texts: 19 out of 24 words of BIP39 passphrase (brute-force last 5?)

texts:
I have managed to lose 5 words of my 24 word Ledger Nano S recovery phrase. I have words 1-19 but I am missing words 20-24.
I have significant holdings on the wallet so would very much like to recover it if possible.
The passphrase is a BIP39 mnemonic (see https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki).
I have the bitcoin and ethereum public addresses for this mnemonic. I am wondering if it's feasible to brute force the passphrase.

Each word is 11 bits (2^11 = 2048 possible words).
The last (24th) word of the passphrase is of the following form [3 random bits][8 bit checksum].
Therefore I only have to check 2^(55 - 8) = 2^47 = 1.4x10^14 combinations.
I would have to compute SHA-512-HMAC with an iteration count of 2048.
As far as I understand, that means I'd have to compute 1.4*10^14 * 2048 = 2.87*10^17 hashes in total.

Is there any hardware out there designed for this? I am aware of ASICs that compute sha-256 hashes but not sha-512 hashes.
Perhaps I could tweak one to work with sha-512 since they are very similar.

Assuming a fairly typical ASIC hashrate of 1TH/s (10^12 hashes per second), I could exhaust the search space in 2.87*10^5 = 287000 seconds = 3.3 days. I'd probably get there sooner, of course (expected 1.65 days). Time is not something I am worried about. Even if I have to wait months, I don't mind - so if I can get 10GH/s at a reasonable price, that would be great.

I would really appreciate any help/information you could provide to help me out and make sure I haven't missed anything.
I could also use GPUs for this (I calculate I can run them at roughly \$1 / 10TH - so it would cost me \$28.7k to exhaust the search space, which I will do if there are no cheaper options).

Many thanks,
James


texts: Could use an explanation of the notation for an oracle adversary

texts:
In the definition below, what exactly does it mean for the adversary (not even sure that's the correct term?) to equal one?

$$
\underset{K}{Pr} \left [A^{F_k(\cdot)} = 1 \right ]
$$

Source (Page 22/35?)


texts: I am using a 8 bit Sbox having 16 entries with a lookup table of 4x4 in cryptographic algorithm. Sbox is constructed on subgroup of galois field 2^8. I want to calculate number of quadratic equations used to describe this Sbox over GF(2) so I can calculate resistance of algorithm against algebraic attacks.Since AES Sbox can be described by 23 quadratic equations and my Sbox is also 8 bit but its size is small having 16 entries only. So kindly if anyone can tell by how many quadratic equations my Sbox can be represented over GF(2)?


texts: Are there any security flaws in using an involutive S-box?

texts: I know that it is difficult to answer these questions without knowing the full scheme it would be used in, but are there any problems that could be introduced into a block cipher if an involutive S-box is used?


texts: Good key update algorithms for key evolving schemes

texts:
In schemes like SAKE(Symmetric-key Authenticated Key Exchange) , the master keys (used to authenticate parties and generate session keys) are evolving, ie undergo transition $K=update(K)$.

What is a good candidate for $update(.)$ function?

Would $K=\operatorname{AES}(K, S)$ have "good properties", with $S$ being arbitrary block-length constant?Author of the algorithm state that $update(.)$ should be irreversible function.


texts: Is 256 a reasonable length for a Diffie-Hellman safe prime?

texts:
There's a program that uses the following OpenSSL function...

DH_generate_parameters(256, 5, NULL, NULL)

...to create DH parameters which are later used for hundreds of key exchanges (and the one-time keys used to encrypt login details sent over Internet).

The manual page says 256 is prime_len in bits. How secure is this value? (I have a bad feeling.)

Also, if I'm reading http://www.keylength.com/, does this correspond to "discrete logarithm key" or "discrete logarithm group" or am I looking in the entirely wrong place?


texts: Is TLS 1.2 compression methods in client_hello a mandatory field?

texts:
As stated int he question, is compression methods list in the client_hello in TLS 1.2 a mandatory field (it is clear that it is mandatory in session_resumption, but not clear to me whether it is mandatory in the new session case)?

Reference to the standard TLS 1.2, RFC 6246, chapter 7.4.1.2 (formatted):

  compression_methods

  This is a list of the compression methods supported by the client,
        sorted by client preference.  If the session_id field is not empty
        (implying a session resumption request), it MUST include the
        compression_method from that session.  This vector MUST contain,
        and all implementations MUST support, CompressionMethod.null.
        Thus, a client and server will always be able to agree on a
        compression method.


texts: Why are the shiftrows in AES in a fixed order? Can the order be changed?

texts:
It seems AES uses fixed shiftrows as follows:

B0  B4  B8  B12  No shift
B1  B5  B9  B13  Right-shift 3 places
B2  B6  B10 B14  Right-shift 2 places
B3  B7  B11 B15  Right-shift 1 place

Would it make a difference to security if the rows were shifted differently?
Not to disturb the carefully selected shifts (0, 1, 2 and 3 shifts), but just the order of them: For example:

Right-shift 3 places
No shift
Right-shift 1 place
Right-shift 2 places


texts: How obvious is it to decrypt numerics encrypted with a reused one time pad?

texts:
For instance say you encrypt text using the one time pad and you end up with some scrambled text that appears illegible.  If you reused the key for multiple times for enough text, someone could potentially crack the message using something like crib-dragging. The hacker tries and tries until eventually comes up with a message that has meaning and is no longer scrambled.

However say you use the one time pad technique to encrypt numeric values like dates, time, or just some numbers within a range like say numbers from 00000 - 10000  AND reuse the same key over and over.

For example in the case of dates like a month you would create a key that consists of a random number between 1 and 12, so that when you add the key value to actual month value and mod by 12 (and add 1) you end with a real month value different from the initial.  Then you use the same method (different range of values) with the days, or years, always ensuring you end up with a real date value in the end.

First is it even possible for someone to recognize that the result was encrypted? The values all appear to be legitimate, real, non-scrambled values, just as the originals were (only displaced in time)

If for some reason they figured out that the numeric values were encrypted, would they even be able to decrypt them to their original values?  How would they know that their efforts are resulting in the correct original value?


texts: Upgrading key derivation by adding a XOR with a known value

texts:
In general keys for password based key derivation are derived from a password hash such as the old PBKDF2 function or Argon2, possibly followed by another derivation function to derive data and authentication keys: $$K_{master} = \text{PBKDF}(pass, salt, factors, length, \ldots)$$.

A possible disadvantage is that it is impossible to update the factors, salt size or password without generating a different $K_{master}$.

Would the following simple way around this be secure?

calculate the initial master key value: $$K_{master} = \text{PBKDF}(pass, salt, factors, length, \ldots)$$
calculate a second master key value $$K_{master}' = \text{PBKDF}(pass', salt', factors', length, \ldots')$$ where each value other than the resulting key size $length$ may differ from the original scheme.
calculate a key adjustment value using XOR $$A = K_{master} \oplus K_{master}'$$
store this adjustment value $A$ with the other upgraded parameters / ciphertext.

Now in further operations, such as decryption of ciphertext that relies on the original $K_{master}$ you can simply calculate the second master key value $K_{master}'$, and perform $K_{master} = K_{master}' \oplus A$.

Are there any drawbacks to using this scheme? Does it have a name?

It seems a very simple scheme, but I haven't seen it used in any practical applications. It is of course identical in operation to simple key sharing / splitting - but in this case we're not sharing anything.


texts: Can a book cipher be cracked without key?

texts:
Book cipher works this way :

Choose a reference book.
For each word find its position in the book.
replace each word by its coordinates (ie: 2,3,4 = page 2, 3rd line, 4th word).

How would somebody go about cracking a book cipher without the knowing what the key [or book used in this case] is?

Finding the key is either impossible or would take a impractical amount of time.
Given a known plain text and a cipher text, finding the right key [or book] is impractical because all possible keys that match the plain text would require
40 billion years using modern day technology to go through.

Example of a book cipher : Beale ciphers, it used the United States Declaration of Independence as a key.


texts: Recover from compromised shares with Shamir Secret Sharing

texts:
He is a quote from Wikipedia page for Secret Sharing:

  If the players store their shares on insecure computer servers, an attacker could crack in and steal the shares. If it is not practical to change the secret, the uncompromised (Shamir-style) shares can be renewed. The dealer generates a new random polynomial with constant term zero and calculates for each remaining player a new ordered pair, where the x-coordinates of the old and new pairs are the same. Each player then adds the old and new y-coordinates to each other and keeps the result as the new y-coordinate of the secret.

The idea here is that if you add a polynomial with constant term $0$ to another polynominal, it doesn't change the constant term. But I don't get how this is better than just redistributing new shares.

If you distribute the updates over an insecure channel, then the attacker can intercept them, steal new shares and convert them to old shares by substracting the update. So you have to distribute the updates over a channel as secure as the one originally used to distribute shares. So what's the point of using updates instead of just generating new shares?


texts: How can two parties offline generate a sequence of corresponding key pairs that are still sufficiently random

texts:
I'm looking to design a protocol between two parties A and B to generate sequence of RSA private keys $p_{a_0}, p_{a_1}, ... p_{a_k}$  and a sequence of corresponding RSA public keys $P_{b_0}, P_{b_1} ... P_{b_k}$.
with the property that $P_{b_k}$ is the corresponding public key of private key $p_{a_k}$. But there is a twist:
$A,B$ will share an initial secret. After this point $A$ will generate its private keys ,and $B$ will generate JUST the public keys and $B$ should have NO way of knowing what $A's$ private keys are. So $B$ should be able to offline generate public keys without knowing what they're private keys are but the protocol should ensure that $A$ ends up with correspoing private keys to $B$'s public key sequence.
The use case is in an "eventually-compromised" system that is $A,B$ initially can share information freely but at some point their computers/networks become infected at which point they shut down and operate in a purely offline manner for a while. During this time I want them to be able to create documents/digitally sign/verify digital signatures of each other despite the inability to communicate and possibility of discovering that some of their keys have been compromised.


texts: What are rounds in the context of ciphers?

texts: Another recent question on security margin included in its answer the discussion of how many rounds are broken so far. What is the definition of a round?


texts: Boomerang attack - looking for simply explanation

texts:
Can someone explain to me in a simple way how it works?
I know what differential cryptoanalysis is, but my knowledge is rather amateur. Nevertheless, reading the post on Wikipedia:Boomerang Attack I do not understand what exactly this type of attack is. The general thought that comes to my mind is a kind of MITM attack, but using different cryptanalysis.


texts: How to calculate the entropy for a fixed length random passwords which has restrictions on the type of characters used

texts:
If we have a set amount of usable characters, but no other restrictions on the potential characters in a completely random fixed length password, we can easily calculate the entropy by doing:
$\log_2(c^{n})$
or
$\log_2(c)*n$
with $c$ being the number of possible characters, and $n$ being the length of the password.
However, when there are restrictions being set on the contents of the random password, this obviously lowers the entropy.

For example, if you have $94$ usable characters, of which $10$ are digits, $26$ are lower case letters, $26$ are upper case letters, and $32$ are special characters.
If there are no other restrictions, this gives us
$\log_2(94^{10}) = 65.5$
which means $65.5$ bits of entropy.

Now, if we have $94$ usable characters and the following restrictions are set:

1 character must be an uppercase letter ($26$ options)
1 character must be a lowercase character ($26$ options)
1 character must be a digit ($10$ options)
1 character must be a special charater ($32$ options)

How do you calculate the entropy for a truly random fixed length password with these restrictions in mind?


texts: How to decrypt file on one machine which is encrypted on other machine?

texts:
I have a doubt related to CryptExportKey and CryptImportKey.
I will try my best to define my problem by explaining the scenario that I want to implement.

I have two machines. On First machine, I create a Key-pair using CryptGenKey with ALGID=ALG_SID_RSA_PKCS then I exported the key using CryptExportKey with PUBLICKEYBLOB flag. I then send the blob to the second machine over the network. On first machine I then encrypt the file using CryptEncrypt with the same key (created previously with CryptGenKey). After encrypting the file, I send this file to the second machine.

So on second machine, I have key blob and the encrypted file. Now, I want to decrypt the file on second machine, using key blob.

On Second Machine, I am trying to import the key blob using CryptImportKey, it returns successfully but when calling CryptDecrypt, it gives an error 08009000d (NTE_NO_KEY, key doesn't exist).

Is it possible to decrypt the file on second machine.

Thanks in advance.


texts: Why is it important that phi(n) is kept a secret, in RSA?

texts: Why is it important that $\phi(n)$ is kept a secret, in RSA?


texts:
I know that md5 shouldn't be used for password hashing because of collisions and possibility of making dictionary attacks e.g. using rainbow tables. But what about other uses? Can I use md5 for encrypting data?

Say, attacker gains access to database where sensitive data was stored using md5. He wants to know just this data that was hashed, not another data that gives this hash. Can he do it?

I know that there are better cryptographic hash functions so don't suggest to use them if md5 is enough.


texts: Why is Lamport-Diffie secure? I note that there is a demonstration based on onewayness (in the book postquantum cryptography). But a one way function is not sufficient to ensure that it can not infer some bits or any feature of the key signature.


texts: how to compute the correlation between two binary vectors?

texts:
We find different equations to compute the correlation or correlation coefficient:

$\begin{align*}
corr &= \frac{a+d}{a+b+c+d}\\
     &= \frac{(a+d) - (b+d)}{a+b+c+d}\\
     &= \frac{(a+d) - (b+d)}{\sqrt{(a+b)*(c+d)*(a+c)*(b+d)}}
\end{align*}$

where a(0,0), b(1,0), c(0,1), d(1,1), which formula give the correct result?


texts: How to check whether the given curve is Elliptic or not?

texts:
I've given a curve E5(2,3) over Zp. How to check this curve is Elliptic or not? I know the curve formed by this will be:
(y2) mod 5 = (x3 + 2*x+3)mod 5.


texts:
I am testing a TLS server that uses x25519 for key exchange. I am relying on Scapy-ssl_tls for building the TLS connection. However, this tool uses tinyec as its crypto library, and tinyec  does not have curve25519 in its registry, thus this whole setup does not work.
Does anybody know how could I add the curve25519 to tinyec? Since its 'registry' is just a bunch of hardcoded values (see below), I assume if I had these values for curve25519, that should be enough for my testing.
                     "secp192r1": {"p": 0xfffffffffffffffffffffffffffffffeffffffffffffffff,
                                   "a": 0xfffffffffffffffffffffffffffffffefffffffffffffffc,
                                   "b": 0x64210519e59c80e70fa7e9ab72243049feb8deecc146b9b1,
                                   "g": (0x188da80eb03090f67cbf20eb43a18800f4ff0afd82ff1012,
                                         0x07192b95ffc8da78631011ed6b24cdd573f977a11e794811),
                                   "n": 0xffffffffffffffffffffffff99def836146bc9b1b4d22831,
                                   "h": 0x1},


texts: What is the point of differential cryptanalysis when the amount of necessary plaintext is unrealistic?

texts:
As someone with a non-crypto background, I learned that differential cryptanalysis is mostly weak against ciphers like DES because, being a chosen plaintext attack, for a state of art complexity of $2^{47}$ there is a need for $2^{47}$ plaintext bits to conduct this attack which is realistically infeasible.
So what's the point of this attack vector at all? If it has always been known that you need a huge amount of plaintext for these to work, why did people bother?


texts: Diffie-Hellman: choosing wrong generator "g" parameter and its implications of practical attacks

texts: In traditional DH one chooses two shared parameters: a large prime $p$ and base $g$, which is primitive root $\bmod p$. Suppose that the generation algorithm is broken and $g$ generates only a subgroup (the group with fewer elements than the number of coprimes to $p$), what could be the possible attack? what's the complexity ? are there any real-world examples of attacking wrong DH parameters (implementation)?


texts: Pseudorandom functions: how are functions stored?

texts: I am wondering about the setup for testing if a function family is pseudorandom. We step into a room, and query the black box with $x$, which yields $f(x)$, etc... We don't know if $f$ is a random function, or if it comes from some preset function family $F$. In the latter case, what assumptions are made about the functions in $F$? Is it enough for each $f$ in $F$ to be listed as a table in the black box, so that $f: \{0,1\}^n \to \{0,1\}^n$ is listed as a table with $2^n$ entries? What if $f$ is described by some function of a polynomial with coefficients that are exponential in $n$? What are the restrictions on the functions in the function family $F$, if any?


texts:
I have recently been reading about encryption and the importance of prime numbers and I have some questions that I would really appreciate some answers to, if possible:

Is it correct that when creating encryption keys you take one large prime number, and then multiply it by another prime number to leave you with an even larger prime number?
If 1 is correct, then is it correct to say "the reason for the large prime number calculation is it is very difficult and time consuming to work out what the initial prime numbers were used in the original calculation"?
What constitutes as a large prime number?

The reason for this question is I have been doing some reading about encryption as stated above, and assuming the above statements are correct I think I have a really simple formula for working out what the original prime numbers used were. I have tested this prime numbers all the way up to $299993$. And I must be doing this wrong because it can not be this simple, I assume someone will point out where I am going wrong.


texts: Which elements of private RSA file are really constitutive of private key?

texts:
I have used openssl rsa to generate a RSA key of 2048 bits and as expected output belongs to a file beginning with BEGIN RSA PRIVATE KEY pattern.
However this file size is ways larger than 2048 bits.
In order to extract the key, i have used the following openssl command:

openssl rsa -in key.txt -text

which returns data for the following items:

modulus
publicExponent
privateExponent (size is 2048 bits)
prime1
prime2
exponent1
exponent2

So which parts of this file are constitutive of the private key? Which are the only sufficient parts to be understood by a cryptographic system? Can I just strip all data except privateExponent and would it still be interpreted as private key?

EDIT

I seems that the couple (modulus, publicExponent) is the public key. However, as mentionned in your answer, puboicExponent is always 65537? Or have I misunderstood it?

It looks like all i need to perform private key operation is d=privateExponent. however, tools such as openssl would need a formated file with all informations, is there a simple way to make it understand that d (and n retrieved from certificate) is all i have and is sufficient for cryptographic operations ?


texts: Is there a cryptosystem which allows slicing and concatenating strings without decryption?

texts:
I want a cryptosystem with the following four functions:

declare function encrypt(text: string, key: CryptoKey): ArrayBuffer;
declare function decrypt(ciphertext: ArrayBuffer, key: CryptoKey): string;
declare function concat(ciphertext1: ArrayBuffer, ciphertext2: ArrayBuffer): ArrayBuffer;
declare function slice(ciphertext: ArrayBuffer, start: number, end?: number): ArrayBuffer;

These functions work such that for any two strings (text1 and text2) and key the following expression is true:

decrypt(concat(encrypt(text1, key), encrypt(text2, key)), key) === text1 || text2;

And for any string (text), index into the string (i), and key, the following is true:

const ciphertext = encrypt(text, key);
decrypt(concat(slice(ciphertext, 0, i), slice(ciphertext, i)), key) === text;

Essentially, I want to arbitrarily slice and concatenate the strings represented by ciphertexts without decrypting anything. Is this kind of cryptosystem possible? Can I use homomorphic encryption to accomplish this? Are there any systems out in the wild which do something like this? I assume the length of the original text must be inferable without the key to accomplish this.

EDIT: To avoid certain trivial solutions brought up in this answer, which simply concatenate/slice ciphertexts trivially using delimiters/tokens, I would like the following to be true as well:

const ciphertext1 = encrypt(text1, key);
const ciphertext2 = encrypt(text2, key);
concat(ciphertext1, ciphertext2) === encrypt(text1 || text2, key);

const ciphertext = encrypt(text, key);
slice(ciphertext, i, j) === encrypt(text.slice(i, j), key));

// I’m using typescript as pseudocode but assuming equivalent ArrayBuffers are tripe-equals equivalent here, even though they aren’t


texts:
I am studying the SCA Evaluation method success rate, and I have a doubt regarding to it.

From my understanding, to calculate success rate, first we have a pool of traces all using same key and random inputs (let's say 10000 traces). The success rate for a certain trace number M(e.g. 1000), randomly choose M(1000) traces from the pool and apply them into the distinguisher to get the result by checking whether the correct key performs best. Conduct the attack operation for N times(N usually chose to be 100). The success rate for the trace number M(1000) is then calculated as the number of correct cases divided by the total attack times N(100).

Here I have a question about the specific key value. Let's say for AES-128, the key has 16 subkeys and each subkey is 1 byte. Everytime We only attack one subkey. So once the trace pool is given, the attacked key is fixed(256 possiblities for each subkey), so can I understand that the calculated success rate is just for this key value because if I use another trace pool with different key, the distinguisher results may be different so that the success rate may be different.

In practice, we can collect multiple trace pools corresponding to different keys. After calculating the success rate for each trace pool with same key, do we need to average all success rates for each key? Or the success rate for each key does not vary a lot, so we can just calculate the success rate for one key value trace pool to represent all other keys.

My question is, when calculating the success rate of an attack, do we need to go through all the possible subkey values([0,255]) and get the average? How do we deal with different key values for calculating success rate usually?


texts: What is more secure, a ciphertext encrypted with AES-256 or encrypted with 3 different AES-128 keys?

texts:
Or better yet, is encrypting a block with 2 AES-128 keys just as secure as encrypting a block with 1 AES-256 key? By the way, I've only recently been learning cryptography stuff; I've made working prototypes in python for both RSA and AES and am familiar with (basically) how they work in general; just not the complex mathematical concepts and terms.

Although my intuition tells me that you cannot fully decrypt a message encrypted twice with two different keys without knowning both keys, that fact that I haven't heard of doing this makes me think it's been asked and answered to the negative and I'm just not seeing it. If AES is really fast, what's to stop paranoid people from going all the way up to 16-32 different keys? That is completely computationally viable for email and chat clients, maybe even other applications (I know nothing about computational complexity).

If I had to guess what would break this, I would say that for any known ciphertext encrypted with AES-128, there exists exactly one 128 bit key that will return the original plaintext from the recovered ciphertext. But I can't see a method for potentially figuring out what the original plaintext was, since that ciphertext could decrypt into any and all plaintexts still.


texts: Let $C$ be a code over the finite field $GF(2)$ with generator matrix $G$ and parity matrix $H$. Let $e+C=C'$ be a coset of code $C$. Let $S$ be a non-singular matrix and $H'=H\times S$. Finally, let $C''\subset C'$. Is there any efficient way of finding any other element of the coset $C'$ by only using $C''$ and $H'$ (with appropriate parameters for the code $C$)?


texts: Are there any specific requirements for the function $F$ in a Feistel cipher?

texts: In a Feistel cipher (as shown below), it seems that the security of the cipher would be entirely dependent upon the function $F$. What requirements on $F$ are necessary for a secure Feistel cipher? Is there any relationship between the function $F$ and the number of rounds necessary to have a secure cipher?


texts:
I'm implementing DES, but I cannot understand example.

  Plaintext: 123456ABCD132536
  After initial permutation: 14A7D67818CA18AD

Plaintext is 64-bits hexadecimal, so each character is 4-bits. The first entry
 of IP(Initial Permutation) table is 58 which means 58-th binary number in the plaintext.

That number is 1 because 58-th binary number is in 3 which is before the last entry 6. Anyway, it means first binary number in plaintext after IP must be 1!

Then, how can 1 is appeared? First hex must be 1*** and it means greater than equal to 8!! What I'm wrong with this?


texts: What is the right notion of security to use for file encryption?

texts: It seems that several file encryption systems do NOT use authenticated encryption. (E.g. gpg --symmetric and boxcryptor as far as I can determine). I understand that this is generally considered insecure, but is not demanded of full disk encryption. But for individual file encryption, for example where one is storing tax files for their own use later, it does seem that ciphertext indistinguishably under chosen ciphertext attack (IND-CCA) is too strong (I am not providing an oracle).  Is there any notion between IND-CPA and IND-CCA that one should consider?


texts:
I’m a little unclear on this subject:

  TPM chips to enable remote attestation. This mechanism works as follows. At boot time, the host computes a measurement list ML consisting of a sequence of hashes of the software involved in the boot sequence, namely the BIOS, the bootloader, and the software implementing the platform. The ML is securely stored inside the host’s TPM. To attest to the platform, a remote party challenges the platform running at the host with a nonce nU . The platform asks the local TPM to create a message containing both the ML and the nU , encrypted with the TPM’s private EK. The host sends the message back to the remote party who can decrypt it using the EK’s corresponding public key, thereby authenticating the host. By checking that the nonces match and the ML corresponds to a configuration it deems trusted, a remote party can reliably identify the platform on an untrusted host.

Lets say a TPM is in one of the nodes of a cluster (in the infrastrusture of cloud) . we know during boot time TPM startes performing integrity measurements :
basically two way of doing this;
1-SRTM (Static Root of Trust for Measurements) (bios-bootloader-kernel)
2-DRTM (Dynamic Root of Trust for Measurements).(running applications : thats something unclear to me too).

those measurements are finally extended to the TPM and saved in the PCRs.

A user is willing to verify the integrity of the cloud platform ,thus a trusted third party has to verify that for him.And finally attest him with a response of trusted/untrusted platform .Lets apply it on the 1st quote.

my questions:

Remote attestation is for authenification or validating the integrity?
Does the authenitification equals integrity of the platform?
The TTP requests measurement list are those measurements meant to be hash
values of SRTM and DRTM protocols?
How does the trusted third party verifies those measurements?


texts: Is HKDF one-way, namely given `Ko` it's hard to guess `Ki`?

texts:
For background, a HKDF (hmac based key derivation function) takes the form of Ko = KDF(Ki, Label, Context, Len) where Ki is the input key and Ko is the (usually longer) output key, computed by iteratively applying HMAC (initially keyed by Ki) until the desired length is reached. See pseudocode here.
Can I assume HKDF is one-way, namely given Ko it's hard to guess Ki? It seems intuitive, as HMAC output should not lead to recovery of the MAC key.


texts: Can we use a hash-based stream cipher against DPA attacks?

texts:
There have been lots of DPA researches against block ciphers.

I was wondering if we use a cryptographically secure hash of an incremental counter as a stream cipher, will it withstand DPA attacks?

Ciphertext = Plaintext ⊕ HASH(counter)

My assumptions are:

The initial value of the counter is kept secret;
There seems to be not many effective DPA attacks against SHA (not HMAC).


texts:
So, browsing through YouTube, I stumbled on this video interview of John Draper (Captain Crunch), one of the first "hackers". He talks for about 3 minutes (until 27:48) about his home rolled encryption method that will use 1 billion bit keys that randomly change every 5 seconds.

My first thought is, is this guy full of crap? But, more specifically, if we have the capability to use 1 billion bit encryption (he claims an overhead of only 250kb to transport keys), why don't we see keys much longer than 4096? Other than the fact that it seems like an insane overkill.


texts: Are the SHA family hash outputs practically random?

texts:
Say I hashed the output from a random number generator (with nonce), would the resulting SHA256 hash be as random as the inputted number?

And If I used the first 5 hex characters, and then used the first 5 ignoring the very first character and so on repeating removal of the first character, would each number be just as random?

Example of what I mean, here's a 512 bit hex string.

26657320797d4f5b385d43274a246178263f3b686b645e375b45643442

Is any segment of 5 characters chosen from random locations in the string guaranteed to be a fairly random number?

I am trying to make a pretty simple random number generated based on a hashed seed.


texts: ElGamal encryption of concatenated messages

texts:
Suppose an encrypter separately produces three ElGamal ciphertexts $c_1 = E(m_1)$, $c_2 = E(m_2)$ and $c_3 = E(m_3)$, which encrypt the messages $m_1$, $m_2$ and $m_3$, respectively.
Is it possible for the encrypter to prove with a zero-knowledge proof that $m_1$ = $m_2 \mathbin\| m_3 = m_2 \times 2^{32} + m_3$, i.e., that $c_1$ encrypts  the concatenation of the messages $m_2$ and $m_3$?

(added by moderator to summarize exchanges with the OP)

It is used a variant of ElGamal encryption, where for plaintext $m$ the group element $g^m$ is what gets encrypted using standard ElGamal.
In the expression $m_2\mathbin\|m_3$, plaintext integers $m_2$ and $m_3$ are bitstrings of fixed size (32-bit).
One option for the encrypter/prover is to make use of the ephemeral secret exponents generated at encryption.


texts: What is the actual difference between security through obscurity and true encryption?

texts:
In an abstract sense, aren't both the same?

Don't their definitions boil down to the following?

security through obscurity:
trying to make sure some information cannot be obtained without knowing the secret method
encryption:
trying to make sure some information cannot be obtained without knowing the secret key

That secret method of STO is, in an abstract meaning, just a key.

So, is the actual difference that in encryption the connection between the key and the information is mathematically sound while STO uses something so abstract that attempting to describe it mathematically is not feasible and its security basically relies on that?


texts: FEAL-4 Linear Cryptanalysis - Prevention

texts:
currently, I prepare for an exam about cryptanalysis. In class, we talked about linear cryptanalysis for FEAL-4. We constructed four linear equations, extended them to equations for three rounds and then applied a Brut Force search in order to find the keys of every round.

My question is as follows: How can I prevent such an attack?

My idea: I think, it is necessary to replace the S-Boxes of FEAL with 'better' S-Boxes? Such that, it is not possible to find relationships between input and output bits of the S-boxes (and therefore, also for the whole F-Function). But how does such an 'good' S-Box look like?


texts: Is this the right way to implement ElGamal scheme over Elliptic Curves over prime field?

texts:
I'm fairly new to Cryptography, especially elliptic curves in general. I learned to do Point Multiplication, Scalar Multiplication and also programmatically implemented them. But I was trying to do ElGamal scheme because I felt intrigued by the subtlety of it.
The problem that haunts me is this:
Suppose, I have a generator point G on an Elliptic Curve (say SECP256k1 or any curve) , an integer x, which is the private key of this scheme, and I generate the public key P= [x]G . Then, I encode the message to a single number (e) that will be surely less than p, the prime number of the field (256 bit).

ENCRYPTION : I generate a random number k, less than N, where N, is the order of the curve, and also: R = [k]P .
I also choose a point C = [k]G. Then I take the x coordinate of R, and do: (x_coordinate of R*e) modulo p -> this will be the cipher text.

DECRYPTION: I take the chosen point C, multiply it with x (private key) to recover the point R back, then I do :  (cipher_text*((x_coordinate of R)^(-1) modulo p))modulo p to recover e , the encoded message, which is then decoded back to plain text !

MY CONCERNS:
[1] Was that the right way to encode the message?
[2] If x_coordinate of R * e was smaller than 256 bits then modulo would output the same x_coordinate of R*e which can be easily factored on a computer, and x_coordinate of R could be recovered !

EDITS:
What can be the maximum size of x_coordinate of R * e when taking modulo p ? I understand that it should be less than p, but even when I take blocks of plain text such that Rx*e alone exceeds ( 485 bits)the bit size of p (256 bits) I'm able to recover the encoded message back ! I do not know the reason for this creepy behaviour!!! ? Sorry, I'm fairly new to the math of all this !!! BUT: If x_coordinate of R*e is of the order of 2000 bits I totally loose data !!! Infact I am getting it wrong if thats the case!
This is what gives me trouble:

/************************
     Code for illustration of
     my mathematical problem
******************/
#include <iostream>
#include <cstdio>
#include <cstdlib>
#include <gmpxx.h>

using namespace std;
mpz_class ModInverse(mpz_class a, mpz_class b)
{
    mpz_t inv;
    mpz_init(inv);
    mpz_invert(inv, a.get_mpz_t(), b.get_mpz_t());
    return mpz_class(inv);
}
int main()
{
      // Prime used by SECP256k1
      mpz_class p=mpz_class("115792089237316195423570985008687907853269984665640564039457584007908834671663");
      //Let this be some encoded message ...
      mpz_class msg=mpz_class("123115792089237316344566776544467896775567567584007908834671663758400790883");
      // Let this be the x coordinate of R
      mpz_class x=mpz_class("712164785702978780789493774073370493892893827485075314964804772812648384");

      cout<< "Encode Message :  "<< msg <<  endl;
      cout << "\nx coordinate of R * msg"<< msg*x << endl;
      cout << "Product bit length: " << mpz_class(msg*x).get_str(2).length()<< endl;
      // Bit length exceeds modulo bit length
      mpz_class cph=(msg*x)%p;
      cout << "Cipher : "<< cph<< endl;

      cout << "\nDecrypted message : "<<  (cph*ModInverse(x, p))%p<< endl;
      if ((cph*ModInverse(x, p))%p == msg){
      cout << "    Crypto successfull !!!"<< endl;
      }
}

EDIT 2:
If (x coordinate of R * e ) is less than p then with sufficient amount of cipher text of that form, can an attacker with some cryptanalysis crack it ??? I'm reading a message in blocks...

Sorry If I'm wrong !!!

Every help will be appreciated!!!


texts: Simplified universal composability (SUC): can I model the use of encryption? Can I prove fairness?

texts:
I have been reading Canetti, Cohen and Lindell's paper, "A Simpler Variant of Universally Composable Security for Standard Multiparty Computation", and there are some parts that I didn't understand.

In page eight the authors mention that

  we cannot guarantee fairness in the SUC framework, nor model local
  computation via an ideal functionality (as is used to model digital
  signatures and public-key encryption in the UC framework).

Since fairness cannot be modeled, does that mean I cannot prove that a voting scheme, for example is fair (that is, that either the protocol finishes execution and everybody learns the result or nobody learns  anything)?

And does the second part of the quotation mean that I cannot model the use of encryption and signatures in whatever protocol I'm using? I doubt that, but the wording used in the article got me a bit confused.


texts: Alter plaintext in block cipher AES in CBC mode

texts:
How can I alter the plaintext before decryption by changing the IV?

I know what the value of the plaintext should be. I also know the value of the IV (initial vector). The IV and the AES block are both 16 bytes long.

What I am trying to do is change what the plaintext will be into something meaningful. "SEND ME THE DATA ENCRYPTED" is the plaintext and "8f6f27b5dbfa2ba8367262bda7154d95" is IV.

I want to change the word "ENCRYPTED". I can change everything before using by changing the IV it but I cannot change it.

This the message encrypted:

IV: 8f6f27b5dbfa2ba8367262bda7154d95
CT: 798e0ff8b06cc27c1591a4088531a64a9b76a9be87a3e944c6e7000f24f5b9f9


texts: Simplified Example of ECC to use in the classroom

texts:
I have come up with the following rudimentary example of how ECC relates to asymmetric keys.
Is this a valid explanation of ECC and its relationship to asymmetry?
To only be deciphered by the person with the private key, it is necessary to use methods nontrivial in cryptography. To randomize the key, a set would be required to contain multiple solutions of which only one is the key.  Primes are also used in ECC, so a useful approximation for implementation would be Gauss' approximation to primes.
$ x^2+xy+x−y^3$
will be used as the basis for this example.
A random point may be selected from within the area of the curve, generated by a set of functions and a rotating exchange of variables.
The shake in the cipher would be:
$k(n)+(−y^3)+x+xy+x^2=kG$
for:
$k(n)+(−y^3)+x+xy+x^2=k$
There are four solutions for $y$ which allows one to be a random key in this example.  The asymmetry comes from the rotation of solutions to $y$, coupled with having to know that $y$ is the variable to be solved for.
Is this a good basic example of ECC?
For proof let Alice create the message $k$, and then create $kG$.  Bob receives $kG$ and has been told by Alice in a separate message that the key is negative and a solution for $y$.  Thus Bob knows to decipher $kG$ he must use:
$$y = -\frac{2^{1/3} x}{(\sqrt{(-27 k(n)+27 k-27 x^2-27 x)^2-108 x^3}-27 k(n)+27 k-27 x^2-27 x)^{1/3}} - \frac{(\sqrt{(-27 k(n)+27 k-27 x^2-27 x)^2-108 x^3}-27 k(n)+27 k-27 x^2-27 x)^{1/3}}{32^{1/3}}$$

To summarize and make my question as explicit as possible, is this a workable example for how asymmetry relates to ECC?


texts: Curve25519 over Ed25519 for key exchange? Why?

texts:
I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures.

My question is why not use only Ed25519?

This implementation supports Ed25519 and key exchange so what is Curve25519 needed for?

Are there any security considerations where it beats Ed25519 key exchange?

This question from CryptoSE answered why to use Ed25519 over Curve25519 for signatures but why not to use Ed25519 for key exchange?


texts: Showing the concatenation of pseudorandom functions is a pseudorandom function

texts:
The definition of a pseudorandom function is:

  Let $F:\{0,1\}^*\times \{0,1\}^* \to \{0,1\}^*$ be an efficient,
  length-preserving, keyed function. $F$ is a pseudorandom function
  if for all probabilistic polynomial-time distinguishers $D$, there is
  a negligible function $\text{negl}$ such that:
  $$\bigl|Pr[D^{F_k(\cdot)}(1^n)=1]-Pr[D^{f(\cdot)}(1^n)=1]\bigr|\leq  \text{negl}(n),$$
  where the first probability is taken over uniform
  choice of $k\in \{0,1\}^n$ and the randomness of $D$, and the second
  probability is taken over uniform choice of $f\in \text{Func}_n$ and
  the randomness of $D$.

We want to show whether or not the following function is a pseudorandom function.

  Let $F$ be a length-preserving pseudorandom function. For the
  following construction of a keyed function $F':\{0,1\}^n\times \{0,1\}^{n-1}\to \{0,1\}^{4n}$, state whether $F'$ is a pseudorandom
  function: if yes prove it, if not show an attack.
  $$F'_k(x)\stackrel{\text{def}}{=}F_k(0\parallel x\parallel 0)\parallel F_k(0\parallel x\parallel 1) \parallel F_k(1 \parallel x \parallel 0) \parallel F_k(1 \parallel x \parallel 1).$$

The problem I am having is applying the definition to the function $F'$. Can I have some assistance?

Remark The question that been linked to this question, does not use the definition to show that it's pseudorandom function.

Looking at a similar problem. I started with strings of length $n=2$,
$$F'_k(0)\stackrel{\text{def}}{=}F_k(000)\parallel F_k(001) \parallel F_k(100) \parallel F_k(101),$$ and
$$F'_k(1)\stackrel{\text{def}}{=}F_k(010)\parallel F_k(011) \parallel F_k(110) \parallel F_k(111).$$
However there isn't a connect between the two. The same is true for $n=3$. Hence why I believe that this is a pseudorandom function. Now I just need to formally prove it is so.

Is the following correct?

Attempt at a proof: We claim that $F'_k$ is a pseudorandom function. To prove this we will do a proof by contrapositive. i.e. If $F'$ is not a pseudorandom function, then $F$ is not a pseudorandom function.

Suppose $F'$ is not be a pseudorandom function. We want to show that $F$ is not a pseudorandom function. Since $F'$ is not a pseudorandom function, then its values on any two (or more) points are correlated. However since $F'$ is composed of $F$ then this implies that $F$ has values on any two (or more) points which are correlated. Hence $F$ is not a pseudorandom function.


texts: Cryptanalysis and weaknesses of SEED cipher

texts:
I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've found two papers that demonstrate attacks - a differential fault analysis, which is fast but has infeasible requirements, and another differential attack that breaks 8 rounds.

For example, this paper says you can do key recovery by injecting faults into the input registers of the G function. What does that entail at a practical level?

Am I missing anything else? Is there anything I should warn them of?


texts: Keeping the key and IV safe when AES256 encrypting publicly known data

texts:
I am encrypting some publicly known data, and some private data using the same key, using AES256 with CBC.

An attacker does not have the ability to choose what the public data is.

Is this safe?  (It looks to be, according to: Why is AES resistant to known-plaintext attacks?)

Assume I encrypt 4096_zeros.plain (public data) and my_private_data.plain with the same key and iv, producing 4096_zeros.crypt and my_private_data.crypt.

Is it possible for an attacker to use 4096_zeros.crypt to speed up either:

the decryption of my_private_data.crypt, or
the recovery of the key and iv.

Is using (and storing) a different iv for each file sufficient?  (Am I correct in thinking that I'd need to store the iv with the encrypted data?)

If not, would adding 32 random bytes to the start of each file (which would be ignored after decrypting) be sufficient?


texts: Could this alternative hash based MAC construction be as, or even more secure than an HMAC?

texts:
Begin hashing (Key||Message)
Encrypt the hash state (or some part of it, such as the first 128 or 256 bits), with the key.
Add the encrypted hash state to the hash and return the result.

This could be roughly described as Hash(Key||Message||Encrypt(Previous hash state))

There are several properties about this:

It may be faster than an HMAC in practice, especially for shorter messages (modern hardware accelerated encryption is up to 5x-10x the speed of hashing).
Encrypting the hash state in stage (2) is a psuedo-random permutation, rather than just a PRF and so may have stronger security guarantees (this is the job of the more math-oriented people [i.e. you guys/girls] to try to analyze though).
A practical advantage of HMAC, though, is that it could work with arbitrary “secrets”, that are not necessarily psuedo-random, but this construction would only work if the “secret” is an actual key associated with some cipher (though the “secret” could be hashed of course, to yield a key) - this may not be a significant limitation in practice though, as in most cases it is used with an actual key.

(Also consider a “weaker” version where stage (1) only performs Hash(Message), [i.e. without the key])

[Non-expert alert: I’m not a cryptographer or even a computer-scientist, so I don’t have the knowledge or capacity for the type of percise mathemtical reasoning that’s needed to analyze this. I guess that’s why I’m asking it here..]


texts:
I'm studying possible attacks on CMAC and I've found the NISTSP800-38B document where a list of possible attacks are defined.
However I have some doubts on possible attacks using forged messages. For example:

Considering a key of 128bit and a message of 128bit, is it possible to recover the key (e.g. if the message is all zeros)?
Which is the suggested minimum message length compared to the key length? Do you suggest some requirements in order to avoid forgery attacks?
Do you have any link or document about other attacks on CMAC?


texts: I have created values for RSA encryption but it doesn't always work

texts:
I am using the values as follows:

$(p, q, n, \phi(n), e, d) = (1033, 5039, 5205287, 5199216, 65537, 3784241)$

Yes, I have made sure $e$ and $\phi(n)$ are coprime.

For example, if I were to encrypt the value $13130$, I would get $4664915$ and then I decrypted $4664915$ and got $13130$.

The problem is when then I encrypted the number $1310731326$ and got $3386045$, when I went to decrypt $3386045$, I got $18660$ which is nowhere near $1310731326$.

I've been trying all day and still can't find the solution. Can someone help me please!?!?!


texts: Rainbow table for DES with all-zero plaintext?

texts:
Consider the function $F$ from $\{0,1\}^{56}$ to $\{0,1\}^{64}$, mapping the operative bits of a DES key to the ciphertext for all-zero plaintext. How could we organize a rainbow table to invert that function with high probability, low computational cost, and a reasonably-sized table that can be constructed at reasonable cost (beyond the cost of $2^{56}$ DES computations, of course)?

Is there such a table accessible online, in essence breaking DES knowing ciphertext for all-zero plaintext? It may have (had) practical cryptanalytic applications against (obsolete) protocols using single-DES and spitting ciphertext for all-zero plaintext, perhaps under some stimulus.

Credit: this question was inspired by a recent comment by Antikithira.

As a test vector:
$$F(\mathtt{00000000010001010001001100111000100101010111001101110111})=\mathtt{1101010111010100010011111111011100100000011010000011110100001101}$$
or equivalently
$$F(\mathtt{00451338957377}_{16})=\mathtt{D5D44FF720683D0D}_{16}$$
with this example corresponding to the DES key $\mathtt{0123456789ABCDEF}_{16}$.

Generalization: how do we organize a rainbow table of some easily computable, random-like function $F: \{0,1\}^m\to\{0,1\}^n$?

Addition: I'm unfamiliar with rainbow tables in general, so ideally I would like a self-contained answer that covers the basics as applied to this problem:

What parameter(s) do we use to control $\text{table size}\over\text{search effort}$, and odds of search failure if applicable?
How is the table organized?
How do we compute the table, for what expected cost?
How do we search?


texts: CCA-2 key recovery attack to an homomorphic scheme?

texts:
It is known that homomorphic encryption schemes are not secure against CCA attacks. This is because in the security game, the attacker may use homomorphic evaluation to cheat in the the challenges and ask for a decryption of a (homomorphically equivalent of the) challenge itself.

However, I found a key-recovery attack. The attacker adaptively asks for decryption of ciphertexts, and at the end she knows the secret key.

Is this of some actual value? Or, just because the scheme is known to be CCA insecure, the hypothesis of an attacker asking for decryptions is no longer valid?

Or else, maybe I am not aware of generic key-recovery attacks using CCA semantic security attacks? If this is the case, please point out a reference.


texts:
Since 18th of December 2010 Germany makes use of an identity card that should allow electronic authentication:

(image source: commons.wikipedia.org)

From a users perspective, the authentication seems to work as follows:

A program requests permission to read information (name, birth date and place, address, photo, serial number, fingerprints) and/or to authenticate
The user puts the card on a reader (see list of readers)
The users gives the program permission to authenticate / get the requested information by entering a PIN

According to Wikipedia, a protocol called PACE which seems to be similar to PAKE is used (English specifications of PACE are here).
I've skipped through the first part of the specification and found:

  The keys and operations for signatures are described in an
  algorithm-independent way. A mapping to RSA and ECDSA can be found in
  Part 3 of this Technical Guideline.

I guess that authentication works with RSA. But I would like to get some sources. So my question is:

How does identification currently work with the German identity card?


texts: (How) Can we use HOTP for file encryption?

texts:
I recently went through the list of available KeePass plug-ins and noticed one that advertises support for HOTP as a means to derive the database key.

Now I trust the developer of this plug-in who is Dominik Reichl, who also signs the KeePass releases, so I doubt this is some sort of KeePass-only feature that won't actually increase file security.

How can we use HOTP to as a factor to derive a key suitable for file encryption?

This is especially puzzling as it claims support for any HOTP client that complies to RFC 4226, which advises to compute the shared-keyed HMAC of a counter and then convert this into a decimal number and I really don't understand how one could leverage this number into a good source for the key.


texts:
Is it possible to prove that I have half a key to decrypt file, to someone who has other half, without disclosing my part?
Or better yet, could you suggest a place where I can read about solved and unsolvable practical cryptographic problems like this one?


texts: Any point to AES on password with hardcoded key?

texts:
I'm inheriting a project that stores a used password in a config file, which is generated by the user giving their password in plain text, and the project giving back a key generated through .NET's Rfc2898DeriveBytes with a given salt on the aes encrypted cipher text (which the user then has to put in the config themselves). The password is decrypted and used when the project starts up for that user.

Since the key and salt are statically compiled into the project as strings, it seem kinda pointless to me, like basically its the same as storing a jibberish password in plain text, with added overhead, right?

Am I missing something here?

EDIT

After asking around about the code, the point is that we're giving this application to a different team to run under a network domain account, so we wanted to prevent them from having the password for the account the program is supposed to run under.


texts: Comparison of NTRU-based schemes and LWE-based schemes

texts:
What advantages and disadvantages can be distinguished in NTRU-based and LWE-based schemes relative to each other? In what cases which scheme gives advantage?

UPD: I'm interesting in two things: 1)how well-studied their respective hardness problems are? 2)how fast existing NTRU-based and LWE-based PKE schemes relative to each other?


texts: Just how surjective is a cryptographic hash like SHA-1?

texts:
From “Are common cryptographic hashes bijective when hashing a single block of the same size as the output” and “How is injective, inverse, surjective & oneway related to cryptography”, it is suggested that cryptographic hashes are surjective. For avoidance of doubt, surjective means this:

whereby all the hash inputs (X) correspond to a reduced set of outputs (Y). This forms holes in the continuity of the output range, and we call them collisions.

Consider any hash function like SHA-1. The size of the possible input domain is $2^{160}$ if we stick to the block size. My linked answers suggest that the output co-domain is less than  $2^{160}$.

How much less exactly?

Are there any proofs or estimates to put a scale on this?  I wonder if the avalanche effect has any bearing on this?  This is probably extremely naive, but does anyone have anything better?


texts: What attacks does future secrecy protect against?

texts:
Consider messaging between 2 parties. A sequence of messages are exchanged between the parties using encryption. We consider an attacker that has at a minimum a log of all the (encrypted) messages sent between the two parties.

Forward Secrecy: encryption keys are constantly updated in a non-reversible way, this means that if the attacker gains key $K_i$ they can derive $K_{i+1}$, $K_{i+2}$ and so on and decrypt message $M_i, M_{i+1}, M_{i+2}$ but they cannot decrypt any previous messages.

Future Secrecy: Like the Axolotl double ratchet, both sides constantly generate new public/private key pairs and only the public parts are exchanged over the communication channel. This means that if the attacker gains private keys $AK_i$ and/or $BK_i$ they can decrypt a finite number of messages $M_i$ or maybe $M_i, M_{i+1}$ but they cannot decrypt any further messages. They also can't decrypt previous messages.

What I don't understand is the security value of future secrecy.

  What kind of attack situation would future secrecy protect against?

It seems like an attacker would have to have exploited one of the messaging devices and read those temporary private keys from its memory - but then couldn't it just read the decrypted messages from memory and not bother with a cryptographic attack?


texts: Message authentication codes construction

texts:
I was reading the paper $[1]$ and came across the scheme that I show below. While I understand the scheme well, I don't understand why they prepend a 0 to the block containing $r$ and a 1 to all other blocks. What is achieved by this? They never explain why they do it. Here is the scheme as presented in the paper:

$[1]$Bellare, Mihir, Roch Guérin, and Phillip Rogaway. "XOR MACs: New methods for message authentication using finite pseudorandom functions." Advances in Cryptology—CRYPT0’95 (1995): 15-28.


texts:
I'm planning on combining RNGs from several sources (Windows, Linux, OpenBSD, etc.) for generating one time pads but I have some questions that I don't know how to answer regarding xoring the outputs of those random number generators together. Trying to search for answers to these is not doing well either.

Suppose we have 2 random number generators, g and h. If g is secure and h is not (an attacker can find some kind of pattern to predict future outputs or an attacker can influence or gather output data from said generator), is g ^ h secure? I believe this one is yes since if we have bits g1 and h1 and an attacker knows h1, g1 ^ h1 will be effectively random to said attacker since he does not know what g1 is.

Suppose we have an unbiased random number generator g and a biased (biased such that p(1) != p(0) and p(1) = C for some constant C) random number generator h. Is g ^ h unbiased? I sort of think this is yes but at the same time I'm not sure since then we should be able to just xor any biased (constant) random number generator output with 0xAA and get an unbiased one.

To go along with the previous question suppose we have a biased (constant like h in the previous question) random number generator and we xor every other output bit with 1. Is the output unbiased?


texts: Figuring out seed/internal state from HMAC-MD5 output

texts:
Here is the scenario i'm imagining, I use the python random library to generate x-bit key that I use to generate a HMAC-MD5 output. Every HMAC-MD5 has uses a different random number as its key.

My question is if I can get a large number of HMAC-MD5 output, is there anyway I can figure out the internal state being used by the random function or the module itself?


texts:
Let's suppose I want to use a (keyed) hash function as a stream cipher, I provide a key and a message to be hashed as a counter (like a nonce), and so, XOR each hashed output block on the plaintext.
Is it possible that one or more different keys produce the same hashed block and so can revel part of plaintext when XORed? If equivalent keys exist, what is the percentage of key space should be brute-forced to find them?


texts:
Let $\mathsf{Exp}_{A,\Pi}(\lambda)$ be some indistinguishability experiment that finally outputs 1 if A outputs $b'$ that satisfies $b' = b$, otherwise 0. Then the textbooks often define the security like this:

  If for all PPT adversary A, there exists a negligible function $\mathsf{negl}$ satisfies $\Pr[\mathsf{Exp}_{A,\Pi}(\lambda) = 1] \leq 1/2 + \mathsf{negl}(\lambda)$, then we say $\Pi$ is a indistinguishable scheme...

However, suppose there is an adversary A that wins the experiment in possibility 0.4, then we can construct another adversary A' that call A as an oracle, and output $b' = 1 - {b'_{A}}$ (where $b'_{A}$ is the output of A), then A' will win the experiment in possiblity 0.6.

So it seems that if $\Pi$ holds the indistinguishability, then there should not exist any adversary A that $\Pr[\mathsf{Exp}_{A,\Pi}(\lambda) = 1] < 1/2 + \mathsf{negl}(\lambda)$, for it also means an A' that $\Pr[\mathsf{Exp}_{A',\Pi}(\lambda) = 1] > 1/2 + \mathsf{negl}(\lambda)$.

Hence my question is, why we don't define the indistinguishability directly via the conditional $\Pr[\mathsf{Exp}_{A',\Pi}(\lambda) = 1] = 1/2 + \mathsf{negl}(\lambda)$?


texts: How many trials does it take to break HMAC-MD5?

texts: I know that you can find collision in MD5 with 2^64 trials using Birthday paradox. Now everyone is saying that HMAC-MD5 is significantly more secure. How can I quantify this security? My question is how many trials does it take to find a collision in HMAC-MD5?


texts: Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

texts:
Consider a common practically-collision-resistant hash function $\mathcal{H}$ (e.g. SHA-1, SHA-256, SHA-512, RIPEMD-160), perhaps based on the Merkle–Damgård construction as are the first three. We define a Message Authentication Code $\mathcal{C}$
$$(k,m) \mapsto \mathcal{C}(k,m)=\mathcal{H}(m\mathbin\|k)$$
where $\mathbin\|$ denotes concatenation, $k$ is a secret key (constant, or at least of fixed size), and $m$ is a message (possibly of variable length). Assume that an adversary can (iteratively) submit queries with $m_j$ and obtain $C(k,m_j)$, and wants to obtain $k$ or otherwise compute $C(k,m)$ for some $m\ne m_j$.

That MAC $\mathcal{C}$ is not trivially bad. In particular, if $\mathcal{H}$ was indistinguishable from a random function in the Random Oracle Model, $\mathcal{C}$ would be secure. And even though $\mathcal{H}$ may have the length-extension property, it does not turn into a devastating attack on $\mathcal{C}$.

The less impractical generic attack that I see is that if a collision was known for $\mathcal{H}$ with the colliding messages of moderate identical length, it could be deduced countless collisions for $\mathcal{C}$. Hence security is demonstrably not better than collision-resistance of $\mathcal{H}$ (for identical-length messages). We could assume that $k$ is half the size of the result of $\mathcal{H}$, and hope that the security is about 269 or is it 257 or even 252, 280, 2128, 2256 hash rounds for SHA-1, RIPEMD-160, SHA-256, SHA-512.

What are the known attacks against $\mathcal{C}$ (better than the above), and their cost, for each of these common hashes?

Is there hope for an argument that an attack against $\mathcal{C}$ would turn into an attack of similar cost against $\mathcal{H}$, or hint of the contrary?

Update: this answer to a similar question is of interest, but I fail to find that it really answers the present question.

Update 2: I am aware that the construction considered is weaker than HMAC, and in particular is vulnerable to collision on $\mathcal H$; I stated that, and that it is thus pointless to have the key wider hopeless to target security against some attacks better than half the hash's size. I'm asking exactly what cryptanalytic attack better than finding a collision on $\mathcal H$ there are. There is room for such an attack only by exploiting a weakness in the structure or/and the round function of a concrete $\mathcal H$.


texts: What is the time complexity of the basic components of a symmetric cipher?

texts:
I have a very basic knowledge on time complexity and even less on programming, so please bear with me. I am interested to know the time complexity in big-O notation of some of the basic operations in symmetric ciphers. In particular:

matrix multiplication (including permutation matrices)
XOR of bit strings
expansions, for instance expanding 64 bits to 128 bits
bit shifts
permutations using a P-box (say the one in PRESENT)
substitutions using an S-box (again, say the one in PRESENT)
combining the operations (as above or other operations)

Related to item 1: If I multiply (say) $vP$ where $v$ is a $1 \times n$ vector and $P$ is an $n \times n$ permutation matrix I see $1 \times n \times n$ multiplications and $n \times n$ XORs (assuming bits). So am I right to sat $O(vP) = n^2 + n \approx n^2$ ?

Related to item 2: a linear operation so I assume $O(1)$ for each XOR and therefore $O(n) = n$ for $n$-bit string XOR another $n$-bit-string.

Related to item 3: If expanding $64$ bits to $128$ bits then it seems there are $128$ operations so $O(n) = n$

Related to item 4: intuitively I should say $O(1)$ for each bit shift and therefore for $n$ bit-shifts $O(n)=n$.

Related to items 5 and 6: I really have little idea. But if it is the $PRESENT$ P-box then I suppose $64$ operations and therefore $O(n=64)=n$. As for the S-box, I think $O(n = 16) = n$, assuming the $PRESENT$ S-box.

Related to item 7: I think we add the time complexities of each component but can approximate the answer as the most time consuming of all terms.

I have looked at a few videos and books on time complexity but most speak in programming languages, and I cannot find anything simple on time complexity for cryptographic components (functions?) as describable above.

One final question:

I assume a cipher has a total time complexity. Where can I find the time complexities of a given cipher, especially DES, PRESENT and AES? And is there available time complexities per round of these ciphers?


texts:
It's well-known that computing lots of hash functions (like SHA1) in parallel involves the use of GPUs in most cases.  However, when doing something serially, such as computing sha1(sha1(sha1(...sha1(x)))) parallelism would not seem to be that useful.

I ran into this very problem recently, and I started running a program on my Mac laptop using python, at about 270k hashes/sec.  Moving to a C implementation, I was able to get 750k hashes/sec.  And strangely, using VirtualBox with Kali and the same C implementation, about 1.3m hashes/sec.

(There is some discussion one can find online regarding why a Linux version of SHA1 code might be faster than a Mac OS version, even when the former is through a virtualization layer, but this is beyond the scope of my question.)

Question: If I want to compute SHA1 as fast as possible and parallelism is not helpful, what's the fastest way to do it?  I suppose the answer involves special hardware?  Or buying a desktop with a good CPU and overclocking?


texts:
how can is possible to know if an elliptic curve is suitable for protocols that adopt pairing?

For example, in Certificateless Cryptography with pairing, is it possible to know if all elliptic curves (e.g. $secp160k1/r1$, $secp192r1/k1$ and so on) are suitable?

Is there a list that facilitate me to see if a curve can be adopt for Certificateless or not?


texts: I want to know how rand() works (even when I don't provide any seed how it produces PRNs?) thanks!


texts:
In my opinion the most important development in cryptography in the last 30 years is the precise definition of semantic security of a cipher. This definition captures the intuitive ideas of Martin Hellman, Ralph Merkle, and Whitfield Diffie of the mid-1970's tying cryptography to complexity theory that gave rise to the new cryptography with all its beautiful applications, multiple use of a key for file encryption, digital signatures, digital payment systems, one-way functions, one-way trapdoor functions, collision-resistant hashing, message digest codes, and so on.

My question is who came up with the precise definition of semantic security? Can you provide the reference to the paper that first defined semantic security precisely?


texts: Very short block ciphers for equally-short plaintexts

texts:
I'm trying to develop an encryption technique for encrypting short phrases (such as reversibly-anonymized names) in text. The key-generation and ciphertext-representation details are fungible, but most of the techniques I'm envisioning would be best facilitated by a function with the following properties:

I want to encrypt multiple plaintexts with a common key (which is expected to be at least 256 bytes) in such a way that the encrypted string is no larger than the source text (which may be compressed with a short-string-compression algorithm like smaz, both keeping the data small and increasing input entropy).

I looked at common symmetric-encryption ciphers like AES and Salsa20, but the block sizes of both of these result in the output being significantly longer than our input (which may be as short as a single byte).

Since my key material is expected to be almost always longer than the input, I also considered using a one-time-pad approach like just simply XORing the input against the bytes of the key, but this is subject to a trivial known-plaintext attack: if an attacker can guess one encrypted string's input representation, they can can obtain a partial key that can decrypt any other string of that length or shorter by XORing against that plaintext.

I also considered a stream-cipher-like approach using each byte as a block, but that had the issue of inputs with the same prefix having the same prefix when encrypted (ie. if I know "John Smith" encrypts to "ABCDEFGHIJ", then I know "ABCDEKLMNOPQ" is another string beginning with "John").

Is it possible to symmetrically encrypt multiple shorter-than-the-key byte sequences (without nonces) in such a way that

the output is the same length as the input,
inputs with similar subsequences (eg. identical prefixes) don't have matching (partial) ciphertext,
and other plaintexts can't be derived from a known plaintext (or at least, not trivially)?

It feels like what I'm asking for is a block cipher that can operate on blocks of any width from $8$ to $n$ (where $n$ is the length of the message, or at least the length of the key). Does such an algorithm exist?


texts:
How can I implement following problem in java code for addition? (here I use Paillier homomrphic encryption):
Input would be to generate a new AES key, encrypt the private data with that key, encrypt the AES key with the FHE key, and send the FHE-encrypted AES key along with the AES encrypted data to the compute node.


texts: How many public keys and private keys are needed for RSA?

texts:
I am just learning about RSA encrytion and I am somewhat confused.
First two prime numbers $p$ and $q$ must be chosen and multiplied to get $n$. Then we compute Euler function $\varphi (n) = (p-1)(q-1)$.
The public key $e$ is generated by choosing a random number that fulfills the condition $gcd(e, \varphi(n)) = 1$. And the private key $d$ is then computed $d * e \:\: mod\:\varphi(n) = 1$.
So if Alice wants to send a message to Bob, a pair of public and private key is generated. But if Bob wants to send something back to Alice, must another pair of public and private key be generated?
If this is the case, does it mean that for RSA between $x$ parties, there must be in total $x(x-1)$ keys (public and private) generated?


texts:
I've been searching for a way to create blind ECDSA signatures.
My research and experimentation has led me to believe that this is not possible.

I've been attempting to articulate why and I think that it is because it is not possible to apply a transformation to the message in a way which can be reversed whilst retaining a valid signature. The message and signature cannot be transformed as required because the ephemeral key is not known by the recipient, and if the key were known then the long term signing key could be determined. An ECDSA signature only permits validating that the signature was formed from the message and the private key corresponding to the expected public key.

I would like to confirm whether there are any known ECDSA blind signature schemes? I suppose publication bias might prevent this from appearing in the literature.

More generally are there any known ECDSA variants such as proxy signatures? My research has led me to the conclusion that it's functionality is entirely constrained to yielding a standard signature scheme.


texts: In ECDSA, why are u and v dividing by s?

texts:
The verification algorithm for ECDSA is:

$P=e\times G$,
$(r,y)=k\times G$, and
$s=(z+re)\times k^{-1} \bmod n$,

where $P$ is the public curve point, $G$ is the generator point, $e$ is the private key, $n$ is the order of $G$, $z$ is the message hash and $k\in [1,n-1]$.

$u = z\times s^{-1}$ and
$v = r\times s^{-1} \bmod n$.

If $u\times G+v\times P=(r,y)$, then signature is valid.

The math works for this, but why isn't something much easier done?

$P=e\times G$, $(r,y)=k\times G$ and $s=(k-rz)\times e^{-1}$

$rz\times G+s\times P=rz\times G+((k-rz)\times e^{-1})\times P=rz\times G+((k-rz)\times e^{-1})\times e\times G)=rz\times G+(k-rz)\times G=rz\times G+k\times G-rz\times G=k\times G=(r,y)$

So $r,s$ can be used almost directly in the $u\times G+v\times P$ equation and the same condition be used to check that the signature is valid. In addition, the formulation does not use as much division, which is computationally the most expensive part.

I'm sure there's some vulnerability with this more naive signature scheme. What is that vulnerability?


texts: Probability of generating same master secret key in Identity-based Encryption

texts: Suppose multiple servers use same IBE domain parameters (I mean same curve description parameters and field) for master secret key setup. Is there any possibility for generating the same system parameters?


texts: Key derivation using known parameters of playfair

texts: Is it possible to derive the key, for a playfair cipher, if both the message and cipher text are known?


texts: What is the purely mathematical definition of encryption strength?

texts:
An encryption function can be used to obfuscate pieces of information and later on retrieve them.

What is the yardstick for measuring how well the function encrypts the information ? Given any invertible function, which are the quantified parameters which measure how effective the function is to encrypt a message ?

I am assuming a finite domain for the function. Any other assumption may be stated.

Motivation: Is there any mathematical/set theoretic formulation at all... I ask this specially because I don't see this approach ever being used as has been rightly observed. My motivation is to find out weather the notion of 'encryption' can be captured fully in a mathematical formalism.-- or that we require other kind of 'concepts' to describe it fully. –


texts: How does $g^{x^2} \bmod p$ help you find $x$?

texts:
I was thinking about the Diffie-Hellman key exchange. One fact that we seem to know is that given a group generator $g$, a prime $p$ and the expression $g^x \bmod p$ its believed to be hard to find $x$; or more accurately $x \bmod(p-1)$.
Now the question is, what if we gave away some extra information. Such as $g^{x^2} \bmod p$.
My guess is that surely this should help us find $x$ in some fashion, but it’s not clear how.
Finding an exponent that sends $g^x$ to $g^{x^2}$ is as hard as finding $x$ given just our usual initial data. So that’s probably not the right way to exploit this information.


texts: Homomorphic encryption of logical OR/AND

texts: Are there any ways to perform homomorphic encryption of logical OR (or logical AND) without using fully homomorphic encryption?


texts: Is it possible to utilize an AES-128 encryption hardware unit for AES-256?

texts:
There exist processors (for example ARM v8/v9 archicteture based),
which cannot do AES-256 hardware based,
but are equipped with AES-128 encryption hardware units.

Is it possible to utilize an AES-128 encryption hardware unit
in some way to speed up the calculation of AES-256?


texts:
I believe I'm probably not the first person to think of using this as a trapdoor.

  Let $R$ be a square matrix ring, and $S$ a commutative subgroup of its multiplicative monoid.

  Let $P \in R$ be a publicly-known matrix such that for all $x \in S$, $x$ can be constructed by calculating $x = P \cdot D \cdot P^{-1}$, where $D$ is some diagonal matrix ($D$ isn't necessarily in $S$, and $x$ isn't necessarily a diagonal matrix).

  The trapdoor problem being: given $a \in S$ and $u = a \cdot b + b \cdot a$, find $b \in R$

What I don't know about is:

How difficult is it to find $b$?
What are some of the cases where finding $b$ would be easier than average?

My Guess:

Because it's not possible to retrieve $b$ using ordinary matrix operations, some search is required.
If $u = 0$, then $b = 0$ would be a trivial answer. If $u \in S$, then $b = (u \cdot a^{-1})/2$ would be another.

A bit of explanation on $S$: its elements are guaranteed to be commutative in multiplication because:

1) diagonal matrices are commutative in multiplication,

2) multiplying an element constructed as $a=P \cdot A \cdot P^{-1}$ with $b = P \cdot B \cdot P^{-1}$ where $A$ and $B$ are diagonal matrices yields $a\cdot b = P \cdot A \cdot P^{-1} \cdot P \cdot B \cdot P^{-1} = P \cdot A \cdot B \cdot P^{-1} = P \cdot B \cdot A \cdot P^{-1} = ... = b \cdot a$


texts: Compare two approaches for cracking RSA key

texts:
I came across these questions while studying for a crypto course, does anyone have any ideas on how to answer these?

(a) Random prime numbers of size 1536 bits are chosen to generate
an RSA modulus of size 3072 bits. Knowing that the number field sieve
factorization algorithm would succeed in factorizing an RSA modulus of this
size in $2^{128}$ elementary operations on average, compare the two following
approaches for cracking this RSA key:

i. factorizing the modulus using the aforementioned number field sieve
factorization algorithm; or

ii. factorizing the modulus by enumerating candidate prime factors and
looking for one that divides the modulus.

(b) Same question as above, but this time the primes p and q that make up the
modulus n = pq are no longer randomly chosen, but derived deterministically
from a user-supplied password. (E.g., we can use a pseudo-random generator
to map the password to a pseudo-random number r of the right length, then
use primality testing to find the first prime that is greater than r.) Feel free
to make any reasonable assumption you need regarding the password.


texts: Symmetric encryption algorithms with large IVs and authentication?

texts:
Most modern symmetric ciphers require a nonce/IV.  If the nonce is reused, security is lost.

If the nonce is large enough, it can be generated securely by using a CSPRNG.  This avoids needing to keep state between encryptions.  I am looking for algorithms that

have a large IV — specifically, one large enough that using a CSPRNG
to generate a fresh IV each time is secure.
provide authentication.
have easy-to-use, well-regarded, portable open-source implementations that
are resistant to timing attacks.

The reason for these requirements is that I am looking for an implementation that is (relatively) hard to misuse and works just about anywhere — and that is written by an expert cryptographer.

I have some ideas (such as encrypting a randomly-generated 512 bit IV with a single round of ChaCha20 – and then transmitting it) but I am not a cryptographer so I don't trust them.


texts: ElGamal against chosen ciphertext attacks

texts:
In Hoffstein, Pipher, and Silverman's book An Introduction to Mathematical Cryptography, the authors make the following remark:

  An attack in which Eve has access to an oracle that decrypts
  arbitrary ciphertexts is known as a chosen ciphertext attack. The preceding
  proposition shows that the ElGamal system is secure against chosen ciphertext
  attacks. More precisely, it is secure if one assumes that the Diffie–Hellman
  problem is hard.

where the "preceding proposition" is a walk-through of a proof that if one can decrypt ElGamal ciphertexts, then one can solve the Diffie-Hellman problem.

However, all the sources that I can find online (including several on this site) seem to make the opposite claim, that ElGamal is not secure against chosen ciphertext attacks.  The errata for the book makes no mention of this passage.  Is my understanding of the authors' statement flawed?


texts: Why does TLS 1.3 AES cipher require both a server and client traffic key/iv?

texts:
During the TLS 1.3 handshake using the cipher suite TLS_AES_128_GCM_SHA256 a server and client traffic key/iv will be derived using HKDF based on the shared secret, see rfc8446 #7.1
Why is it necessary to derive the key/iv for both the server and client instead of a single key/iv for encryption and decryption?


texts: How secure is this modified Bazeries Cylinder?

texts:
This device is a modification of the Bazeries cylinder, it has two stacks of 5 rotors which each bear two alphabets plus numbers 0-9, one in correct order and one in random order ( 36 characters in each row ). Plain text in 5 letter groups is entered by setting the rotors as in Fig 3. The shaded character on the bottom rotor is read and the whole rotor stack is then turned ( keeping the individual rotors in alignment ) so that this character appears on the top rotor.  The enciphered group is then read from top to bottom as in Fig. 4.  This group is then re-enciphered by the same procedure using the lower stack of 5 rotors, producing a doubly-encrypted code message.( Figs. 5 & 6 )

Obviously this would be devilishly difficult to decipher without knowing the rotor stack sequence and the random sequences of the alphabets on each rotor.  Frequency analysis, Kasiski tests and Index of Coincidence tests do not reveal any useful information. My question is, could this coding system be broken by other than brute force methods ( which would be very tedious and expensive ) ?

To maintain security, the rotor stack sequence would be changed in accordance with a code book list ( or other protocol ) after every 50 groups.

A specimen of code produced with this device follows :

4FRLO 7W0W9 PL84F 7BITX 9VNBN H0U81 DJ3PU 1R27H 9SCN3 FJTBG 9CIQK D1ZZU
IJB4H YML6O DHTZU IFJBH UABHD L37I8 RYEXE QQ9SU BJX4G YG0KT 7GJAT X0XOW
R9DT1 MEH3A EU8HO 9J70M DO0E4 STXQS 9VS5N 9ICZ9 KN4TR 55AMC ELLGW AQ2IH
AEOC8 E0EMP FM36V OGBEP 8MLO5 0GY00 KSRQN MMJ88 DQYB8 4GU0X 1ZPVU FQTQD
4LVKW 4W4G0


texts: What makes an algorithm "fast in software" vs. "fast in hardware"?

texts: When reading about different algorithms, I often encounter claims that various algorithms are "fast in software" (e.g. Salsa20) or "fast in hardware" (e.g. DES). What properties make a cipher relatively faster in hardware or faster in software? Why would something be fast to implement in hardware but much slower in a software implementation?


texts: Randomness Testing of Cryptographic Algorithim

texts:
I am new to algorithim randomness and confused at I guess a basic level question. Is it common for any cryptographic algorithim to have repetitions in its output i.e.let say 34 and D8 are two consective bytes which are repeting at random intervals.

I have got an encrypted file and it has 34 D8 at line 5 and then same sequence at line 903 and then again at 1002. File has total 1500 lines.

This also goes for other byte sequences. Is there any safe threshold in which there shouldn't be any repetition? I am asking it generally for any good encryption algorithim (AES 256, AES 128, Triple DES etc.)


texts: What does Maj and Ch mean in SHA-256 algorithm?

texts: I'm guessing they're some kind of standard function but what do they do and what do the names mean? A little explaination or link me to an article would be great.


texts: RSA - Calculating $d$ given $\varphi (N)$ and $N$

texts:
From this discussion, I know that if I know $\varphi (N)$ and $N$ (where $N=pq$, $p$ and $q$ prime), then I can very easily get $p$ and $q$.

Suppose I have the encrypted message $c$. I want to get the exponent $d$ such that $c^d \pmod N$ is the original message $m,$ without knowing $e.$

I know that it is theoretically possible to go through all the exponents from $1$ to $\varphi (N)$, and then see if the resulting message makes sense. But since I know $p$ and $q$ and $N$, I think there should be a better way than brute force.

I don't know if trying to factor $\varphi (N)$ is that much easier than trying to factor $N$? That means that even though not all numbers between $1$ and $\varphi (N)$ will have inverses (since they will not all be relatively prime to $\varphi (N)$) I won't know based on the information I have.

Is there a better approach to breaking the encryption?


texts: How does IES compare versus AES and RSA?

texts: How does IES compare versus AES and RSA in terms of speed and security?


texts: Hardware Random Numbers - How to convert Voltage signal into binary?

texts:
I have a physical unit, e.g. a resistor. I bias it with current and measure the voltage. Let us assume that the fluctuations ($\Delta V=V-<V>$) of this voltage signal are random. Now, $\Delta V$ contains floating numbers with some certain significant digits, say [1.243, 3.567, -3.987, ..., etc]. To test these random numbers (using something like DieHard test), I need to convert these values into binary, 0 or 1.

How do I do that? One way to do it is to set a limit, say 0, such that positive values are mapped to zeros and negative values are mapped to ones (or vice versa). Is there any better way to do it?


texts: Homomorphic encryption watermarking identity

texts:
I've been doing some research on FHE and SWHE schemes, most specifically on watermarking.
As far as I've understood, you take as the merchant, take the buyer information encrypted and his public key and perform the watermarking embedding on the encrypted domain exploiting the homomorphic properties. But how can the merchant verify the idendity of an ilegal destribution on its product since the information of the buyer is encrypted by him?
The papers I'm refering to are:
-"A Robust Zero-Watermarking Algorithm for Encrypted Medical Images in the DWT-DCT Encrypted Domain" Jiangtao Dong, Jingbing Li*, Yucong Duan, Zhen Guo
-"Anonymous Fingerprinting with Robust QIM Watermarking Techniques" J. P. Prins, Z. Erkin, and R. L. Lagendijk
Thank you in advance!


texts:
Given the following Trap-door Commitment scheme

Secret key receiver: $x_B \in_u Z_q$
Public key receiver: $y_B = g^{x_B} \mod p$

Here, $p=q*k+1$ for two primes $p,q$ and $k \in Z$. And $g$ is the generator of subgrup $G_q$ of $Z_p^{*}$, of order $q$.

To the sender commit $w \in Z_q$, he selects $r \in_u Z_q$, the commitment is $c=g^wy_B^r \mod p$. To open a commitment, he sends $(w,r)$.

My question is: if I want create milions of theses public-secret keys for milions of different senders, could I reuse $p,q$?


texts: What kind of machine can generate 100-400 digits prime number? RSA

texts: The 64 bit machine's biggest number can be 2^63 (9,223,372,036,854,775,807). So what kind of a monstrous machine can generate 100-400 digits prime number? I probably don't understand something, so that's why I am asking.


texts:
Is there any algorithm for generating the same ciphertext from different plaintexts, depending on the key used? This seems similar to Honey Encryption, but I don't need to have every key give realistic data. I want to specify a set of keys and corresponding plaintext.

For example, "hey" encrypted with key1 and "bye" encrypted with key2 would both become "aaa". Decrypting with key1 and key2 would succeed and return the corresponding plaintext, while decrypting with any other key would fail.


texts: Breaking the discrete logarithm problem in subgroups of $G$

texts:
I need to find the discrete logarithm of 20 modulo 71 where the generator of the group is 7. I need to break the group $|G|=2 \times 5 \times 7$ in subgroups $|G_1|=2, |G_2|=5, |G_3|=7$. I am new to this. Can someone please help me out?

Edit:
Till now, I have reduced the above problem to the following system of equations (I don't know if I'm correct.):

\begin{align}
20^{35}&=(7^{35})^a\text{ in }G_1\\20^{14}&=(7^{14})^a\text{ in }G_2\\20^{10}&=(7^{10})^a\text{ in }G_3
\end{align}


texts: Encrypting 256 bit AES keys with AES ECB?

texts:
What are the pros/cons of using AES ECB mode to encrypt encryption keys (data encryption keys or DEKs)? Aware of the significant weaknesses when it come to encrypting low-entropy data that's greater than a block size and also aware of AES Key wrapping functions (nice post). The low efficiency of AES KW in high throughput cases is an issue in our case (thousands/millions of fields flowing, each encrypted with own DEK).

In our case, the data encryption keys

are high entropy (hardware RNG + 4 PRNG sources + crypto-hash expansion) and
will be 128/256 bits long (concerns on even longer keys?)

We're avoiding AES-GCM etc to skip the IV to reduce the size since every byte is precious (big data/high volume)

Update:

Integrity of the DEK isn't a concern in the threat model. DEK tampering will trigger decryption failure affecting Availability. Availability is a concern at a higher system level. (Also, if an attacker can modify the DEK bits, they can simply delete the entire field/data payload just after the encrypted DEK)
The main concerns are Confidentiality and Integrity of the data itself.


texts:
Suppose i have a crypto provider, i.e: i give that provider some plaintext bytes and get the encrypted result.
I don't know the used encryption method, but i know it is using a block cipher and the Block cipher mode of operation is something behaving like ECB (every block is encrypted individually => 2 identical blocks of plaintext should lead to 2 identical blocks of ciphertext, if there is no prefix) and thus vulnerable to different padding attacks.
The crypto provider may add a prefix and suffix to the plaintext but i don't know if and how long they are.

I want to execute different padding attacks on this crypto provider (Detect prefix and suffix length, bruteforce suffix in linear time, strip pre- and suffix, ...).
In fact everything works, but i need to know if the padding method used by the crypto provider is appending a padding block if the length of the plaintext % blocksize == 0. Otherwise my calculation of the length of prefix + suffix might be wrong.

Giving the described circumstances, is there a way to detect this without having to test for the exact used padding scheme ?

What i do atm:
To detect the blocksize and prefix + suffix length i start with encrypting one byte, get the length of the cipertext (cipher_a) and then add one byte to the plaintext (plaintext_n) till the length of the cipyertext (cipher_n) is larger as the first one.
Now i know:
blocksize = length(cipher_n) - length(cipher_a)
If the padding used DOES add an empty padding block:
fixes_length = length(cipher_a) - length(plaintext_n)
Otherwise:
fixes_length = length(cipher_a) - length(plaintext_n) -1

Short example which (hopefully) shows the problematic.
Suppose: blocksize = 3, prefix = "xx", suffix = "yy":
With an empty padding block:

 ╔═══════╦═════════════╦═════════╗
 ║ Chars ║ Plaintext   ║ Blocks  ║
 ╠═══════╬═════════════╬═════════╣
 ║ 1     ║ xxa yy-     ║ 2       ║
 ║ 2     ║ xxa ayy --- ║ 3       ║
 ╚═══════╩═════════════╩═════════╝

In this case the calculation is correct.
blocksize = 3
fixes_length = 6 - 2 = 4

Without an empty padding block:

 ╔═══════╦═════════════╦═════════╗
 ║ Chars ║ Plaintext   ║ Blocks  ║
 ╠═══════╬═════════════╬═════════╣
 ║ 1     ║ xxa yy-     ║ 2       ║
 ║ 2     ║ xxa ayy     ║ 2       ║
 ║ 3     ║ xxa aay y-- ║ 3       ║
 ╚═══════╩═════════════╩═════════╝

This fixes_length is wrong.
blocksize = 3
fixes_length = 6 - 3 = 3

I am relatively new to cryptography, so please excuse me if i got some terminology wrong


texts: Proof of application of $f(x)$ without disclosing input $x$

texts:
I have three nodes in a network: $\mathcal{S}$,$\mathcal{T}$,$\mathcal{R}$.

$\mathcal{S}$ supplies data $x$ to $\mathcal{T}$. $x$ is signed so $\mathcal{T}$ knows it actually comes from $\mathcal{S}$. $\mathcal{T}$ computes $f(x)=y$ and sends $y$ to $\mathcal{R}$. $\mathcal{R}$ uses the result $y$ in some computation. $f$ Is implemented in code and the code is public.

Question: Is there a way for $\mathcal{R}$ to know for sure that $y$ is the result of the correct application of $f$ to data supplied by $\mathcal{S}$, without disclosing $x$?

In other words: Can $\mathcal{T}$ prove that it correctly applied $f$ to trusted data when computing $y$, without disclosing $x$?


texts: Why can't the commitment schemes have both information theoretic hiding and binding properties?

texts: The commitment schemes like Pedersen's or Hash based, either have information theoretic hiding and computational binding or computational hiding and information theoretic binding. So can we ever get both information theoretic hiding and binding? Is it ever possible to do, or it is proven to be impossible?


texts: Use of less than secure random numbers for 'a' during an SRP proof of password

texts:
With Secure Remote Password protocol SRP6a random numbers are used for s, a and b. Where s is the salt registered with the user, a and b are random one time ephemeral keys of the user and host respectively. What would be the risk of letting some clients (old webbrowsers which don't have the WebCryptoAPI secure random numbers) perform a password proof using a which is less random than a good secure source. Lets say that they use the web browsers insecure Math.random and that is seeded with a timestamp.

Superficially if a was simply a nonce, not even a weak random, then an attacker can gain very little. With each login attempt a unique B is sent by the server which can always use secure random numbers. This random B is used with the nonce a to create a new S, then from that a new M1 and M2 proof of a new shared key.

Or is it the case that a being less than a high quality secure random would compromise the security of either the client or the server.

(Edit: Note that sending a from the server opens you up to a server sending a crafted a, s and B to attack the password using a dictionary lookup of M1 to give the password so that is not something that anyone should consider doing. The question is about whether a needs to be truly random not a question about suggested sources of secure random numbers for a)


texts: Rabin encryption when M is not Disjoint to n

texts:
I need help with proving that the encryption going well when the message $M$ is not Disjoint to $n$ (public key).

Encryption message $\ C= M^2 \bmod n$

Decryption message $\ C^{(p+1)/4} \equiv ±M \bmod p$ and $\ C^{(q+1)/4} \equiv ±M \bmod q$.

Now, we can't use Fermat's little theorem.
Suppose that $M \neq 0 \pmod p$ and $M \equiv 0 \bmod q$

(because $n = pq$ and $p,q$ are primes)


texts: Format of hybrid crypto envelope structure?

texts:
From posts including the accepted answer to

How to encrypt file with RSA and AES that anyone with RSA key can decrypt them?

hybrid crypto (AKA envelope encryption) a GPG-encrypted file has an element that is the symmetric-key-encoded payload and also an element that is the asymmetric-key-encoded symmetric-key.

I need to manually construct such a file using e.g. RSA and symmetric crypto APIs in a legacy system.

(Edited the following to clarify...)
I know from reading up at e.g. https://futureboy.us/pgp.html#Symmetric, https://www.gnupg.org/gph/en/manual/x110.html, https://tools.ietf.org/html/rfc4880 that an OpenPGP message follows this structure.  But is there a good reference with examples having the required structure of a composite GPG-encrypted file?

Does anyone know of resources that include example envelopes of this kind?


texts: Would RSA-encrypting a private key for itself constitute a vulnerability?

texts:
I'm planning to encrypt some individual files for storage, using the GnuPG implementation of RSA. If I happened to encrypt the private key corresponding to the public key used for encrypting -- either as an internal GnuPG file or an ASCII-armored exported key -- would this constitute a vulnerability?

The key in question is password-protected, but I'd be interested in both situations.


texts: Reasoning behind SHA-3 state array indexing

texts:
I was reading through the SHA3 standard (https://dx.doi.org/10.6028/NIST.FIPS.202) and in the standard it defines how to construct 3D state array from a 1D array.
The state array is defined as follows:

For all triples (x, y, z) such that 0 ≤ x < 5, 0 ≤ y < 5, and 0 ≤ z <
w,
A[x, y, z] = S [w(5y + x) + z]

This indexing is a bit cumbersome because in some sense, y > x > z (I can clarify what I mean if requested). I think it would be more natural to swap the x and y indices and defined it as:

A[x,y,z] = S [w(5x + y) + z]

Is there a reason for the definition in the standard?


texts: Relation between entropy and min-entropy

texts:
I understand that the entropy is the number of bits that can encode a set of messages. However, I don't understand what the min-entropy is and how it is related to entropy.

Let's describe a simple password case: if a password is 100 random bits, is the min-entropy also 100?


texts: Explanation of $z^{-1}$ and $T_{1,2}$ within E0 Bluetooth encryption algorithm

texts:
I am trying to understand how E0 Bluetooth algorithm exactly works. I know that $y_t$ is the sum of $x_1$ to $x_4$ and can take values $0, 1, 2, 3, 4$. Also $S_{t+1}$ = $(y_t + c_t)/2$ and can be $\{0,1,2,3\}$. But I don't understand what $z^{-1}$ and $T_{1,2}$ means.

According to the Bluetooth core specification:

  $T_1$ and $T_2$ are two different linear bijections over $GF(4)$.

Picture and explanation is on page 164.

Can you please clarify this and provide some examples?


texts: ElGamal in $\mathbb Z^*_p$ with $g$ not a generator of $\mathbb Z^*_p$

texts:
Let $G$ be a subgroup of $\mathbb{Z}^*_p$, $p=23$. The order of $G$ is $|G|=11$. Let $g=4$ be a generator of $G$. Consider the key generation algorithm of the ElGamal encryption scheme. Assume that the secret key is $x = 3$. Compute the corresponding public key $y$?

Apparently the solution is the following:

  For the ElGamal encryption scheme we have that the public key $y = g^x$ in $G$. Hence$$\begin{align}
y&=g^x\bmod 23\\
&=4^3\bmod23\\
&=64\bmod23\\
&=18
\end{align}$$

However this doesn't make sense to me. Indeed, the ElGamal scheme requires that the calculations be done in $\mathbb{Z}^*_p$ and not in $G$ and that we use a generator of $\mathbb{Z}^*_p$ and not a generator of $G$. So either we can write $G$ as some $\mathbb{Z}^*_q$ and then we calculate modulo that $q$ or we have to find a generator for $G$.

Am I wrong in my reasoning or is the correction of this exercise wrong?