto-scheme is breakable only in case the attacker finds preimages for hash function, we say that the scheme is as secure as preimage resistance of hash-function.
Imaging, that some hash function is not preimage resistant in general (e.g. it has not enough length, say only 64 bit). Nevertheless, it's obviously difficult to find preimages in short time (say 10 minutes). And imaging that we're able to construct a reduction that implies that successful attacker is able to find preimages in some short time, e.g. during some short session of protocol (e.g. some online key exchange which is abandoned in 10 minutes in case counter-party doesn't respond ).
In this case, the scheme should be recognized as secure based on 2 assumptions:

party controls time of sessions and discontinues a session after 10 minutes of waiting
hash function is preimage resistant within time 10 minutes.

My question is whether you know some research/papers which use such approach in provable security, i.e. they use such assumptions of form "preimage resistance in small time T", instead of conventional "preimage resistance in acceptable(polinomial) time"?
Concrete problem (preimage resistance or something else) doesn't matter obviously,
I'm interesting only in time-restriction.
And does this approach could be reasonable at all?


texts: Decryption with password, compiled code and ciphertext known

texts:
There's a program I'm using that downloads encrypted XML files to a user's computer that can be decrypted within the program with a provided password. I have the correct password for one of these encrypted XML files.

Basically my question is: Is there any way to decrypt an encrypted file without using that file's specific program if I have the password to decrypt it?

(I know it's some form of base64 encryption and that the program itself can be decompiled to an extent with a VB decompiler, but that's it for any extra, quite possibly useless info)


texts: Getting the Encryption Function From the Decryption Function + Decryption Key + Encrypted Item

texts: Is it mathematically possible to always be able to get the encryption algorithm used to encrypt a certain item (file, number, text, ...etc.) by knowing the decryption algorithm that will be used to decrypt that item, the encryption key (i.e. private key), and (of course) the encrypted item itself? I.e. are all encryption algorithms reversible and have this hypothetical equality hold (going to left decryption, while going to right is encryption), while still being able to get the method to go either way (right or left) if I know the other way: encrypted item + key <=> decrypted item?  I am referring to reverse engineering an encryption/decryption algorithm from knowing the other one in both symmetric and asymmetric encryption/decryption algorithms.


texts: One Time Pad - does it work for long plain texts?

texts:
Reading Dirk Rijmenants's work on One Time Pad and he frequently mentions that it is suited to short plaintexts.

I presume this is just because of the practicality of encrypting and decrypting one time pad ciphers? If not why is it not mathematically appropriate for longer plaintexts 1000 characters plus?

Presumably if the one time pad was longer and totally plaintext this cipher works with plaintexts of lengths through to infinity.

Thanks for the help with this small point.


texts: How does one calculate the cryptoperiod?

texts:
NIST Special Publication 800-57 defines a cryptoperiod as

  the time span during which a specific key is authorized for use by legitimate entities, or the keys for a given system will remain in effect. A suitably defined cryptoperiod:

  Limits the amount of information protected by a given key that is available for cryptanalysis,
  Limits the amount of exposure if a single key is compromised,
  Limits the use of a particular algorithm to its estimated effective lifetime,
  Limits the time available for attempts to penetrate physical, procedural, and logical access mechanisms that protect a key from unauthorized disclosure
  Limits the period within which information may be compromised by inadvertent disclosure of keying material to unauthorized entities, and
  Limits the time available for computationally intensive cryptanalytic attacks (in applications where long-term key protection is not required).

The standard goes on to describe risk factors affecting cryptoperiods:

  Among the factors affecting the risk of exposure are:

  The strength of the cryptographic mechanisms (e.g., the algorithm, key length, block size, and mode of operation),
  The embodiment of the mechanisms (e.g., FIPS 140-2 Level 4 implementation, or software implementation on a personal computer),
  The operating environment (e.g., secure limited access facility, open office environment, or publicly accessible terminal),
  The volume of information flow or the number of transactions,
  The security life of the data,
  The security function (e.g., data encryption, digital signature, key production or derivation, key protection),
  The re-keying method (e.g., keyboard entry, re-keying using a key loading device where humans have no direct access to key information, remote re-keying within a PKI),
  The key update or key derivation process,
  The number of nodes in a network that share a common key,
  The number of copies of a key and the distribution of those copies, and
  The threat to the information (e.g., who the information is protected from, and what are their perceived technical capabilities and financial resources to mount an attack).

It then goes on to list other factors that might affect cryptoperiods, such as the consequences of exposure, whether the key is used for communications or storage, and the cost of key revocation and replacement.

Specifically for a symmetric key wrapping key, for example, the standard recommends:

  The recommended originator usage period for a symmetric key wrapping key that is used to encrypt very large numbers of keys over a short period of time is on the order of a day or a week. If a relatively small number of keys are to be encrypted under the key wrapping key, the originator usage period of the key wrapping key could be up to a month. In the case of keys used for only a single message or communications session, the cryptoperiod would be limited to a single communication session. Except for the latter, a maximum recipient usage period of 3 years beyond the end of the originator usage period is recommended.

My specific question is what constitutes "very large numbers of keys" and "relatively small number of keys" in the above recommendation?
More generally, is there a standard formula to compute the optimal cryptoperiod taking all the risk factors listed above into account?

As a specific example, please consider the following scenario:
1. Protection consists of AES-256 in CBC mode and HMAC based on SHA-256
2. 100,000 keys issued per month with this protection to manufacturers, for personalisation of consumer units
3. Probability of compromise is thought to be "low"
4. Ability to exploit compromise is thought to be "difficult"
5. However, confirmed compromise will entail recall of affected consumer units to their original factory


texts: What are the required properties of a PRNG to make it suitable for a stream cipher?

texts:
As an example, if a PRNG passes the BigCrush test suite, and has a period of 2^1024, can it be used on its own to make a secure stream cipher?

What are the required properties, and similarly, what are the bad properties that the PRNG must not have?


texts: Is Schannel supposed to use SHA1 for (EC)DHE params?

texts:
I captured a TLS 1.2 handshake on my server (WIN2012.R2/IIS 8.5) and noticed that SHA1 is being used to hash ECDHE parameters despite both the server and client(s) supporting SHA2 signatures.

Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)

TLSv1.2 Record Layer: Handshake Protocol: Multiple Handshake Messages
         Content Type: Handshake (22)
         Version: TLS 1.2 (0x0303)
         Length: 1980
    Handshake Protocol: Server Key Exchange
            Handshake Type: Server Key Exchange (12)
            Length: 361
            EC Diffie-Hellman Server Params
                Curve Type: named_curve (0x03)
                Named Curve: secp384r1 (0x0018)
                Pubkey Length: 97
                Pubkey:
                Signature Hash Algorithm: 0x0201
                    Signature Hash Algorithm Hash: SHA1 (2)
                    Signature Hash Algorithm Signature: RSA (1)
                Signature Length: 256
                Signature:

I've tested the clients with other servers and found SHA2 was chosen
in many cases so it seems to be my server (not clients) forcing the use of SHA1 for
some reason.
I've also tested another 2012 R2 VM I have as well as 2016 TP5 and
again with both, SHA1 is chosen for ECDHE.
The certificate chain is signed using SHA2 and the HMAC chosen in
this case was SHA384 so the server doesn't seem to have any problem
using SHA2 signatures in other cases.

Could this be misconfiguration on my part? I haven't found any way to effect the (EC)DHE signature algorithm in Windows either accidently or intentionally.

Could this just be a known trait of Schannel in server 2012? (If someone has a similar setup and could confirm by capturing a handshake, I'd appreciate it.)

In any case, is there any risk in SHA1 being used here?

Thanks!


texts: Why must IV/key-pairs not be reused in CTR mode?

texts:
Many sources mention that IVs must not be reused with the same key in CTR mode, for encrypting 2 different pieces of data, because that totally destroys security - but I haven't found an explanation so far as to why this is the case.

The issue is obvious if the attacker can manage to obtain the plain text and its corresponding cipher text for one piece of the data - but if no known plain texts are available, how could an attacker reconstruct the key-stream from just the IV value?

Can the security issues be mitigated by keeping the IV secret too? E.g. would an attacker have any realistic chance of cracking the encryption by just knowing that key/IV-pairs have been reused in the creation of two different ciphertexts, but nothing more?


texts:
The brutal ciphertext is given. The text volume is more than 6000 characters. It is known that the text is encrypted with a 7x7 matrix. Unknown key and plaintext. Is it possible to crack this code? Russian alphabet. The vector is recalculated modulo 32 (not 26).

The search of all matrices on a computer is not possible! It will take some years :)
There was an idea to divide the text into groups of 7 characters. Next, compare the same tokens in the same positions…

Total it turned out 3 groups with the same substring.
There were 2 substrings of length 4.
Several pairs of substrings of length 3.
Some of them occur 3 times.

Can this somehow help solve the system to find the key or the source code?


texts: Is there a feasible way to reconstruct the key from the (Triple-)DES round key?

texts:
Assume there is a closed source application which uses Triple-DES with a fixed/hardcoded key to decrypt large amounts of data. Someone managed to extract the round keys from a process memory dump and was able to verify (using a patched version of 3DES that takes round keys as input) that these keys are actually able to decrypt the data successfully.

Is there a known way to use these round keys to reconstruct the original secret key from it? (As it is DESede, two keys are derived using decryption mode and one key using encryption mode). Technically, it is not necessary to be able to do so (a patched 3DES implementation can decrypt the data fine), but it would make the code more readable to just use normal 3DES and plug the original secret keys in. (Plus it would be possible to encrypt instead of decrypt with them).

If there is no such way, is it a design decision that reversing the derivation of round keys to be hard, or is it just coincidence?


texts:
I have read some documents to decrypt ciphertext without a key using Frequency analysis. here are my questions:

If the most occurring Char is not 'E' then how do we start?
Let's say I have  this ciphertext

MLD BLF PMLD GSV TZNV SLD GL KOZB RG. TVG
    IVZWB ULI HRNROZI KILYOVNH RM BLFI VCZNH.
    XSVVIH.

Here is its decrypted text: now you know the game how to play it. Get ready for similar problems in your exams. cheers

can someone please help me to sort this out, here most occurring is 'L' but it is not 'E'. 'L' is 'o' here ... I am very confused.


texts: How to prove a function is pseudorandom function?

texts:
I am currently enrolled in a cryptography course, which uses the book by Katz and Lindell.

I am using a function having $F_{k}$ = $A_{k}(B_{k}(r,m),r)$, the random number is generated using the Linear feedback shift register, A and B are the functions such that the output of B and a random number r is taken as input to A. I have the following doubts:

Is the above function using A and B a pseudorandom function as it is using LFSR to produce cipher text?
If the above function is pseudorandom then how to prove it mathematically?
Can any function which uses LFSR as the random number generator be considered CPA secure?


texts: Block Cipher Mode Amicable to Fast Key Change/Rotation Like XOR?

texts:
I'm working with documents encrypted in long term storage. When a client requests the document, the document should be delivered encrypted under a distinct key (distinct from the long term storage key).

For efficiency, I want to avoid decrypting the document under its long term key and then re-encrypting under a client delivery key.

Are there any FIPS 140-2 block cipher modes of operation that are amicable to a simple XOR for the transformation? That is:

Client Key = Long Term Key ⊕ Random Key
Client Encrypted Document = Long Term Encrypted Document ⊕ Keystream based on Random Key

When the client receives the document, he/she would:

Decrypted Document = Decrypt (Client Key, Client Encrypted Document)

I think a mode like CTR is close to what I want since it Encrypts the Counter and then XORs it with the plain text, but I would like to avoid the "Encrypts New Counter" if possible.

The block cipher and approved modes are important because I'm constrained by FIPS 140-2.

Any insight or help would be greatly appreciated.


texts:
I used rsa-json.native to generate RSA keys for a node.js application that will use secure-peer later to connect two clients with each other. Now I have 2 questions:

In secure-peer/index.js I've found defaultCiphers = ['RC4'] - is this acceptable? I've heard that RC4 is broken.
Are my example RSA keys flawed? They contain the same data at the end and beginning of the keys.

RSA-Key #1:

-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBALJWTxyvIedsbg4QffU7vqvBlsHR8w6dfN19bSMiVjdSPoU2mKGN+n/Ck5gTPrWK
zz64JRrLWE7pYsd1YF1RQIbh8eUUNA3cUmVpuAdfolwpE3ixFlaYRgwGjwkaONoGerP9p1SS
VUCwuEfgmS14n5x9AQ/3HJVICQTb/2dryQqFAgMBAAE=
-----END RSA PUBLIC KEY-----

-----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgQCyVk8cryHnbG4OEH31O76rwZbB0fMOnXzdfW0jIlY3Uj6FNpihjfp/wpOY
Ez61is8+uCUay1hO6WLHdWBdUUCG4fHlFDQN3FJlabgHX6JcKRN4sRZWmEYMBo8JGjjaBnqz
/adUklVAsLhH4JkteJ+cfQEP9xyVSAkE2/9na8kKhQIDAQABAoGAJpEtyLlDLsYvQtFkPA2w
nXpfPQlHdCiw4UGHwapiVNJvfOWiuoV23/xXaPL4g9BCI4E1XQcO0Pn+B76lmWjB+EvVLTnw
SM0M/coY73mOT/Suc51OKG+cd9HnYjNe9hzwkbIwX73AcgyWRGYt0NAPbAFBM/xxLPNzSeyo
othjFYECQQD9BD/HDwbNycu3mhPOlhPU605xcZnWb2IOcSWoNb6zlq4JcVXXR/Nb1R4qPSBU
s+thdtc6Lpk+0Fr/iQaJ9f3hAkEAtHCiTQbsDBlR8ypCfau2CmHZ8nLMlYhtarzfcJ5PJZ0d
zQOVdcdivC5gIGs0t6+UH4KKbFBPSvuNH+pwZbx5JQJAAaj7eiThGIyQZ539L0fQzX7VvuzN
45hLfmjDpHzlyWvdrHYv5/+y2xFk50YLZkLf8n3DH8CahMz9K9wMTO9uQQJAeS6D8dNKSD3h
CbxB94CQu5xH8UokF/EN+vdp4IqRgSNp1jwn7ne/2b4TlPIq74odoqPbLy8ocaVLfDnIzqqr
eQJAB9j9REz3a5J1vAcFTcZ36pt3D6O/cF+9AB5jopeV5je2qJ2VRqMlr2yoxLEyEVNXHWbS
tkRRNBKgDChumUtMAA==
-----END RSA PRIVATE KEY-----

RSA-Key #2:

-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBANMnnH3ZrBRVboez1+u5CS6nHg0M4BwkVGHfHDX3AdGyxxm2L8QFdOK3Uf5b9jCK
MlDGXPoCoqiT6FesQvtXcTSJ4ZkIPvY9BKi2qZ3oK7B50Rc5ULd8MsHoQH+DV436GlV/JRUg
NLgoouykKKryo7dSU2LzwcPc0v7w16HVebIHAgMBAAE=
-----END RSA PUBLIC KEY-----

-----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQDTJ5x92awUVW6Hs9fruQkupx4NDOAcJFRh3xw19wHRsscZti/EBXTit1H+
W/YwijJQxlz6AqKok+hXrEL7V3E0ieGZCD72PQSotqmd6CuwedEXOVC3fDLB6EB/g1eN+hpV
fyUVIDS4KKLspCiq8qO3UlNi88HD3NL+8Neh1XmyBwIDAQABAoGBAKtn7FD88gNPlnnyM8TW
X+3PG0XcvdAabaVFR9FGweNIDPeCPSQSid/AkH66iA6/IDkRzUfl+8R8zI7e90CwquNRmUWa
uBg1xO6heOGXn+HFUQlt0TXmnPw6CZl0yWGPhED7otO6wyFmSix8h+kR6ixWTGR0EfmtYfFw
MaLgpVWBAkEA8Jgz5NVjQUMz1s6zRXD65Tk9kjcKRuia3pccwvxXSbnm+jqE2jvqyA+ucVJu
+QzzxukPjBY3kzK4fVJ+KOgoPQJBAOCs1a6gOYdHoh19btROLoK3p3WK/dvPfWO2/yGB1VPh
d/1kI0N5oQ+taDRHTy0BGU/brxnMvhrV8dOD0NG3Y5MCQQC3AH5Qa8MAbBZtKHIRursMSfq8
UaM+hkTuVHCrG3dle8LlyEcvG+4cWFkuly4Tv7dZMAMEYg3JqAXORUXy5YtdAkARFTMeFvKo
1Yp/AYWGwPcKW1pxNoM8zlbzWPunGY8V1KPh8VY5ECtt3Lp6lx1vB5FcIBD9PjMKKVA8y935
xB7fAkEAsbtvwg3leiFz8biyWib8Gq7KDSEZOeBFKbPu7zDHR7koCxJoqjUtBA6WSJ6td5b+
RjnPQl6sh+lyQ1gEuAJMJA==
-----END RSA PRIVATE KEY-----


texts:
Why is Rijndael restricted to key length in $\lbrace 128, 160, 192, 224, 256\rbrace$ bits (and not larger)? The algorithm looks to me like it would support an arbitrary-sized key (multiple of $32$).

The rounds operate without the key. Between rounds, the state is XORed with as many key bytes as are needed according to the block size. The key generation process is dependent on the number of rounds, which is dependent on key size, so growing a key triggers a process that uses the key data.

I heard Dr. Eric Cole mention something about this like 10 years ago when first I took one of his classes which covered a "101" into to crypto. We were talking about how AES is replacing DES (triple DES, whatever) and he told us about basically said that Rijndael has variable key lengths. He didn't say specifically, but I took him to mean arbitrary. If I recall corrected he said that because of this feature we'd be using it for a long long time to come. He also talked about all the fun he had attending the NIST AES contests, but now I'm off topic. Does anyone actually know?


texts: How to show that this modification of CBC-MAC is insecure?

texts:
I'm working on some cryptography problems, found this and I'm not sure how to solve it:

  Modify CBC-MAC so that all blocks $t_1,\dots,t_l$ are output rather than just $t_l$ and prove it is not secure.


texts: extract password hashed in scrypt using hash and salt

texts:
I have the hashed password and its salt. It is encrypted using SCRYPT by firebase.

How can I extract the plain text password from these two?

Or alternatively, how can I re-encrypt or convert them to hash/salt that is readable by passport-local-mongoose plugin?
here is an example of what I have at my disposal:

  "hash": "jHyvk2qCPRncEAq5H05JeO4873MIMeyakVMmUXDjRfcdvflDvOXoEn7AhTW0T4f2zb24JYyPrIwTW96C4/iZ+A==",
  "salt": "zVzcUzIS+wCC+w=="


texts: Efficiently map $2^n$ unique 64-bit vectors to $2^n$ $n$-bit vectors where $n < 64$?

texts: Is there an efficient way to map $2^n$ unique 64-bit vectors to $2^n$ $n$-bit vectors where $n < 64$?


texts: curious DHE implementation for key exchange

texts:
I have made some reverse engineering on proprietary software and came up with some DHE algorithm that works like this:

First and foremost, the client and the server shares some public parameters (g, p) where p is a prime number :

# the client generates some random number X
# Then...
A = g^X % p
B = 4^X % p

At this stade, A and B are two numbers computed with some exponentioation modulus p.

The client keeps A for itself and sends B over network to the server.

I can't guess out what's the server doing with B.

What comes up next is that the server sends the client back some buffer which is 20 bytes long. This buffer is xored with the first 20 bytes of the little-endian representation of A. Meaning something like this:

key = buffer ^ A[0...20]

And there you go, key is the shared key between the client and the server.

I am trying to guess out how the server generated that xoring buffer, and what did it compute with 'B'. Any clue?

Edit:

For instance, I have these numbers:

g=4251748925932087506992136911681457196421197968417424634771122535345596546655443876920558972863202693157925206950493858768680434551750613271334944372387511

p=7552255105811443149655814117645061441469802313473420161620729142606560015854445500056007762660457578016660416343667268412286196867181440500178902692672641

X (random number) = 8788592173807205653697600075440308493757969005221433286958441247128089107594429784362875543428031794230308326680487467902465260209524609291268858491985100

How could  the server compute A?


texts:
With unsalted passwords becoming rare, and stream ciphers having a significantly large state, are there currently any widely deployed systems still vulnerable to such time-memory-data trade-off attacks?

If I were to show a small generic improvement to rainbow tables, what would be a good problem to demonstrate on?


texts: attacks and defenses on multi party Diffie-Hellman protocol

texts:
I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property.

However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate on them:

Is it safe against a passive adversary, who just listens to messages, or is it also safe against an adversary who could change messages that are sent between people in the party?
How can i change the protocol to be more secure against an adversary that can change not more than one communication between people in the party(for instance the adversary can change a message between $P_0$ and $P_1$ or $P_2$ and $P_3$ etc)? This is my idea I am not sure how to implement: by allowing every person $P_i$ to send messages to people that their index is one more or one less, meaning $P_i$ can send messages to $P_{i-1}$ or $P_{i+1}$(for instance $P_3$ can send a message to $P_2$ or $P_0$)

This is my 4 people implementation of Diffie-Hellman:

for some generator g: since ${y_A}^{x_B} = (g^{x_A})^{x_B} = (g^{x_B})^{x_A} = {y_B}^{x_A}$ (for two people), for four people we'll have: $(((g^{x_A})^{x_B})^{x_C})^{x_D} = ... = (((g^{x_D})^{x_C})^{x_B})^{x_A} = (((g^{x_A})^{x_B})^{x_C})^{x_D}$ ($x_i$ is private), then we can do the following scheme:

For $P_i$ where $i \in {0,1,2,3}$:

$P_i$ generates its own  private key $x_i$
$P_i$ generates its public key $y_i=g^{x_i}$
$P_i$ sends $y_i$ to $P_{i+1}$
$P_i$ now needs to calculate $z_{(i-1)(i)}=y(i-1)^{x_i}$
$P_i$ sends calculated $z_(i-1)(i)$ to $P_{i+1}$
finally, $P_i$ calculates using above steps $k_{(i+1)(i+2)(i+3)(i)} = z_{(i+1)(i+2)(i+3)}^{x_i}$

so $k_{(P_i)(P_{i+1})(P_{i+2})(P_{i+3})} = ... = k_{(P_{i+3})(P_{i+2})(P_{i+1})(P_i)}$

However, not sure how to apply 2. (changing the protocol to be secure against an adversary that can change not more than one communication as mentioned above).

And regarding 1, would really appreciate mathmatical explanation to understand it better.

Thank you very much for helping


texts:
A few days ago I asked a question about the security of the Lim-Lee Prime Generation algorithm used by GNU Privacy Guard’s libgcrypt library.  L. Carvalho provided a good answer to that question.

As a follow up question, I am wondering whether one could use Lim-Lee Prime Generation as a means of creating a “Nothing Up My Sleeve” prime for use in Diffie-Hellman key exchanges?

It seems to me that if one wanted a 2048-bit prime (p) with no prime (other than 2) dividing p-1 less that 256 bits in length then by choosing a set of maximum prime divisors of p-1 that give a prime p, one would have a good construction of unique, "Nothing up my Sleeve" (NUMS) numbers for a given prime size and prime order subgroup size.

I'm thinking that for a 2048-bit Lim-Lee Prime (p), p-1 could be divisible by 2, the largest 255-bit prime, and the 7 largest 256-bit primes such that p is prime. That would be unique – right?


texts: Diffie-Hellman Parameter Check: when g = 2, must p ≡ 11 (mod 24)?

texts:
I'm adding some Diffie-Hellman groups to a program as specified in RFC 3526, More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE).
When I test some of the group parameters per OpenSSL's DH_check, a result is returned that essentially states: 2 is not a suitable generator for Group 5 or the 1536-bit MODP Group.
According to DH_check() claims that RFC 3526 groups have DH_NOT_SUITABLE_GENERATOR, it appears OpenSSL's tests are (from crypto/dh/check.c):

for $g = 2$, $p \bmod 24 = 11$
for $g = 3$, $p \bmod 12 = 5$
for $g = 5$, $p \bmod 10 = 3$ or $7$

The posting then goes on to state 2048, 4096, and 8192 are congruent to 23 modulo 24, not 11. I've confirmed the 2048-bit and 4096-bit MODP groups as well.
I can't find reading on the expected residues (they probably exists, I just have not come across the paper).
Is it acceptable to relax the test such that $p \bmod 24 = 23$ when $g = 2$?


texts: Paillier Homomorphic encryption to calculate the means

texts:
Paillier Homomorphic encryption supports addition and multiplication with plaintext value.

Can I use these properties to calculate the means of cipher-text values? I try to use the following steps:

Multiply set of cipher texts (to get there sum in plaintext value)
Raise the calculated ciphertext in step1 to the power of $\dfrac{1}{c}$ where $c$ is the number of cipher texts) to get the average

The problem I have is that, paillier is defined in integer domain $\mathbb{Z}$ thus $\dfrac{1}{c}$ is always $0$ so the final results is also $0$.

Any help or suggestion?