texts: Cracking a key using a combination of partial keys

texts:
As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$.

The attack works successfully against these partial keys, and outputs a list of possible values for each partial key along with their likelihood. The list is ordered by likelihood such that the first value of the output is the attack's best guess for that part of the key.

This likelihood also tells me what kind of confidence exists in each partial key -- a certain high likelihood value means that the correct partial key will almost surely be in the first 10 best guesses; some other lower likelihood value means that the partial key guesses aren't as good and you only expect to find the correct partial key after testing 120 guesses.

What is the optimal strategy (in terms of number of attempts) to combine the partial key guesses into a guess of the entire key?

For this, let's imagine that, from the lists of partial key values, I want to build a list of possible (complete) key values, ordered by likelihood.

My best guess for the complete key is, trivially, the best guess for each partial key, and thus that's the first item in my list. For the second item in that list, I will take the partial key which has less likelihood, and instead of using the best guess, I'll try the second best guess and see if that works.

Now, how do I proceed to complete my list? I've already tried the second best guess of the least confident partial key, but indeed I could continue, and just brute-force the least confident partial key. After, I could do so for every other partial key, from least confident to most confident.

This approach is sensible, however, it may not be optimal. It seems to me that if I know the expected position of the correct value for the lists of each partial key, perhaps I don't actually need to test all the positions of the least likely partial key first, and actually, one of the more confident partial keys perhaps has the correct answer as the second best guess.

If I can define which kind of strategy is optimal, then I can finally reach my goal of computing the expected position of the correct value of the key in the candidate list of complete keys, in terms of the expected position of the correct values for each partial key. This is because my final goal is to get some measure of entropy (guessing entropy, for example) for the complete keys calculated from the partial keys.

If you know any scholarly sources (conference papers, articles, books, etc. for further reading) for this kind of problem and possible solutions, that'd be greatly appreciated.


texts: Increased AES key lengths vs keyphrase entropy

texts:
I'm selecting an AES key size for a LUKS partition using XTS-PLAIN64.

XTS will effectively reduce the AES key strength in half.

The default key size for AES XTS-PLAIN64 is 256 bits (meaning 128 bits effective). Given exponential progress making quantum computing ever more a reality, I was thinking to increase the key size.

I believe that AES is only defined on key sizes of 128, 192 and 256 bits, but cryptsetup/LUKS does allow me to select a key size of 384 or 512 bits.

I am aware that in theoretical related-key attacks certain cases AES256 may be less secure than AES192, but I'm not going to be using related keys.

What are the implications of using a 384- or 512-bit AES key?
Even if using XTS with AES256 (128 bit effective strength), would my 90-bit entropy keyphrase and 15,000 PBKDF2 iterations of SHA-512 still be the weakest link in the chain?
How would I work out how many bits of entropy and iterations are needed to make the keyphrase and the AES128 encryption the equal-weakest links in the chain?

If you could answer using finger-puppets in preference to complex formulae (where possible), that would be appreciated - I'm relatively new to the world of crypto.


texts: Are there any references on using neural networks to distinguish CSPRNGs?

texts:
No feasible algorithm should be able to distinguish the outputs of two CSPRNGs. Are there any research papers that present results of actually testing this?

In particular, I'm interested in references that try (and hopefully fail) to distinguish them using neural networks or other machine learning techniques.

N.B.: I'm a mathematician, not a cryptographer, so – even if such references exists – I don't even know what journals to look in. My own research efforts didn’t turn up anything usable.


texts:
One of the primary advantages of JWTs is that they serve as capability tokens, allowing for a portable verification of capabilities/ privileges. However, JWTs are often criticized for a number of weaknesses.

What is the disadvantage of simply applying an HMAC to a JSON object yourself and avoiding the rest of the baggage of the JWT spec?


texts:
In many homomorphic encryption scheme, a security parameter is calculated as p =O(n).

How to use the complexity order as values?

Is there any specific method with an appropriate example?


texts: Asymetric encryption, multiple recipients, traitor must share private key

texts:
Is there an Asymetric encryption scheme, or public key encryption, where multiple recipients are able to access the data but in order for one of the recipients to leak the key to the data they would need to share their private key?

I believe this to be true for most one-to-one methods of public key encryption (correct me if I'm mistaken) where if something is encrypted using a public key the corresponding private key would need to be shared to decrypt the encrypted data and could used to identify the corresponding public key.

However, I am curious if such guarantees could be made in a Asymetric encryption mechanism with multiple recipients.

An example is GPG with multiple recipients. I believe the way this is accomplished is by encrypting a common synchronous key with each of the public keys specified so I don't think this could make the guarantee that the private key would need to be shared in order to grant permission to decrypt the data to another party since the synchronous key likely could just be shared.

Another example I identified is An efficient public key traitor tracing scheme but it's not clear to me weather the private key would need to be shared in order to be considered a "traitor".

The use case I see for this is if something of value could be accessed using the private key then the party holding the private key would be motivated to keep it secrete. It doesn't guarantee they will but it will put something at stake.

Stated formally what looking for is;
Given $A, B, C \in \{pub,priv\}$, a set of functions for encrypting/decrypting data $x$ follow $f_0:x,seed,A_{pub},B_{pub},C_{pub}\rightarrow x_{encrypted}$ and $f_1:x_{encrypted}, A_{priv} \lor B_{priv} \lor C_{priv} \rightarrow x$ then the private key of $A$, $B$, or $C$ would need to be revealed in order for data encrypted by $f_0$.

Tying value to the private key and encrypting in this manor strikes me as a useful mechinism for incentivizing the owners of $A,B,C$ to keep their private keys private as they a continuous data broadcast with encrypted data for their eyes only. Obviously the parties could just relay the data but that's another topic for another post and what I want to focus on here is a shared key mechanism that that can guarantee a high probably that the raw private key will need to be shared in order to actively decrypt the encrypted data broadcast.


texts: Query sensitivity of time series under differential privacy

texts:
I stumbled upon a paper that proposes local DP around this argument:

A user $u_i$ generates a sequence $s_{i}$ of observations at certain timestamps:

$$
s = ((t_1, x_1), (t_2, x_2), \dots, (t_n, x_n))
$$

The authors apply $(\varepsilon/n, 0)$-DP to each sequence by adding Laplacian noise
As widely known, Laplacian must be of scale $b = \frac{\Delta f}{ \text{budget}}$

The authors propose budget of $\varepsilon / n$, which is IMO correct. But they also define $\Delta f$, aka the sensitivity of the query, as simply the range of any value at any timestamp, $\text{max}(x) - \text{min}(x)$.
I'm not convinced that this is the true sensitivity. To my understanding, the query output is (ignoring the timestamps) not a single value $\mathbb{R}$ but rather the vector of outputs $\mathbb{R}^n$, so per definition of sensitivity $\ell_1$-sensitivity of a function $f : \mathbb{N}^{|\mathcal{X}|} \rightarrow \mathbb{R}^k$:
$$
\Delta f = \max_{x, y \in \mathbb{N}; \| x - y\|_1 = 1} \| f(x) - f(y) \|_1
$$
and properly computing the $\ell_1$ norm as $\| x - y\|_1 = \sum_{i = 1}^{k} | x_i - y_i |$, the sensitivity should be
$$(\text{max}(x) - \text{min}(x))^n$$
Is my reasoning correct (and the paper's DP potentially wrong), or am I missing something? (I don't reveal the paper on purpose.)

Update: Claryfing context of the time series.

The health data stream each user is represented as a sequence $s = ((t_1, x_1), (t_2, x_2), \dots, (t_n, x_n))$

Here, $(t_d, x_d)$ represents the $d$-th point in the stream where $x_d$ denotes the value measured by the wearable health device at timestamp $t_d$.

We further assume that $x_d$, which is measured by the specific sensor in a wearable health device, is within the predefined range $[x_{min}, x_{max}]$.

Their particular use-case is collecting heart rate ($x$) over time ($t$).


texts:
Wikipedia mentions ISO10126 Padding has been withdrawn, but doesn't say why. Also there were no news reports about this, as far as I can see.

Why was it withdrawn? Are there security flaws? Is there maybe a new version?


texts: Help to understand the KDM in SP800-56A, and the usage of "FixedInfo"

texts:
Can somebody help me to understand the LOGIC behind Key-Derivation Methods (SP800 56A CH5.8)?
This is my common understanding and please correct me if any wrong..

Alice and Bob can general individual key-pair, by any public
cryptography method (RSA, ECC, DL, etc..);
Based on the Key Exchange protocol (for exp ECDH), Alice and Bob can obtain the shared secret Z between them, and using Z as AES key for the afterwards communication.
If they like they can generate the new shared secret Z as they want--that is named as Ephemeral ECDH.

OK my question would be: here I don't really understand the Key-Derivation Methods (SP800 56A CH5.8) application scenarios--it looks like based on the common key agreement scheme (like ECDH), this KDM introduce a "FixedInfo" (which can be a readable text or just some hex string) concept.

I didn't find detail infor about how this "FixedInfo"  works:

Does it use some Hash to process the "FixedInfo" and then derive new Secrete Key?

And does that mean each time a new FixedInfo shall be applied for both Alice and Bob?

Anyway, adding this "FixedInfo" looks NOT enhance security if compare to an Ephemeral ECDH--from my point-of-view..

---self update:
OK after some study I have one explain but am not sure if that is correct--add such "FixedInfo" is actually a kinds of Ephemeral ECDH--it does not require a new ECC key-pair to be generated, so would reduce the key leakage risk? or from computing point-of-view this would save computing power?


texts:
Are there two step encryption systems that - given the same plain text - support choosing two keys ($k_{A_1}, k_{A_2}$) for a first encryption so, that you can calculate another pair of keys ($k_{B_1}, k_{B_2}$) resulting in equal cipher texts?

$E(k_{B_1}, E(k_{A_1}, m)) = E(k_{B_2}, E(k_{A_2}, m))$ with $k_{A_1} \neq k_{A_2}$

A one-time-pad encryption is one of these systems, if you choose the keys like this $k = k_{A_1} \oplus k_{B_1} = k_{A_2} \oplus k_{B_2}$. Are there other systems that don't suffer from key re-usage?


texts: Determine the RSA private key from public key

texts:
I was told that you can determine the private key of an RSA encryption with the public key.

I thought the point of a public key was to avoid letting people find the private key, but anyway, they said I could find it by simply factoring the public key modulus? Were they joshing me or can it be done? If so, how would I do that (need to acquire $p,q$ somehow?)?

So with with example Public Key $( e, n ) = ( 13, 119 )$ or any other valid key you want to use...


texts: Using Keccak permutation as a block cipher

texts:
The inverse of Keccak is slow, but if you have a problem where that is not a concern would this be a secure cipher? The encryption function can be made incredibly fast in hardware. Or the reverse if you choose to encrypt using the inverse.

Is there any cryptanalysis of block ciphers that are unbalanced in such a fashion? Inverse being more expensive and having different diffusion properties.

The round constant step (used to break symmetry) in the round function is the only thing that needs to be changed to employ a key schedule.

The nonlinear step is worrisome, they use a simple cellular automaton rule: flip bit if pattern 01 is to its right (and wrap around). This makes invertability cumbersome for an arbitrary odd length input (not possible for even length), but they use it for just a 5 bit input which just makes it a trivial 2^5 S-box - is it a good one? 0* maps to 0* and 1* to 1* for example.

PS: * means repetition, in the case of keccak 1* = 11111


texts: Compare RFC 5246 SessionID re-use versus RFC 5077 Session Resumption?

texts:
Can you help me understand the differences, both algorithmic and practical, between RFC 5246 SessionID re-use and RFC 5077 Session Resumption?

Both appear to be ways to nail up a second TLS session without a Server certificate exchange, leveraging the full certificate exchange and validation of a previous, separate TLS session.

Having read RFC 5246 § 7.4.1.2 and RFC 5077 § 3, it seems that RFC 5077 hands a token to the client which has session setup information encrypted with the server's key, such that the client can hand the token back to the server and shortcut the negotiation and agreement of session setup parameters.  RFC 5246, on the other hand, simply provides a reference to an existing connection that both parties share, and allows them to re-use those session parameters, based on both parties still having them in memory for the original session.

Is that a proper theoretical grasp?

Insofar as that's "close enough for government work", I'm interested in the real-world usage of the two separate types of connections:

Is RFC 5246 SessionID good

Only as long as the original session is still active?
As long as there's a consecutive chain of sessions using the same SessionID?
For a loosely defined amount of time after all such sessions have closed but before the SessionID is dropped from active memory?

Is RFC 5077 Session Resumption

Commonly used instead of RFC 5246 SessionID?
Commonly used for more widely separated connections that RFC 5246?
Commonly used at all?

Do the two differ as described here:

RFC 5077 token creation (server send to client) is wholly contained within encrypted packets, e.g., after the handshake?
RFC 5246 session exchange is wholly unencrypted, e.g., within the early (ClientHello, ServerHello) parts of the handshake?

Any insight you can share is appreciated!


texts: Why does ed25519 seem to accept and use 96-byte / 384-bit signatures?

texts:
Why do ed25519 signature verify functions accept 96-byte signatures? Take this piece of code for one example: crypto_sign_ed25519_open() requires that signatures be at least 64 bytes (512 bits) but will accept longer ones, and get_hram() will include extra bytes at the end of the signature in its hashing step if they are present. Yet crypto_sign_ed25519() generates a 64-byte signature.

Is this some kind of legacy thing? Does it have any cryptographic implication?


texts: Why can’t the public key exponent in RSA be negative?

texts:
I am looking at why certain public keys in RSA can't be used, such as:

2 and all other even numbers (since $\gcd(\phi,e)$ must equal 1)
1 (since the cipher text would equal the message)
0 (since the cipher text would be 1. Also because 0 has no
multiplicative inverse)

Let's say we have a message $m = 10, e = -3, N = 55$ then encrypting the cipher text would be: $m^{-3} = \frac 1 {1000} \mod 55$. Can we only use integers when writing in terms of a modulus?
Why can the public key exponent not be negative?

(Perhaps this is more of a maths question....Sorry)

Edit: Also, why can’t the public key exponent be greater than $\phi(N)$?


texts: Does perfect forward secrecy (using DH or ECDH) imply quantum resistance?

texts: Does perfect forwarding secrecy, as used for e.g. the DHE_ and ECDHE_ TLS ciphersuites make it impossible for quantum analysis to retrieve the plaintext data within the connection?


texts:
Let's suppose CTR mode is instantiated such that the input to the block-cipher is $\langle \mathrm{IV}+\mathrm{ctr}\rangle$ instead of $\mathrm{IV}\mathbin\|\langle \mathrm{ctr}\rangle$, where $\langle X\rangle$ is the bit representation of $X$.

Will the mentioned version of CTR encryption scheme be IND-CPA secure against nonce-respecting adversaries? If not, can this be made nonce-IND-CPA secure by adding some cryptographic methods over it without altering the underlying structure?


texts: Salt and pepper at both client and server sides?

texts:
Putting aside that it may sound paranoid.

I know that many users tend to use the same password on many sites. Then, from an ethical point of view, I should not only be concerned about security breaks that affect my own system, but also how my system might facilitate breaking the security of other systems.

Suppose that an attack allows a third party to read (but not modify1) the communication, including the password exchange during login. If they can read the user's name and password, they could gain access to the account of that person on other systems if they used the same name and password there.

To avoid that, I was thinking about doing hash(system_public_pepper+username_as_salt+password) at client side, along with bcrypt (which includes salt) with a secret system pepper. Both peppers would change at each server (randomly generated on install).

But then my new concern is whether this client-side hash could weaken the password (example: limiting the entropy).

And then:

What hash should I use to make sure there is no significant entropy loss? Is MD5 ok?
Can the pepper and/or salt weaken the entropy, considering it is of public knowledge (although salt changes between users)?
Does it make a difference whether the salt (username) or pepper (public) are prepended or postpended? Which order is best?

I think that if the salt or pepper are prepended, one can take the state of the hash algorithm at that point as a start, and then computing the hash of every password would cost less (as if there were no salt and pepper).

But, also, one could apply the same to common passwords if they are at the beginning.

Is there anything else I should consider?

Edit: I think that there is a misunderstanding from what I proposed. So, I will put an example. U is user, C is cliente, S is server, D is database (just pseudo for clarity, we can use PDO for prepared statements and so).

SIGNUP EXAMPLE:

C>S: I need to signup, send me the public pepper.
S>C: {"system_public_pepper":"Potts"}
U>C: {"username":"johndoe","password":"IWasBornOn1987"}
C: P=system_public_pepper+username+password; //P="PottsjohndowIWasBornOn1987"
C: H=md5(P); //="28d36f3969e05dedb5f9ba20acd3842a"²
C>S: {"username":"johndoe","hashpass":"28d36f3969e05dedb5f9ba20acd3842a"}
S: private_pepper="GwynethPaltrow";
S: new_pwd=private_pepper+hash_pass; //"GwynethPaltrow28d36f3969e05dedb5f9ba20acd3842a";
S: pwd_bcrypted=bcrypt(new_pwd); //"$2a$04$qh7z5sSkMCrLq6mrpdOwM.ohlvCKWvU3vQm.CrjrxcQc6otwByBle"³
S>D: INSERT INTO users ('username','password') VALUES ('johndow','$2a$04$qh7z5sSkMCrLq6mrpdOwM.ohlvCKWvU3vQm.CrjrxcQc6otwByBle')

SIGNIN EXAMPLE:

C>S: I want to sign in, send me the public pepper.
S>C: {"system_public_pepper":"Potts"}
U>C: {"username":"johndoe","password":"IWasBornOn1987"}
C: P=system_public_pepper+username+password; //P="PottsjohndowIWasBornOn1987"
C: H=md5(P); //="28d36f3969e05dedb5f9ba20acd3842a"²
C>S: {"username":"johndoe","hashpass":"28d36f3969e05dedb5f9ba20acd3842a"}
S: private_pepper="GwynethPaltrow";
S: attempt_pwd=private_pepper+hash_pass; //"GwynethPaltrow28d36f3969e05dedb5f9ba20acd3842a";
S>D: SELECT 'username', 'password' FROM users WHERE 'username'='johndoe'  //'$2a$04$qh7z5sSkMCrLq6mrpdOwM.ohlvCKWvU3vQm.CrjrxcQc6otwByBle'
S: password_verify(attempt_pwd,stored_hash)

Footnotes:

I know that it would be odd, since usually if you can sniff an HTTPS
communication, you can also run a MitM attack. But I was thinking
about a generic attack only aimed at reading because it may work on
a massive amount of sites. While modifying them would require more
work. So, at least I can prevent those. Also, I suppose it could be
a specific attack to the OS or HTTPS deamon that allows to read
communications.
Here is the key, the user password does not leave the client.
Let's say there is a bug at the server, and the received communications
get logged: you can't get the password logged, just the hashed version.
The stored hash is neither the original password, nor the received one.


texts: Why does HKDF use HMAC(salt, key) instead of HMAC(key, salt)?

texts:
I've been looking over the HKDF specs (RFC 5869), and something I noticed is that in the key and salt are reversed:

2.2.  Step 1: Extract

 HKDF-Extract(salt, IKM) -> PRK

 Options:
    Hash     a hash function; HashLen denotes the length of the
             hash function output in octets

 Inputs:
    salt     optional salt value (a non-secret random value);
             if not provided, it is set to a string of HashLen zeros.
    IKM      input keying material

 Output:
    PRK      a pseudorandom key (of HashLen octets)

 The output PRK is calculated as follows:

 PRK = HMAC-Hash(salt, IKM)

Neither the spec nor the paper seem to address the order.

To me it seems like HMAC(salt, IKM) would be weaker against a brute force search of IKMs, as the digest of the salt can in this case be precalculated by an attacker (assuming the salt is a non-secret value or zero).

What is the benefit of using it this way?


texts: Could someone please explain the implementation of public-private key encryption for storing passwords?

texts: As someone new to cryptography,I have a question about how logins work on websites. I understand mathematically how asymmetric encryption works and how https web requests work to securely send symmetric encryption keys. What I struggle to understand is how a website can have an encrypted version of my password stored that they aren't capable of deciphering, yet they can check the password is correct, without at any point sending data that would cause a breach. Maybe this is a dumb question but if anyone could point me in the right direction for resources to read that would be great.


texts: What is the fastest way to generate a truly random one-time pad without electrical or any other complicated device?

texts: I want to generate a truly random one-time pad as fast as possible, but without the use of any electrical or any other complicated device. What is the fastest way to do that?


texts:
I'm encrypting in C++ with openssl library.

Basically I'm using these functions:

RAND_bytes(key, 32);
AES_set_encrypt_key(...)
AES_ctr128_encrypt(...)

My purpose is to encrypt parallelly with different threads. Obviously, every encryption/decryption will be on completely different objects.
Does these functions thread safe? If not, is there anything except mutex that can help? (mutex will awfully damage my systems' performance). Thanks!


texts:
Crypto schemes normally use discrete logarithm instead of normal logarithm.
I think this has to do  with the fact that discrete logarithm is hard to solve while normal logarithm isn't.
Can someone explain why discrete logarithm is hard to solve and normal one isn't?


texts: Why this function isn't preimage resistant?

texts:
Prove that the function
$$
G(z) = \mathcal{H}(z) \, || \, \text{LSB}(z)
$$
(where $\mathcal{H}$ is a collision resistant hash function, $||$ is concatenation and $\text{LBS}$ is the least significant bit of $z$) is not preimage resistant.
Obviously, if $z = 0^n$ then from the output $G(z)$, one can extract $z$ from the last bit. That also can be said about the case $z = 1^n$.
But is this enough to prove $G$ is not preimage resistant?

Pre-image resistance: given a hash $h$ it should be hard to find any
message $m$ such that $h=hash(m)$. This concept is related to that of
the one-way function. Functions that lack this property are vulnerable
to pre-image attacks.


texts: CSPRNG for Contract Bridge (RAND_MAX = 0xAD55E315634DDA658BF49200)

texts:
Some background information:

In contract bridge, there are 0xAD55E315634DDA658BF49200 (just under 2^96) possible bridge deals. Since the 1990s, bridge deals for major tournaments were generated on PCs and dealt using dealing machines. Initially, the deals were generated using a PRNG with very low periods with dubious seeding (no CryptGenRandom back then and DOS was still widely used) and dealing algorithms that introduce bias with the modulo operator, which predictably caused problems when deals were found to be repeated.

This all changed around 1999 when Hans van Staveren released a program called Big Deal, documenting the issues with existing dealers and how Big Deal fixes them to ensure:

The software should be able to generate every possible bridge deal, since that is also possible with manual dealing
The software should generate every deal with the same probability, without being influenced by the board number, previous hands or any other circumstance
It should be impossible to predict deals, even after having seen all other deals in the session

Big Deal's document acknowledges that it's use of the RIPEMD-160 as a CSPRNG runs into a Birthday Paradox issue: H( H(associated data) || 160 bit seed || 32 bit counter )

Which comes to my first question:

Could Big Deal have avoided the Birthday Paradox problem by loading H(associated data) XOR seed into the RIPEMD-160 state (instead of hashing them in) before hashing the 32 bit counter?

I am planning to propose the use of my modern re-implementation of Big Deal. In this implementation, I chose to use Gimli with a 256 bit seed and a 128 bit counter (actually, 2x 32 bit and 1x 64 bit counters). This is done simply by loading the 384 bit Gimli state with the 256 seed appended with the 128 bit counter. I run the Gimli permutation function and extract the first 96 bits of the new state. If the value >= 0xAD55E315634DDA658BF49200 I rerun the permutation again.

So here is my second question:

Are there any issues with the way I am using Gimli as a CSPRNG?

Thank you


texts: LTV signatures - Expiry of embedded timestamps

texts:
I work for a company which decided last year to offer a PADES (PDF advanced electronique signature) for its clients. We don't do the advanced signature ourselves, we work with external AATL(Adope Approved Trust List) providers who generate the short-lived certificates and perform the signature on their side. Basically the flow is the following:

We generate a PDF with placeholders for signature (if there are multiple signers then we will put several placeholders in the PDF)
We send the PDF for eSealing to our external providers
After eSealing, each signator digitally signs the document in his websession:
      a)The pdf is sent to our external provider which issues a short-lived
       certificate for the client
      b)The client confirms that he would like to sign
      c)The external provider signs the hash of the document with the
       certificate and sends the result of the signature to a TSA for
       timestamping
      d)Signature +timestamp(embedded) are put in the placeholder and the document is
      sent back to us
      e)Once all the required signers(1 or many) have signed the document,
       we store the document in our long term archiving system (e.g.: for
      10 years)

Problem: So far so good. However, last week our external provider told us that the certificate used for timestamping is only valid for 3 years while the validity of our contracts can last for 10 years. We did a test opening one of our signed document with Acrobat Reader, changed the date of the computer (3years in the future) and we noticed some warnings on the signatures "The signature includes an embedded timestamp but it is expired"

Questions:

Is it mandatory for long term non repudiation to re-timestamp each signature before expiry?
Should we re-timestamp every signature or only the last signature? (Since there can be multiple signers and generally we allow a timewindow of a month so theoretically, the last signator can sign a month after the 1st signator)
How things work under the hood during re-timestamping? Which data to send to the TSA for retimestamping? Where in the pdf should we put the result of the re-etimestamping?
Will Adope still show the warning after re-timestamping?

thanks a lot for your help


texts:
I'm having trouble with the following question:

  $X(A) \rightarrow B:(A,N_X)$
  $B \rightarrow X(S):(B,((A,N_X,T_B),K_{BS}),N_B)$
  $X(A) \rightarrow B:(((A,N_X,T_B),K_{BS}),(N_B,N_X))$

  Give two very good reasons why this attack works, in terms of the properties of the messages being exchanged and their content.

$X$ is the attacker in this case.

$A$ and $B$ are the names of two agents, $S$ is the name of a trusted server, $N_X$ denotes a nonce created  by entity $X$, $T_X$ denotes a timestamp created by entity $X$, $K_{XY}$ denotes a key shared between entities $X$ and $Y$

If anyone can help at all, I would greatly appreciate someone going through this question with me step by step.

From this I have understood that $B$ relays the encrypted message back and thinks everything is okay. The attacker doesn’t care about verifying the message. It gets the key and communicates with $B$ where $B$ thinks it is $A$ who has got the key through the server.

I just want to make sure that i have understood it correctly.


texts: Elliptic curve as a product of 3 cyclic groups possible?

texts:
I'm looking for some kind of 3-dimensional Elliptic curve. As far as I know a normal Elliptic curve like $$y^2 = x^3 + ax + b$$ over $F_p$ consists of one or two cyclic groups $Z_m (\times Z_n)$. Given one point and one/two generators you can reach each point with it. Now I'm looking for a product of 3 cyclic groups, given a point and 3 generators let you reach each point in this product.
(btw for cryptography do you mainly use elliptic curves with one ore two cyclic groups?)

So lets say it's $Z_m \times Z_n \times Z_r$ with generators $g_m, g_n, g_r$ and a point $s$ which lies in there. With $s g_m^i g_n^j g_r^k$ all points can be reached. E.g. $s g_m^m$ would be $s$ again and $s g_m^i g_n^j = s g_n^j g_m^i$ (same for $r$,$m$,$n$). (Best for use case would be $m=n=r=prim$)

I read from Wikipedia about Projective twisted Edwards coordinates with $$(a X^2 + Y^2)Z^2 = Z^4 + d X^2 Y^2$$

It has 3 coordinates but not sure if it's what I'm searching for. Can't find information about the inner structure.
I did some tests with the written algorithm but it was neither cyclic for all points nor closed for all points nor a product of 3 cyclic groups. I did some test with small numbers ($p,a,d$) and found many different cycle sizes. Normal for that kind of Elliptic curves? Did I something wrong? Is it what I'm looking for?

Do you know any other Elliptic curve with an inner structure of 3 cyclic groups (some more also Ok, can ignore those)?
Or something else which produces 3 cyclic groups, with the condition, given two points, starting at one you don't know how to reach the other point. Only way doing this try around until finding him. So you don't know which generator using next. And if you found him you also know the way backward.


texts: Commutative homomorphic encryption for zero-knowledge transfers

texts:
I am trying to design a scheme that would allow the following:

Alice has a number $a$ which she wants to keep secret
Bob has a number $b$ which he wants to keep secret
Alice can "transfer" a number to Bob such that whatever she transfers must be subtracted from her number (the sum of their numbers must remain the same)
Victor is an independent observer and must be able to validate that the sum of the numbers does not change without learning any of the numbers

For example, suppose Alice's number is $10$ and Bob's number is $5$. If Alice transfers $2$ to Bob, his number will become $7$ and her number will become $8$. Victor, observing the transfer, should be sure that the total sum didn't change but he shouldn't be able to learn any of the numbers involved. Alice shouldn't be able to learn Bob's starting or ending number, and Bob shouldn't be able to learn Alice's starting or ending number.

I am thinking this is possible to implement using a deterministic encryption that is both commutative and homomorphic (additive). For example:

Alice would use her public key to encrypt her number $a_1 = E(a, pub_a)$ and would share it with Victor
Bob would do the same $b_1 = E(b, pub_b)$
If Alice wanted to transfer $x$ to Bob, she would compute $a_2 = E(a-x, pub_a)$, $x_a = E(x, pub_a)$, $x_b = E(x, pub_b)$. She would then share $a_2$, $x_a$, and $x_b$ with Bob and Victor
Bob would decrypt $x = D(x_b, priv_b)$, and then use it to compute $b_2 = E(b + x, pub_b)$. He would then share $b_2$ with Victor

Using this info, Victor would be able to verify that Alice's number was updated properly, because $a_1 = a_2 * x_a$. He would also know that Bob's number was updated properly because $b_2 = b_1 * x_b$. And finally, he would know that $x_a$ and $x_b$ encode the same number because $E(x_a, pub_b) = E(x_b, pub_a)$.

Deterministic encryption should not compromise security because the numbers themselves can be randomly "padded". For example, the numbers could be 128-bit integers where lower 64 bits are randomized. So, essentially, instead of sending $2$, Alice could be sending something like $2.00034094035343043$.

It seems to me that El Gamal could work to implement something like this, but I'm not sure if there is anything better. Also, there are some concerns for El Gamal:

Homomorphism for regular El Gamal is multiplicative, not additive
Ciphertext and public key size may be quite big - and I'm trying to make them as small as possible


texts: Quantum algorithm for elliptic curve's private keys

texts: Is there a quantum algorithm to find private keys generated using elliptic curves ?


texts: If $f:\{0,1\}^n \to \{0, 1\}^n$ is a one-way function, $G:\{0, 1\}^n \to \{0, 1\}^m$ is a pseudorandom generator, and $U_m$ is the uniform distribution over $m$-bit strings. Is the joint distribution $(f(X), G(X))$ computationally indistinguishable from $(f(X), U_m)$, for uniformly chosen $X$?


texts: Choice of authenticated encryption mode for whole messages

texts:
There are several well-regarded block cipher modes for authenticated encryption which have made their way into standards and protocols: CCM, EAX, GCM, OCB, …

If I am designing a new messaging or storage protocol which requires both confidentiality and authenticity of the data, how do I choose between these modes? I am specifically interested in the case of whole-message encryption and integrity verification (as opposed to block storage).

I'm after answers like “pick whichever of X or Y is easily available in your programming environment”, or “padding for this mode is delicate to implement, but it is more robust to a broken RNG”.

(This is in the spirit of AES CBC mode or AES CTR mode recommended? for modes that provide confidentiality only.)


texts: Why does second pre-image resistance imply pre-image resistance

texts:
I am studying hash functions. I can understand why collision resistance implies second preimage resistance, but I don't get why second preimage resistance should imply first preimage resistance.
Could anybody be help me with this argument from Introduction to Modern Cryptography by Katz & Lindell, please?

Collision resistance: This is the strongest notion and the one we have considered so far.

Second pre-image resistance: Informally speaking, a hash function is second pre-image resistant if given $s$ and $x$ it is infeasible for a probabilistic polynomial-time adversary to find $x' \ne x$ such that $H^s(x') = H^s(s)$.

Pre-image resistance: Informally, a hash function is pre-image resistant if given $s$ and $y = H^s(x)$ (but not $x$ itself) for a randomly chosen $x$, it is infeasible for a probabilistic polynomial-time adversary to find a value $x'$ such that $H^s(x') = y$. (Looking ahead to later chapters in the book, this essentially means that $H^s$ is one-way.)

[...] Likewise, any hash function that is second pre-image resistant is also pre-image resistant. This is due to the fact that if it is possible to invert
$y$ and find an $x^\prime$ such that $H^s (x^\prime ) = y$ then it is possible to take $x$, compute
$y = H^s (x)$ and invert it again obtaining $x^\prime$. Since the domain of $H$ is infinite,
it follows that with good probability $x \neq x^\prime$. We conclude that the above
three security requirements form a hierarchy with each definition implying
the one below it.


texts: How rotate RSA keys and how work with old encrypted data

texts: I am planning to use the RSA for encryption my data and I am wondering - I've generated the keys pair with some limited expiration time and I will use this private and public keys for the purpose of encryption and decryption and in one time the certificate will be expired. How can I use the new certificate? What is the best scenario if my old certificate is expired and I want to have an access to my old encrypted data - Do I need to re-encrypted all my old data with new certificate or what is the best practise for that?


texts: Could symmetric keys be of sizes other than 2^x or 2^x + 2^y?

texts: Is this an issue for, perhaps, RSA? I wonder if a key could be any other size, say 261 bits.


texts: Avalanche noise RNG for one-time pad use

texts:
I came across this little HRNG widget and was really intrigued as I have been looking for a decent but afordable source for truly random bits to use in a one-time pad.

The question is, would a HRNG like this one generate bits with sufficent randomness to provide the perfect secrecy one-time pads are known for? Such a design is of course slightly less random than a quantum RNG using decaying radioactive materials, but is the output random enough to be relied on?

If yes, would XORing the output bits with the plaintext be enough?


texts: Why is a public key insufficient to decrypt a message?

texts:
I'm curious about how E2EE encryption works, but the high-level descriptions I've been able to find aren't quite as clear as I'd like them to be. My current understanding is as follows:

Suppose one party, Alice, wishes to send a secret message to another, Bob. They both have "public" and "private" keys. Alice uses Bob's public key to encrypt her message, which is only decryptable using his private key.

This leads me to imagine that the public key basically specifies some kind of algorithm that Alice will need to run on the message before sending it, to make sure nobody but Bob will know what it says. But couldn't a third party, Claire, just use Bob's public key to determine exactly what algorithm Alice ran on her message and reverse those steps on Alice's encrypted message to determine what it said, with no private key involved? Why can you do this process one way with just the public key but not the other?

Put in other words, what information does the private key contain that the public key doesn't?

To give some idea of the level of depth I'm hoping for an answer in, I have a mathematical background but (obviously) no particular knowledge of cryptography.


texts: How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?

texts:
I would like to know if this is theoretically possible, or impossible, and if possible, if there is any algorithm/protocol to accomplish this...

I want another entity, lets call them the Auditor, to be able to see a piece of data, store something smaller that's derived from that data (I might not know what it is), and then I want to be able to prove to the Auditor repeatedly that I still have that piece of data without having to send the data itself.

If we relax the last requirement I could just send the data every time and the Auditor could verify the hash.
If we relax the 'repeatedly' requirement the Auditor could store a salted hash without telling me the salt, and then later give me the salt and ask for the salted hash back, but that only works one time since afterwards I could just remember the salted hash, throw away the data, and still fool the Auditor.
If we relax the 'derived' requirement the Auditor could store its own copy of the data and do a simple challenge-response protocol.
... but I haven't been able to figure out how to do it without relaxing any of these requirements.

THANKS!


texts:
I assume that my case is weird but I've the following information:

IV: 0x263e or 0x3e26
Auth tag: 0x25
AES256-GCM encrypted payload: 0x4eec96df534ade4c013a
AES256-GCM decrypted payload: 0x0041e36baf2648090174

Regarding the length of the IV and Auth tag, I'm wondering if it is possible to guess the key used to encrypt the payload ?


texts: Simultaneous 2 way exchange without trusted third party

texts:
Stakeholders:
Alice - has a message, M containing a secret, SA that Bob wants, where H(SA) is a hash which may be used by Bob to redeem some Bitcoin time-locked transaction sent previously by Alice.

Bob - has a message, M containing a secret, SB that Alice wants. Similar to Alice's situation, where H(SB) is a hash which may be used by Alice to redeem some Bitcoin time-locked transaction sent previously by Bob.

Problem Description:
Alice and Bob wants to exchange their messages simultaneously and both messages have a mutual dependent relationship where the invalidity of one secret should invalidate the other secret.

A ------- MA --------> B
B ------- MB --------> A

Valid(SA) i.f.f Valid(SB) when M are checked simultaneously by Alice and Bob. (i.e. if SA was found to be invalid, then SB should be invalidated and vice-versa)

I am wondering if there was a cryptographically secure protocol which enables this exchange without the need of a trusted third party acting as an escrow? If there isn't such a scheme, what other properties could be added to enable a simultaneous 2 way exchange without the need of a trusted 3rd party? (i.e. time-constraints?)


texts: Can someone explain the "three-for-two" trick used by the DGHV scheme authors to squash the decryption circuit?

texts:
Can someone please explain the "three-for-two" trick used by the authors of the DGHV scheme (page 17) to squash the decryption circuit? I looked for resources on the same, but it looks like the authors coined this term.

A brief description of the "three-for-two" trick:

It is a technique that uses a constant depth circuit to transform three numbers of arbitrary bit lengths into two numbers that are almost 1 bit longer, such that the sum of the two output numbers is equal to the sum of the three input numbers.

Furthermore, the paper says that the total depth that it takes to reduce $k$ numbers to two numbers is $d \leq 2^{\lceil log_{3/2}k \rceil + 2}$. I don't get how we landed on this expression.


texts: Decode RSA given e,p and q_inv ( with respect to p)

texts:
Suppose I was given e, p and q_inv. Where q_inv = 1 mod (p).
How would one go about computing N to decode the ciphertext?


texts: Construct PRF with longer output from existing PRF

texts:
Assume we have a secure PRF $F$ which takes a key of length $k$, a message of length $l$, and outputs an output of length $o$.
The task it to construct a secure PRF $G$ which takes the same input parameters, but outputs an output of length $2 \cdot o$, by using the first PRF.

My basic intuition would be to construct something like this:
$$G(k, m) = F(k, m) \| F(k, F(k,m))$$

But there is a dimension issue here, since the length of the output is not the same as the length of the message.

Could anyone give me a hint to push me in the right direction?


texts: Can the lengths of HTTPS requests be used to deduce which public pages on a site are visited?

texts:
I thought of this recently:

There are some websites which have many publicly accessible pages, some of which could be embarrassing despite being public (e.g. Wikipedia). The HTML for these pages also references other resources (other pages, images, Javascript, etc) whose sizes are also known to the attacker.

An attacker can observe the lengths and timing of requests made over an HTTPS connection. Given this, can an attacker reliably deduce which page a victim visits despite the connection being "secure"?

I know there is some message padding to integer multiples of a certain length; however, could the lengths of enough messages be combined to give a good guess as to which pages the victim visits? Also, has there been any work done on this or a similar attack?

Here's an example:

Website A has 3 public pages with the following sizes:

A1 100 bytes - embarrassing
A2 200 bytes
A3 100 bytes

Let's assume that A1 and A2 reference an external resource with size 300 bytes.

If an attacker observes a response with length 100, she knows the victim has requested either page A1 or A3. Then, if she observes a response of length 300, then she can deduce that the victim has visited page A1.


texts: Can anyone tell whether this RHO step of SHA3 is correct?

texts:
In rho step of SHA3, I have done right circular rotation whether its correct ??
I am doing in Verilog so I am using concatenation operator for rotation.

For x=0 and y=1 that is A[0][1] rotation will be of 36 bits (See page 22 of the reference)

RotA[0][1] = A[0][1]{[35:28],[63:36],[27:0]};

Is this rotation correct??


texts: How random are permutations generated from Feistel networks with a small number of rounds?

texts:
I wrote a toy pseudo-random permutation out of a Feistel network using blake2b. However, looking at the distribution of permutations for small n = 6, it's clearly not uniform unless many rounds are performed. I was under the impression that 3 or 4 rounds were sufficient. What am I missing?

The code below works as follows, to generate a random permutation of $n$ elements.

We find the smallest integer m such that $n \leq 2^{2m}$
We use blake2b in a Feistel network. Blake2b is keyed with a seed, which determines the random permutation, and is given a salt, which is the round number.
We compute a permutation on 2m bits integers using a Feistel network as described.
We transform that permutation into one that acts on $n$ elements by following the cycles, that is, iterating the permutation of $2^{2m}$ elements it until it produces a value < $n$.

To test this code, we then draw $100~n!$ pseudo-random permutation and perform $\chi^2$ test for an increasing number of rounds in the Feistel network. It's clear that for only 3-4 rounds, the permutations generated are not uniformly distributed.

import hashlib
import math
from collections import Counter
from scipy.stats import chi2

class Permutation():

    def __init__(self, n, seed, rounds=3):
        self.n = n
        self.rounds = rounds
        # n_bits is least integer suc that n <= 2**(2*n_bits)
        self.n_bits = 1 + math.floor(math.log(n, 4))
        self.seed = seed
        self.low_mask = (1 << self.n_bits) - 1
        self.high_mask = self.low_mask << self.n_bits
        self.digest_size = math.ceil(self.n_bits / 8)

    def __hash(self, msg, salt):
        h = hashlib.blake2b(msg, digest_size=self.digest_size, key=self.seed, salt = salt)
        return int(h.hexdigest(),base=16) & self.low_mask

    def __round(self, i, r):

        def to_bytes(m):
            b = 1 if m ==0 else 1 + math.floor(math.log(m, 256))
            return m.to_bytes(b, byteorder='little')

        low = self.low_mask & i
        high = (self.high_mask & i) >> self.n_bits
        low, high = high ^ self.__hash(to_bytes(low), salt=to_bytes(r)), low << self.n_bits
        return high + low

    def __p(self, i):
        result = i
        for r in range(0, self.rounds):
            result = self.__round(result, r)
        return result

    def __call__(self, i):
        j = self.__p(i)
        while j >= self.n:
            j = self.__p(j)
        return j

n = 6
fact = 1
for i in range(1, n + 1):
    fact *= i

for rounds in range(3, 10):
    cnt = Counter()
    for w in range(0,100 * fact):
        p = Permutation(n, seed = bytes('w=%d' % w, encoding='ascii'), rounds=rounds)
        ss = ''.join([str(p(i)) for i in range(0, n)])
        cnt.update([ss])

    x2 = sum((x - 100.0)**2/ 100.0 for p, x in cnt.items()) + 100.0 * (fact - len(cnt))
    print("n = %d,\trounds = %d,\tx2 = %f,\tchi2-cdf = %f" % (n, rounds, x2, chi2.cdf(x2, fact - 1)))

edit:
as a sanity check, I replaced blake2b with an actual random oracle

class RandomOracle():

    def __init__(self):
        self.known = {}

    def __call__(self, msg, digest_size, key, salt):
        entry = (msg, digest_size, key, salt)
        if  entry in self.known:
            return self.known[entry]
        else:
            v = os.urandom(digest_size)
            self.known[entry] = v
            return v

oracle = RandomOracle()

and this still produces non-uniformly random results...


texts:
I've been reading this in many places and I still don't properly understand what it means to be "sound". As an example of what I am asking for:

The Fiat-Shamir transfrom is sound in the Random Oracle Model (ROM), where hash functions are assumed to behave as Random Oracles.

I know that being in the ROM means that hash functions are thought to be trully random functions and the Fiat-Shamir is a technique to transform interactive $\Sigma$-protocols to non-interactive. So what that means?


texts: how to calculate non linearity of AES S-box?

texts: S-box has to satisfy different design criteria. How to calculate non-linearity , propagation criteria for an AES S-box?


texts:
I have a huge list of MD5 hashes, which takes up quite some space. I wonder whether I would achieve (some) compression by encoding the characters (which are A-F 0-9), with Huffman coding. I made a quick script, and seem to notice that almost every character in the strings (A-F 0-9) has the same frequency in the file of hashes.

So my questions is: will hashes always produce strings with an almost equal letter frequency?


texts: Is it possible to create a 128-bit UUID from a weak entropy source?

texts:
I am looking at a seemingly popular piece of JavaScript code to generate a UUID which is supposed to be a 128-bit number:
function uuidv4() {
  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
    var r = Math.random() * 16 | 0, v = c == 'x' ? r : (r & 0x3 | 0x8);
    return v.toString(16);
  });
}

This uses the browser's Math.random(). To dissect this further, it seems to be mostly replacing each x character in the string with a separate call to the Math.random API to create a hex digit (4 bits) e.g.:
function getRandomHexChar() {
    let randomChar = Math.random();       // 0.6429364007765519
    randomChar = randomChar * 16;         // 10.28698241242483
    randomChar = randomChar | 0;          // 10
    randomChar = randomChar.toString(16); // a

    return randomChar;
}

For our application I assume we absolutely need the UUID to be unique or probably bad things could happen if it is repeated. However the thing I would like to know is if it needs to use a cryptographically secure PRNG to guarantee it to be unique?
Apparently Math.random once returned random numbers limited to $2^{32}$. It is a bit better in Chrome, Firefox and Safari now though, they are able to return numbers limited to $2^{128}$ (but it now uses xorshift128+ algorithm which is not cryptographically secure). Also this is certainly not 'all' browsers so maybe it's safe to estimate Math.random only gives $2^{32}$ bits of entropy.
So I guess my question really boils down to this: With repeated calls to Math.random (i.e. a non-cryptographically secure 128 bit RNG or with perhaps $2^{32}$ bits of entropy) like this e.g. getRandomHexChar() + getRandomHexChar() + ... to concatenate 4 bits of pseudo randomness at a time until you get a 128 bit number, will this really give a safe unique UUID of 128 bits? Or is the entropy in that resulting UUID much lower?


texts: Where can I download a database of RSA keys?

texts:
I'm looking to do some research into how RSA is used in the wild. I've read through a few papers and it seems other researchers have had no trouble collecting millions of keys to perform analysis on.

I've done some preliminary research but can't seem to find any one site from which to download other people's public keys.

I assume that given the nature of public keys that it would not be a privacy risk to have this sort of database available to the public.


texts:
For a given block cipher, I would like to verify if any input word diffuses to all output words.

For example in Twine block cipher, they define diffusion as "every output word is dependent of every input word".

How can we check by the program? Is there any algorithm or program to test this property?

I couldn't write a computer program for that. Any help or reference would be appreciated.


texts: Is hashing large files CPU or I/O bound?

texts:
For SHA3, if I were to hash large files (> 1GB), would that operation be CPU or I/O bound?

Suppose I were to exploit parallelism and either use multicore/SIMD execution or generate a hash tree, would that also be constrained by the same resource?


texts: This note (http://maths-people.anu.edu.au/~brent/pd/primality4.pdf) states that AKS is not practical. However, it is known that AKS runs in polynomial-time, and I cannot understand where the slowness of AKS algorithm comes from? Brent, on the above link, justifies this to the high probability of hardware errors during the computation of the algorithm? can some one, either explain Bret's justification, or explain me other drawbacks?


texts: What does it mean for “1^n”(i.e., the security parameter written in unary)?

texts: As it is mentioned above, I am confused about “Gen takes as input $1^n$ and outputs a key“. Does it mean that the input of Gen is 1111....111 with length of n?


texts:
I read that the following adaptation of the CFB block cipher mode into an authenticated mode is prone to chosen plaintext attacks, yet Im still unsure how to prove it:

Let $P_1,P_2,\ldots P_n$ be the plaintext blocks, $C_1,C_2,\ldots C_n$ the CFB encrypted ciphertext blocks and consider the authentication tag is computed as:

$$ T = E_k(C_n) \oplus  P_1 \oplus P_2  \ldots \oplus P_n$$

(this is basically appending an extra block of plaintext containing the XOR of all plaintext blocks and using this final encrypted block as an authentication tag).

Can anybody point me out what is the major mistake in this?


texts: How to attack Oblivious Transfer from a malicious sender that can deviate from the protocol

texts:
I am looking at at the $1–2 \space \text{oblivious transfer}$ that is described here: https://en.wikipedia.org/wiki/Oblivious_transfer#:~:text=In%20cryptography%2C%20an%20oblivious%20transfer,Rabin.
I want to show that a malicious sender (Alice) can attack this protocol if it can deviate from it, namely, send a wrong RSA key pair, and learn the secret bit $b$.
If the sender (Alice) sends $e$ such that $gcd(e, \phi(N)) \neq 1$, then the RSA key is not valid, but the receiver (Bob) can't efficiently know this without the factorization of $N$.
However, I don't exactly understand how sending such an invalid input $e$ helps.
Since $e$ and $\phi(N)$ aren't coprime, then $k^e$ from the protocol that the receiver sends is not exactly random. But how does it help to understand who is $b$?
Help would be appreciated.


texts: NTRU less secure than previously thought?

texts:
A new paper (https://eprint.iacr.org/2015/552.pdf) says:

  This makes it possible to asymptotically and heuristically break the NTRU cryptosystem in subexponential time (without contradicting its security assumption).

Does this mean NTRU is less secure now? By how much?


texts: How is n-bit security calculated with nested encryption?

texts:
What will the total $n$-bit security be if I encrypt a message with a 128-bit XOR cipher and then take that ciphertext and encrypt it with a 128-bit key.

Is the total security level now 256?

One definition on n-bit security said;

  n-bit security means that the attacker would have to perform $2^n$
  operations to break it

But say you are brute forcing then is this $n$ the total amount of combinations or just the expected number of combinations?


texts:
I am currently studying Diffie-Helman protocol. In my lecture notes I have a generator g=2 and I'm in group $Z_{13}^*$ . There I calculate a remainder cycle from 1 to 12 with $r =g^i \mod 13  \forall i [0,12]$

I do not quite understand the relation between the generator and the group. This is my $Z_{13}^*$:

How is the generator in the multiplication group any different from $Z_{13}^+$?


texts: How can I verify certificate signature algorithm in TLS 1.3 using PSS?

texts:
I've read this post but I'm still unable to understand some things.

I'm trying to verify that the signature algorithm used in the certificate matches the proposed list from the client. (As it's mandatory in TLS 1.3)

But I cannot understand the difference in verification when the client offers both signature schemes 'rsa_pss_rsae_' and 'rsa_pss_pss_'.

Both of them indicate that the signing can be in PSS, but from my understanding, the 'rsa_pss_rsae_' is specifying constraints on the public key? Is that correct?

Does it mean that when verifying the certificate signature algorithm, both will be signed with the OID RSASSA-PSS BUT the difference will be in the public key?

(as in RSA (rsaEncryption) or PSS only (RSASSA-PSS) key)


texts: What is the exact computational complexity in absolute operation numbers (multiplications, exponentiations, etc) of a bilinear map evaluation both for symmetric and asymetric groups. And how this is comparable with exponentiation?


texts: Possible data leak when duplicating encryption?

texts:
Say we have 3 keys $K_1$, $K_2$ and $K_3$, and a piece of data $D$.

If I were to encrypt $D$ with all three keys separately and store them together  then discard two of the keys, will it be possible to recover the other keys from it?

My understanding is because we have access to the plain-text via one of the keys, it should be possible for us to figure out the other keys based on all the information we have.

Is that assumption correct? is such a scenario leaking information?


texts:
The local YMCA has new locker rooms with built-in 3-digit combination locks. If I understand the Birthday Paradox correctly, I have a better than 50% chance of finding a lock combination with 33 tries on a given lock. (The lock combination gets set by the member at the time of locking the locker door.)

Is my analysis correct?


texts: Does it matter if I append the secret to the salt or pass it in separately?

texts:
I'm using PBKDF2, and this is my current call.

key = pbkdf2-hmac-sha256(iterations = 100_000, secret = password ++ salt)

I recently learnt that the function I'm calling also takes an optional salt field, and passing the salt instead of appending it gives different answers. Is what I'm currently doing insecure? I don't think it is, but I want to be safe - it looks like PBKDF2 uses the secret many times, but the salt only once, and there might be a good reason for that.


texts: What is TPMFail attack and what are the countermeasures?

texts:
Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries.

Although Intel's firmware based fTPM has FIPS 140-2 and STMicroelectronics hardware-based TPM has Common Criteria EAL 4+ certifications, recently in an attack TPM-FAIL: TPM meets Timing and Lattice Attacks by Moghimi et al., They demonstrated that an attacker can recover server's private authentication key even by remotely.

How do the attacks work?
What are the countermeasures?


texts: Is container format relevant to security of encrypted message inside?

texts:
Still trying to design a fully binary cryptography container format for my mobile app, I am here asking if container is ever relevant.

Thanks to Apple, I cannot use GPG directly because I can neither call GPG through GPGME (fork(2) is not allowed) nor embed it (license conflicts)

The container format is simple ar(1) format that store its contents in plaintext, probably then compressed with some algorithm like Gzip. I am wondering if the container format affects the security of the already encrypted data, the MAC and IV that is held as separate entities within.

The plan is to use AES-CTR (or AES-CFB, or AES-OFB, or my homebrew cipher SHA512-HMAC-OFB which turned out to be just as fast as AES thanks to its larger block size) to encrypt the data and put it in the archive file (data.obj in the archive), its initialization vector in plain (iv.bin), asymmetrically encrypted symmetric key (key.bin, if relevant), the SHA512-HMAC of the archive in "check archive" form that is described below (mac.bin) and some metadata (algorithms used, compression of plaintext used, probably a user supplied tag in plain text) in plain (info.json)

EDIT

ar(1) format stores file name (up to 16 characters), owner UID/GID, modification time, file mode (permissions) in its file header.

MAC (or signature) is calculated on a "check archive": every entity except the MAC (or signature) itself are in the check archive, which is also in ar(1) format, sorted in binary order based on their file names, retaining all their properties (name, owner, modification date and file mode).


texts: Diffie-Hellman algorithm and MITM attack

texts:
How does the Diffie-Hellman algorithm prevent MITM attack?

I have tried to search about it but i couldn't find any understandable reasons.


texts: Why does Skein use an output transform, but other similar hashes don't?

texts:
Skein uses an additional compression function call to finalize the output, even when the output isn't larger than the native output size.

The Skein paper says:

  Due to Skein’s output transformation, it remains an open problem how to create collisions or second preimages for the Skein hash function, even if one can create pseudo-collisions or pseudo-second-preimages for the compression function.

and

  Output transformation. Originally we applied the output transformation only if the output size
  was larger than the state size. Unfortunately, without the output transform, you can construct two messages $M$ and $M'$ such that $H(M) ⊕ H(M')$ is the same as the XOR of the last blocks of $M$ and $M'$. (A similar property has recently been described for SHA-1 [101].) This violates the requirement that the hash function behave like a random mapping.

At a high level Blake has a very similar construction but doesn't use such an expensive finalization. Is there a technical reason why Skein needs such a finalization, but Blake doesn't? In particular does the non randomness issue that Skein prevents with the output transform exist in Blake? Why (not)? Is it related to the way Skein turns a blockcipher into a compression function?


texts: Apply visual cryptography to a video stream?

texts:
I read that there are different ways to apply visual cryptography. One is to generate two images that when overlapped provide the original image. The main issue of using this approach with a video is that I would need to generate those two images for each frame. Is there a way to generate a single decryption image for the entire video?

In that case such image would act as a symmetric key and so all the encrypted frames could be decrypted with such key.


texts:
I am a newbie here, this is my first post.

I have searched the forum but I haven't found a clear answer to this.

In general. What is the relationship between key length and the keyspace? (if there is any at all)

For example, with the Simple Substitution Cipher, I understand that the keyspace is 26! (because there are 26 characters in the English alphabet)

The key length is 26? (due to 26 characters in the english alphabet) Is it?

The keyspace seems to be quite long, isn't it? so looking at the keyspace the 'Simple Substitution Cipher' would be quite secure.
But looking at the keylengh, being only 26 long, how could this be considered secure by today standards?

Could anyone shed some light here?
Again, sorry for my naivity if I am missing something important here.

Thanks in advance


texts:
I'm trying to learn how RSA works. From what I found online, I'm supposed to
generate private key using Extended Euclidean algorithm.

I've managed to generate the public key, but don't know how to use EEA to generate the private key. How should I exactly input into EEA, and how to process the output?


texts: Sharing an encrypted file between a group of people

texts:
Is there any way to share an encrypted file with a group?
In the other words, can I encrypt a file with a public key so that each person in a group decrypt it with his/her private key?

Is there any way that I have a public key and some different private key for it?

I want to find a way to encrypt a file with a public key, and then produce some private keys from this public key, so that whenever I wanted to share that file with some person, I gave him/her a private key from this set to decrypt my file.


texts: Best practices (if any) to add metadata to encrypted files

texts:
I am encrypting files using AES/CBC/PKCSPadding, with 256 bits long keys. So far the first 16 bytes of each encrypted file are the IV.

I would like to store some more information regarding the algorithm used, key length, mode and padding at least.

This will be useful I think for two reasons:

a) I can scan the filesystem looking for my files and checking they are all encrypted (encryption is a new feature, so there are already a bunch of unencrypted files out there). This way I can create a background task that progressively encrypts all old files

b) Say someone breaks AES or there's a problem with CBC or something in 10 years or whatever. I could just upgrade the parameters of the encryption function and again scan the file system and upgrade the encryption of my files.

I was thinking for this something like:

byte[] header = "AES|256|CBC|PKCS5Padding|".getBytes(UTF_8);
byte[] iv = ...; // the result of cipher.getIV() after initializing the Cipher;

And then writing both the header + IV to the beginning of the file.

So my question is: Does adding such metadata to encrypted files create any security concerns for such files? Is this something that people normally do? If so, is the way I'm trying to do it (adding a fixed number of bytes) will be enough to accomplish this task?


texts: While generating a random Elliptic curve what are the conditions i have to considerd?

texts:
I want to generate a random elliptic curve over a prime field. What are the conditions I should satisfy?
For the NIST recommended standard ECC-224 bit curve with prime $p=2^{224}-2^{96}+1$, a reduction technique is given by $(z_1+z_2+z_3-z_4-z_5)
\bmod{p}$, what is the logic behind in this?


texts: Could Diffie-Hellman protocol serve as a zero-knowledge proof of knowledge of discrete logarithm?

texts:
The Schnorr identification protocol is widely recognized as the simplest ZKPoK of the discrete logarithm (more clearly, Honest-Verifier ZKPoK).

However, I can't figure out why this simple protocol, which is actually just a Diffie-Hellman key establishment protocol, is not an HVZKPoK also
(I understand that if it would be the case, I would see it everywhere in literature as an example of HVZKPoK).

Common input: generator $g$ of group $G$;

Prover's input: secret random $x$, and $y=g^x$;

Verifier's input: $y$;

Verifier is getting proof that the prover knows $x$ so that $y=g^x$ in 2-steps protocol:

Verifier $V$ selects randomly $k$, and sends $v = g^k$ to the prover.
Prover evaluates $r = v^x$ and sends it to the verifier.
Verifier accepts iff $r = y^k$.

Completeness of this protocol is obvious.
Soundness is based on the assumption of hardness of Diffie-Hellman problem.

Honest-verifier zero-knowledgeness seems easy to show: in order to simulate correct transcripts, simulator just selects random $k$, and outputs $(g^k, y^k)$ as a valid transcript.

Could you point me to a mistake in my logic, or assert that this protocol is correct HVZKPoK (in the latter case, why it's not preferred than Schnorr one).


texts: The danger of Hash collision in Schnorr NIZK

texts:
We use Fiat–Shamir heuristic to turn Schnorr ZK to NIZK. So now NIZK is secure against chosen message attacks in the random oracle model, that is, ideal hash function: every unique query leads to a truly random response.
Ok, I get why our Hash function should not be reversible  - otherwise, we disclose skey.
But what is the danger of collisions?
Suppose, a prover computes NIZK proof (r,c):

c = Hash( g || V || pkey || User Id || Other Info )
r = v + skey*c mod q
V = g^v mod p, v - random

Even if I find any other combination that results in c, it's unlikely I can forge proof.


texts: Using MITM to attack three keys 3-DES encryption?

texts:
I know that MITM can break three keys into two parts $(K_1,K_2)$ and $K_3$ where the worst time complexity is $2^{112}$.

My questions is whether we are able to break three keys $(K_1,K_2,K_3)$ into three different parts, then starts to attack each key independently? If we can, will the time complexity and space usage both be $O(2^{56})$? assuming each key size is $56$ bits.


texts: How about a homomorphic integer sorting in a MPC context?

texts:
I want to implement the ATV-FHE scheme as described by Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan: On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption (ePrint revised 2014, originally in Proceeding of STOC 2012); and based on it I want to compare homomorphically a vector of integers. Would this be a valuable application, something that is both new and useful ?

By new, I mean that the integer comparison I want to implement is for a multikey FHE. For FHE there are some very good implementations that deal with homomorphic integer comparison and sorting.


texts: DCT Steganography - Where to embed the data

texts: Just a quick question about DCT Steganography. Do you embed the data before or after you send the 8*8 block through the quantization table?


texts: With node-jose, Should I expect the JWK -> PEM conversion to be reversible?

texts:
I am using node-jose to convert a particular JWK to a PEM, and then ... converting that PEM to a JWK.

The resulting JWK has the same e, but different n than the original. Should I be surprised?

I have read in another answer here that

  there are varients of RSA for which a public key might not meet these assumptions; they deal with the fact that $M^e$ might not have a unique inverse

Is that what I am seeing here?

If so, In my case, Will both combinations of {n,e} be able to verify signatures from the same private key? (I haven't tested this yet). If so, ... can someone point me to a more accessible explanation of why different RSA public keys (two different keys with same e, distinct n) can ... be equivalent in this way?

Or is this a conversion bug in node-jose?

Something else?

code:

const jose = require('node-jose');

let publicKeyJwk = {
        "kty":"RSA",
        "use":"sig",
        "n":"ANMPv9JuRDbixAFMT8UzJl6yfG4ZMj7pwtlQi02gPtnZGIUdKXzzOEbQjvbapI3Ot0WqLNzk6YfSPYBO0TAYlNBlTAQ2Hu-Di2Y6RniOzjvE5kIWjni81_3o_UAb6tYG4R7dUBj95uN_4NWzeuBoLQauDQl5tSHvNDb3cVg7Con4WIuH4KPs4XDAWkhNh4cnN0yINaBCn4fhJhy_-C4T3ewmJeD8akfg1TWya3RnhjrXll-KebFu_bf_ArJ7yeEreWL97BiuSbgW5hoilvMFhJ_vWw4OYt0j5YpjAXckh_sDGxVC8n1UryR3jJhADByg6vj1RnTPs5zZDwglSJB2RkU=",
        "e":"AQAB"
      };

jose.JWK.asKey(publicKeyJwk, 'json')
  .then (key => {
    let jwk = key.toJSON();
    console.log(JSON.stringify(jwk, null, 2));
    console.log("\n");
    if (jwk.e == publicKeyJwk.e &&
        jwk.n == publicKeyJwk.n) {
      console.log('reflexive');
    }
    else {
      console.log('NOT reflexive');
    }

    let pem = key.toPEM();
    console.log(pem);

    return jose.JWK.asKey(pem, 'pem')
      .then (key => {
        let jwk = key.toJSON();
        console.log(JSON.stringify(jwk, null, 2));
        console.log("\n");
        if (jwk.e == publicKeyJwk.e &&
            jwk.n == publicKeyJwk.n) {
          console.log('reflexive');
        }
        else {
          console.log('NOT reflexive');
        }

        let pem2 = key.toPEM();
        if (pem == pem2) {
          console.log('same pem');
        }
        else {
          console.log('NOT same pem');
        }

      });
  });


texts: How to "score" partially decoded ciphertext?

texts:
I am attempting to write a basic codebreaking program to break simple ciphers (think caesar cipher & railfence) such as these here https://en.wikipedia.org/wiki/Classical_cipher.

The program will make semi random attempts at decoding the ciphertext, and I need a way to "score" these attempts on how close they are to fully decoded plaintext.
For example "hello world" would score higher than "Kello woHld" or "aellp wprld" which would both score higher than "KRYYP ZPHYI", thus the program can use a hill-climbing or similar method to converge on decoded text.

I am unsure how to score text, perhaps using a dictionary (+regex?) to check for decoded words, or counting occurences of common letters and common groups of 2,3 & 4 letters, then perhaps comparing to known frequencies.

I am not asking for a finished algorithm, just some pointers of how to score text on its "decodedness" / closeness to plaintext.

Edit: I am working with ciphertext 500 to 1000 characters long, would like the system to work with or without word boundaries preserved.


texts: Differential probability of modular subtraction $xdp^-$

texts:
The modular addition has been a main component in block  cipher. The use of modular subtraction in block cipher is not common but there are some cipher such as Bel-T cipher which uses both modular addition and subtraction.

To find the xor differential probability of modular addition, the following equation is used :

$xdp^+ (\alpha,\beta,\gamma)= 2^{-\sum_{i=0}^{n-2}¬eq(\alpha[i],\beta[i],\gamma[i])}$

$\begin{equation}
  eq(\alpha[i],\beta[i],\gamma[i])=\begin{cases}
    1, & \text{if $\alpha[i]=\beta[i]=\gamma[i]$}.\\
    0, & \text{otherwise}.
  \end{cases}
\end{equation}$

Iam interested to find the xor differential probability equation of modular subtraction $xdp^-$

Q: How to derive the $xdp^-$ equation? or  $xdp^+$ and $xdp^-$ are same


texts: Does the server signs message body after ssl handshake?

texts:
So after SSL handshake the master secret is used to securely transfer data encrypted using symmetric cryptography. My question is simple: after SSL handshake, when the server (for example my bank) sends to me message encrypted symmetrically, is the message body (when my computer decrypts it) signed by server's public key or not?

SECOND QUESTION: If answer to question 1 is yes, then if I would receive some data (for example my bank statement) from the server, could I present this data signed by trusted server's key (bank's key) to some third party to prove that this data originated from particular company (because it's signed by asymmetric key that this company is using)?

THIRD QUESTION: If answer to question 1 is yes, then does the message (when decrypted symmetrically) received from server (after handshake) contains timestamp which could be used to prove, in the way similar to one presented in QUESTION 2, that this message originated at this-and-this time (for example a week ago)?


texts: What are the different uses of MAC and Digital Signature?

texts:
I know both of them can be used for Integrity and Authentication.
In which practical cases is preferred a MAC? and a Digital Signature?

Thank you in advance


texts: Key clamping in curve25519 not evident in generated key's binary representation

texts:
I understand with curve25519 that the private key for secret.box is clamped...

I understand that this clamping process to clear the lower 3 bits in order to ensure the key is a multiple of 8, ensuring it's part of the right cyclic subgroup.

However, as I generate example keyPairs using sodium such as:

a67e2d949d00606d2b6d0d9114d3ee273f118a078151c7aad2b55694ea18bb39 // 1010011001111110001011011001010010011101000000000110000001101101001010110110110100001101100100010001010011010011111011100010011100111111000100011000101000000111100000010101000111000111101010101101001010110101010101101001010011101010000110001011101100111001

or

b2c80def0dc392671e5143e9804c1083a39c751eec7348383eb586d708b374cc // 1011001011001000000011011110111100001101110000111001001001100111000111100101000101000011111010011000000001001100000100001000001110100011100111000111010100011110111011000111001101001000001110000011111010110101100001101101011100001000101100110111010011001100

I noticed that despite being able to positively confirm they are part of the multiple of 8 subgroup, their binary representation does not have the lower three bits cleared...

So as you can see above, the binary representation of these random private keys doesn't have 000 for the lowest three bits. Yet when I check in SageMath, I can confirm both of these keys are multiples of 8.

Update:
I generated the keys using the libSodium->SecretBox->KeyPair()...

Which internally calls the clamping/scalar multiplication.

I also verified that despite not ending in three zeros (000) - the private keys are always of order 7237005577332262213973186563042994240857116359379907606001950938285454250989 and as such are of the correct subgroup.

Any idea why?


texts: What are the curly brackets in this cryptographic hash function definition?

texts:
Reading the Schnorr signature Wikipedia page, I stumbled upon the following statement:

  All users agree on a cryptographic hash function $H:\{0,1\}^*\to\mathbb{Z}_q$.

What do these curly brackets mean here and how exactly is the hash function's input domain defined? Normally, you can use whatever input you want for a CHF/ PRF.


texts: Is it possible to recover an AES encrypted file that was decrypted with incorrect key/password?

texts:
I am new to cryptography and have been experimenting with AES to encrypt files. I was testing some code I found online which allows the user to enter the directory of the files that they went to encrypt/decrypt, the program then asks for the user to input the “password” or “key” to be used for the encryption/decryption.

My problem is that I accidently inputted the wrong password/key when I was trying to decrypt the file, and as I hadn’t added a way for the program to detect incorrect passwords it tried to decrypt the file and so I was left with a file that was still in an encrypted/corrupted state.

I am wondering if it is possible to recover the original encrypted file. I now know the correct password that I should have first used to decrypt the file as well as the incorrect password that was used.

I have found another page where a user had a similar problem here Repair AES-128 decrypted file however this user did not specify that they knew the “correct” password that would have worked for the decryption, whereas I do.

The encryption function used in the script used a random IV as well as AES mode CBC.

Any help appreciated thanks


texts:
I am reading DJ Bernstein's paper on the Poly1305-AES mac (https://cr.yp.to/mac/poly1305-20050329.pdf). I understand that AES is needed to provide the array s. In its paper on page 5 we can read:

reads AESk(n) from s[0], s[1], . . . , s[15]

I understand that n is a nonce and k is the secret key. What I am not sure about is which AES mode is used (ECB, CTR, GCM...) ? Is the nonce the message being passed to AES or is it a real nonce and thus we need to pass another message to AES ?
I am quite surprised that I cannot find any details about the AES mode in its paper. Is it because there is a default plain AES mode ?
FYI, I am using the mbed_tls crypto library, but I don't find any relevant example in their documentation.


texts:
I'm currently carrying out a differential attack on the FEAL-4 algorithm, however I have hit a bit of a wall.

Basically I attacked the final round first ($K3$) using the differential characteristic of 0x80800000 which yields a differential of 0x02000000 with a probability of $1$.

I have found four possibilities for the round 4 subkey. To advance the attack to the next round (round 3) and verify which key is the correct one, I need to choose a new differential characteristic (other than 0x80800000) to attack round 3.

I know the difference in the input to round 2 should be 0x02000000, so I can begin my attack on round 3 — but how do I go about finding my differential characteristic so I can generate my plaintext/ciphertext pairs?


texts: What does "message schedule" mean in SHA-256?

texts:
I am trying to understand the sha-256 algorithm from FIPS 180-2. I understood the padding and parsing of the message string. However after that it states (page 15):

  For $i = 1$ to $N$:
     {

  Prepare the message schedule, ${W_t}$:
  $$ W_t= \begin{cases} M_t(i) & 0 \leq t \leq 15 \\
     ROTL^1( W_{t -3} \oplus W_{t-8} \oplus W_{t - 14} \oplus  W_{t-16} ) &
     16 \leq t \leq 79 \end{cases} $$
  ...

But I am unable to understand what $W_t$ is in the first place. Could someone please help me out?

I know it states on page 3:

  $W_t\qquad$ The $t$th $w$-bit word of the message schedule.

But what is the message schedule and how is it generated?


texts: Must a key for a HMAC-SHA256 digest kept secure?

texts:
I need to check integrity of high secure system value - in this case encryption key(s)

I would like to create HMAC digest of this user encryption key (key is used in application as a key for AES-256 cipher) to check it's integrity. The encryption key is derived with a KDF from his password and salt, after every user's login into the application. After user registration, I create an integrity HMAC-SHA256 digest for user's encryption key. This digest IMHO shouldn't be kept secret and will be saved with other user data. While user is logging in, I create digest and compare it with saved value of the digest. If both of digests are same, integrity is approved.

-This makes me ask: Is it required to keep keys used for HMAC-SHA256 secured or can I leave it with other user data (non-secure, "in the open")? When a hypothetical opponent gets the key, is it possible for the opponent to restore the original value of an encryption key from a HMAC-SHA256 digest?

Edit

I'm not sure, because I'm thinking; when an opponent doesn't know the "secret value" (application encryption key), the opponent is not able to create the same digest, even if he knows the HMAC-SHA256 key. Is that a correct assumption?


texts:
Is ShiftRows(SubtBytes(x)) = SubtBytes(ShiftRows(x)) the same for the same entry : in AES
It seems like these two are equal, can someone explain in theoretically?


texts:
Based on the BSI evaluation criteria for quality of deterministic random number generators:

K4 – It should be impossible, for all practical purposes, for an attacker to calculate, or guess from an inner state of the generator, any previous numbers in the sequence or any previous inner generator states.

What is exactly the inner state in simple words? Is it the the very first seed? Also I would appreciate if you explain what is meant by the above rule?
Many Thanks.


texts: Combining secret keys into a single shared key

texts:
Let's say there are $n$ participants each with their own secret key $x_i$. Is it possible for them somehow to build a shared key which is an arithmetic sum of all their secret keys ($x_0 + x_1 + ... + x_n$) but without revealing their individual keys to each other.

Also, ideally, this would be done non-interactively. Meaning, each participant shares something about their secret key with everyone else, and once everyone has shared this "something", the shared key can be constructed.


texts: Laplace mechanism in Differential Privacy

texts:
From The Algorithmic Foundations of Diﬀerential Privacy
It wrote that :

But from this pdf

I am confused which one is right, or I misunderstand.

In second method, after I compute Pr[v], and then what to do?

I am not sure how to implement the Laplace mechanism.


texts:
Suppose we have a trust party $P_A$ that can be used to manage a data transfer from parties $P_I = P_i, \ldots, P_{i+n}$ which do not trust each others to a party $P_R$ which is also not trusted. However, parties $P_I$ would like to send some obfuscated values to $P_R$ without going to through $P_A$ and would like $P_R$ to know if two obfuscated values from say party $P_{i+k}$ and party $P_{i+j}$ are obfuscations of the same value.

A slightly weaker example would be: $P_A$ create a secret key $k_a$ and transfer that to all parties in $P_I$ and they we would HMAC their values and send them to $P_R$. However, since they are all using the same $k_a$, a party $P_{i+k}$ is worried that party $P_{i+j}$ might give that key to $P_R$ and $P_R$ is now able to brute-force the values (small input space).

Is it even possible to achieve such a system? I believe it might be impossible because if $P_R$ knows that two obfuscations are the same and knows the key of one of them then it can try that small input space with that key and be able to match the values of the other party.

I'm wondering if there's maybe a smart way to overcome that even with a guarantee between the example and what's desired.


texts: Any gotchas when deriving a symmetric key from two seeds?

texts:
Consider a connection protocol where, after jumping through several other hoops, Alice and Bob know each others' public keys; and they now want to do a RSA-handshake-kind-of-thing to come up with a symmetric key for subsequent communication.

Alice randomly generates a 32-byte secret seed s_a, and Bob generates s_b.
They use asymmetric encryption to send the keys to each other.
Now both Alice and Bob want to independently generate a shared secret key s to symmetrically encrypt the rest of their conversation.

In this final step of deriving the shared secret, are there any pitfalls to look out for? I can think of several deterministic approaches - e.g.

Multiply the two seeds and stretch the product:
s = hash(s_a ⨉ s_b)
Concatenate the two seeds in ascending order, and stretch the result:
s = hash(concat(sort(s_a, s_b)))
Use the smaller key as a hash key to hash the larger one.
s = hash(s_smaller, s_larger)
Just use the smallest of the two keys.

Do we need to be careful here? Is there any reason to prefer one of these over the others?


texts: Random Coin Flip using ElGamal and a Trusted Party

texts:
An old exam question I am trying to figure out:

  Consider the following protocol for two parties to flip a fair coin.

  Trusted party T publishes her public key pk
  A chooses a random bit $b_A$, encrypts it under pk, and announces the
  ciphertext $c_A$ to B and T
  B does the same and announces a ciphertext $c_B$
  T decrypts $c_A$ and $c_B$, and announces the results.
   Both parties XOR the results to obtain the random value $b_A \oplus b_B$.

  (a) Argue that even if A is dishonest (but B is honest) the final
  value of the coin is uniformly distributed.

  (b) Assuming that T uses ElGamal (where bit $b$ is encoded as $g^b$ before encryption),
   show that a dishonest B can bias the coin to any value he likes.

I can figure out a, but I am having trouble with b.


texts: Key derivation after ECDH: why h(q ‖ pk1 ‖ pk2)?

texts:
I want to use the X25519 DH key agreement for generating a single AES-128 key.
The distribution of the shared secret of such a key agreement is not uniform, so it shouldn't be used directly.

The libsodium docu suggests to hash it with: h(q ‖ pk1 ‖ pk2).
As hash function h() I want to use SHA-256. As the output is 256 Bit I would just use the lower half.

Why do you append the public keys there? Shouldn't h(q) be good enough?


texts: What is the proper way to use a client nonce?

texts:
I've implemented an API for one of my clients, it relies on nonces and a shared secret. The structure:

Client's Site (CS) requests nonce from My App (MA), posting their username
MA verifies the username is valid, then generates a nonce in response

The nonce is only valid for the given username and is only valid for 1 minute.

CS uses the nonce to make a userful API call; the post looks like this:

username, nonce (from step 2), cnonce (Generated by CS), payload (Useful API call), and hash Which is a sha1 hash of the nonce, payload, shared secret, and the client nonce.

MA confirms that the nonce is valid for the given username (and then invalidates the nonce for future use), and then uses the shared secret for the given username along with the nonce and provided client nonce to hash the payload and confirm the hash matches the given hash.

If it matches, it executes the API call specified in the payload.

My question: Am I using the idea of a cnonce correctly? I'm having a hard time seeing its usefulness.


texts: Is it secure to use Salsa20/ChaCha as the key schedule for a 512-bit block cipher using a public permutation in Even-Mansour construction?


texts: Extended message space public key scheme

texts:
Being $\mathcal{E}$ a public key schem,let the following encryption scheme $\mathcal{E}^2=(G^2,E^2,D^2)$, where
\begin{equation*}
\begin{split}
        G^2()&:=(pk_{0},sk_{0}) \xleftarrow{R}, (pk_{1},sk_{1})\xleftarrow{R} G() \\
        &\text{,outputs pk}=(pk_{0},pk_{1}),sk=(sk_{0},sk_{1}) \\
        E^2(pk,(m_{0},m_{1}))&:=(E(pk_{0},m_{0}),E(pk_{1},m_{1})) \\
        D^2(sk,(c_{0},c_{1}))&:=(D(sk_{0},c_{0}),D(sk_{1},c_{1}))
\end{split}
\end{equation*}
Show that even $\mathcal{E}$ (public key scheme) is C
CCA secure, $\mathcal{E}^2$ is not CCA secure.
I'm trying to prove it, by an attack game in which the adversary takes advantage of the deterministic decryption step, but I'm stuck since this system seems to me like a duplicate CPA secure scheme, and I don't know how to find vulnerabilities. I would be very grateful if you could help me with this exercise..


texts: Let $P$ and $Q$ are two points of NIST elliptic curve $E$ (defined over $F_{2^m}$ with prime $m$) and $k$ is a private key such that $k.P=Q$. Also we have a machine that is able to leak some information about $k$. If $k$ be an odd number this machine say $k$ is odd, else return two points $\frac{k}{2}\cdot P $ and $P'$ such that $2\cdot P'=Q$.  Can we find $k$ with this machine? Other question is can we know that is $k$ divisible by other prime number?


texts: How to evaluate the security of transposition ciphers?

texts:
how to evaluate the security of transposition ciphers? I am specifically interested in the security of turning grilles and how to (mathematically) evaluate their security.

I would appreciate any help.


texts: Preventing Quantum Attacks on Cryptography

texts: With the advancement of technology in quantum computing, it's becoming more evident that we need to start thinking about protecting the future integrity of our cryptographic standards.  What can we do on binary computers to prevent attacks on cryptographic related items such as password hashes, private keys, and asymmetric key exchange?


texts:
I'm a hobby programmer and very new to this field.
I opened a bank account recently and got two pins. One for the girocard and the other for a creditcard. And I needed two more pins for the online banking account, that I could choose by myself. Just for fun I tried to come up with an algorithm, that generates each pin for me, so that I don't need to remember all.

Let's say the two predefined pins are:

2812
7791

The other two pins will be generated shortly.

The algorithm I came up with is the following and it operates on each digit seperately.

(x + n(k + n)) mod 10 = d

where d is one digit of the n-th pin.

Using simple arithmetic I got the following lists:

x = [9, 1, 5, 5]

k = [2, 6, 5, 6]

k is the secret key I memorize.

If I want to get the second pin for example I set n = 2 and use the first k with the first x to get the first digit of my second pin.

the other two pins my algorithm generates with n = 3 and n = 4 are

4893
3115

With this method I can generate up to 10 pins and need to remember only one key.
I don't have any knowledge of cryptography and this is just my amateurish attempt. I'm not even sure if this has something to do with cryptography but I hope this is the write place to ask.

Is there some mysterious way someone could decrypt those pins just knowing of the algorithm and the list x?


texts: What is the difference between a dual cipher and a tweak?

texts:
I have looked at the idea of dual ciphers but I cannot convince myself I really understand them. I think I just need a very simple worked example.

I was given the definition:
Two ciphers $E$ and $E′$ are dual ciphers if they are isomorphic, i.e. if there exist invertible transformations $f(⋅)$, $g(⋅)$, $h(⋅)$ such that $\forall \ P$ and $K$ $$f(E_K(P))=E′_{g(K)}(h(P))$$
However, this is not easy for me to follow. I think $E$ is the encryption method (in my case below, $[(P \times K_1)+ K_2] \bmod26$). Yet looking at the definition it seems $f(.)$ is the cipher, is that right? And $P$ and $K$ are the plaintext and cipher key respectively. But I really don't understand what $g(K)$ and $h(P)$ are, or how to derive them.

Let's say my encryption cipher is: $C = [(P \times K_1)+ K_2] \bmod26$

How do I make a dual cipher of it? A very simple one is fine. If my cipher is not suitable, would you give an equally simple one that can have a dual cipher?
In my dual cipher from $.1$, what are my $g(K)$ and $h(P)$?
What could I do to this cipher to makes it a tweak but not a dual cipher?
How do I show my tweak is not a dual cipher?

This has been bugging me for a while so a simple example would be very much appreciated. I have posted similar questions but the answers are too difficult for my age and level.


texts: Post-quantum aggregate / multi signatures

texts:
Are there any practical post-quantum aggregate / multi signatures?
Currently, the aggregate / multi signature schemes seem to be limited to pre-quantum elliptic curve assumptions only, e.g., [BDN18], [MPSW18] and [Zha18].


texts: Proving Pseudo Random Generator from other Pseudo Random Generator?

texts:
How can I prove that if $G$ is a Pseudo Random Generator, then other generator is a PRG (while the range's size is different)?

For example: for the PRG $G$ (from $n$ to $t(n)$ where $n < t(n)$), the generator $G'$ (from $n$ to $n+1$), where $G'$ returns the first $n+1$ bits of $G$) is PRG too?

Is the fact that the ranges are different affect the indistinguishability between the PRGs?


texts:
I'm supposed to show the complement property of DES ($c=DES(p,k) => \bar c = DES(\bar p, \bar k)$).

My idea was to just start the algorithm with $\bar p$ and see what happens (ignoring the initial permutation for now). I looked at it step by step and got the the point where $R1 = \bar L1 \oplus f(\bar k1, \bar R0)$. So I figured I had to show that $f(\bar k1, \bar R0) = \bar f(k1,R0)$. Is that even right so far? Because I got stuck at the point where the S-Boxes are used. Why would $S(\bar x) = \bar S(x)$?

Somewhere else I read something about a formal prove using induction, but I don't know how I would do that either...


texts: Deniability properties of the X3DH Key Agreement Protocol

texts:
Signal's X3DH Key Agreement Protocol specification states in section 4.5.:

  Alternatively, it might be tempting to replace the DH-based mutual authentication (i.e. DH1 and DH2) with signatures from the identity keys. However, this reduces deniability, [...]

How exactly does replacing DH1 and DH2 with signatures reduce deniability?


texts: Repeated Encryption using same/different Encryption systems

texts:
I would like to know if there are any security risks/gains from encrypting twice, i.e. $$\text{plaintext}\xrightarrow{encrypt}\text{intermediate text}\xrightarrow{encrypt}\text{ciphertext}.$$
I would like to know if there are known gains/risks to what I'm looking at. Perhaps certain pairs of systems are compatible while others are detrimental. Or perhaps some systems are obviously its own inverse (like the one-time pad).

I would like to hear your thoughts and if there is a survey paper, that would be great as well. Thanks!


texts: Are there reasonably secure online voting implementations e.g. for student council elections?

texts:
Assume a university want to elect the student council. This was done via paper ballot and there is a need to reach more students for voting, so electronic voting is on the table.

While researching existing solutions I came across Helios: helios voting and agora voting

Both seem to implement somewhat peer-reviewed schemes to do a online vote, but my impression is that the devil might hide in the details.

Has anyone here experience using these schemes?
We plan to implement such an online voting scheme and would authenticate the voters via the university LDAP. Which cryptographic obstacles or security problems could we face?


texts: GPG encryption truncates large files ( ~ 4 Gb )

texts: We currently use GPG to encrypt large text files ( ~ 4 Gb ) and occasionally the encrypted and compressed file will be truncated.  I have tried several different algorithms but cannot pinpoint a culprit. Does GPG have a maximum file size after which it will truncate the file?


texts: How to define secure pseudorandom functions?

texts:
I was told that for both cases the PRF is strong/secure, but I cant find a proper way to define this. Personally i think only (b) is secure because $x$ is not as strong as $O^n$ for $Fs$. But if that was true, what would be the ppt algorithm which could break it?
Is it related to the fact that $F(x)$ is not pseudorandom since its values on any two points are correlated?