texts: How useful is proxy re-encryption if we end up needing a symmetric key?

texts:
I'm trying to design a system using proxy re-encryption (PRE) to allow the sharing of data between a user (delegator) and other users he delegates access to (delegatees). The goal is to use a PRE scheme to prevent the sharing of the delegator's private key.

I wanted to have a DB where all data is encrypted, each delegator's data encrypted under his private key. If someone requests access to a delegator's data there are 2 options:

Has legitimate access permission, in which case data should be returned;
Doesn't have access to what was requested, data should not be returned;

The proxy would have a re-encryption key and the delegatee would have another key to convert the proxy's (partially decrypted) ciphertext to plaintext.

My problem: if I have my records encrypted under my symmetric key and I allow a delegatee to see that key (after the proxy partially decrypts that key, the definition of delegatee would mean he's someone who can finalise decryption), he can then have access to all delegator files.

I was thinking a solution could be to have each record encrypted under a different key, so the delegatee would only have access to the key which encrypts the files he requested. This seems like it would have insane computational/storage overheads.

Another alternative would be to have some sort of proxy to DB which could generate keys on fly and encrypt data before sending it to a valid delegatee. Problem here is that that data was encrypted in the DB so the proxy would have to be able to decrypt it before encrypting it again under this new key. This means the proxy would have to know the key, defeating the whole point of a PRE scheme (also, the delegator would not know the key which encrypts his own files, which is undesirable).

Finally, the reason I'm posting this here is because I believe this is related to the understanding of PRE schemes and how they can be used in practise.


texts: Generate unique pair $g^k, E(k^{-1})$ for each group

texts:
Let say I have n computers, with some t-threshold encryption scheme.
I want to have n public shares (known to every participant) such that any t of them generates a pair:
$g^k, E(k^{-1})$ that is unique, such that $E(x)$ is the encrypted value of x. and $k^{-1}$ is computed in some cyclic group of power $q$. Also no member can know the value of $k$ or $k^{-1}$.

I have a solution that requires communication:

each share is $(g^{k_i}, E(k_i), E(p_i), E(c_i))$. The $k_i$, $p_i$ and $c_i$ are private, the shares are public.

When a group $Is$ of size $t$ wants to generate $g^k$ and $E(k^{-1})$ they compute

$g^k = \prod_{i\in Is}g^{k_i}$,
$E(k) = \sum_{i\in Is}E(k_i)$,
$E(p) = \sum_{i\in Is}E(p_i)$,
$E(c) = \sum_{i\in Is}E(c_i)$

$E(k)*E(p) + q*E(c)= E(kp+qc)$ So we decrypt that and each party receives $kp+qc$. Remember, $q$ is the power of the group and public. So we can have kp  by computing $kp = (kp+qc) \space mod \space q$. After that, we can compute $E(k^{-1})=E({(kp)}^{-1}*p)={(kp)}^{-1}*E(p)$.

To use this, we require an homomorphic encryption with level-1 multiplication.
Is there anyway I could do this without communication? Is there any encryption scheme that support that properties?


texts: Optimal threshold for passive and perfect security

texts:
The authors of the book titled "Secure Multiparty Computation and Secret Sharing" claim that there exist functions which cannot be computed with passive perfect security for $t \geq n/2$ corrupt parties, where $n$ is the total number of parties. The authors prove this by showing that no protocol $\pi$ exists for secure 2 party AND with one corrupt party. However, for a 2 party protocol ($n=2$), the threshold of 1 can be written as a function of $n$ as $n/2$ or $(n-1)$, since $n=2$. So how can we guarantee that $n/2$ is the optimal corruption bound?

Can someone please help fill the gap in my understanding?


texts: Is it possible to perform a length-extension attack if only the last bit of the new message changes?

texts:
Given a Merkle-Damgård hash function H, let's say SHA256, that computes a MAC as follows:

H(secret_key||timestamp), so that the attacker knows the result and the timestamp.

Is it possible to produce a valid MAC of H(secret_key||timestamp+1) with length-extension or other attack?


texts:
I just started working with certificates and signatures. For an application I write I need a key pair for ECDSA signatures, using the elliptic curve secp384r1 (aka NIST P-384).

I produced such a key pair with the Bouncy Castle lib in Java. Just for testing purposes I then used the JcaPEMWriter to write the two keys to files.

I got the following results:

  -----BEGIN EC PRIVATE KEY-----
  MDUCAQEEMB4Tr3coGQbhIax2Aqs3IJW3D2QmsG1efvhrCeY+6F0K9fTAFT1+mTyL
  ENJ2lUdD/Q==
  -----END EC PRIVATE KEY-----

and

  -----BEGIN PUBLIC KEY-----
  MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhUvTJddWZidioBHCnPk23SH2C1lITFEK
  UGH63OqRcbE3cfGkykx0XUdHh8ZIKMUhikKr8+ln59sh7Tz1D6TqjtNPsuEMO07t
  ykzbQM+xZT0DMwnVNx+B0UT1Rr9JrNVX
  -----END PUBLIC KEY-----

My questions are:

1) Why is the format of the two key representations different? The private key is in PKCS#8, the public key in X.509 format (at least that is what Java's "getFormat" method tells me). I think there must be some good reason why the developers decided for these different representations, but for me it is just confusing ;-). Is this due to some standard?

2) Next I went to https://lapo.it/asn1js to decode the keys. For the public key I got some information about the algorithm used, and then a 776 bit string. These are 97 bytes. If I understand it correctly, those are made up of one byte telling me that the elliptic curve point is in uncompressed encoding, 48 bytes (=384 bit) for the x-coordinate and 48 bytes for the y-coordinate.

But when I try to decode the private key in the same manner, I get only 48 bytes for the actual key. What exactly do these bytes represent? Is this the curve point in it's compressed form? But in this case, shouldn't there be a flag at the beginning telling me that this is compressed form?

Maybe you can help me get a better understanding of what's going on here. Thank you in advance!


texts: Are some combinations of Substitution + Transposition more vulnerable than others?

texts:
Iterating multiple substitution ciphers is not mathematically different from using a single substitution cipher (3 Vigenere iterations with a 31-, a 32-, and a 33-letter key would essentially be a single Vigenere cipher with a 32,736-letter key), and a long enough message can be decrypted even with this long key the same way that a shorter message can be decrypted with a short key (likewise for iterating multiple columnar transpositions).

But if I wanted to use 3 Vigenere ciphers and 3 columnar transpositions on the same message, would doing all 3 substitutions first and all 3 transpositions second (or vice versa) be less secure than alternating something like "Vigenere-column-Vigenere-Vigenere-column-column"? Or would the same combined-substitution-transposition decryption techniques apply regardless of the order?


texts: Security aspects of a splitted Pohlig-Hellman system

texts:
Given a Polig-Hellman (is that really the name for that?) system with

$$C = M^k \bmod p$$

where $M$ is the message, $C$ is the ciphertext, $k$ is a (secret) key (any integer relatively prime to $p-1$), and $p$ is a large public prime.

Encrypting twice like this

$$(M^{k_{A}})^{k_{AB}} \bmod p = (M^{k_{B}})^{k_{BA}} \bmod p$$

where the second pair of keys is generated according to https://crypto.stackexchange.com/a/42140/41839, by selecting a random $k_B$ (relatively prime to $p-1$), and then computing

$$k_{BA} = k_{A} k_{AB} k_{B}^{-1} \bmod p-1$$

If the second encryption step with $k_{AB}$ and $k_{BA}$) is done by an untrusted server, so it knows these keys, what are the security aspects of such a system (besides not offering ciphertext indistinguishability as wanted)?

Given more key pairs matching the first one, can you calculate the secret key $k_{A}$ by solving the following equations if you know $k_{AB}$, $k_{AC}$, $k_{BA}$ and $k_{CA}$?

$$k_{BA} = k_{A} k_{AB} k_{B}^{-1} \bmod p-1$$
$$k_{CA} = k_{A} k_{AC} k_{C}^{-1} \bmod p-1$$


texts: Why avoid custom HMAC implementations like the following?

texts:
H (o_pad || H (i_pad || m, static_salt), static_salt)

Where the Hash algorithm used is SHA512-crypt: https://www.akkadia.org/drepper/SHA-crypt.txt

What if an attacker knows the o_pad, i_pad, the static_salt, and the final HASH but not the message... it's potentially possible obtain the message (other than just brute-forcing it) using this custom implementation?


texts: Definition of randomly generate in the parallelepiped

texts:
I am reading the [CLT13] paper regarding multilinear maps over the integers and I have some troubles in understanding what the following random generation means:

The vectors of the matrix $r_i \in \mathbb{Z}^n$ are randomly and independently chosen from the half-open parallelepiped spanned by some vectors $\pi_1,...,\pi_n \in \mathbb{Z}^n$.

What I've understood: Those $r_i$ can be written as $r_i = a_1\pi_1+...+a_n\pi_n$ where each $a_i$ is random in $\mathbb{Z}$. Is it correct?
You might want to search for the word span to see exactly what the authors meant in the paper.


texts: Symmetric Crypto Primitives derived from Rijndael Block Cipher

texts: Rijndael Block Cipher supports multiple block/ key lengths and a subset of these was selected as AES. What other cryptographic primitives are derived from Rijndael or make use of its round function/ design principle (e.g LED Block Cipher, Lex Stream Cipher)? Are there any other possible variants of Rijndael/ AES that have been proposed/ published?


texts: Practical probabilistic proof systems not based on polynomials

texts:
All practical probabilistic proof/argument systems I know of are based upon polynomial identity testing in finite fields. These constructions include QAPs, STARKs, GKR and many variants. In particular, they all rely on the Schwartz-Zippel lemma, and thus they all take place in a polynomial setting.

There are constructions that do not take place in a polynomial setting, such as the expander-graph based PCP. But they are impractical both asymptotically and in practice.

Are there constructions that do not take place in a polynomial setting, but are still potentially practical?


texts:
I often encounter the phrase "I am not a cryptographer".  Is there a generally accepted definition for who is a cryptographer?  What qualifications would be expected?

For instance, should that person be expected to hold a relevant degree, or to have published $N$ papers?

Alternatively, would someone performing cryptanalysis or analysis of cryptographic protocols in a professional capacity be considered a "cryptographer", even without the academic background?


texts: How to generate a 16 X 8 perfectly nonlinear S-box

texts:
I want to generate a 16,8 perfectly nonlinear S-box for an encryption algorithm I am working on. I don't have a background in math, and I'm an undergrad, so a lot of the math involved is very confusing.

I want the perfectly nonlinear S-box to have 16 bits of input and 8 bits of output.

I have been reading Kaisa Nyberg's 1991 paper Perfect nonlinear S-boxes, and I am having trouble understanding the method described.

In Section 4, A Construction based on Maiorana-McFarland method, the implementation is described as:

Take n bits of input (where n >= 2m)
Split the n bits into two parts (x1 and x2)
Obtain the first digit of the output (of length m) by doing x1 • x2
And the second digit of the output by shifting a n/2 size LFSR (with
a primitive feedback polynomial) once, and the calculating • between
LFSR's content and x2.

I am having trouble understanding how the two digits are to be used since both would be of length m..

concatenating them would make the output size 2m

Which is not right. The problems I face are:

Should there be a • operation between the two digits to produce an m-bit output? In a construction based on Maiorana-McFarland method?
Which (per my understanding modular) operation would be the optimal?
Is there anything else I should be considering in addition to
perfect nonlinearity?


texts: Cube-Root attack - RSA with low exponent


texts: Non interactive zero knowledge proof with common reference string

texts:
I would like to have some explanations about Non Interactive Zero Knowledge Proof. I saw with an example how to use the Fiat-Shamir transformation on Schnorr identification scheme to get a NIZK and I understood how it works in the random oracle model.
What I don't understand is how does a NIKZ work in the common reference string model (CRS). If I understand it right, the principe is that the CRS is generated in a trusted way and is used by the prover and the verifier to establish the truth of a statement.
Without worrying about the generation of this CRS, I would like to know how an algorithm works with a concrete example. I found lots of examples in the random oracle model but I didn't find any with a CRS. Can someone explain to me or give me some links that illustrate this concept in a more practical way, for example with a demo implemented in some language or from a library ?


texts: Is there really any way to nullify or avoid MITM attacks?

texts:
The question pretty much sums it up.

Is there any way to make an attacker who is successfully performing an MITM attack to actually not be able to read or change the messages? Assuming there is no pre-attack key transfer or an agreed upon key that isn't transferred mid-attacking conversation.


texts: "Power of one" as input to functions of a cryptosystem

texts:
What does $1^\lambda$ mean when you pass it as a parameter to the functions of a cryptosystem. The cryptosystem in question is this and a picture reference is this.

I have been told it signifies the "security parameter of the cryptosystem" but this is not clear to me. In this picture, you can see that

$\lvert p \rvert = \mu$ bits

$\lvert q \rvert = 2\lambda - \mu$ bits

which means $\lvert \Delta_K \rvert = 2\lambda$ bits

So does all this mean that if I want 128 bits of security,
$\lambda$ has to be 128 and $\Delta_K$ 256 bits?

If yes, this would not make sense with their results they mention and also all the work I have done with this system. For a 128-bit security in this system, the size of $\Delta_K$ has to be 1828 bits. This is something I can strongly assure you of.

Any pointers would be greatly appreciated. Lastly reiterating the question,

"What does the notation $1^\lambda$ mean when it is passed to KeyGen(), Encrypt() and Decrypt() ?"


texts:
I want to sync blobs over the network and the most frequent change will be appending to blob. To minimize data amount sent I would prefer to encrypt appended data, send it over the network, append to encrypted blob and then decrypt whole blob at once when needed. Changes are very frequent and small, so storing each change independently possibly will have some performance issues.

Can I store counter along with blob and append to encryption using GCM with stored counter value (assuming it won't overflow/reset counter, which is obviously insecure)? Would GCM still provide authentication? Will this construction be secure (assuming correct implementation and key/IV selection)? What other options do I have?

P. S. I imagine this is easy done with CTR mode or any stream cipher, but they won't provide authentication.


texts: Will the ECDSA with SHA-3 implementation be quantum-proof?

texts: I know, that ECDSA could be broken by quantum computers, but since there is post-quantum hash function SHA-3, does not this make the digital signature resistant to them?


texts: How to prove simultaneous security for the Rabin's function

texts:
Let $p,q$ be odd primes, $n:=pq$ and $a,x \in \mathbb{Z}/n\mathbb{Z}$ be quadratic residues such that $x^2 \equiv a \pmod n$. I have understood the proof that calculating the least significant bit of $x$ is computationally as hard as deciding the Quadratic Residuosity Problem and I am aware of the fact that it is even as hard as factoring $n$. Now the "Handbook of Applied Cryptography" states in Fact 3.89 (chapter 3, page 117) that computing the $k = \mathcal{O}(\log(\log(n)))$ least significant bits of $x$ is also as hard as factoring $n$. (The key word is "simultaneous security".)
Could you please tell me how to prove this? How can I relate this to the established result that the least bit of $x$ is secure?


texts: New Improved Probabilistic version of RSA

texts:
On the 2nd page of "New probabilistic public-key encryption based on the RSA cryptosystem" by Roman'kov (PDF), at last it says Alice can find "f" of order "l" with least probability of (1-1/l). I cannot understand how they came up with this probability.
Can anyone help me with this.


texts: What are the chances of an RSA signature collision?

texts:
My understanding is: fundamentally it should be hard to produce a different message with the same signature. Therefore chance of collision should be low. But what exactly is the probability of a collision, taking into account stuff like the birthday paradox?

As a consequence, in a system with many signed messages, is it safe to use the (sha-2 or sha-3 hash of the) signature as a unique identifier?


texts: Is one-time-pad still secure if the number of 1's in the key is revealed to the attacker?

texts: For example, if $m = 10011$, $k = 11001$, $n=3$ (which is the number of 1's in k), $c = m \oplus k = 01010$. If $c$ and $n$ are revealed to the attacker, is this scheme still secure?


texts: Which hash is used when providing signature algorithm ED25519 or ED448?

texts:
From TLS 1.3 there are two signature algorithms using edDSA:

      /* EdDSA algorithms */
      ed25519(0x0807),
      ed448(0x0808),

All the other signature-schemes provide hash information, for example:

ecdsa_secp256r1_sha256 => sha256

rsa_pkcs1_sha384 => sha384

How can I determine when receiving edDSA signature algorithm which hash to use?

Is there any default value for each one of them?


texts: Is it possible to find data which makes sense when decrypted with different keys?

texts:
In theory, does a piece of data exist which, when encrypted (using any method) with a given key, makes some sense when decrypted with the wrong key?

Here, a definition of "some sense" might be something like "when interpreted as ASCII character codes, the data forms a series of mostly correctly spelled English words". In essence, a definition of "some sense" would be that the decrypted data looks (almost) like it was correctly decrypted.


texts:
Problem

Is there any combination of hash and encryption algorithms with show the following properties:

File $\rightarrow$ Hash $\rightarrow$ Encrypt $==$ Hash $\leftarrow$ Encrypt $\leftarrow$ File

So a combination of hashing and encryption which can be applied in arbitrary order so that it leads to the same result.

Use case

I want to add optional encryption to an existing file synchronisation service. Currently only trusted nodes exist, which store data unencrypted. They use the file hash as an identifier.

My idea is, to add untrusted nodes which store the data encrypted. Only the trusted nodes have the key.

In order to detect changes, hash values are compared. Since the data only exists in encrypted form on untrusted clients, they can only compute the hash of encrypted files. On trusted clients, data exists unencrypted and has a hash of the unencrypted version stored along. Now it would be far easier to just encrypt the hash on the fly instead of encrypting the whole file and computing the hash of it.

Don't overlook the extension in my edit!

Edit (2019-03-26)

I noticed that I should clarify some things about the use case:

Two equal files do not exist in our application since they are deduplicated!
We split files into equally sized blocks. So in this example all files have the same length!
There are multiple nodes. For simplicity let's look at the case where we have 2 trusted ($N_{t1}$, $N_{t2}$) and 1 untrusted node ($N_u$). They are all in sync at an arbitrary point in time. Now node $N_{t1}$ creates a new file, encrypts it and synchronizes it with $N_u$. Now $N_{t2}$ comes back online and wants to determine which files have changed.

Further, I want to respond to Ilmari Karonen's answer (also too long for a comment):

  The case $m_1 = m_2$ does not exist (see my clarification above).

  We use relatively small blocks (128KB). So plaintext-guessing-attacks are an issue?

  I thought about something like your first scheme already (please correct me if there is a structural difference):
  I could just store the hash of the unencrypted file (which is our current file identifier) $H(m)$ together with the encrypted file $E_K(m)$. This would allow offline key-guessing attacks though:
  1. Try to decrypt the ciphertext $E_K(m)$ with different keys $K_i$:
     $E^{-1}_{K_i}(E_K(m)))=m_i$
  2. Hash the result $H(m_i)$
  3. Check if this is equal to the stored hash $H(m_i)\stackrel{?}{=}H(m)$
     If so, we found the plaintext :/
  When the used keys are long enough, this shouldn't be a problem. But with increasing computing power, it is only a question of time until this can be cracked.

  Is your third scheme different from what I try to avoid (see use case): In order to calculate $H_K(m)$, I need to encrypt and hash the plaintext ($H(E_K(m))$). This needs a lot of computational power for big directories. Alternatively, I could compute it once and save it. This would decrease data efficiency significantly. Nevertheless, if it is considered secure, I guess it is the best we have since I don't want to compromise on security.

  Your second scheme seems interesting, although I didn't understand it completely yet (I will have to check the links you posted). Do you think this scheme is more promising with the clarified use case than the third scheme?


texts: Simple example for CP-ABE (Ciphertext policy attribute-based encryption)

texts:
I'm currently working on Ciphertext Policy Attribute-Based Encryption (CP-ABE). So far I'm only using it with a basic understanding how it actually works. Now I want to understand it a bit better, but I've never learned anything about bilinear groups or pairing-based cryptography.

To start with I would like to calculate a very simple example on my own. Therefore I'd like to use small numbers and very simple operations (although this definitely won't be secure).

I will just write what I tried to do for the first step (Setup) — would be great if someone could tell me whether it is completely wrong or if it goes in the right direction:

I chose a group generator of $g=7$ and an order of $p=13$. Therefore I got the group $G_0=\{1\ldots12\}$. (Correct so far?)

Then I defined $e(X,Y)=g^{XY}\bmod{}p$

Using this, I can now calculate the Public Key and the Master Key with two random integers $\alpha=3; \beta=4$:

$MK=\{\beta,g^\alpha\}=\{4,7^3\}=\{4,343\bmod13\}=\{4,5\}$

(Still correct?)

$PK=\{G_0,g,h=g^\beta,f=g^{1/\beta},e(g,g)^\alpha\}=\{G_0,7,7^4\bmod13,7^{1/4}\bmod13,7^{7*7*3}\bmod13\}=\{G_0,7,9,??,5\}$

(How can I calculate $7^{1/4}$?)

I hope to be able to do the rest on my own as soon as I understand this part.


texts:
Let a function $f$ be one-way, if there exists a probabilistic polynomial time algorithm to find the preimage of $y = f(x)$ for uniformly chosen $x$ with non-negligible probability.

Define the function as $f(x,y) = x\times y$, where the values of $x$ and $y$ range across the integers in $[2^{n-1}, 2^n-1]$ (basically, they are $n$-bit numbers with the left-most bit set). Is $f$ one-way??

(Although with probability 0.75 the received $y$ is even, $2$ and $y/2$ cannot be output as the factors, since I want the preimages to lie in that specific range)


texts:
I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil Rogaway. In that when describing the block cipher modes for e.g. CBC he says the following (table in page 5) --

  Confidentiality is not achieved if the IV is merely a nonce, nor if it is a nonce enciphered under the same key used by the scheme, as the standard incorrectly suggests to do.

I don't understand the difference between the IV and nonce in this context. If I choose the nonce randomly won't it be the same as an IV? What am I missing here?


texts: How to get the order of a type a elliptic curve group G?


texts:
Let $(R , \chi$)  be a standard RLWE problem instance. I.e. $R$ is a finite degree polynomial ring over a finite field and $\chi$ is some gaussian distribution over R with small variance.

I wonder if the following promise problem is hard.
Let $a_0$ and $a_1$ be two random elements from $R$
The challenger choses a boolean $b$ and two elements $s,e \in \chi$,  and calculates $c= a_b s + e$.

The problem is then:
Given $c, a_0, a_1$, calculate $b$ with non-negible advantage.

For motivation:
If that promise problem turns out to be hard, one could use as natural PQ replacement of PACE, the password authenticated key agreement protocol used in electronic passports. (See
ICAO doc 9303)


texts: Do practical key-less cryptosystems exist?

texts:
Hopefully the question isn't too broad or off.

Basically, are there any practical, and by practical I mean secure enough that a ciphertext only attack is infeasible, key-less cryptosystems? For example, there's the Caesar Cipher (I'm aware of the fact that it can pass as a special case of the shift cipher with the key = 3, but let's assume that there is no general case of the hypothetical cipher), however, it's very impractical according to the aforementioned definition of practicality.


texts: Difference in one time key and one time pad and many time key

texts:
These terms are confusing me. One time pad is when you use one key for one message. That is what One time key is.

Secondly, what is the connection of many time key, can i use one time pad many times, will it become many time key.


texts: How to evaluate number of security bits of a signature scheme?

texts:
I am trying to evaluate the effective security levels that a digital signature scheme (namely post-quantum digital schemes like WOT-S (Winternitz one time signature scheme) and Dilithium Crystals). How should I do that for a particular message?
For WOT-S I am using the standard python library For Dilithium I am using Liboqs Library.

For WOT-S I referred to the following research paper: https://www.researchgate.net/publication/225630354_On_the_Security_of_the_Winternitz_One-Time_Signature_Scheme. The formula for security level gives me a value of 405. Which I feel is not right.

For Dilithium I was not able to find a paper that quotes any formula for it.


texts:
What is the high level  idea why trapdoor is used for digital signature?
Are there any digital signature schemes without trapdoor?


texts: How are initialization vectors used in TLS 1.1?

texts:
From my understanding, TLS 1.0 can use CBC to encrypt data. To do so, it creates one initialization vector (IV), and then uses the previous ciphertext block as the IV for the next record. I made this diagram to depict my understanding about TLS 1.0:

In the diagram above, the red arrow opens up TLS 1.0 to the BEAST attack. As of TLS 1.1, this seems to be fixed by creating explicit IVs:

  [CBCATT] describes a chosen plaintext attack on TLS that depends on
  knowing the IV for a record.  Previous versions of TLS [TLS1.0] used
  the CBC residue of the previous record as the IV and therefore enabled
  this attack. This version uses an explicit IV in order to protect
  against this attack.

  - RFC 4346

My question is: When and where exactly are these explicit IVs created? Are they created for each message like so (both messages are still being sent within the same stream like above)?:

Or do we now have explicit IVs for each record?:

... or is it neither of these?

I'm relatively unexperienced with all this so please forgive me if this is a silly question.


texts: Beginners question about revealing randomness in probabilistic asymmetric encryption

texts:
I am encrypting "1" with probabilistic encryption with a foreign public key (I don't have the private key for it) which results in an encrypted file e.

Can I prove to a third party, that e contains the plain text "1" if I reveal the randomness that I used to encrypt it?

If yes, is there any way to prevent that?


texts:
I am just wondering what's the differences between boolean circuits and arithmetic circuits? I know the basic notions of circuits. My question is their applications in cryptography. For example, why we should consider them separately (e.g., why we should consider functional encryption for boolean circuits and functional encryption for arithmetic circuits separately)?

I cannot find any literature that explain this clearly currently. If you have read such literature, please tell me.


texts:
My question is related to this:

Collision-resistant Pseudorandom function

Assume we have a pseudorandom function as follows: $PRF: \{0,1\}^{l}\times\{0,1\}^{t}\rightarrow\{0,1\}^{m}$, where $l$ is the security parameter. Also, assume $k,k'\leftarrow \{0,1\}^{l}$ are two independent random keys and $r_1,r_2 \leftarrow \{0,1\}^{t}$ are two independent random values.

Question 1: What is the probability that $PRF(k,r_1)=PRF(k',r_2)$

Question 2: Would the probability in the question 1 be different if we replace $r_1, r_2$ with a fixed value $i$, probability that $PRF(k,i)=PRF(k',i)$?


texts: I was looking at the algorithm for Twofish, and I noticed that in some places a XOR is used, but in others, they use "addition modulo-32." What makes modulo-32 special? Why not always use XOR? Why not always addition mod 32?


texts: How to convert RSA public keys to one key to use for text hashing?

texts:
I've recently asked a question about RSA encryption. One of the things that I don't understand is the usage of two public keys.

In the example on Wikipedia, a message is encrypted like:

c(m) = m ^ e % n

This means that I need e and n to do an encryption. Also, in the article m is defined as plaintext but represented as an integer.

My two questions are:

How do I combine e and n to be one public key?
How should plaintext be formatted to be used in the Wikipedia example?

PS: RSA public key generation is based on this Wikipedia article.

PPS: Here is an example of an online RSA generation tool, I don't understand how those hashes are created based on the Wikipedia example.


texts: What happens if a SHA-256 input is too long (longer than 512 bits)?

texts:
What I understand is: When we parse a message into 512 bit message blocks. Then we extend the first message block to 64 entry array and start with the compression function.

What happens if the message is longer than 512 bits? As a result, we would receive several message blocks, but where are these fed into the function.


texts: I know we could possibly be using DH key exchange, that would enable PFS. However, what if we make modifications on our SSL 3.0 handshake such that the only cipher we use is RSA for the achieving PFS? Is it possible to modify SSL handshakes to enable PFS while still using RSA during the handshake?


texts:
While searching for a mutual authentication protocol I often stumbled upon SKID3. However I encountered different variations of it.

The basic structure is the following:

(1) $A \rightarrow B: r_A$

(2) $B \rightarrow A: r_B || \operatorname{MAC}(r_B||r_A||A)$

(3) $A \rightarrow B: \operatorname{MAC}(r_B||r_A||B)$

where $A$ and $B$ are the identifiers of the senders and recipients, '$||$' means concatenation and $r_A$, $r_B$ are challenges(e.g. random numbers).

Sometimes the concatenation order of $r_A$ and $r_B$ is inverted between step 2 and 3 (page. 19) . Some other time $r_A$ is omitted in step 3 (slide 23) . But the authors never explain why those parts are designed that way.

To me it looks like those variations don't introduce any problems. So do you think those variations offer the same level of security?
Something that all variations have in common is that in step 2 in the MAC function $r_B$ (the "own" challenge) always comes first (maybe a coincidence?). Doesn't look to me like it makes a difference whether $r_B$ or $r_A$ comes first. What do you think?
Is SKID3 actually a standardized protocol or is it just a scheme that can be used or built upon? I couldn't find it in any document defined as a standard.

I know that the identifiers in step 2 and 3 are used in order to thwart a reflection attack and the concatenation of $r_B$ and $r_A$ in step 2 is necessary to prevent a parallel session attack. But the above questions are still unclear to me.


texts: SCP03 - Does it always to depend on pre-provisioned static keys?

texts:
I am trying to understand Secure Channel Protocol 03 from specified by Global Platform and have seen a few implementations. From the standard:

  Session keys are generated to ensure that a different set of keys is used for each Secure Channel Session. The session keys are derived from the static Secure Channel keys.

"
From what i have understood, there is a set of keys known to both parties (host and the card) refered as " static Secure Channel keys". So any new session is encrypted with a new set of keys that are freshly derived from the static keys but those keys are always derived from the same static keys.

Isn't this a security vulnerability ? I mean wouldn't doing asymmetric channel encryption like Diffie-Hellman for every session and continuing  with symmetric encryption there on be a lot better ?

I am relatively new to the field and might be missing something fundamental or this might be an affordable risk compared to the overhead and implementation complexity. Any clarification is appriciated.


texts: Derive both MAC and AES keys from same PBKDF2?

texts:
When doing password-based encryption, is it OK to create one instance of PBKDF2 from the password, and then use it to create both the AES key and the MAC key? (Or should a new instance of PBKDF2 be created using a different salt or iteration count, for each?)

This answer   seems to say this isn't a good idea. While this one   seems to say it is. Am I misunderstanding one of them? (Or both.)

(And by the way, the first is marked as a duplicate of a question which deals with an initially strong key, while it itself deals with a simple passphrase.)


texts: Protecting my message without encryption

texts: I am studying Information Security, and I am wondering if I can send a message to my friend X and keep the message confidential without using encryption?


texts: Is it true the longer the key length is the more secure the encryption?

texts:
Then why don't we use xxxxxxx bits encryption? what stopping us from using a very lengthy key?
I am referring to the encryption we use with SSL


texts: Password hash that can be upgraded without plaintext password

texts:
Most password hashes have a cost parameter that indicates how long the algorithm should take. Is there an algorithm where you can increase that cost for a particular hash, without access to the plaintext password?

So I have existing hashes in the database with cost=10, and I want to upgrade these to cost=20, without access to the plaintext password.

This isn't possible for PBKDF2 and bcrypt, because these use the password in each iteration. Is there any algorithm that supports this? Is there a specific name for this property?


texts: Public key homomorphic encryption based on secret key homomorphic

texts:
Let $(E,D)$ be a secret-key bit-encryption scheme that is homomorphic to xor, and assume that each bit encryption is of size n (this concerns both fresh encryption and encryptions that have been homomorphically manipulated).
For two ciphertexts $ct$ and $ct'$, we abuse notation and will denote by $ct \oplus ct'$ the ciphertext resulting from their homomorphic xor.
Consider the following suggestions for a public-key encryption scheme:

$G'$ sample $r \gets \{0,1\}^{2n}, sk \gets \{0,1\}^n$.
$pk = (r, ct_1, . . . , ct_{2n})$, where $ct_i = E_{sk}(r_i)$. The secret key is sk.
$E'_{pk}(m) = (\oplus_{i:x_i =1} ct_i, m \oplus_{i:x_i=1} r_i)$ is done by sampling $x \gets \{0,1\}^{2n}$
$D'_{sk}(a, b) = D_{sk}(a) \oplus b$.

I already proved that $(E',D')$ is CPA secure based on $(E,D)$ CPA secure. Now I want to prove that if $(E,D)$ is fully homormorphic encryption scheme, so does $(E',D')$.
In order to do so, I think that it is enough to show support of homomorphically $\times, \oplus$ in $(E',D')$.

Let $(a_1,b_1),(a_2,b_2)$ denote 2 encryptions. The problem I encounter is the second term $b_j$ in the encryption: $m_j \oplus_{i:x_i = 1} r_i$.

Supporting homomorphic xor in $(E',D')$ can be made simply by outputting $(a_1 \oplus a_2, b1 \oplus b2)$. In order to support $\times$ homomorphically, I defined $b_j = m_j \oplus R_j$, and tried to set:
$$ (a_1 \times a_2, b_1 \times b_2) = (a_1 \times a_2, (m_1 \oplus R_1) \times (m_2 \oplus R_2)) = (a_1 \times a_2, m_1m_2 + R_1R_2 + m_1R_2 + m_2R_1)$$

where + is like $\oplus$ in our case (mod 2). Trying now to decrypt, we get $m_1m_2 + m_1R_2 + m_2R_1$ which is wrong, and in general this is my problem: how can set homomorphically "the correct" value, which should be $(SOMETHING, m_1\times m_2 \oplus SOMETHING)$.

I'd appreciate any suggestions.

Clarification:

Please note that I want to prove it based on the above, and not modify the scheme.
The scheme is initially assumed to be xor homomorphic, and next assumed to be FHE.


texts: How could you disclose what you like and have someone respond with what you want without revealing who you are?

texts: Bob likes Apples and Oranges (virtual, not physical). Alice and Eve are fruit sellers (again, virtual, not physical). Bob wants to indicate his appetite to buy one Apple and one Orange without revealing who he is. Alice and Eve want to sell to Bob but they can't know Bob's identity. How does Bob communicate his preference to buy, and then take receipt, without Alice and Eve ever knowing who he is and without using a central authority?


texts:
for bcrypt it's probably common knowledge that it isnt binary safe because it uses null termination, which means that when bcrypt is used you need to make sure that no one does these (e.g. by hashing the passwords in a different binary safe function like SHA256 before and encoding the output)

by now we have essentially 2 other ways which can be used for password hashing, scrypt and argon2, and after a quick round of using google I couldnt really find any info on whether these 2 are binary-safe (meaning I can just use them directly on passwords which certainly makes them easier to use) or not.

does anyone know?


texts: Convert messages to elliptic curve points

texts:
Let $E$ be an elliptic curve; $\alpha,\beta$ two points of $E$; and $a$ a private key such that $\beta=a\cdot\alpha$. We choose random integer $k$ and plain text $x\in E$. Encryption and decryption methods are as follows:

$\operatorname{Enc}(x,k)=(k\cdot\alpha,x+k\cdot\beta)$
$\operatorname{Dec}(y_1,y_2)=y_2-a\cdot y_1$

How can we convert a message such as "Hello" to a point of $E$?
edit: In answer to question "Mapping of message onto elliptic curve and reverse it", we are given a general probabilistic method, and methods that are easy for special cases; for example when the curve is super-singular, or for ordinary curves defined over $\mathbb F_q$ with $q=3\bmod 4$ and group order divisible by $4$. I am looking for methods which are not probabilistic and are applicable to general cases. Do such methods exist?
I will be so thankful for any helpful comments and answers.


texts: What does $\to$ mean in the following definition of a block cipher?

texts:
In the following picture $\kappa$ is the key length and $n$ is the block size.

I understand that $\{0,1\}^\kappa$ means all possible combination of keys and $\{0,1\}^n$ means all possible combination of a plain-text block.

But I don't understand the overall equation, specially the meaning of the arrow $\to$. Can anyone explain it in brief? (note: I am very weak in mathematics)

  Let $E: \{0,1\}^\kappa \times \{0,1\}^n \to \{0,1\}^n$ be a block cipher with a $\kappa$ bit key and an $n$-bit state.


texts: How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?

texts:
If cryptanalysts today were to crack the original Enigma machine, “how fast” or “how easily” could they do it? What methods would they use?

The original cracking was significantly helped by operator mistakes, like always including the same header, always including a weather report, and finally, a long message of LLLLLLLL… being sent. Let's assume no such operator mistakes happened.


texts: What is the most secure encryption algorithm to encrypt my password database?

texts:
The password manager I use lets me choose an algorithm from the list below in order to encrypt my password database:

Microsoft Base Cryptographic Provider v1.0:

RC2-128
RC4-128
DES-56
3DES TWO KEY-112
3DES-168

Microsoft Enhanced Cryptographic Provider v1.0:

RC2-128
RC4-128
DES-56
3DES TWO KEY-112
3DES-168

Microsoft Enhanced RSA And AES Cryptographic Provider:

RC2-128
RC4-128
DES-56
3DES TWO KEY-112
3DES-168
AES-128
AES-192
AES-256

Microsoft RSA SChannel Cryptographic Provider:

AES-128
AES-256
RC2-128
RC4-128
DES-56
3DES TWO KEY-112
3DES-168

Microsoft Strong Cryptographic Provider:

RC2-128
RC4-128
DES-56
3DES TWO KEY-112
3DES-168

The default value is RC4 with the key length of 128 bits from Microsoft Strong Cryptographic Provider.

Now I have two questions:

Which algorithm is the most secure?
Does the algorithm provider matter?

Edit:

@mikeazo♦: I use Kaspersky Password Manager v5.(Unluckily, I don't have enough reputation to leave a comment!)


texts: Is ChangeCipherSpec a part of handshake message in tls 1.2?

texts: Is changecipherspec a part of handshake message in transport layer security (tls) 1.2 because according to rfc5246"ChangeCipherSpec messages, alerts, and any other record types are not handshake messages and are not included in the hash computations. Also, HelloRequest messages are omitted from handshake hashes."


texts: Usage and limitations of sponge functions for PRNG

texts:
This HRNG uses SHA3 as a sponge function (in its device driver) to inflate ots raw source output to many MByte/s. They compare this output rate to the output of other HRNG which don't use a sponge function. I'm wondering if this comparison is fair and brings me to the question to which extend a sponge function should be used to inflate RNG. The goal should be to get entropy suitable for cryptographic operations (e.g. key generation).

Edit: In other words, if a sponge function could be used to inflate 300 kByte/s to 500 MByte/s without reducing the entropy, why--talking Linux--to use /dev/random in favour of /dev/urandom at all?


texts: I've been searching about rekeying attack, but what I found is always using the term "rekeying/related-key attack". Is rekeying attack the same as related-key attack?


texts: Running time of Shamir's secret sharing scheme

texts:
Let $p>n$ be a prime number. The key steps in the $(t,n)$ Shamir's secret sharing is as follows:

Steps of dealer:

Choosing $s \in \mathbb{Z}_p^*$
Selecting $b_i \in \mathbb{Z}_p^*$ for polynomial $g(x)=s+\sum_{i=1}^{t-1}b_ix^{i}$
Calculating $s_i=f(i) \mod p$ /* assume that $i$ is the participant $P_i's$ public id.*/
Distributing shares accordingly.

Participants step:

Applying Lagrange polynomial interpolation to get s.

Running time analysis:

Steps of dealer:

$O(1)$
$O(t)$
$O(t)$
$O(t)$

Participants step:

$O(t)$

Is the running times of corresponding steps true?

So, is overall time complexity $O(t)$?

I did not found any where over internet discussing running time of Shamir's secret sharing scheme. Is my analysis correct? Refer me any source or explain briefly the running times of steps involved.


texts: I am only a beginner and doesn't know much about https. I have heard that they uses somekind of a key and is shared between them. If an attacker wishes to attack could he be able to capturebthe key and attack?


texts: What is the difference between Module-LWE and Ring-LWE?

texts: Recently, the CRYSTALS lattice-based cryptographic suite has been published, which is based on "module lattices". What is Module-LWE? How is it different from Ring-LWE?


texts:
Is there a hash function which has no collisions?

To clarify: it would be some function which would produce variable-length output, and never produce the same output for differing input. It would also be computationally hard to derive the input from the output.


texts: Secret Key Exchange and FIPS or Industry Standard Compliance

texts:
I am trying to collect several information regarding Security Industry Standards and the FIPS compliance to meet the security standards for our future development system.

In this case, we have two systems connected each other point to point through switch. We are interested in encrypting the data to run IO's across these two systems. Planning to encrypt data with AES-128, but struct on the best Industry standard compliance algorithsm to exchange the Symmetric Key. We are not connected here to Internet to exchange keys through 3rd Party or any other Certificate Authority.

Could someone please suggest the best possible way to generate and exchange keys in this scenario and also meet the industrial standard ?

Thanks a lot in advance...


texts: Zero knowledge proof relation + number is binary

texts:
I want to develop a ZKPK for the following problem:
$$Y=g_0^{r_Y} \prod_{i=1}^n g_i^{s_i}$$
and $$Z=h_0^{r_Z} \prod_{i=1}^n h_i^{s_i}$$
I want to proof knowledge of $r_Y,r_Z$ and $s_i$ which I have been able to do with standard proof or relations. My problem is that I need a proof that the $s_i$ are binary. I also understand how to prof that for a general el gamal encrypted number using the fact that $x^2=x \implies x \in \{0,1\}$. However I don't understand that how to combine these proofs, i.e. proof that the $s_i \in \{0,1\}$ are the same $s_i$ as in $Y$ and $Z$.

Any help is appreciated.


texts: Is there an $n$-bit hash function such that $n$ is equal to the length of input and the collision resistance is close/equal to $2^{n/2}$?

texts:
Let $B$ denote a non-empty bitstring of arbitrary length. Then let $n$ denote the length of $B$.

The question: does there exist a cryptographic hash function $H$ that outputs a hash $h$ of $B$ such that the length of $h$ is equal to $n$ and collision resistance of $H$ is either $2^{n/2}$ or negligibly less than $2^{n/2}$ (other standard cryptographic properties, such as pre-image resistance equal to $2^n$, are also implied)? If yes, what can be an example of such function?

I should also emphasize that $H$ is allowed to be significantly slower than standard hash functions, and the entire input is allowed to be stored in RAM.

EDIT
Of course, a function with this abstract property is not a standard “hash function” in the usual meaning. One example of similar function would be MD6 compression function (described in Chapter 2.5 and Chapter 9 of the document “The MD6 hash function: A proposal to NIST for SHA-3”), which was designed without any claimed limits on the security level. That is, the security depends on the length of the output, not on the length of the internal block size. It accepts the input of arbitrary length and outputs a truncated bitstring, assuming that the number of rounds increases when the length of the input increases. Yes, the output is truncated (and becomes smaller than the size of the input), but since the input size is variable, we can simply pad the input by any number of bits to obtain the output of any size. One problem is that this function requires an additional algorithm (described in Chapter 9.2 of the document) to detect what specific parameters will be optimal for the corresponding length of the input. This is different from Keccak family of fixed pseudo-random permutations, which is designed without any additional optimizing algorithms for different block sizes (1600, 800, 400, ...). Also, non-iterative cryptographic hash functions may be relevant.


texts: How does the attacker include input before compression and encryption in CRIME?

texts:
I have read this article about the CRIME attack against TLS and SPDY. The article says that:

  What is not yet clear is how the attacker is including their input in the source material before it gets compressed and encrypted.

And this is my question: How does the attacker include their input before compression and encryption?

Also, I have the feeling that this is an inconsistency: If the attacker can insert their input before compression and encryption in TLS, isn't it necessary that the attacker is the real client itself?

Please explain what I am missing here in order to understand the CRIME attack.


texts: What is adversary's advantage in cryptography and why we use it?

texts: The definition of adversary's advantage seems a bit odd for me and I am wondering why do we use it to measure the power of an adversary rather than just use the probability of a PPT adversary succeeding in answering an computationally hard question?


texts: Why did Histiaeus tattoo his slave's head?

texts:
The story is often told that Histiaeus tattooed a secret message on his slave's head, waited for his hair to grow back, then sent him off to Miletus. Why would he have done this?

The story is usually cited as an early historical example of steganography. But a message in someone's memory is less obvious than a message on one's skull. A message in someone's memory doesn't seem more resistant to torture (a strong-willed slave might not disclose the message, while a strong-willed torturer would almost certainly discover the tattoo). It also doesn't seem likely that the message could be kept secret from the messenger (since the messenger could just ask a friend to read it off his skull).

In short, is there some information-theoretic advantage to this anecdotal method?


texts: Is there another resource for Carter-Wegman-style message authentication?

texts:
I'm wondering if there are other resources that cover Carter-Wegman style message authentication, besides the sources themselves.

Is there an online text or a book that covers their ideas?  I'd prefer something that's very thorough, and less importantly, free.  I'm just really trying to get a feel for their ideas and related works.

Wikipedia covers VMAC, which is an application of their ideas, here:
http://en.wikipedia.org/wiki/VMAC

LINKS

The original sources are linked through http://www.dblp.org/search/index.php#query=author:mark_n_wegman:&qp=H1.1000:W1.4:F1.4:F2.4:F3.4:F4.4

...and you can refine the search to just Wegman and Carter's works by clicking on Carter on the right side.


texts: About the necessity simulators set adversary random-tape

texts:
In the ideal/real proof paradigm we sometimes find simulators with the capacity of set adversary random tape.

My question: when do we have to consider the necessity of simulators set adversary random-tape?. We know that malicious adversary can substitute random-tape setup by whatever he want, but: are there cases where it's needed to consider this capacity with semi-honest adversary?


texts: Is tweakable block-cipher based on the Merkle-Damgård construction secure if $F$ is a PRP

texts:
Assume $F$ is a pseudo-random permutation (PRP) then the tweakable block-cipher based on the Merkle-Damgård construction (take this as the way I understand, here is the equation):

$F_k[t](m) := F_{F_k(t)}(m)$

is a secure tweakable block cipher. This is marked with two stars in my notes.

First question: is it right or wrong?

Second question (if it is right): will a standard argument - that distinguishes the real world from the ideal world - work?


texts: Why do Problems for Post-Quantum algorithms have to be NP-Hard?

texts:
The mathematical problems used for Post-Quantum Cryptography problems I came across, are NP-complete, e.g.

Solving quadratic equations over finite fields
short lattice vectors and close lattice vectors
bounded distance decoding over finite fields

At least the general version of these is NP-complete
I am asking myself why these mathematical problems need to be NP-complete (in the general version) and how this is even useful, when instances are used that are not NP-complete


texts: recommended encryption algorithms to create an encrypted communication application

texts:
I have just turned 17 and I have been developing in Java for a few years. Recently I have been interested in a language called rust, I have also been made aware of privacy issues by some of my friends. Mainly in order to learn rust but also to learn more about cryptography I decided to start creating an encrypted communication application (which I may never use but I would still like to do something more or less secure). The idea of the application is that you can have a (written) conversation with a friend, stored on a server... and that even if the server is hacked it is impossible (at least not too easy) to decipher the conversation.

Here is how I thought I would make the application work:

Thomas wants to send a message to Emma. Using an algorithm (which works with a couple of public/private keys), they'll generate a shared secret so that the server cannot know it. Thomas will cipher his message using the secret in a symmetric algorithm and send it to the server. The server stores all the messages. When Emma wants to read the messages, she downloads these ciphered messages and decipher them using the secret.

Now let's say Peter wants to join the conversation, he also has public/private keys. Thomas or Emma will send him (over the server) the secret ciphered using his public key. Now that he has the secret he can download and read the messages.

If I haven't been clear somewhere, don't hesitate to point it out to me.
I would like the encryption algorithms to be modular: depending on the configuration of the conversation, messages could be encrypted with AES or ChaCha20, but by default I would use Curve25519 for the elliptic curve Diffie–Hellman in order to generate the shared secret and ChaCha20 to encrypt messages. Do you think that's wise? Is there any alternative to the elliptic curve Diffie–Hellman which could resist to potential quantum computers?


texts: Secure multiparty computation connectivity bound

texts:
I read some papers which studied the relation between the fault tolerance in secure multiparty computation and the connectivity of the underlying communication graph. Here I consider information-theoretic security. By the paper The Byzantine Generals Strike Again, in the case where the adversaries are malicious and their behaviors are not restricted, to achieve correctness and security, the number of adversaries must be less than one half of the connectivity of the communication graph. By another paper Connectivity requirements for Byzantine agreement under restricted types of failures, if the behaviors' of the adversaries are restricted to omission or stopping faults, then to achieve correctness and security, it is enough that the number of adversaries is less than the connectivity of the communication graph.

In my problem, I only consider semi-honest adversaries. I wonder is there any result for this case for the relation between the fault tolerance and the connectivity of the communication graph.


texts: RSA Timing Attack and Prevention through blinding

texts:
I am kind of confused regarding timing attacks on RSA.
I do understand that the attack exploits the fact that the modular exponentiation (square and multiply) has key dependent branching. That is, if bit $k$ of $x$ is $1$ then the duration of the exponentiation takes longer than if the bit is $0$.

But how is the execution also dependent on the message (the inputs)?

The proposed solution of Kocher is "blinding" by a adding a random value to the message. Hence, the execution time can not be correlated to the input anymore, but how does this help? Isn't the execution still slower if the exponent bit is $1$?

Thanks in advance!


texts: Comparison of end-to-end encryption and TLS

texts:
I am writing a comparison paper about security of electronic communication and I want to compare end-to-end encryption and TLS by giving two examples such as Whatsapp and Facebook Messenger. However, I am not sure if this is a valid comparison.

If they are comparable solutions to this problem, how should I compare them? In which aspects are they superior?

If they are not, which two solutions can I compare? I am new in this topic but I am willing to learn.

I would be grateful for any kind of suggestions.


texts: why Efail CFB malleability gadget is different from CFB mode decryption?

texts: Really, I could not understand why the decryption process of CFB malleability gadget takes the next cipher block while PGP uses the previous block as shown in the equations in the attached image, I read Efail attack paper but I could not understand how it works? Could someone clarify it to me.


texts: Aes encryption -The relevance of static matrix in mixcolumns operation

texts: Can someone explain to me the relevance of the static matrix used for the mixcolumns operation in aes encryption.i.e the relevance of why the byte is multiplied by 2 + next byte multiplied by 3 + next byte +next byte


texts: Questions about the double ratchet mechanism in Signal

texts:
I am trying to understand the threats the double ratchet system is trying to prevent against.

The threats mentioned in the paper do not quite make sense to me. May be someone can explain where I am wrong?

For the DH ratchet the paper says --

  An eavesdropper who briefly compromises one of the parties might learn the value of a current ratchet private key, but that private key will eventually be replaced with an uncompromised one. At that point, the Diffie-Hellman calculation between ratchet key pairs will define a DH output unknown to the attacker.

But practically speaking how does an attacker "briefly" compromise one of the parties? An attacker either has compromised a party or not. If the user is compromised at time T during a communication, isn't it true that the device is considered compromised for all time > T? If so why is the above assertion in the paper good?

For the Symmetric key ratchet --

  The KDF inputs for the sending and receiving chains are constant, so these chains don’t provide break-in recovery. The sending and receiving chains just ensure that each message is encrypted with a unique key that can be deleted after encryption or decryption.

Here again if the user or device is compromised at a time T computing all future keys is trivial, isn't it?

So what is the system providing in addition to forward secrecy? Just in terms of forward secrecy, this is obviously adding per message PFS. So this is great, I just don't understand the other assertions as I listed above.


texts: Efficient decoding of irreducible binary Goppa codes and the role of matrix P in McEliece cryptosystem

texts:
If we assume that the support for an irreducible binary Goppa code $\gamma_1, ..., \gamma_n$ is publicly known, when is it possible to efficiently decode the code? I know it's possible if one knows the generator polynomial $g(x)$, and also, if one can obtain a parity check matrix $H$ of the form $XYZ$, where

$ X = \left( \begin{array}{cccc}
g_t & 0 & \dots & 0 \\
g_{t-1} & g_t & \dots & 0 \\
\vdots & \vdots & \ddots & \vdots \\
g_1 & g_2 & \dots & g_t \\
\end{array}\right) $

$ Y = \left( \begin{array}{cccc}
1 & 1 & \dots & 1 \\
l_1 & l_2 & \dots & l_n \\
l_1^2 & l_2^2 & \dots & l_n^2 \\
\vdots & \vdots & \ddots & \vdots \\
l_1^{t-1} & l_2^{t-1} & \dots & l_n^{t-1} \\
\end{array}\right) $

$ Z = \left( \begin{array}{cccc}
\frac{1}{g(l_1)} & & & \\
 & \frac{1}{g(l_2)} & & \\
 & & \ddots & \\
& & & \frac{1}{g(l_n)} \\
\end{array}\right) $

as in the paper by Engelbert, Overbeck and Schmidt (1, 2), since here we are able to recover a multiple of the matrix $X$ and so a multiple of g(x) which generates the same code. My question is, is it possible to efficiently decode the code whenever one knows ANY generator matrix or ANY parity check matrix for the binary irreducible Goppa code?

Also, on p.15, Sec. 3.1 of the Engelbert et al. paper an attacker is assumed to know a generator matrix $SG'$ for the Goppa code and a corresponding systematic check matrix $H'$. The attacker is then assumed to be able to recover matrices P an M such that $M^{-1}H'P^{-1}=H$ where $H=XYZ$ is of the above form (and thus, decode the code). Why is this assumption feasible? How would an attacker know at all when $H=XYZ$? Also, why should H generate the same subspace as H'?

Finally, the section 3.1 of the paper claims that if in a McEliece system with public code generator matrix $G=SG'P$ the matrix $P$ is revealed, then it is possible to recover $g(x)$. How? The only way I can think of it is that if $c$ is a codeword in a code generated by $SG'P$ then $cP^{-1}$ is a codeword in a Goppa code generated by $SG'$ and so the syndrome $S_{cP^{-1}}(x)=\sum (cP^{-1})_i/(X-\gamma_i)$ which the attacker can calculate is congruent to zero modulo $g(x)$. Is this a way to obtain $g(x)$?


texts: Share encrypted files without giving master key

texts:
Imagine I have four files I want to encrypt. I have master key, and from that master key I derive four keys, one for each file:

key1 = HMAC-SHA-2(masterKey, filename1)
key2 = HMAC-SHA-2(masterKey, filename2)
key3 = HMAC-SHA-2(masterKey, filename3)
key4 = HMAC-SHA-2(masterKey, filename4)

After that, I encrypt each file with AES, each with its own derived key (file1 encrypted with key 1, file2 encrypted with key2, etc).

Imagine Alice (owner of the master key) publishes every encrypted file publicly and only shares key3 with Bob.

Is it then safe to assume that Bob will only be able to decrypt file
three because he only has key3, and no one else will be able to
encrypt the other files (except Alice)?
Is Bob able to decrypt the other files, when he knows that his key
was made by using HMAC-SHA-2(masterKey, filename3), even though he
doesn't have the keys for the other files?
If all four keys are handed out to one person (and that person also
knows the four filenames) , is that person then able to derive the
master key?


texts: Verifying affine spaces in Xoodoo component

texts:
I am reading "The design of Xoodoo and Xoofff". On page 13 there is a collorary related to the component $\chi$ [Algorithm 1, 1].

Corollary 1. For fixed (difference or mask) $a$, the compatible (difference or mask) $b$ values form an affine space of dimension 2 and vice-versa

I am trying to verify this corollary exhaustively. That is I have fixed a $b$ and generated all $a$. Specifically, I took $b=110$. For this value, the corresponding possible $a$'s are $S=\{010, 100, 011, 101\}$. My question is Does $S$ form an affine space of dimension 2? if so, why?


texts:
Consider a threshold FHE scheme based on RLWE like this:
Refer to this paper
$\textbf{Initialization:}$
Every party generates his own secret key $s_i$, then uses the common polynomial $a$ to generate his public key $pk_i=(p_{i,0},p_{i,1})=(-as_i+e_i,a)$. Therefore, the ideal public key is $pk = (p_0,p_1)=(\sum p_{i,0}, a)$.
$\textbf{Online:}$
The party $P_i$ has his own data $x_i$, he encrypts it under the $pk$ and sends the ciphertext to some receiver. The receiver computes some function and then sends the result $(c_0,c_1)$ to every party.For the parties, they perform the partial decryption: $h_i = c_1s_i+e_{smudge}$.
My Question: Why smudge? Why not use a common noise $\chi$ distribution?
Could you give a simple derivation?


texts: Does the RSA algorithm use repeated squaring?

texts: Simple question: in order to reduce such huge exponents in modular arithmetic, is repeated squaring used in RSA or is there a better way to implement it?


texts: Using a blockchain for secure communication

texts:
I've recently heard of the idea of using a blockchain for secure communication. No details were given so it's a little hard for me to say that it can't be done. But as far as I know:

Secure communication doesn't need blockchains. We have AES, MACs,
digital signatures, etc. for that.
Blockchains are only useful for documentation. Not for securing
anything.

Am I missing something here?


texts: How relevant are hardware implementations of crypto algorithms?

texts:
All of the SHA-3 finalists discussed speed and efficiency of a hardware implementation of their algorithms. How relevant are such details?

I'm curious about who commercializes hardware that implements specific hashing algorithms, and who uses them. In what situations is this worth a dedicated chip, vs. just running it through the CPU / GPU / whatever?


texts: How to generate private SSH RSA key from given primes?

texts: I have two primes and public exponent. How I can generate private key with this values?


texts: How to configure a client browser cert to be authenticated by a server?

texts:
I currently am being asked to partake in a strange authentication format while working with a client, and was hoping for clarification.

The client is using HTTPS with client certificate authentication, therefore I will install their provided certificate within my browser as a form of authentication.

As a second step, they are also asking that I create my own certificate and have a CA sign it, and then provide them with the certificate and CA so that the server is configured to authenticate with the client.

While I can create a certificate with openssl from the command line, have it signed, and send it to them, how is this authenticating/verifying my browser at this point?


texts: What is Post-Compromise security exactly?

texts:
After reading these papers on Post-Compromise Security:

Post Compromise Security
  Asynchronous Ratcheting Trees
My understanding is the following: it is possible for a key-agreement protocol to offer post-compromise security if the protocol offers a key update process and if the adversary is passive.
Therefore, can a key-agreement such as ECDH-RSA can be updated to provide Post-Compromise security? And is my understanding of Post-Compromise security correct?


texts: Calculating hash of original message by encoded message

texts:
Consider E - encryption function and H - function calculating hash of message.
Is there any E, H for which for message M:

H(E(M)) = H(M)


texts: In which disciplinary category can cryptography be put?

texts:
Is it a multi-disciplinary, inter-disciplinary, cross-disciplinary, or maybe even trans-disciplinary? What are the basis to describe each kind? I mean, how can we infer by which disciplinary field we can describe the cryptography?

I got an answer saying that it is multi-disciplinary because it contains multiple subjects like information theory, mathematics… what about the other fields?


texts: Using non-standard constants for SHA-256

texts:
For SHA-256, FIPS 180-4 states the following on the constants:

  These words represent the first thirty-two bits of the fractional parts of the cube roots of the first sixty-four prime numbers.

If one were to change some small number of those constants, say $n \leq 8$, to suitably "random" values, would this significantly weaken the cryptographic strength of SHA-256? The intent is simply to use a "non-standard" version of SHA-256.


texts:
I'm conducting a research regarding CDN security, and have noticed that in the following document https://community.akamai.com/docs/DOC-5175
A cipher suite named "ak-akamai-pfs-supported" includes the following:

ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-SHA384
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES256-SHA384
ECDHE-RSA-AES256-SHA
ECDHE-RSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
AES256-GCM-SHA384
AES128-GCM-SHA256
AES256-SHA256
AES128-SHA256
AES128-SHA
DES-CBC3-SHA

My questions is, do the following ciphers from the mentioned above list do support Perfect Forward Secrecy?

AES256-GCM-SHA384
AES128-GCM-SHA256
AES256-SHA256
AES128-SHA256
AES128-SHA
DES-CBC3-SHA


texts:
It's hard to say exact QC specs, but let's assume we have decent a quantum computer using Grover's algorithm that is able to half AES-128 keyspace to that of AES-64.

How long will a bruteforce attack take on a AES-64 protected key? What about AES-128 or AES-256? Also, would we be able to increase to AES-512 and still maintain the same level of security?

Since the keyspace is halved, does it also introduce any other possible vulnerabilities to attack vectors (in addition to any attacks that can be done on a QC)?


texts: What is the key length of shared secret by Curve 25519 ECDH

texts: Both parties uses Curve 25519 key pairs for ECDH key exchange. What is the key length of shared secret after ECDH?


texts: Encrypt multiple files with OpenSSL securely

texts:
I wish to encrypt potentially gigabytes of data on my pc, and I wish to be able to decrypt and use those files.

However, I am a noob, so bear with me.

My idea is to use openSSL to encrypt files with AES-256bit-CTR, since it's fast.

I imagine I'd be using a super long password (at least 20 chars),
I'd use the same salt and password for every individual file for speed.

My questions are:

How to make my encrypted files as secure as possible? What arguments to provide in OpenSSL?
Would I be safe if I were to use a 20-30 letter password?
How to use a random IV? What argument to provide in openssl? (AFAIK openssl derives an IV based on the password, so if the pw is secure am I good?)
What should my openssl command look like for max security? This is mine right now:

openssl.exe enc -in secret.txt -e -aes-256-ctr -out something.txt -k securepass -salt


texts: Is OpenSSL HMAC vulnerable to length extesion attacks when using MD5 as hash algorithm?

texts:
Given that a valid hash for a specific payload is known, would some C code like this be vulnerable to a length extension attack?

#include <openssl/hmac.h>
...
unsigned char *calculated_hash = HMAC(EVP_md5(), &key,sizeof(key) - 1, payload, payload_len, NULL, NULL);
...
    if(memcmp(calculated_hash, received_hash, 16) == 0){
        dprintf(client_fd, "Payload Valid\n");
        exit(0);
    } else {
        dprintf(client_fd, "Payload Invalid\n");
        exit(1);
    }


texts: ZK due to rewinds, why we need poly number of rewinds?

texts:
I've been looking into rewinding techniques for proving ZK and got a bit confused.

This answer is good, but I still have questions about challenge size and the number of rewinds.

Consider an interactive sigma protocol, for which Simulator can always produce an indistinguishable transcript if he guessed the challenge. Since the probability of guessing is 1 over challenge space, Simulator would not be very useful, unless he has special rewinding powers.

A) If Verifier is honest, he would use only his tape to chose the challenge, thus after rewinding, he will select the same challenge. Simulator needs to rewind just once for obtaining the challenge.

B) If verifier is malicious, then it's a bit tricky. First of all, sigma is honest verifier zero knowledge and doesn't deal well with malicious Verifiers. For one thing, malicious Verifier can always select a challenge based on Simulator's first message. No poly number of rewinds would help in such case.

Still, if we modify sigma protocol a bit and ask Verifier to commit to the challenge first, we avoid the whole dependency thing. Though commitment should be a perfectly binding one aka one-way function, otherwise Verifier still may change his response and no way Simulator guesses it in poly time.

Now after rewinding, Simulator would get the same challenge and thus can finally create a transcript. Thus, again just one rewind.

Where poly number of rewinds is coming from? Why challenge space is important? How the existence of Simulator with super powers in unrealistic settings helps to claim simulatability in real ones? I've got why it's handy for proving extractability, but ZK?


texts: Provable security of cryptographic hash functions

texts:
I am working on the following exercise question:

Consider the following construction of a “keyed” hash function from Katz & Lindell (ex. 7.22 (1st ed.)/ 8.21(2nd ed.)).
Gen : On input $1^n$ , generate a cyclic group $\mathcal{G}$ of order $q$, where $q$ is an $n$-bit prime, and a generator $h_1$. Then select $h_2, \ldots , h_t \leftarrow \mathcal{G}$. Output $s := (\mathcal{G}, q,(h_1, \ldots, h_t))$ as the key.
H : Given a key $s$ and input $x_1, \ldots , x_t$ where $x_i \in \mathbb{Z}/q\mathbb{Z}$, output $H_s(x_1, \ldots , x_t) := \Pi_i\, h_i x_i$
a) Let $\pi$ be a permutation of the integers $1, \ldots , t$. Prove that no adversary $A$, even knowing $\pi$, can distinguish between $(h_1, \ldots , h_t)$ and $(h_{\pi(1)}, \ldots , h_{\pi(t)} )$ with better than negligible probability. Give a formal description of this statement as an experiment before completing the proof.
b) Prove that if Gen produces groups $\mathcal{G}$ where the discrete logarithm problem is hard, then $H_s$ is collision resistant.

a) For this part I can intuitively see that since picking numbers from random in a cyclic group are no different than a permutation,I am not sure how to formulate it.
b) how can you break the discrete logarithm problem if you find a collision in such a scheme?


texts: Generate secp256k1 ECC key pair with libsodium

texts:
I'm new to crypto and I want to generate a key pair, in C, which would be the equivalent of openssl ecparam -name secp256k1 -genkey -out ec-priv.pem.
I love libsodium API but I can't find how (if ever) to generate a key pair that is an EC key. I was expecting to get a 32-byte private key, and a 64 byte (+0x04) public key.
Is it something that is not offered by the high-level libsodium API?


texts: AES ECB deterministic encryption to perform Private set intersection

texts:
There are two parties, and each has a list of plain-texts. My end goal is to assign indices to unique plain-texts across both parties. My present approach is the following.

Both parties perform a Diffie-Hellman key exchange to generate a secret key (which is the same for both workers).
Then they encrypt the plain-texts using AES in ECB mode using the secret key.
The set of encrypted plain-texts is brought to my local machine. (Note that I bring a set, thus each encrypted text returned by a given party is unique.)
I compare them and assign unique indices to each of them.

The deterministic property of ECB mode, plays an important role here, as it helps to compare similar plain-texts encrypted with the same key.

But I understand (after reading multiple answers about it) that ECB mode has many weaknesses. For example, two plain-texts longer than 16 characters, having the same characters after the 16th character will have the same ending block in the encrypted text. The same logic applies to the first 16 characters as well.

I want to know, if there are other ways in which I can extract information about the plain-texts of both parties, by analyzing the encrypted texts returned by them to me.

And is there any other more secure way to achieve my end goal?


texts: Is it possible to test implementation for side-channel attacks?

texts:
When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge required.

Along with that seems to go the assumption that such code needs to be very carefully written and reviewed but I haven't found much in regards to testing.

Now of course it's hard to test in software whether an implementation is vulnerable against some side channel attacks but it seems to me that it should be possible for timing and maybe even cache based attacks.

Is that actually possible and where can I find information on that topic?

In particular I imagine one could observe how an implementation performs under random inputs and use CPU performance counters to monitor instruction counts and cache misses. Differences here for different inputs would probably be bad. At least for compiled languages it should also be possible to have tools that perform static analysis on machine code, shouldn't it?


texts:
Suppose:

$H: \{0,1\}^{n} \rightarrow \{0,1\}^{n}$.
$H$ is bijective.
It is difficult to derive $x$ from $H(x)$.

Is this type of function possible? What would the strength of it be?

I realize that RSA and discrete logarithms can fulfill this, but I was thinking of using standard operators instead of those two. Other primitives could be acceptable.


texts: How much stronger is RSA-2048 compared to RSA-1024? It is hard to imagine very big numbers. So what would be your way to explain the difference to someone who doesn't know much about cryptography?


texts: What's the difference between game-based and simulation-based security? When we use the simulation-based, how to construct the simulator based on the adversary?


texts: Safe elliptic curve point addition using projective coordinates: How do I tell if the points are the same?

texts:
I am trying to implement elliptic curve point addition in hardware for NIST p256 and p384 curves. I have noticed the following issue with the suggested NIST routines:

Consider routine 2.2.7 of http://www.nsa.gov/ia/_files/nist-routines.pdf: Point addition $R = S + T$ is not valid for the case $S = T$ (this would be a point doubling).

Is it correct to state that before performing point addition, you must first check if the two points are the same point and if they are the same point then perform a point doubling instead? If so how do you test if the points are the same?
I am using Jacobian coordinates for my intermediate computations so a given point may have a large number of congruent representations: $(x,y) \mapsto (x/Z^2,y/Z^3,Z)$, e.g. $(16,64,1) \equiv (4,4,2) \equiv (p+16, p+64,1)\equiv\dots$.

How does one determine if two points are the same if they have a large number of possible representations?

A naive method could be that before performing point addition to convert back to affine coordinates and reduce all coordinates to the range $0 \leq x < p$ so then both points have a unique representation but this defeats the purpose of using projective coordinates which is to avoid modular inverse during intermediate computation. In this case it would be better to do all computation in affine coordinates. There must be an easier way to test if $S \equiv T$ without doing this but I have not found many references to this problem. How is this handled in the real world?

In addition to using Jacobian coordinates, all of my intermediate results are not bounded by $0 \leq n < p$ but are instead bounded by $0 \leq n < M*p$ where  $1 \leq M < 2^r$ which is because of my modular multiplication algorithm which has not posed an issue except if trying to determine if the two points are congruent. This increases the search space in affine coordinates to $M$ possible congruent points.

Does there exist a safe addition algorithm for generalized curves?

Inb4 use Edwards curves: I am required to support NIST p256 and p384 curves so I can't pick arbitrary curves.


texts: how to iteratively calculate a^emod n with modulus n sized 4096 bits

texts:
In most sites the exponent of the RSA public key is 24 bits. But the modulus can get to 4096 bits size. I have an accelerator that can get max. 2112 bit size modulus. It calculates a^e mod n.

Is there a way to separate $n$ (maybe bit wise) and use the accelerator in several iterations to calculate the wanted a^e mod n?


texts: Application level encryption and key renewal

texts:
(I had posted this question on stackoverflow and been asked to move it to crypto.)

I have a question related to encrypting data in the database, at the application level.

The application will encrypt the data (e.g. using AES) when persisting it to the database and decrypt the data once they have been retrieved from the database.

Is there any good technic to renew the encryption key?

If for example a company has a policy to renew the encryption key every two years we would end up in a position where we have to decrypt the overall database with the old key, and reencrypt it with the new one every two years.

Is there any technic to avoid such an issue?

I had the following answers: https://stackoverflow.com/questions/37172931/application-level-encryption-and-key-renewal

I mentionned AES because it is an industry standard. Would Paillier be fit for the industry?


texts: How can I construct a distinguisher given an inverter?

texts:
Let $ PRG: \{ 0, 1\}^n \rightarrow \{ 0, 1\}^{n+s}$ be a pseudo random generator and let $A$ be an inverter that runs in polynomial time, specifically:

$\large \mathbb P_{d \leftarrow PRG(U_n)}[ A(d) = v, PRG(v) = d] \ \ge \ \delta$

Show how to construct a polynomial distinguisher $B$ that uses $A$ to distinguish $PRG(U_n)$ from $U_{n+s}$ with probability at least $\ \delta (1-2^{-s})$, namely that the following inequality holds:

$ \large | \  \mathbb P_{d \leftarrow PRG(U_n)}[ B(d) = 1] \ -\ \mathbb P_{d \leftarrow U_{n+s}}[B(d) = 1] \ | \ \ge \ \delta(1-2^{-s}) $

Note: $U_n$ denotes the uniform distribution on $\{ 0, 1\}^n$

The only thing I could think of is the following distinguisher $B$:
Given a string $\ d \in \{0,1\}^{n+s}$, $B(d) = 1$ if and only if $PRG(A(d)) = d$.

Now we mark $\ T = Img(PRG)$. According to the formula of total probability (in all the probabilities below $d \leftarrow U_{n+s}$ ):
$\mathbb P(B(d) = 1) \ = $
$\mathbb P(B(d) = 1|d \notin T) \ \mathbb P(d \notin T) + \mathbb P(B(d) = 1 | d \in T) \ \mathbb P(d \in T) \ =$
$\mathbb P(B(d) = 1 | d \in T) \ \mathbb P(d \in T)$

( the last equation is true because $\mathbb P(B(d) = 1|d \notin T) = 0 \ $)

This is where I got stuck. I think I could have solved it if I knew that the $PRG$ is a one to one function, but I don't...
I'm not even sure if my construction is right. Is there a better way to construct $B$ ? Or maybe there is something else that I'm missing ?


texts: Protect the original message of a hash from brute force

texts:
My apologies for the somewhat inaccurate terminology.

Basically I have some simple messages (entropy ~50 bits) the user will use for registration. The messages should remain private, and I don't plan to keep that in my database. However, I do need to keep a hash so that I know when the same message is used again. (this is quite similar to ProtonMail registration)

Using simple hash it would be trivial to run through all possible messages to find the original messages from the hash, even if a really slow algorithm is used. Besides, a random salt probably can't be used as I need to check if the hash against all previous hashes.

Besides encrypting the database, I am thinking if an HMAC construct would help here. I assume the attacker cannot find the original message from the hash, if she couldn't find the key (where the key is not distributed, locally stored), and finding the key would be computationally infeasible if only the hash table is leaked. Is this correct? Is there a better solution?


texts: How can I convert a DER ECDSA signature to ASN.1?

texts:
I having trouble verifying an ECDSA signature signed using client side javascript with Java/BouncyCastle.

The javascript signing function source:

sign: function (hash, priv) {
        var d = priv;
        var n = ecparams.getN();
        var e = BigInteger.fromByteArrayUnsigned(hash);

        do {
            var k = ECDSA.getBigRandom(n);
            var G = ecparams.getG();
            var Q = G.multiply(k);
            var r = Q.getX().toBigInteger().mod(n);
        } while (r.compareTo(BigInteger.ZERO) <= 0);

        var s = k.modInverse(n).multiply(e.add(d.multiply(r))).mod(n);

  return ECDSA.serializeSig(r, s);
},

serializeSig: function (r, s) {
        var rBa = r.toByteArrayUnsigned();
        var sBa = s.toByteArrayUnsigned();

        var sequence = [];
        sequence.push(0x02); // INTEGER
        sequence.push(rBa.length);
        sequence = sequence.concat(rBa);

        sequence.push(0x02); // INTEGER
        sequence.push(sBa.length);
        sequence = sequence.concat(sBa);

        sequence.unshift(sequence.length);
        sequence.unshift(0x30) // SEQUENCE

        return sequence;
},

The server side verify function source:

  /**
     * Verifies the given ASN.1 encoded ECDSA signature against a hash using the public key.
     *
     * @param data      Hash of the data to verify.
     * @param signature ASN.1 encoded signature.
     * @param pub       The public key bytes to use.
     */
    public static boolean verify(byte[] data, byte[] signature, byte[] pub) {
        ECDSASigner signer = new ECDSASigner();
        ECPublicKeyParameters params = new ECPublicKeyParameters(ecParams.getCurve().decodePoint(pub), ecParams);
        signer.init(false, params);
        try {
            ASN1InputStream decoder = new ASN1InputStream(signature);
            DERSequence seq = (DERSequence) decoder.readObject();
            DERInteger r = (DERInteger) seq.getObjectAt(0);
            DERInteger s = (DERInteger) seq.getObjectAt(1);
            decoder.close();
            return signer.verifySignature(data, r.getValue(), s.getValue());
        } catch (IOException e) {
            throw new RuntimeException(e);
        }
    }

Does anyone know what format the javascript signature is in (DER?) and if so how to convert it to ASN.1?

I tried:

public static byte[] toASN1(byte[] data) {
            try {
                ByteArrayOutputStream baos = new ByteArrayOutputStream(400);
                ASN1OutputStream encoder = new ASN1OutputStream(baos);

                encoder.write(data);
                encoder.close();
                return baos.toByteArray();
            } catch (IOException e) {
                throw new RuntimeException(e);  // Cannot happen, writing to memory stream.
            }
}

but validation still fails.


texts: Requirement for the length of a HMAC tag?

texts:
I've seen NIST requirements about key length. What about the output lengths ?

Is 112 bits enough for the HMAC output length ? Can we truncate the tag to keep only 112 bits ?


texts: A function $H(x)$ is given. If there is an algorithm $B(H(x))$ that get part of $x$, is $H(x)$ a one-way function?

texts:
I came up with this question while I was reading this paper: Pilaram, Hossein, and Taraneh Eghlidos. "An efficient lattice based multi-stage secret sharing scheme." IEEE Transactions on Dependable and Secure Computing 14.1 (2015): 2-8.
The theorem 1 in section 4, the author says this:
Therefore, on input $Ex$, the algorithm $\mathcal{B}$ outputs the first part of $x$, i.e. $x_1$, which contradicts with one-wayness of Ajtai's function.
I wonder if this is a correct way to prove a function satisfies one-wayness. I am a noob in cryptography, and English is not my first language. Deeply sorry for the trouble. Thanks for your time :P


texts: Why do we append the length of the message in SHA-1 pre-processing?

texts: As we know, SHA-1 is irreversible, so why do we append the length of the message to the preimage?


texts: Digital signature in a group chat scenario?

texts: I understand that RSA is great for 1-to-1 digital signature. In the group chat of N people, other than storing and maintaining N public keys, is there a simpler way of authenticating each and everyone in the room?  Perhaps with just one public key per client?


texts: DH Key Exchange Protocol (one-out-of two)

texts:
Now given this problem, for part 1) I have solved it as follows, (I hope I am correct).
The basic idea is this:

I Have two prime numbers g and p and I tell you what they are.
You choose a secret number (a), you compute ga mod p and send that result back to me. (call it A).
I do the same, and call my number b and B respectively. So I compute gb mod p and send you the result B.
You take the number that I sent and perform the same operation,Ba mod p.
And likewise for me: Ab mod p.

Therefore step 5 is the same is as Step 4 due to modular exponentiation giving us the shared secret key (could also be between Alice and Bob).

(ga mod p)b mod p = gab mod p
(gb mod p)a mod p = gba mod p

Now for Part 2 and Part 3 I am not sure how to solve this - so any help would be kindly appreciated  - please as I have an exam question that will be similar. Thanks guys!

Sonia.


texts: Should I update my fedora encrypted system?

texts:
I have installed my Fedora Workstation version 23 using native disk encryption. Since it, I am upgrading it using dnf system-upgrade plugin. Today, I have fedora 32. Some time ago, I’ve discovered about SHA1 is now discontinued.

Reading the cryptsetup luksDump of my encrypted system, I can see it was installed using SHA1:

Version: 1
Cipher name: aes
Cipher mode: xts-plain64
Hash spec: sha1
Payload offset: 4096
MK bits: 512

My password length has more than 70 characters. But, should I reinstall the full system to update my hash encryption ?
I am really unsafe for keeping SHA1 ?


texts: Stateless user-generated one-time passwords

texts:
I've been working on my course project lately and got stuck with the problem which I reduced to the following abstract protocol:

Alice generates an ID key and gives it to Bob.
Bob generates some random data, combines it with that ID key to produce a token and sends it back to Alice. It is essential that data is random, i.e. Bob does not maintain any state.
Alice verifies that token is generated by Bob and also is able to tell whether it was used before. This can obviously be achived by keeping all previous tokens in a database, but if we are talking about passwords for example, it would be great to maintain as little state as possible.

The idea behind these requirements is that existing one-time password schemes require either interaction with the service (challenge-based OTPs) or maintaining some state (TOTP, HOTP, etc). What I would like to do is, basically, to generate a new password for every session, be able to generate those passwords upfront and be sure that once used, password can never be used again.

Is there any one-time password scheme that would satisfy these requirements?


texts: A method for creating distributed public key for ECDSA, what are the risk factors?

texts:
There is quite a bit of literature on distributed ECC signing without a trusted dealer. Published works are mostly overly complicated, so I am proposing this simple technique which I am sure if it is valid is already published (but I couldn't find it):

Problem: "t" actors need to create an ECC private key and public key without a trusted dealer. Assuming some standard ECC parameters, and generator $G$.

Solution:
Each actor $a_i$ creates a private key $p_i$. Final private key is $\sum_{i}{p_i}$ that will never be published.

Actors publish the public key by publishing their part $p_i.G$. Final public key can be created by $\sum_{i}{p_i.G}$

Question Is this too simple to be true? What are the risk factors here that I am not anticipating? Note that in elliptic curve fields $(a+b).P=a.P+b.P$

Please note that for simplicity we assume at the time of signing we can trust the signer and she can collect the private key parts from the actors. Hence, the question is only in regards to creating a public key without a trusted dealer.


texts: Forward Secrecy when using non-ephemeral DH

texts:
In context SSL/TLS, reading up on various sites, I find forward secrecy in DH key exchange being linked to its ephemeral use i.e. DHE. I don't fully understand this link, where does following reasoning break?

If non-ephemeral use (plain DH) would not provide forward secrecy, and ephemerality refers to a new session key being made each time a new session is set up. Then the use of SSL/TLS Session IDs/Session Tickets would make DH-use non-ephemeral.

But how can the compromise of server public/private keys result in the compromise of an earlier established DH session key? I should presume that the nonces which were used are already discarded; and the storage associated to Session IDs/Session Tickets is not necessarily compromised if the server public/private keys are compromised?


texts: X.509 CSR: Why does CA remove signature?

texts:
I just read this article on Wikipedia: Certificate Signing Request

I'm not a PKI or Crypto expert. As I understand, a CSR (certification request) is always signed by the PKCS#10-Request creator.

What I don't understand is why the CA, which receives and processes the CSR, then removes this signature (I mean, without this signature a CA could possibly alter attributes of the CSR).

Why does a CA not just add the necessary attributes to the CSR and sign it with its private key?


texts: What is definition of "adversary"? And what do they do?

texts: Currently I am writing my last assignment about secret sharing. But I don't clearly understand adversary. I know this is a fundamental concept in secret sharing. But I couldn't find references that clearly definite adversary. Moreover, what is passive attack and active attack? What are the differences between them?


texts: Using Montgomery ladder to calculate the coordinates

texts:
In one of my assignments I need to solve the problem below:

  For a Montgomery curve $3y^2 = x^3+x^2+x$ over ${\mathbb{F}}_{11}$ and point $P = (9,8)$, compute the $x$ coordinate of $3P$ using the Montgomery ladder.

I just need a hint to get an idea and not the whole answer. if anyone with some useful links would also be appreciable. As I tried to search google for this but was not able to get any idea.

Is it that I need to find it as $3P = 2P + P $ because I found one question about scalar multiplication here. but then I think it is not the correct way to use the Montgomery ladder.


texts: What are the practical limitations of Asymmetric encryption vs Symmetric encryption?

texts:
I hear it commonly said that the advantages of Symmetric encryption are speed and no limit to the amount of data that can be symmetrically encrypted.

I also hear it commonly said that the advantages of Asymmetric encryption are security.

But theoretically, if I want to symmetrically encrypt a 1TB file, my algorithm is just going to break the 1TB file into smaller chunks, encrypt them, and spit out the cipher text.

Why couldn't I do the same with Asymmetric encryption?  AKA,  what are the practical limitations of using Asymmetric encryption for bulk encryption?


texts: What is the most important piece of information in a X.509 certificate?

texts:
X.509 has a structure which contains information like version number, serial number, signature algorithm, issuer, subject name, subject public key, signature of the issuer etc.

However, I'm having an argument between friends because according to them, the public key is the heart of the certificate.

On the other hand, I think issuer's signature (CA) is the most important attribute. This is because basically you can't do anything without having a valid certificate, whereas if public key for some reason is missing, I still think you can digitally sign documents (since it uses private key and not the public one).

Certificate here comes handy because you need the subject's name (signed by youremail@gmail.com") which you can access since you have a valid cert. If you don't have the CA's signature, you can't even digitally sign.

I need to know which is the right answer. Thanks!


texts: What is the difference between these two TLS suites?

texts:
I am comparing the security information of two different HTTPS connections in the Google Chrome (v63.0.3239.132) security tab in developer tools. The information for each of the two connections is given below:

The first states ECDHE_ECDSA with X25519 as the key exchange.  The second just states plainly that X25519 is the key exchange.  This seems odd to me because X25519 is the curve, correct?  Are these two key exchanges the same and they are just worded differently (for some reason)?  Is this because of the use of QUIC?
The first site is an API, the second is google.co.nz.

What are the differences, if any?


texts:
I found a definition of an exponent operation over the element of $\mathbb{G}$ in this paper (page 4):

$$ (g^a)^{\% b} = g ^{a \text{ mod } b}$$

I couldn't understand the rest of the paper (Decrypt primitive).

We have $D = g^r g^{M_S} = g^{r + M_S}$

How could they compute: $(D)^{\% M_T}$. In this paper, they have written it in a form:

$$(D)^{\% M_T} = g^{(r + M_S) \text{ mod } M_T}$$

But the exponentiation in $D$ is already computed, we cannot run the $\text{ mod }$ operator before the exponentiation.

Here are captures of the paper:

Thank you in advance for your help.


texts: Encrypted vs unencrypted digital signatures

texts:
Is there a difference in terms of security between

An encrypted stream of bits obtained by encrypting a plaintext concatenated with it's signature

$ C = E_k(plaintext||\sigma)$

where $E$ is a symmetric or asymmetric encryption function, II is a concatenation operator and

$\sigma=h(plaintext)^k$

where $h$ is a secure MAC (the key is assumed to be the same).
A bit stream obtained by concatenating a ciphertext and the signature over the its corresponding plaintext

$C=E_k(plaintext)||\sigma$

where

$\sigma=h(plaintext)^k$
A stream obtained by encrypting the ciphertext of the plaintext concatenated with the signature over the respective ciphertext

$C=E_k(E_k(plaintext)||\sigma)$

where

$\sigma=h(E_k(plaintext))^k$

Also, is there any risk due to using the same key for both encrypting and signing? I don't refer to the cases that do not involve recovering the key through other means other than passive or active attacks.


texts: Bulletproof - Is it possible to do range proof only from public key?

texts: is it possible to proof x in range (2^1,2^64) from xG=Q with bulletproof or something else only from Q? I’m new in this subject, so thanks before.


texts: Calculating inverse of transposition key cipher

texts:
I need some help on transposition cryptography.

If I'm given the encoding key to a transposition cipher, how do I get the decoding key for it? I tried googling but couldn't find any steps on the calculation for it. For example, like in this website, when I enter
 4 3 1 6 2 5 I would get 3 5 2 1 6 4 but why and how?


texts: How to make my hash more robust to the brute force?

texts:
I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret.

I want to increase the cost of brute forcing the passphrase I use to generate the secret.

I'm thinking of using scrypt after the pbkdf2 computation.

scrypt(pbkdf2(passphrase, salt))

Is there a better way?


texts:
Can someone explain to me, why Zero-Knowledge-Protocols are used instead of letting the person sign a random string and then verify the signature?

Doesn't Fiat-Shamir need even more processing-power than RSA with swapped private and public keys? (RSA can be used as signature-method by "encrypting" with the private key and "decrypting" with the public key, can't it?)