texts: how to measure/calculate guessing entropy for side channel attacks

texts:
I was going through the paper (https://link.springer.com/chapter/10.1007/978-3-319-66787-4_3), and I came across where authors says that accuracy alone is not enough as an evaluation metric and guessing entropy should be taken into account as well (Section 2.4). I do understand how accuracy is measured in machine learning but I am unable to understand how to measure guessing entropy for a particular key byte or key bit. How guessing entropy is calculated here, which finally leads to the minimal number of traces? What does 10 independent attacks mean?  Does this mean that attack was launched on test data 10 times and mean of all the outcomes was taken?

  To take this remark into account, we will always associate the test
  accuracy to a side-channel metric defined as the minimal number   N⋆
  of side-channel traces that makes the guessing entropy (the average
  rank of the right key candidate) be permanently equal to 1 (see e.g.
  Table 1). We will estimate such a guessing entropy through 10
  independent attacks.


texts:
How can companies authenticate messages sent between different security components in the company? (say SIEM for monitoring and IDS for intrusion detection)?

What protocols do they use in order to protect their authentication against an adversary who impersonate  to other security component in the company?


texts: Authenticating and encrypting data for an automated system

texts:
I wish to distribute a file from A to an automated system B.
The requirements are:

Contents are encrypted
Contents are tamper proof
Contents origin is verified

To do this I have devised the following system
A key pair is created, where A (origin) has the private key and B (destination) has the public key. Note: I say public and private here for sake of simplicity, none of the keys are actually publicized.
Steps at A:

Generate a random 256bit symmetric key (AES) and a 96bit nonce
Encrypt {contents} using AES-GCM using the 256bit key and 96bit nonce to produce the ciphertext and a MAC
Encrypt {key, nonce, mac} using the private key and append it to the ciphertext
Send the ciphertext + encrypted key, nonce and MAC from step 3 to the destination B

Steps at B:

Decrypt the encrypted key, nonce and MAC using the public key
Use the decrypted key, nonce and MAC to decrypt and verify the contents

It seems to me that this would both verify authenticity (since the key+MAC is effectively signed using the private key) as well as provide given the prerequisite that the automated system B has not already been tampered with.
In theory, if an attacker would obtain the public key (from some other attack on B), non-tampered with systems would still be able to securely receive files from the origin. Although the attacker that obtained the public key would be able to read the contents, but not tamper with them.
Am I missing something?


texts: Basic question on hash-based signature scheme

texts: If a hash-based signature schemes such as W-OTS is used, do we still need public key based certificates to prove ownership of a public key? I understand that hash-based signatures are one of the candidates for post-quantum signatures. However, if quantum vulnerable schemes such as RSA is used for certificates, it makes such system still vulnerable to quantum computing.


texts: A block cipher whose key changes after each block

texts:
I have been reading about various block cipher modes of operation, and all of them seem to treat the block cipher (including it's key and key schedule) as a sort of immutable black box.

I would like to know whether or not any one has designed a mode of operation where the effective key schedule of the cipher is changed between each block encrypted.

Suppose, purely for example, that we had a 256 bit block cipher, using a simple a 4 round Feistel structure.  The expanded key, generated from a secure hash of the user-supplied key and an IV, would be 512 bits.  In between each pair of blocks encrypted, we treat these 512 bits as the state of a 512-bit linear feedback shift register, advance the LFSR one step, then use the result as the scheduled key for the next block of data encrypted.

Like CTR mode, encryption and decryption are parallelizable, and it has the property of random read access.

Does anything remotely like that exist?

If not, is it because it would be obviously horribly secure in a way I'm not seeing, or for some other reason?


texts: If the RNG of a HSM is said to be compliant to FIPS 140-2 (approved DRBG - SP 800-90 CTR mode) does also imply that it is compliant to FIPS 186-2 ?


texts:
I have two secret keys. One is a secret key generated by OpenSSL (primary secret key). Second key is generated by performing one way hash operation to GPS co ordinates and time parameters (geo secret key). Now I want to combine this two keys to be used for an AES encryption. I have two options.

Encrypt twice by using two keys.
XOR the two keys derive a single key and use it for encryption.

The first option will be bit expensive since there will be two encryption operations. Although the second option will be less expensive I am not sure whether it is secure or not. Will the second option make the finale encryption key vulnerable? Will it severely affect the randomness of the finale key in a way that it is not usable?

More details about my requirement: I want to decrypt a message successfully only when the device is in a specific location. So I am deriving a second key based on the GPS data. But location and time cannot be kept secret. So I need to know whether will it reduce the randomness of my finale key due to the XOR operation done between Primary secret key and Geo secret key.


texts: Why does Schnorr's Digital Signature scheme necessitate two prime numbers?

texts: One of the necessary components to the Schnorr Digital Signature scheme is a pair of prime numbers $p$ and $q$ such that $q$ divides $p-1.$ However, there is never a modular inverse taken of q so why is there an extra constraint on $q$? Couldn't $q$ be a number that divides $p-1$ but not prime?


texts: Weak and strong uniformity of cryptographic hash functions

texts:
For any $n\in\mathbb{N}$, let $\{0,1\}^n$ denote the set of $\{0,1\}$-strings of length $n$. For $n\in\mathbb{N}$ let $$\{0,1\}^* = \bigcup_{k\in\mathbb{N}}\{0,1\}^k \text{ and } \{0,1\}^{\leq n} = \bigcup_{k\leq n}\{0,1\}^k.$$
Note that $|\{0,1\}^{\leq n}| = 2^{n+1} -1$.
Cryptographic functions $h$ map $\{0,1\}^*$ to $\{0,1\}^n$ for some fixed $n\in\mathbb{N}$. Note that in general, for a cryptographic hash function $h:\{0,1\}^*\to \{0,1\}^n$ it is not known whether $\text{im}(h) = \{0,1\}^n$ where $\text{im}(h) = \{h(x): x\in\{0,1\}^*\}$ is the image of $h$.

A cryptographic hash function $h:\{0,1\}^*\to \{0,1\}^n$ is said to be weakly uniform if for every hash value there are infinitely many collisions, i.e. $h^{-1}(\{h(x)\})$ is infinite for every $x\in\{0,1\}^*$. (The pidgeonhole principle only implies the existence of one $x\in\{0,1\}^*$ such that $h^{-1}(\{h(x)\})$ is infinite.)

A cryptographic hash function $h:\{0,1\}^*\to \{0,1\}^n$ is said to be strongly uniform if the number of pre-images for each possible hash value approaches $1/|\text{im(h)}|$ as the input length grows longer, or, formally, if for every $x\in \{0,1\}^*$ we have: $$\lim \sup_{n\to\infty} \frac{|h^{-1}(\{h(x)\})\cap \{0,1\}^{\leq n}|}{2^{n+1}-1} =\frac{1}{|\text{im}(h)|}.$$

Question. Of all the hash functions known to be cryptographically secure, is there one of which we know whether it is weakly, or even strongly, uniform?


texts: Shamir's ID based signatures - Notation issues

texts:
I am currently implementing Shamir's ID Based signature scheme as defined in the original paper (archive link). The sign and verify operation are defined as follows:

Sign: $s = g * r^{f(t,m)} (\mod n)$

Verification: $s^e = i * t^{f(t, m)} (\mod n)$

I have some troubles to convert this to Java code, because I am unsure about the order of evaluation, i.e., I am unsure, what the modulus refers to in this context, the hole right hand side (including the multiplication) or the exponentiation operation, only?

PS: This post is related to this question.


texts: How to prove security of a randomized encryption algorithm?

texts:
I have designed an random encryption in public key setting. I am convinced about its security guarantee but I need a formal way to prove its robustness. How can I prove the security of this random-public-key-encryption algorithm? Any proof method such as induction-method, proof-by-contradiction-method or anything else?

I am trying to publish this algorithm in a journal paper. This is why I need a formal proof.


texts: Stateless hash based public key cryptography?

texts:
Merkle-Winternitz signatures based on fractal hash trees are an attractive alternative to other post-quantum cryptographic schemes, in particular since they are conceptually simple, the security properties are easily understood and they are easy to implement correctly.

However, all schemes based on Merkle trees appear to be stateful, in the sense that the signer must keep track of the number of signatures already generated, and because some optimizations make it significantly impractical to generate several signatures in parallel. This is a huge minus e.g. for server authentication, where the same key might have to be used for several connections in parallel.

Furthermore, stateful private keys are vulnerable to server crashes if the private key state is not immediately persisted (which further increases stalls from serialized signing). Randomized schemes (such as DSA/ECDSA), or schemes based on trap door functions rather than one way functions (such as RSA) do not have these problems.

Does there exist any public key scheme based solely on hash function that does not require a stateful private key?


texts: Can we exchange the permutation of a sponge construction?

texts:
Part of a sponge construction (like SHA3 uses) is a fixed permutation $p$; which is clearly not one-way.

Could we, theoretically, exchange the permutation $p$ with any other permutation? What basic characteristics should such a permutation have – or would, for example, a simple LFSR already represent a valid replacement, assuming it spans the whole bit-range ($r+c$)?


texts: AES CBC with fixed or predictable IV, what are the risks?

texts:
I am making a call with parameters from application "A" to a web application "B".
Parameters are in the query string of the URL. They don't need to be hidden.
But I want to be sure that nobody can change the parameters.
And web application "B" must ensure that the query comes from application "A".

So, I encoded the parameters in AES with CBC. I know that HMAC is best for this kind of situation.
But AES with CBC is the only one algo that the 2 applications have in common.

The security of the system relies on the fact that nobody in application "A" can choose arbitrary plaintext to be encrypted
(to avoid request with modified parameters). Parameters are not an input for the users.

I would like to know the risk if I use a fixed IV or a predictable IV?

It seems that the risk is a chosen plaintext attack.
With this article:
https://stackoverflow.com/questions/3008139/why-is-using-a-non-random-iv-with-cbc-mode-a-vulnerability,
I understand how chosen plaintext attack can lead to reveal the content of the ciphertext.
But I don't mind if the content of the ciphertext is discovered.

What are the other risks?

Can someone build unauthorized request?
CWE-329 says yes. But does that only imply the reusing and adaptaptation of blocks of older messages?
Or does the attacker can build his own request with whatever plaintext he wants?

Does the secret key can be discovered?
From Wikipedia it seems that chosen plaintext attack can reveal the secret key, but I don't understand how.


texts: Licensing software with asymmetric signed files

texts:
NOTE: I know that there are numerous topics here on StackExchange about this but I've read them all and this question still persists.

I'm currently working to enhance the security of a windows based application that is sent to specific clients. We use AES encryption to create a big binary file with license data. In this data we have numerous hardware restrictions and things like user name and login. AES keys are stored within the application in a very secure and complicated manner and accessing the keys is done by a "random-based" routine that never uses the same key twice.

So far so good but new policies demand that everything should be signed by an asymmetric encryption scheme. I've being studding RSA and I can totally see how it works for most cases, but in this scenario there's a tiny thing that I still get into my head:

Most posts say that you should sign your license file and send it along with the public key so that it could be verified. So the software doesn't know the privet key, it only has a public key to check the license hash.

Question: What is preventing the user to just sign the license with his key and use his public key to verify it: How does the software can guarantee that the license is in fact made by me and no someone else?

Is more of an conceptual question because is really not clear how this signing will add security at all.

On symmetric encryption the software is build in with information that can decrypt and verify a license. But if the software is depending only on a public key, how does that work?

Thank you all in advance for you time


texts: Why does DES use a block size of 64 bit?

texts: Why do we use 64 bit as block size for the DES algorithm? Is there a reason not to use another block size, for instance 72 bits?


texts:
Let $F$ be a pseudo-random function. Show that the following constructions are insecure as message authentication codes (in each case $K \in \{0,1\}^n$ is the private key):
$(a)$ To authenticate a message $m=m_1||m_2||\dots||m_l$ where $m_i\in \{0,1\}^n$, compute
$$
t=F_k(m_1)\oplus F_k(m_2)\oplus \dots \oplus F_k(m_l) \mbox{ as the tag}
$$
(b) To authenticate a message $m=m_1||m_2||\dots||m_l$ where $m_i\in \{0,1\}^n$, do the following:
$$
r\stackrel{$}{\leftarrow} \{0,1\}^n
$$
$$
t \leftarrow F_k(r)\oplus F_k(m_1) \oplus F_k(m_2) \oplus \dots \oplus F_k(m_l) \\
send (r,t)
$$
This is what I have tried:
(a) Designing an Adversary: Query $m_i$ and get $t_i$ $\forall i= 1$ to $n$
$t=t_1 \oplus t_2 \oplus t_3 \oplus \dots \oplus t_l$
return $(m,t)$
$\Pr[\text{Adversary forges}]=1$
$(b)$ Designing an Adversary: Query $m_1||m_1$ get $t^{*}$ $(F_k(r))$
Query $m_i$ get $t_i$ $(F_k(r)\oplus F_k(m_i)) $
${t_i}^{'}=t_i \oplus t^{*}$
$t=t^*\oplus {t_1}^{'} \oplus {t_2}^{'} \oplus \dots \oplus {t_l}^{'}$
return $(m,t)$
$\Pr[\text{Adversary forges}]=1$.
Any help with the answers will be truly appreciated.


texts: Use of the master key in Delerablée's Identity-based Broadcast Encryption

texts:
I'm reading “Identity-Based Broadcast Encryption with
Constant Size Ciphertexts and Private Keys” by Cécile Delerablée.

On page 207, the encryption process needs $\gamma$ which is part of the master key.
This does not make sense to me.

I want to know whether I read this thesis wrongly or not.
Can anybody give me a opinion?


texts: How does a chosen plaintext attack on RSA work?

texts:
How can one run a chosen plaintext attack on RSA?

If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?


texts: Finding output given an S-box input of 8 bits

texts:
I'm given the following table:

I'm told to find the output given an hexidecmal input of 2B.
 I know that 2B in binary
= 001 01 011

So I took the first two and last two outer bits (0011) to find the first row which is row 3.Then I took the remaining bits (10 10) to find number 10 on the top row. Matching up the values I get a final answer of 3, which is 11 in binary. But the correct answer is 1001 which is 9 in decimal. I have no idea where I have gone wrong here. I followed the procedure for 6 bit number, but I do feel like I'm missing a key element on how to solve this for a 8 bit number.


texts: Checking the share membership in secret sharing schemes

texts:
I was thinking of this since yesterday. Imagine, a secret is split into its respective shares (using any secret sharing scheme) with threshold $t$ and total $n$.  Can we find out given any random string if it is a valid share of the secret ?

Of course without brute force approach, i.e splitting the secret into its shares and matching the string with each of its member to find out if its legitimate member.

Is it possible at all ? for any secret sharing mechanism ? So to summarize, given a string $s_i$ ,a secret string $secret$ and any configuration parameters needed (say $t,n$ values etc) to share secret.

Can we identify if $s_i$ is valid $secret$ without brute force approach described above ?


texts: Is the Vigenère Cryptosystem malleable, and how can we prove that it is (or it is not) malleable?


texts: Looking for a detailed example of proof by reduction

texts:
I'm looking for a very detailed example of proof by reduction. Say we have two or three protocols (that have been proven secure) and we construct a new protocol. We want to provide a proof of security for this new protocol.

For instance, we can consider the following simple example: we have a (secure) signature algorithm $D$ and a (secure) hash function $H$ and we construct the following signature algorithm (denoted $N$) that takes input the secret key $sk$ for $D$ and a message $M$ :

We compute $d=H(M)$;
We compute $s=D.Sign_{sk}(d)$ and ouput $s$.

(We can deduce the verification algorithm)

This kind of new algorithm is not useful (we add a hash function to a signature algorithm that has already a hash function embedded in it) but I think it can be used to show an example of proof by reduction.

So, we have an adversary $A$ that can break $N$ in time $t$, with $q$ queries and an advantage less than $\epsilon$. We want to show that:

we can build an adversary $A'$ against $D$ that runs in time $t'$, with $q'$ queries and having an advantage $\epsilon'$
we can build an adversary $A''$ against $H$ that runs in time $t''$ with $q''$ queries and having an advantage $\epsilon''$

What is a correct proof by reduction? How to use $A$ to build $A'$ and $A''$ ? and what is the relation between the times $t$, $t'$, $t''$, the relation between the advantages, etc ?


texts: Does order matter for RSA when used multiple times?

texts:
I actually have no idea how RSA works, but I currently (think that I) know

Public and private keys are mathematically doing their opposites
Therefore, the order in which they are applied doesn't matter
The system is cyclic and applying one key repeated times will eventually lead to the starting number

Hoping I am OK till here, these made we wonder if you can apply the keys in any arbitrary order multiple times and come back to the starting number, as long as you use both keys the same number of times.


texts: Fully Homomorphic Encryption - state of the art

texts: What are the latest advances in fully homomorphic encryption? First of all, I am interested in cryptosystems based on LWE / RLWE and NTRU problems.


texts:
Let Z be a cipher system consisting of three m-sequence linear feedback shift registers (LFSR) of length 128 bits each which are assumed to be not cryptographically secure and the registers are seeded with IID variables. Lets identify the registers as S for select register, C for the ciphertext register, and D as the decoy register. The enciphering system works as follows:

The output bits of S control the select line of a two input multiplexer with one input being the XOR of the message bits with register C(call these the ciphertext bits as is the usual custom) and the other input being the bits of D, the decoy register.It is assumed that the message bits are held in a buffer until they are selected for output but register C is continually clocked even if it is not selected, so C is constantly losing information ,likewise with register D. So the output of the multiplexer is a pseudorandom mixture of ciphertext bits with decoy bits. In order for the adversary to recover the message he/she must first separate the ciphertext bits from the decoy bits. Of course this is not a very efficient way to encrypt information because by adding decoy bits to the ciphertext bits effectively doubles your information traffic, but let's say we don't care about efficiency. How could an adversary separate the ciphertext bits from the decoy bits in polynomial time, neither bitstream gives any information about the other and nothing about the select bits S.


texts:
I'm trying to solve a problem that was given to me. The issue I have is that I'm missing some parts to solve it.

I'm confronted with an Oracle that performs MAC on an input that can be of any length using the following function. I need to forge a message that must match the message the Oracle has computed.

$o_1 = E(k, d_1)$
$o_2 = E(k, o_1 \oplus d_2)$
...
$o_N = E(k, o_{N-1} \oplus d_N)$

therefore $MAC(k, d) = o_1 \oplus o_2 \oplus ... \oplus o_N$

where $d_X$ are block size parts of the message (ex.: message is 32 bit long = 4 x 8-bit blocks).

In order to forge the message, the Oracle offers 2 methods:

  $mac0(n)$ -> performs $MAC(k,msg)$ with msg = n x d (where d is a 8-bit block full of zeros and n is the number of block asked)

  $mac3(input)$ -> performs $MAC(k, d)$ with any input (if the input is bigger than 3 blocks, it truncates it to 3 block; if smaller, it pads the remaining parts with zeros until the input is 3 blocks long).

In the case of the example I'll use an 32-bit long input (4 blocks).

The first thing that I currently do is that I use mac3 with the first blocks which will result in $o_3$. I, then, XOR $o_3$ with the last block ($d_4$) and send the result through $mac3$ again. When comparing with the actual result from the Oracle, I find that it is not equal.

So that's where I'm stuck.. According to what I understood, this might be due to the padding done by $mac3$ since the input is not 3 block long. This is the part I don't know how to solve. Would there be a way to revert the result to find the actual forged message?

Any other ideas?


texts: Is there a way to compare the 923 bit pairing based key with RSA or AES, etc

texts: I've see many articles, most of them basically the same, praising Fujitsu for cracking what is referred to as a 923 bit pairing based encryption.  I understand that in comparing RSA to AES you've got something like a power of 10 for the key lengths to be equally strong.  From what I read it seems that this pairing based algorithm is a public key algorithm but somehow involving 3 keys.  I don't know much about the various algorithms but I have read that in the public key space eliptic curve algorithms can get away with much smaller keys than RSA.  I've seem some articles that rate the complexity of various algorithms based on key length, but I don't know nearly enough to understand the papers on this.  Is this new record similar to breaking something encrypted with a 923 bit key using RSA?  I've seen articles that I believe are badly overstating this by saying things like "if they can break a 923 bit algorithm, how secure is the standard 256 bits?"  I assume that's comparing apples and oranges, but I don't know nearly enough to really know.  Does anyone know how to compare these things?


texts: NIST STS incorrect results for sample files

texts:
So I wanted to check the outcome of a hardware TRNG and see if its entropy is good enough. I downloaded the source files for statistical test suit from nist.gov website, compiled them on my macOS machine with clang and tried some sample data files as inputs to check that everything works correct before proceeding to the next step. However, when I used data/data.pi file as an input for STS, the very first result P-value was incorrect!

For a Frequency test it was 0.534146 while the paper from NIST corresponding to that suit stated that the Frequency P-value for pi should be 0.578211 ("Appendix B Empirical Results for Sample Data", page 107). Other results were also incorrect, no surprise. I double-checked the selected options, but they are the same: 10 streams for 100,000 bits and a total of 1,000,000 bits. I also checked configuration parameters in defs.h file, they all match the corresponding ones in the paper.

My first concern was that during compilation process there were some warnings from the compiler. It was mainly unhappy with some uses of 'fabs(x)' for integer-types variables instead of 'abs(x)' in some files. I changed the code but the resulting P-values were still the same.

Any idea what might be the source of the problem? Results for other sample files do not match too.

Thanks!


texts:
I am making an encryptor software for a stream cipher with my own PRNG as a project for an inter school science competition. How can I make one so that after it generates the pseudo random nos. it can recognise each character and make the shifts. Can any one explain this either in Python or in a pseudo code algorithm.

I tried to make one myself, but I am not sure if it will work. This is how it works: first the programme starts counting and recording each character we enter, somewhat like a keylogger. It must beable to identify each of the characters exclusively. And then it does the shifting. If its good enough can  I use it as it is or must I make changes.


texts: Can I use the Sequence Number as the (implicit) IV in AES-GCM IPsec?

texts:
The RFC https://tools.ietf.org/html/rfc4106#page-5 states that, under AES-GCM IPsec, each packet is expanded by 8 bytes for the IV and up to 16 bytes for the ICV.  Why? Since we already have a Sequence Number (4 or, in the case of ESN, 8 bytes), can't we just use that as an implicit IV? This saves 8 bytes per packet (which is sometimes negligible, but sometimes not), and doesn't seem to harm security at all - either way, we need to ensure that sequence numbers are unique.  If anything, it's easier to ensure that one field (ESN) is unique, more than two?

If I am correct, and you can just the ESN has the implicit IV, is doing so compliant with the standards?

Note: I recognize this assumes only one encryptor per SA.  For cases of multiple encryptors using the same key, each encryptor would need to prepend their unique id to it.


texts: How does pairing letters increase the security of a substitution cipher?

texts:
Hello can someone help me to understand this :

  One way to reduce this problem is to increase the size of the cipher alphabet. Rather than considering our cipher alphabet to be just the 26 letters, each with a single keyable transformation to ciphertext, we could instead use pairs of those same letters, and have at least 26 x 26 = 676 transformations. This vast increase in keyable transformations makes the code harder to create and store, but also decreases the number of times each individual transformation might be used


texts: Using the same symmetric key in both directions?

texts: A simple symmetric encryption scheme uses the same key, derived from a password, for both directions of the communication.  Is this bad practice, and if so what should be done about it?  Is it 'good enough' for many things?


texts:
SQUARE attack on AES128 requires a single delta set for 4-round variant, or I assume single delta set is enough since keyspace is reduced to few keys which can be easily brute-forced. However, as we increase round number to 5, we need 5 delta sets approximately, as proposed by AES proposal. And further, for 6-round variant, we need about 10 delta sets. Is there a mathematical relation between the number of rounds and required delta sets, or is this pure heuristic? If there are any underlying mathematical relations, I couldn't spotted.
I am not able to execute a 5-round attack, since I'm following up the attack mentioned at the proposal, which requires a search on $ 2^{40}$ bits, and I'm not sure about the size of the resulting keyspace after using only one delta set. I mean, if we use a single delta set, is brute force still infeasible so that we want to use multiple delta sets, or is there any other reason?
Answers appreciated.
Thanks


texts: Multi signature encryption (multiple people can decrypt)

texts:
I understand that multi sig transactions exist so that X of N need to sign to release a transaction. If only 1 of N is required I guess any of the recipients can spend.
This made me wonder, is it possible to encrypt something, so that any one of a set of people can decrypt the data?
I suppose the data could be in the exponent or something, but also possibly going beyond bitcoin, would it be possible to do this with multiple Mb worth of data (stored off chain in this case)? I guess it would require some sort of script that means conditions have to be met to decrypt the data.


texts:
Recently I'm working on steganography and I want to know that what are the main steganography algorithms and how they work.
I'll be happy if you help me.
thanks.


texts: I am following a wiki diagram for CTR mode of operation in AES256. The documentation states that for it to work you need a random nonce with 8 bytes and then a counter of 8 bytes. So I guess you can randomly generate nonce for instance: SgVkYp3s. And then you just add a count to it. Then you iterate over all of your plaintext bytes and up the count with every pass of the for a loop. So in the end you get nonce like SgVkYp3s00000000, SgVkYp3s00000001, ... And then you use the same format for decryption. Is this the correct approach?


texts: Burmester Desmedt Key agreement. Is the division a floating point one or an integer one

texts:
As I look upon Burmester Desmedt algorithm:

I notice that the intermediate key $K_i$ is getting calculated as:

$K_i=(k_{i+1}/k_{i-1})^{x_i} \mod p$

Thus I wonder wheher the division $k_{i+1}/k_{i-1}$ should result an integer of a floating point number.


texts: Using public key cryptography with multiple recipients

texts:
I have a message that I want to send to multiple recipients.
Can I encrypt the message separately with each of the recipient's public keys, then send the message thus encrypted to the respective recipient?
If an attacker obtains all the encrypted messages and knows that all of them have the same content but are encrypted with different keys, would that make the attack easier?
How about if the attacker manages to decrypt one of the messages, or obtains the plaintext by other means, would that compromise any of the other private keys?
Is there a form of asymmetric encryption that would work better than others in this scenario?


texts: Do Quantum Key Distribution and Physical Unclonable Functions combine, and how?

texts:
I see there's a project to combine Quantum Key Distribution, Physical Unclonable Functions, and classical crypto, in order to secure a high speed (100Gb/s) optical link.

While there does not seem to be a direct combination of QKD and PUF in that particular project, I wonder if that combination could be used to solve one of the problems of QKD: it is by itself not secure against a Man-in-the-Middle attack. Perhaps a PUF could solve that by some synergy with QKD (the issue seem to be: make it impossible for a MitM to appear holding the legitimate PUF, when he really is using the legitimate one remotely).

Are the QKD and PUF combined for that purpose? It yes, how, and how is it superior to the combination of classical crypto (which can solve MitM) and PUF (which should prevent cloning of the credentials), without QKD?

Reformulation: One problem with proof of ownership of a PUF (especially of the silicon memory kind envisioned in my first reference) is that they can be relayed, so that the verifier may believe he is interacting directly with the PUF, when in reality he is interacting with the PUF through some hostile proxy/MitM. My question is about using a quantum protocol to solve that, which hypothetically could make sense with some PUFs, e.g. optical. Perhaps this should be migrated to the physics site (but I have not the foggiest idea how).


texts: Is there any encryption algorithm that, with small change in input will produce big change in the encrypted output?

texts:
As stated in the title, I'm looking for an encryption algorithm with the characteristics that, when inputs are slightly different, the encrypted output will be VERY much different, to the point that no one will suspect that unencrypted inputs are quite similar when they compare the encrypted outputs.

The TDES encryption algorithm doesn't seem to reproduce the above characteristics. So is there such an algorithm?


texts: Is there an advantage to storing keys split between several hashes?

texts:
I have a question about the way to store a key or password that was used for encryption, so that the application can check if the user put in the right key for decryption. If I make a mistake, please advise me and I will try to avoid such a mistake in the future.

Normally, the key that was used for encryption is stored hashed on the system, so that the application can check if the user used the correct key.

Would it be better to store not the whole key hashed, but split the key into several parts and hash each of these parts? This should make cracking more difficult, because the attacker has to crack several hashes, with different salts (if used). Am I totally wrong with my line of thought?

If yes a little hint would be nice, so that I can investigate in that direction and avoid this mistake in future.


texts: Can we associate HMAC signed messages with each other?

texts:
Assume:

$hmac(K, m) = M$
$hmac(K, m') = M'$

Can we associate that $M$ and $M'$ were signed by the same $K$?

Given $M$ and $M'$ and that we know they were signed with the same $K$, can we calculate the string similarity between $m$ and $m'$?

Edit: I originally asked the wrong question. The original question is known as a distinguishing attack and this paper (among many others) demonstrate it's possible.


texts: Algorithm/encryption technique which outputs a set number of numerical digits e.g. 20 digits from a given input

texts:
What the name of the algorithm/encryption technique which outputs a set number of numerical digits e.g. 20 digits based on some input.

You can input some data e.g. text or numbers but the output is always 20 unique digits.

If you put the same input, it should give you the same output.


texts: How do substution-permutation networks work?

texts:
I understand what's going on in higher level. But i don't understand what's really going on in page 3 and 4 of this slide.

Specifically,

How S0 and S1 is used? What goes in what goes out?
How exactly  key bits determine
which s-box is to be
used at each position? Position refers to what?
is the function "f" in page 4 exactly the same SP network in page 3?
why split plain text into left L and right R?
why XOR L with R after applying "f"?
why rotate after  applying last "f"?
why XOR is used? why not some other bitwise operation?

preceding slides for reference


texts: Is there a hash function h(M + t1) = c1 that relates to h(M + t2) = c2 in a way that can be verified without knowing M?

texts: Is there a hash function h(M + t1) = c1 that relates to h(M + t2) = c2 in a way that, knowing t1, t2, c1, c2, and with no knowledge of M, it can be verified whether both use the same M?


texts: Why do we need to compute message digest of a message first while signing it?

texts: Why is it more efficient to compute a message digest (message & signature) rather than sign the message directly?


texts: Calculating the average key search time of DES

texts:
I am trying to understand how to calculate the average key search time given a specific scenario:

Suppose we have a program that uses standard DES with 56 key bits, and we can test 10^6 keys per second.

The key consists of 8 characters, a simple concatenation of the 8 ASCII characters yielding 64 = 8*8 key bits. With the permutation PC-1 in the key schedule, the least sig. bit of each 8-bit character is ignored, giving us 56 key bits.

What is the size of the key space if all 8 characters are randomly chosen 8-bit ASCII characters?

My thought is the key space is 2^56.

How long does an average key search take?

We can test 10^6 keys per second, and 2^56 is roughly 7.2058 x 10^16. I don't know if this is proper way to do it, I estimated ~3 seconds.

I am assuming there is much more accurate mathematical approach but I'm not familiar with it, could anyone shed some light on this for me?


texts: How can my application make sure the right symmetric key is used for decryption?

texts:
I am developing an Encryption/Decryption Utility using Adobe AIR. I have chosen the AES algorithm and currently use the as3crypto library for this. My query is in what practical ways can I detect if the password provided at the time of decryption valid or not.

As of now I thought of encrypting a constant string with the password and storing the encrypted string in the header of my encrypted file. For decryption, I can check if the correct password is provided by decrypting this string.

This is a temporary work around as storing a ciphertext of a known plaintext (The string is hard coded as a constant inside my application) is not a proper way as I know.

Since I don't have much experience, I am looking for a proper and safe way to accomplish this. My application will be a standalone desktop application without a server.


texts: $F$ be a PRF, is the following $G(x)=F_{0…0}(x)||F_{1…1}(x)$ a PRG?


texts:
Alice has a secret A, Bob has a secret B. They have a secure channel and a MAC. They each want to know the other's secret, but don't particularly want to give up their own. However, neither will not lie about the secret, but if possible, will stop communications once [s]he learns the other's secret.

How can such a protocol work, that if Alice or Bob doesn't correctly follow all steps in the protocol, neither person can gain any information about the other's secret.

You may not use a third party.


texts: Security level of DSA when $q$ is a 224 bit prime?

texts:
What is the security level of DSA algorithm when $q$ is a 224 bit prime?
Is it always a simple rule that the security level is the bit length of $q$ divided by two ?


texts:
For example:

Assuming someone has found a second preimage for SHA-256. In other words, for SHA256(M1)=H, someone has found M2 which SHA256(M2)=H

Now, is it possible to generate k-way second preimages faster than brute force? To illustrate my point:

For SHA256(M1)=SHA256(M2)=H, is there a way to find:

SHA256(M1)=SHA256(M2)=SHA256(M3)=SHA256(M4)=...=SHA256(Mk)=H

faster than brute force?

EDIT:

I did find some relevant information here: (https://pdfs.semanticscholar.org/bc44/a277e6e10ff318ea7ecb06af12a191d1193a.pdf)

According to the paper, by using an extension of Joux's multicollision technique, it is possible to generate multiple second preimages faster than brute force. However, this doesn't seem to match what I want to find, because the technique described in the paper creates multi-preimages with the same message block, but different initial values. I want a technique to find multi-preimages with different message blocks.


texts: If ChaCha20 is being used just as a CSPRNG, is nonce needed?

texts: I'm planning to use ChaCha20 just as a CSPRNG. Key is random (taken from strong initial entropy source) and will be constantly replaced via DJB's fast key-erasure scheme. What should I use as the nonce? Does it matter? Is it safe to just use zero?


texts: Does NTRU provide Perfect Forward Secrecy?

texts: Does NTRU provide Perfect Forward Secrecy if the world would use it in an HTTPS connection?


texts: I had a client requirement asking me to provide an existing base64 encoded certificate in a CVC  format. Could someone point me in the right direction here to understand what this format is? How can I convert an x509 certificate to CVC format and the tools to achieve this, please? thanks.


texts: Uniform vs discrete Gaussian sampling in Ring learning with errors

texts:
The Wikipedia article on RLWE mentions two methods of sampling "small" polynomials namely uniform sampling and discrete Gaussian sampling. Uniform sampling is clearly the simplest, involving simply uniformly selecting the coefficients from the set of small coefficients, thereby guaranteeing they will be small. However, the articles mention that security proofs rely on discrete Gaussian sampling.

However, I have a bit of difficulty wrapping my head around

Why discrete Gaussian sampling would be better than uniform, security-wise?

I mean, usually uniform is preferable - it maximizes the entropy/information in each sample, making the outcome more unpredictable. I could understand it if the Gaussian sampling technique would somehow serve to avoid (at least with high probability) "weak" parts of the space of outcomes but I have found no information/justification that this is the case.

Another reason I can see why discrete Gaussian might be better is that there is, after all, a chance (albeit a small one) one would select a non-small coefficient, so the space of outcomes is actually larger. However, given that this probability of hitting this extra space is (by design) quite small but also that one would likely immediately reject such a sample (because the algorithm calls for a small polynomial), this seems to be irrelevant.

It is not because I am against discrete Gaussian sampling I just want to understand why it is more secure. Also, I want to understand if it really IS more secure or it is simply easier to prove security in that model. I would actually consider that very interesting if it is the case because it raises the question of why is it easier to prove the security under conditions that are intuitively worse (i.e. discrete Gaussian vs the intuitively better uniform case)? If it is so intuitively clear that uniform sampling is better, surely it must be possible to transform that intuition into a security proof of RWE also under uniform sampling. Otherwise, I would fear the intuition must with high likelihood be wrong or at least dubious.


texts: How to solve encryption with ASCII output

texts:
There are lots of text files which have unknown data packets with ASCII output (no available plaintext exists with regard to any ciphertext, I have only encrypted outputs). The input data is known to be ASCII as well.

Looking both in a hex viewer and a text editor, I can see the string well. I tried to draw histogram of all the data one by one.

One text file data does not have uniformly distribution
Histogram of all of the text file has non-uniformly distributed data

I observed the following from the histogram:

There are 0xA and 0xB ASCII chars and all the other data is in the range of 0x20 to 0x7E
There are lots of parenthesis "{]{[_XWZc" letters in the data that I have. This range makes a peak in the histogram

One more interesting thing is, sometimes the last 3-4 letters look like a meaningful plaintext string (for example "John, eat") and may repeat in some other text files at the end of data (the letter cases are also the same).

Question 1: What are some ASCII encryption methods that look like this encryption?

Question 2: Which strategy should I follow to retrieve the plaintext?

This is my first question on Stack Exchange.  Sorry for any mistakes related to the rules or missing parts in the topic.

Helpful links:

http://www.asciitable.com/index/asciifull.gif
https://www.browserling.com/tools/ascii85-encode (I've tried the algorithms on that page)


texts: Paillier's Cryptosystem - Secure Key Size

texts:
Given Paillier's Cryptosystem. What size in bits would be considered secure  for now and the near future? I know it differs for every cryptosystem.

For reference, the most important part of my implementation of the key generation is given below. I would wish like to increase the performance of my app but remain secure for the near future. What would be the recommended bit size, and why? Thank you for your time.

final int PRIME_CERTAINTY = 100;
final int BITLENGTH = ???;
BigInteger p, q;
do {
  p = BigInteger.probablePrime(BITLENGTH / 2, new SecureRandom());
} while (!p.isProbablePrime(PRIME_CERTAINTY));

do {
  q = BigInteger.probablePrime(BITLENGTH / 2, new SecureRandom());
} while (!q.isProbablePrime(PRIME_CERTAINTY) || q.equals(p));

n = p.multiply(q);


texts: Static DH/Static ECDH certificate using OpenSSL

texts: I've been searching for some time and have found no way to create a working certificate and private key pair with a DH or ECDH public key using OpenSSL. Once I do this, I'd like to sign it with an RSA key, too. Does OpenSSL support this? If so, how can I do it?


texts:
I have an elliptic curve defined over finite field where $S_1=aP$ . Is it valid to say that $S_1P$ can also be computed.  $P$ is the generator of the group.
What my real question is that. Should '$a$' be always an integer or can it be a group element itself??


texts: Homomorphic Evaluation of Pseudo Random Function

texts:
I'm looking for a special Pseudo Random Function (PRF) $F_k()$ which follows the below.

For fully homomorphic encryption (FHE), $\mathit{FHE}(F_k(x)) = F_k(\mathit{FHE}(x))$.

Or is there any homomorphically evaluable doubling pseudorandom number generator algorithm? (because Goldreich-Goldwasser-Micali PRF construction is based on the doubling pseudorandom number generator.)

Thanks.


texts:
We've been trying to produce a valid, and pretty, MD5. Something that has repeating digits, or spells a word, or something. It's probably more difficult than spelling out the dictionary on a calculator whilst standing on your head on top of a washing machine on ship in the arctic but it's always made me curious.

Are there any valid, and person readable, checksums possible? Or would the checksum itself typically prevent this?

I'm preparing for some massive flames to blow my way.


texts: Difference between function $f$ in eval and dec of homomorphic authenticated encryption

texts:
In the homomorphic authenticated encryption, as described 1, there are Eval and Dec PPT algorithms:

In Eval, f is the function to be performed on the encrypted data. However, I need to know why it is used in Dec algorithm?


texts:
I'm creating an implementation of the DCT Steganography algorithm in Java and I'm having a slight problem. When I embed a message into a cover-image, I am doing so by initially obtaining the DC Coefficients of that image for a particular 8*8 block and then replacing the last coefficient equal to either a 0 or 1 depending on the binary message I am embedding. Once this has been embedded into the 8x8 blocks, I then pass it through the inverse DCT to re-create my Stego-object.

However, when I pass the Stego-object through DCT and recover the last coefficient of each block, sometimes the coefficient has changed and therefore doesn't produce the correct message that I originally embedded into it.

Does anyone have know/understand why this might be happening and how I can solve it?

E.g. Embedded message = 00 0 1001000 0 0111101 0 01 1 0101100101 Recovered message = 00 1 1001000 1 0111001 1 01 0 0101100101

This only happens on some images but not all and I am not sure what's happening. My program checks to see if the last coefficient is equal to 0 before it decided to embed on it or not.


texts: I've seen papers saying toy ciphers can be improved with powerful key scheduling, but was wondering if there is evidence they are needed in reasonable ciphers? for instance AES. Is there any cryptanalysis which shows a strong cipher becomes dramatically weaker with simpler or no key scheduling?


texts: RSA PKCS#1 v.15 Signature verification computational complexity explanation?

texts:
I've been experimenting with MBEDTLS on an ARM-M4 (but this question is not platform-specific) and am confused/surprised regarding the computational complexity (execution time) of mbedtls_rsa_pkcs1_sign() versus mbedtls_rsa_pkcs1_verify(). Apparently the _sign is much more computationally complex than the _verify. I don't understand this and would expect the opposite to be true.

Observations:

mbedtls_rsa_pkcs1_decrypt() or  mbedtls_rsa_pkcs1_sign()    < 3 secs
mbedtls_rsa_pkcs1_encrypt() or  mbedtls_rsa_pkcs1_verify()  < 100 millisecs
(this is for RSA-2048 / SHA-256)

I would have assumed that the verify should be similar in complexity to the decrypt (because it requires decryption of the signature hash) and that the sign would be similar in complexity to encrypt (because it requires encryption of the hash). I understand that for the signature operations the Private and Public key use is reversed, but I'm not sure how/why that affects things.


texts: How should I calculate the entropy of a password?

texts:
If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, the number of English words assumed by the attacker?

Does the language matter, is the average entropy per word in German, French, Italian, or Spanish significantly different from the average entropy in English?

Does a numeric digit always have an entropy of $\log_2(10) = 3.321928$?


texts: Which of the following is/are true about nonces/timestamps?

texts:
a. A nonce may or may not be predictable.
b. Use of timestamps requires fewer numbers of messages compared to nonce-only authentication
protocols.
c. Server keeps track of nonce it has used in the past.
d. Timestamp based protocols are sensitive to clock skew.
From the above options which option are true about the question asked


texts: What encryption/decryption method should I use when multiple users should have access to the encrypted information?

texts:
Ok, I am in a little bit of cryptographical fix :D

I need to figure out a way to encrypt and decrypt data handled by a website.
The website is intended only for a certain group of people who will use it to upload and search sensitive information.

Data is entered by them using a browser, which should be encrypted before sending and storing it in the server/database.

On the other hand when these users search for a value (say, account number) in the database, it is queried whether present in the database and if yes, it is decrypted and displayed on the browser.

The whole point of encryption/decryption is to make sure that website hosters, owners and administrators do not understand the data values.

It is a website that has multiple users who might be accessing the same data/values from the same database. If we have 1000 registered users, the information uploaded by each of them should be available to all of the 1000 users.

The problem here is that this is not a person to person encryption/decryption (like sending an encrypted email), therefore I am not sure if the private and public key cryptography can be implemented in it's raw form. What is the logical way to implement cryptography in this situation?


texts:
This question is aiming at clarification related to message authentication codes (MACs).

Wikipedia’s Message Authentication Code article states:

  In cryptography, a message authentication code (MAC), sometimes known as a tag, is a short piece of information used to authenticate a message—in other words,  to confirm that the message came  from the stated sender (its authenticity) and has not been changed.  The MAC value protects both a message's data integrity as well as its authenticity, by allowing verifiers (who also possess the secret key) to detect any changes to the message content.

(emphasis mine)

Is it correct to say that MACs not only provide integrity information related to the data itself, but also validate the identity of the originator? Or does it make sense to verify/validate the identity of a sender using additional cryptographic means – maybe something along the lines of a Sender Identification Code, Originator Verification Code, or something like that?

Differently asked:

Should the identity of a sender be verified using additional means, or does a MAC suffice?


texts: Is there a Pseudo Random Permutation Generator that can output all values of the length of N

texts:
Is there a pseudo random permutation generator that produces all permutation of any bit length of the plaintext (this may not be clear, please let me know and I will explain).  It must be fast, and does not hold numbers in memory.
This is a permutation of (1)
(1)
This is a permutation of (1,2)
(2,1)
This is a permutation of (1,2,3)
(1,3,2) (2,3,1) (2,1,3) (3,1,2) (3,2,1) n!
Note* the above is not in a pseudo random order and not a complete set that I am looking for.
This is a pseudo random permutation with replacements that I am looking to duplicate with a generator of any size.
PRP of (1,2,3) with replacements
(1,1,1)(3,3,3)(2,3,3)(1,1,3)(3,3,2)(2,3,1)(2,2,2)(1,3,3)(3,2,3)(2,1,2)(1,2,2)(3,1,3)(1,1,2)(3,3,1)(2,3,2)(2,2,1)(1,3,2)(3,2,1)(2,1,1)(1,2,3)(3,1,1)(2,2,3)(1,3,1)(3,2,2)(2,1,3)(1,2,1)(3,1,2) N^N
If one does exist could you please post its name, if possible.
If it does not exist could you expound as to the reason why, if it is against a known proof, or it has simply not been made, yet.
The question here is very similar but it needs to be with replacements.
https://math.stackexchange.com/questions/3521660/invertible-pseudo-random-permutation-function
What would it mean if it could be made. Meaning given the length of any plaintext if that order and length is your first permutation of group g than all permutation after that would be your subgroup permutations. Given that the key length that produces the permutation is not an issue (I would be glad to explain this as well).
Another way of writing this would be. What program would generate all permutations of a given string with replacement? The given string is the complete message source or file to encrypt of any size. It will probably be recursive. Once all permutations are calculated it should loop back to the original permutation which is the file.


texts: Can Shannon's entropy be used to determine if a file is encrypted?

texts:
If we have to determine a file is encrypted or not, can we use Shannon's entropy algorithm on the file?

As discussed here, the entropy (in bits per byte) being closer to 0 is considered as more orderly and being closer to 8 is considered more random.

Intuitively this might be generating false positives a lot. Can any one explain if this approach is appropriate to determine given a random file is encrypted or not?


texts: How was the AES MixColumns matrix constructed?

texts:
How was the constant matrix in AES MixColumns constructed?

\begin{bmatrix}
02 & 03 & 01 & 01 \\
01 & 02 & 03 & 01 \\
01 & 01 & 02 & 03 \\
03 & 01 & 01 & 02 \\
\end{bmatrix}

How can I construct in $GF(2^4)$ an invertible matrix for the MixColumns step?


texts: How do I interpret the CADO-NFS output for discrete logarithm calculation in GF(p)?

texts:
I'm using CADO-NFS to calculate discrete logarithm in a finite field GF(p). The problem is when I type

./cado-nfs.py -dlp -ell 101538509534246169632617439 target=92800609832959449330691138186 191907783019725260605646959711

as described in the README.dlp file I just can't understand which of the three values (log2, log3, log(target)) is my discrete logarithm result:

Anyone with some experience with this tool could help me, please? I didn't find anything on the Internet and the documentation that came with CADO say anything about it.


texts:
I was playing around with modular arithmetic when I noticed something.

\begin{align}
g^k &= a \bmod n\\
g^{k+0.5(n-1)} &= b \bmod n
\end{align}

Then $a + b = n$, so you can also write

$$g^{k+0.5(n-1)} = n - a \bmod n$$

This seems to hold if $n$ is prime and $g$ is the primitive element of $n$, according to randomly trying sets of $n$ and $g$. I have tried to see the theory behind this, but was not able to do so. None of the properties (Wikipedia: Modular arithmetic properties) of modular arithmatic seems to relate to this. Can someone explain why this holds?


texts: Is inverse polynomial in a finite field NP hard?

texts: In ECC we have: if we know $G$ and $P=kG$, it is very difficult to find $k$. I wonder whether or not in NTRUEncrypt: if we know $h$ and $P=rh$, it is difficult to find $r$?


texts: User-specified PBKDF2 password, salt, and iterations limits

texts:
For a decentralized login where a user is left to select the password, salt, and iterations, what minimums for each should be enforced?

In other words, because none are ever stored by the implementation, can standard login authentication guidelines also with a 4-digit PIN be enforced to produce theoretically uncrackable combinations where the login username & password are substituted for the PBKDF2 password & salt or vice versa, and the PIN is the number of iterations no less than 1,000?

Specifically, this PBKDF2 scheme is merely a tool for the user to generate 32-byte signing keys from user memory rather than by storage.  Any conforming key is of course accepted by the overall implementation, but for those that use the tool properly, I'd like to help save them from themselves.

If the standard username/password rules should not be implemented, why, and what minimums, by any measure such as length or quantity and/or variety of special characters, should be placed upon the PBKDF2 password/salt combination?


texts: Are RSA or ECC vulnerable to an attack where the same (unknown) plaintext is encrypted with multiple public keys?

texts:
I'm not sure what this attack model is called - it's not known-plaintext and also not quite cipher-text-only. It is similar to this question except the general case (not just two keys) and using keys you'd find in the wild.

Say you have one hundred ciphertexts which you know are the result of encrypting exactly the same plaintext with one hundred different public keys. Is there any vulnerability here in terms of figuring out what the plaintext is or what the private keys are, either using an RSA-based system or an elliptic curve-based system?

If there is, what would some valid approaches be to preventing the attack? I'm thinking along the lines of the first four bytes being a seed to a PRNG which modify the remaining bytes in some way so that the plaintexts end up being quite different. I suppose something like OAEP should be enough?


texts: Proof of number of logins in last N days without saving login times

texts:
Let's say we have an user Bob. User Bob logs in into our web application every so often. We are a website that tries to save as little information about our users, however we'd like to know which users are inactive so we can suspend their account.
Is there any way we could save information about Bobs logins in a way that doesn't tell us anything about when he logged in, but tells us how many times Bob logged in in last n days?
Assume everything is being done on server side, and only thing we're trying to prevent is data leak in case of a database breach or similar.


texts: Why do we need in RSA the modulus to be product of 2 primes?

texts:
I think I roughly understand how the RSA alorithm is working.

However, I don't understand why we need the $N$, which we use as a modulus, to be $pq$ for some large primes $p, q$.

I vaguely know it has something to do with factorization, but I am kind of lost. So, hypothetical questions.

What would happen if the $N$ was not $pq$, but just a big prime?
What if $N$ would be some random composite (that's easy to factor)?

The other parts of RSA would stay the same.


texts: Is there a reason to use multiple hashing algorithms in a single system?

texts:
I came across an authentication system Here that uses multiple hashing algorithms to hash data in different stages of the authentication.
My question is what's the rationale behind this?
If a hashing algorithm is secure (or has been secure so far, like SHA-256) why use different ones?
For example: When someone/something is registered in the system, its registration token is generated using algorithm H0 and when it is doing some other actions in the system it uses another hashing algorithm like H1.


texts: Why does Openssh use only SHA1 for signing and verifying of digital signatures?

texts:
I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh implementation uses only SHA1 for signing and verifying of digital signatures. SHA1 is hard coded in these two functions, ssh_dss_sign() and ssh_dss_verify().

I am wondering, does all the implementations of use SHA1 as hash algorithm for signing and verifying digital signatures.  And why don't we use SHA-256 as it's better than SHA1?

Is there any specific reason for doing so..? If yes, could someone please provide some references.

Thanks in advance.


texts: How to implement 1-out-of-n OT from 1-out-of-2 OT?

texts: How can I implement a 1-out-of-$n$ oblivious transfer protocol from 1-out-of-2 OT protocol which is resistant against passive corruption? Assume we can access 1-out-of-2 OT $n$ times.


texts:
Homomorphic Encryption (HE) which supports any function on ciphertexts is known as Fully Homomorphic Encryption (FHE), while Partially Homomorphic Encryption (PHE) includes encryption schemes that have homomorphic properties, with respect to one operation (e.g., only addition or only multiplication, but not both).

Are symmetric homomorphic encryption schemes (like Domingo-Ferrer, Castelluccia, etc.) also considered to be PHE?


texts:
It seems that OTP encryption is unbreakable. I have read some articles (Wikipedia, Blogpost, etc.), but I could not find any information about how they are used.

If I wanted to create a messenger service, how would I distribute the OTP keys? Both the sender and the receiver need this key before the message is sent, right?

And how do I make sure no one else gets these keys?


texts: Prove that pseudorandom generator is a one way function

texts:
Suppose the following PRG $G : \{0,1\}^n \rightarrow  \{0,1\}^{n +l}$, I want to prove that $G$ is one way function (and not building one), for:

$l = \omega (\log n)$
$l = 1$

For $l = \log n$, suppose that $G$ isn't OWF, so there's an inverter $A$ which succeeds w.p. $\geq 1/p(n)$, trying to build a distinguisher $B$ from inverter $A$ to $G$, I can do as follows:

$B(y)$ assigns 1 to each input successfully inverted. So $\Pr[B(y) = 1 : y = f(x) = G(x)] \geq 1/p(n)$, and for random input $\Pr[B(U_{n + \log n})] \geq 2^{n}/2^{\log n + n}$. All in all, the distinguisher succeeds w.p.

$$|\Pr[B(y) = 1 : y = f(x) = G(x)] - \Pr[B(U_{n + \log n})]| \geq 1/n - 1/p(n) \geq 1/2n$$

But for $l=1$, I get a bound of $1/4$ ($1/2 -1/p(n) \geq 1/4$)... It doesn't feel correct, but does (?) follow the definition of distinguisher for PRGs.

What am I missing?


texts: Why does a padding block exist for ECB and CBC modes?

texts:
In ECB and CBC mode, the size of cipher text is more than the plain-text size by one padding block.

From what I read, ECB does a simple encryption to each 64 bit block of a Plain text, and produces an equivalent 64 bit cipher text block. Then how does an extra padding block exists?


texts: Does this scheme break under a DHP adversary?

texts:
Consider the following cryptography scheme:

We are given a prime $p$.
Alice wants to send the plaintext $m \pmod p$ to Bob.
Alice chooses $a$ s.t. $\text{gcd}(a,p-1)=1$, and sends Bob, $u = m^a \pmod p$.
Bob chooses $b$ s.t. $\text{gcd}(b,p-1)=1$, and sends Alice, $v = u^b \pmod p$.
Now Alice sends Bob, $w = v^{a^{-1}} \pmod p$, where $a^{-1}$ is the inverse of $a$ modulo $p-1$. Bob now calculates $w^{b^{-1}}$ to get back $m$.

Now I want to know if we have a passive adversary Eve who is able to solve the Diffie-Hellman Problem, gain access to $(u,v,w)$, can she get back $m$.


texts: Diffie Hellman Problem (DHP) and Discrete Logarithmic Problem (DLP)

texts:
I am novice here. I am following a lecture series of Prof. Christof Paar and in his lecture of DLP, he states a fact which I did not understand at all. Can somebody please explain it better to me.I understand DLP and DHP independently.
The statement goes as follow:

"If the only way of solving the DHP requires the DLP, one would say that, the DHP is equivalent to the DLP" However this is not proven yet.

Also he says that if somebody proves it, it would be ground breaking research.


texts: Is knowing the private key of RSA equivalent to the factorization of $N$?

texts:
Given the RSA modulus $N$ the fastest method to factor it is of sub-exponent order. But, now if I know the private key $d$ of RSA, does that mean I can factor $N$ efficiently?. It intuitively seems true as I know the public/private key pair. Can someone help me to prove this?

Please provide references so that I can read further into this subject.


texts: Is the One Time Pad (OTP) considered a cryptographic hash function?

texts: As the title states, would the One Time Pad (OTP)  be considered a cryptographic hash function?


texts: What is preventing chaotic cryptology from practical use?

texts: What factor is preventing cryptography based on chaos theory from being of practical use? Is it because of the unpredictability of the system?


texts: What is the difference between CBC and GCM mode?

texts: I am trying to learn more about GCM mode and how it differs between CBC.  I already know that GCM provides a MAC which is used for message authentication.  From what I have read, and from the code snippets I've seen, GCM does an exclusive or much like CBC, but I'm not sure what the exclusive-or is against.  In CBC mode, the exclusive-or is plaintext against the previous ciphertext block, except for the first block which uses a random IV.  Does GCM do the same, or does it do the exclusive-or against something else?  If so, can someone please briefly explain how GCM uses the IV and how the exclusive-or is done.


texts: How to represent the point-at-infinity(Elliptic Curves) in code?

texts:
I am writing code for Elliptic Curve Cryptography. I have a class class EllipticCurvePoint.

class EllipticCurvePoint{
    FieldElement x, y;
};

I need to support point-at-infinity (which should behave as if it is an object of type EllipticCurvePoint). Only thing I can think of is to reserve (-1, -1) for this but x and y can assume values only from {0, 1, ..., p-1} (p being the Field they belong to). If I want to represent it this way, I would need to add support for -1 in the classes FieldElement and Field too.

I have also overloaded the + and the * operators which work perfectly fine for other points. But I cannot think of a way to represent point-at-infinity which can work homogeneously with the rest of the code and I wouldn't have to change the parent classes(Field and FieldElement).

Is there any elegant way to achieve this? Thanks a lot for your time!


texts: Instead of sending a set of random values, send a key for a PRF

texts:
Some Protocols require one party to send $n$ random challenges (or random values) to another party. For communication efficiency purpose, one can pick a random key for a pseudorandom function, and send only the key to the other party, instead. Given the key and the function, the recipient can generate $n$ (pseudorandom) values locally.

In here (on page 5) it's stated that we cannot prove it in the standard model but can we can do it in  random oracle model. However, in here (on page 12-13) it is said we can use block cipher in the counter mode to do that. So it's a bit confusing.

Question: Why cannot we use standard primitives and assumptions to construct a provably secure scheme described above?


texts: Prove that Alice’s solution x is equal to Bob’s plaintext m

texts:
The answer to the second part of this question exists already.
However, I need help understanding how the first part of the question is solved.
I have a feeling that it must have something to do with FLT, although I can't figure it out.

Could someone post the proof or hint me in the right direction?
It feels like I am missing something very obvious although I'm not sure what.

  Alice chooses two large primes $p$ and $q$ and she publishes $N = pq$. It is assumed
  that $N$ is hard to factor. Alice also chooses three random numbers $g$, $r_1$, and $r_2$ modulo $N$ and computes
  $$g_1\equiv g^{r_1\cdot(p−1)}\pmod N\text{ }\text{ and }\text{ }g_2\equiv g^{r_2\cdot(q−1)}\pmod N.$$

  Her public key is the triple $(N,g_1,g_2)$ and her private key is the pair of primes $(p,q)$.

  Now Bob wants to send the message $m$ to Alice, where $m$ is a number modulo $N$. He chooses two random integers $s_1$ and $s_2$ modulo $N$ and computes
  $$c_1\equiv m\cdot{g_1}^{s_1}\pmod N\text{ }\text{ and }\text{ }c_2\equiv m\cdot{g_2}^{s_2}\pmod N.$$
  Bob sends the ciphertext $(c_1,c_2)$ to Alice.

  Decryption is extremely fast and easy. Alice use the Chinese remainder theorem
  to solve the pair of congruences
  $$x\equiv c_1\pmod p\text{ }\text{ and }\text{ }x\equiv c_2\pmod q.$$

  (a) Prove that Alice’s solution $x$ is equal to Bob’s plaintext $m$.
  (b) Explain why this cryptosystem is not secure.


texts: I have a new cryptography algorithm, what should I do?

texts:
I created a new, unknown symmetric encryption algorithm. It looks like it's very fast and can be useful. I'm kind of independent researcher, hobbyist. Since years I'm interesting in Kakutani's problem and it's generalizations. And that's why I was abble to create it. I'm not a matematician with academic degree, what's more I even can not programming (I know only total basics of C), but I am very involved on the subject of the Kakutani's problem and its generalizations, I have known and read all major scientific publications since years ago on this topic. Here is an example of hash function which can be done with Kakutani's sequences and it's generalizations:
https://arxiv.org/pdf/1801.05079.pdf
As you can see it is possible to made a brilliant cryptographic/hash algoritm based on these functions, if you know how to use them. In recent years, more and more scientists are beginning to see the cryptographic potential in this field of mathematics (Kakutani's problem). So it's not just some easy topic, another stupid algoritm, it is based on one of the biggest unsolved math problem. Someone who will create algoritm based on pseudorandomness of Kakutani's sequences (and generalizations) can probably create very strong cryptographic tool.
Algoritm like this (I mean this one which I created) requires testing in couple areas (confusion and diffusion, differential cryptanalysis and so on), but I do not know cryptography so well to do this on my own (even don't know how to start). Simultaneously I have strong believe that my algoritm is something valuable and interesting.
What should I do? Do you think that such algorithm can be commercialized or it is possible to somehow made a profit on it (I also thought about a patent)? Like I said, it looks like algoritm runs faster than AES but I'm not abble to check everything on my own, for example confusion and diffusion of this algoritm is still a mystery to me (but I hope that algoritm will pass all tests). Maybe some of you guys work in cryptography and can give me some advice? Or maybe should I publish it somewhere on the internet and forget about profits or even authorship (because what can I do as nobody in the cryptographic industry)?


texts:
Consider that Alice wants to send a digitally signed message to Bob.
Mallory might be able to publish his public key under Alice's name and then impersonate Alice to send a message with an apparently valid signature.

But let's assume that Bob already has received Alice's correct public key.
Can Mallory still send a fake message with a valid signature using more advanced methods?

Consider the following situation:
Bob knows Alice's public key.
Alice private key is secret and only known to Alice.

Mallory doesn't have Alice's private key, but he knows her public key.

Alice now sends the signed message "today is my birthday".
Mallory wants to change that message to say "tomorrow is my birthday".
Mallory and Alice know What is message: "today is my birthday".

Can Mallory find a way to send his fake message without Bob noticing, i.e. with a valid signature.

Could Mallory somehow compare the hash value of "today is my birthday" and the signature generated by Alice and learn from that how to generate a valid signature of "tomorrow is my birthday" under Alice's public key?


texts: If you have a file and XOR every bit with a random bit, can you extract any information?

texts: Say you have a file that is not random, and you XOR every bit with a random bit (not pseudo, but really random). Can someone who sees only the result extract any information from it? Obviously, it won't be 100% accurate, but I imagine you can do some sort of stochastics and get a vague idea. If yes, how? If no, is there a mathematical proof?


texts: some of my confusions about DDH assumption

texts:
The wiki defines the decisional Diffie–Hellman assumption as follows:
Decisional Diffie–Hellman assumption
Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH assumption states that, given $g^a$ and $g^b$ for uniformly and independently chosen $a$,$b$ $\in \mathbb{Z}_q$, the value $g^{ab}$ "looks like" a random element in $G$.
This intuitive notion is formally stated by saying that the following two probability distributions are computationally indistinguishable (in the security parameter $q$):

$(g^a,g^b,g^{ab})$, where $a$ and $b$ are randomly and independently
chosen from $\mathbb{Z}_q$
$(g^a,g^b,g^c)$, where $a,b,c$ are randomly and independently chosen
from $\mathbb{Z}_q$.

some confusions about DDH assumption
my confusion doesn't lie in the group that hold the DDH but that does not hold the DDH. The Wiki says

Importantly, the DDH assumption does not hold in the multiplicative group $\mathbb{Z}^*_p$, where $p$ is prime. This is because given $g^a$ and $g^b$, one can efficiently compute the Legendre symbol of $g^{ab}$, giving a successful method to distinguish $g^{ab}$ from a random group element

poncho shows me how to do it. Next i will describe that in my understanding.
Given  $(g^a,g^b,g^{ab})$ and $(g^a,g^b,g^c)$, such that $a,b,c$ are are randomly and independently chosen from $\mathbb{Z}^*_p$. if $\left(\frac{g^a}{p}\right)=1\Rightarrow a\equiv0\pmod2$, and if $\left(\frac{g^a}{p}\right)=-1\Rightarrow a\equiv1\pmod2$ , so does $\left(\frac{g^b}{p}\right)$ and $\left(\frac{g^c}{p}\right)$. So there are one occasion that can be distinguished correctly : if $ab\neq c\pmod2$ then we can faithfully say that $g^{ab}\neq g^c$.
This is error-free as poncho said. But when $ab\equiv c\pmod2 $ happens, we can not distinguish $g^{ab}$ from $g^c$.That is to say, we can only partially distinguish $g^{ab}$ from $g^c$.
But in practical, does the DDH Oracle  really exist? if not, supposing the exist of DDH Oracle will mean nothing.  Or in other words, in the real word this Oracle is hard to realize  then  this kind of assumption will do nothing(this is only my personal thought)

A practical example
Next i want to use an example to illustrate my confusions.This protocol comes from here

The writer just say that  $\mathbb{G}=\langle g \rangle$(a cyclic group of order $q$) on which DDH problem can be efficiently solved. i guess that $q$ is prime. And i'm not sure whether the "on which DDH problem can be efficiently solved" refer to the method of  quadratic residue above. if so, there are many occasions that the DDH() cannot give a right answer. so i think the "on which DDH problem can be efficiently solved" does not have much meaning. i don't know if there exist other way to efficiently solve DDH problem, i really think that the DDH() cannot fully guarantee the answer's correctness in this example.
so who can help to clear these confusions?


texts: Reducing the output of AES MixColumns to one byte per entry

texts:
I am attempting to manually step through the AES algorithm. I have reached the MixColumns step, and am working with the following values:

30 CA 96 24
32 92 09 23
3F CA 43 63
7D 5A F8 96

My output for the first "row" (multiplying the first row of the constant matrix by each of the four columns in the matrix shown above, which was the output from the ShiftRows step) is as follows:

B4 B2 97 D4

With the following logic:

60 X 96 X 3F X 7D = B4
194 x 1B6 X CA X 5A = B2
12C X 1B X 43 X F8 = 18C (MOD 11B) = 97
48 X 69 X 63 X 96 = D4

For the second cell of the second row, I have the following logic: (01 X CA) X (02 X 92) X (03 X CA) X (01 X 5A), with X used here as a symbol denoting the exclusive or operation. The above simplifies to CA X 124 X 25E X 5A, which evaluates to 3EA. 3EA is clearly too large to be a single output value for MixColumns, which outputs a byte array. Thus, we must reduce it, as 18C above, by taking it MOD 11B. However, 3EA (MOD 11B) evaluates to 2F1, which is still too large.

What is the procedure to be used in further reducing 3EA to a valid output byte for the AES MixColumns function?


texts:
Given two CSPRNGs $A$ and $B$ (of possibly the same family/algorithm), where $A$ is properly seeded from a high-entropy source, can $A$ be used to seed $B$ without compromising the security of either? Moreover, could a tree of such CSPRNGs rooted at $A$ be formed such that all generators can be used independently without revealing information about any other?
My loose attempt at proving this claim uses properties/assumptions gathered from here, here, and here:

Let $A$ be the root of a tree of CSPRNGs, each seeded by its parent. Assume that given the states of a subset of the non-root CSPRNGs, one can learn some secret property of one of the other non-root CSPRNGs not in the set.
Let $A'$ be an unknown source of randomness. By constructing a similar tree from its output and knowing the states of all non-root CSPRNGs, one can test for the above property to distinguish $A'$ from true randomness with non-negligible probability. This contradicts the indistinguishability of the CSPRNG, so it must be infeasible to find such a property.

Also (less rigorously):

Let $A$ be the root of a tree of CSPRNGs, each seeded by its parent. Assume that given the seeds and states of a subset of the non-root CSPRNGs, one can learn some secret piece of information about the root $A$. Then one can predict with non-negligible probability a bit of $A$'s past or future output other than the known seeds. This contradicts the security of the CSPRNG, so no such information can feasibly be obtained.

Together, these would mean that any CSPRNG in the tree is secure, needing only to trust the CSPRNGs in the path from it to the root.
Are these proofs and my conclusion correct for general CSPRNGs?

Note: A trivial counterexample for non-cryptographic PRNGs is the linear congruential generator, for which $A$ and $B$ would share identical states and produce identical results.


texts:
Which cascade in VeraCrypt is the safest?
(assuming same password, keyfile strength etc)
a] Serpent(Twofish(AES))
b] AES(Twofish(Serpent)

What could the difference be? I can't think of any and I don't uderstand why there are 2 options. Which one would you choose and why?


texts: Combine Sinkov score bigrams, trigrams and quadgrams

texts:
I am trying to break a special substitution cipher (where the text is divided into several columns and each column has its own substitution table). Currently I am trying hill-climbing.

For the score, I am using Sinkov, which I found at the M4 project.

The algorithm for the Sinkov score is like this (My implementation in PHP):

S = ln(f / u * e), u=MIN(f)
u is lowest non-zero frequency
f is frequency of that substring in sample text
e is base of natural logarithm.

I have created a lookup table for the Sinkov score for bigrams, trigrams and quadgrams, and I tested it with some good and bad text samples:

Sinkov bigram:

Score of good text: 106069
Score of bad text: 83450

Sinkov trigram:

Score of good text: 113648
Score of bad text: 65496

Sinkov quadgram:

Score of good text: 94478
Score of bad text: 23528

Now my problem: I see that trigrams and quadgrams are very good to find out if a text is valid English or not. However, during the hill-climb process, both will show bad results, because it is unlikely that 'good' trigram/quadgrams are found on the first try.

So I am looking for a Sinkov score algorithm, which combines bigram, trigram and quadgram together, kinda like this:

Do a hill-climb to find 'good' bigrams.
Give 'bonus-points', if there are 'good' trigrams in it.
Give 'super-bonus-points' if there are 'good' quadgrams in it.

How can I achive this? And can I achieve this in a single score-function, or do I need to modify the hill-climb process (how?)


texts: Challenge Response at Application Layer of BLE using ECDSA

texts:
There is a need for an Offline BLE device to Auth a Phone. I am planning to use challenge response somewhat outlined here.

There is a small change. Instead of shared secret. I am planning to use a Public Key and Private Key.

Basically as soon as the phone connects to ble device. Device gives a random message (at max 20 bytes). Phone reads and generates signature using deterministic ECDSA signature and sends it back to device.

Device validates the signature. Establishes the authenticity for that session.

Public Key is embedded in the device. Private key is made available to owner through user manual or qr code on the device.

Questions:

How good is deterministic ECDSA for a small random message of 20 bytes?
Any visible problems with the flow?


texts: Statistical attacks on a list of MD5/SHA-1 hashes?

texts:
I have a list of MD5 and SHA-1 hashes where the input string is of the form

secret1000
secret1001
…

all the way up to

secret2000

Are there any attacks, analytical techniques that can give me any insights on the input strings?


texts: PhD in cryptography using elliptic curves

texts:
I am currently a MSc student in number theory and considering switching to a phD in cryptography. I would like to use number theory techniques. (i.e. RSA, elliptic curves, etc).

The purpose of all of this is to find a job outside of academia. I would like to find a job in the industry.  Here is my worry: in 10-20 years quantum computers will be able to "solve" these problems. Hence, number theory will become useless in cryptography.

Knowing this, will I be able to find a job in the industry in, say, 5 years?
My thought is that I will eventually have to adapt but so will everyone else. Will this be a problem for my career?

Kind regards.


texts: Does BouncyCastle (for ECC) resist timing attacks?

texts:
I need to extend the TLS protocol to be able to use other key exchange scheme based on elliptic curves. I am planning to use BouncyCastle's implementation in Java and in .NET.

I am worring about timing attacks against the ECC key exchange scheme. Is BouncyCastle prone to timing attacks? Is there a way to use it to implement operations in data-independent time?


texts: How to factorize the group order in Pohlig-Hellman algorithm

texts:
The Pohlig-Hellman algorithm is for computing discrete logarithms in a group whose order is a smooth integer.
This algorithm requires the factorization of the group order. However we know that factorization of big number is a hard problem. So how could Pohlig-Hellman be an effective algorithm?


texts: Shamir Secret Sharing data limitations per share?

texts:
Do “Shamir Secret Sharing” schemes have a limitation for the amount of data that can be split up between each share, or a maximum number of data that can be shared within one secret?

I believe there is a relationship between the maximum data that can be shared the prime and the number of shares, or am I mistaken?


texts: Decrypting a message encrypted twice with RSA but with same n


texts: gpg --gen-random quality level: is higher "better"?

texts:
The GNU Privacy Guard manual pages have this to say about using the gpg --gen-random 0|1|2 count command:

  Emit count random bytes of the given quality level 0, 1 or 2. If count is not given or zero, an endless sequence of random bytes will be emitted. If used with --armor the output will be base64 encoded. PLEASE, don’t use this command unless you know what you are doing; it may remove precious entropy from the system!

I am wondering what the "quality level" means.  Is 2 "better" (i.e. more random) than 0? How much "more random" is one level over another?

BACKGROUND:
I came across this command in an article in Linux Journal that illustrated using gpg's --gen-random command to generate a random password. I want to have as random of a password as possible, so I want to know what "quality level" is best for this purpose.


texts: Applicability of physical unclonable functions for public-key cryptography

texts:
Can physical unclonable functions (PUFs) be used to protect secrets against physical tampering in the context of public-key cryptography?

Some solutions (i.e. ChipDNA or QuiddiKey) apparently use PUFs to protect their private key that are used to perform ECDSA. Some MIT slides about Physical Unclonable Functions and Applications mention private/public keys, implying that this is possible.

From my basic understanding of PUFs, a database of challenge-response pairs is created during manufacturing and we can authenticate a chip when it provides the correct response(s) to challenge(s) as long as challenges are not reused. How is the PUF "fingerprint" derived to a secret key?


texts: AMD's implementation of RDRAND instruction

texts:
The latest AMD programmer manuals, dated June 2015, include the RDRAND instruction in the instruction set. For completeness, it lacks RDSEED. Confer, AMD64 Architecture Programmer’s Manual Volume 3: General-Purpose and System Instructions, page 278.

The description includes the text:

  Loads the destination register with a hardware-generated random value.

I'm having trouble finding information on AMD's circuit and other design/implementation details. I'm not getting specific hits when searching AMD's site, and a general web search is returning a lot of noise dominated by Intel (not Intel's fault, its just the way it is).

What is known about AMD's circuit?

Based on @Richie comments (it was a good lead): according to NIST's Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules, AMD does not have an approved module. Additionally, according to NIST's Modules In Process, AMD does not have something in evaluation.


texts: Reason for squaring and not arbitrary exponentiation in Wesolowski and Pietrzak verifiable delay functions (VDFs)

texts:
I'm working at understanding the Wesolowski and Pietrzak RSA group based VDFs (verifiable delay functions). These basically work by requiring the prover to do a bunch of repeated squaring within a semiprime group G of unknown order, and then computing a proof that a verifier can check without having to do the time consuming work of repeated squaring mod G. These can be used for proof of work, trustworthy randomness beacons, spam prevention, etc.
I'm curious as to why both rely on computing (g^(2^t) mod G) as the work to be done rather than just computing g to the power of some arbitrary huge exponent mod G. (The huge exponent could be generated by e.g. running a CSPRNG seeded by a known input.) In this case you could compute a proof of exponentiation for g^bignum mod G and supply that to the verifier.
Does the use of repeated squaring rather than some arbitrary exponent have any cryptographic significance? Is it just simpler? Just curious so I can understand why these choices were made.
Also curious about the generator (g). Any reason it needs to be a particular number, or should it just be something like 3? Maybe I didn't catch it but I didn't see that discussed.


texts: Best way to encrypt lots of private keys with the same passphrase

texts:
I'm working on software which deals with lots (several millions) of RSA private keys. Keysize is 2048.

I have to store them in a database, and I want them to be encrypted to mitigate risks of compromise from hostile access to the database. Naturally, applying a passphrase with PKCS #8 comes to mind.

I can't have a separate passphrase for each key because I can't store them securely. I can only store several passphrases in a secure vault.

But now I suspect that it's not safe to apply the same passphrase to millions of private keys with PKCS #8.

Could you please:

Confirm or refute my assumption that using the same passphrase to encrypt millions of keys with PKCS #8 significantly weakens encryption strength. If Eve gets enough encrypted keys, can she decrypt them knowing that an identical passphrase was applied? A kind of "many times pad" attack?
Suggest a better encryption method which uses the same passphrase (or a limited number of them).


texts: Can an encryption key be inferred by knowing the plaintext and the corresponding ciphertext?

texts: Thinking about validation methods for guaranteeing a proper key is used. Will keeping a dummy plaintext value and its corresponding ciphertext in plaintext code expose any risk?


texts: Is the concatenation of two one-way functions a one-way function?

texts: Suppose we are given two one way functions $f$ and $g$. We define a new function h that is the concatenation of f and g. That is, $h(x)=f(x), g(x)$, where the comma indicates concatenation. We want to figure out whether this is a one way function or not. My teacher tells me this is not true generally. I know it is true if $f=g$, but otherwise I am clueless. I'd love some help.


texts: Would it be secure to use random numbers from random.org in a cryptographic solution?

texts:
Random.org provides true random numbers through an unsecured web service. Since these numbers would be transmitted in plaintext could they still be considered useful as true random numbers while maintaining security in a cryptographic solution?

At first I was thinking if a large pool of them was obtained then a small subset of them could be used randomly to make the fact they are known of less use. Then I realized that no matter how many random numbers were obtained this way, it would still be a smaller number set to explore in attempting to crack the cryptography.

Update: Random.org supports SSL over HTTPS, but are not encouraged for use in cryptography.


texts: Why are MACs in general deterministic, whereas digital signature constructions are randomized?

texts:
The fact is I'm not quite sure if my question statement is true, however all the MAC constructions I know of (e.g. CBC-MAC, CMAC, HMAC) are deterministic, whereas many constructions for digital signature are randomized (e.g. DSA, ECDSA, RSASSA-PSS). I also know that RSASSA-PKCS1.5 is deterministic but still considered secure (though not recommended in favor of RSASSA-PSS).

Why is it the case that most MACs are deterministic whereas most digital signature schemes are randomized? Are there randomized MACs that I simply don't know about, and do they provide any advantages over the deterministic approach? Is there some fundamental difference between MACs and digital signatures that makes the randomization more desirable (but still not required) for signatures?
Are there randomized constructions for MACs or digital signatures that breaks badly if the randomizer output is not indistinguishable from random, or do they all simply reduce to a still secure deterministic scheme?


texts: How does TLS generate the shared secret?

texts:
From many readings, I got to know that TLS generates master shared secrets using pre-master keys and uses the DH algorithm to generate the shared secret/Master secret.

What values during the hello messages act as

1. P - Prime number

2. G - Generator

3. Secret primes owned by each parties
?

Why does it need a client-server random number along with the pre-master secret to generate the master secret as DH requires only p, q and (a,b) are generated on each side?


texts: Is BBS+ 1. a multi-messages signing protocol or 2. a group signature signed by a member of a group anonymously?

texts:
There's no doubt that the BBS Signature was born from this classic Short Group Signature paper in 2004. It's capable of Zero-knowledge.
In the paper, section 5, it describes how a member of a group, can sign a message, without revealing which member signed it. But, this group signature can be verified that it was signed by a member of a group (anonymously) through a group public key $gpk$.
However, later, there are some works improving BBS into BBS+. It was first modified and named in Constant-Size Dynamic k-TAA by Au et al. BBS+ was touched again in Anonymous Attestation Using the Strong Diffie Hellman Assumption Revisited. Nevertheless, in those two papers mentioned above, it seems the BBS+ scheme is a multi-messages signing protocol. It takes messages $m_1, m_2, m_3,..., m_L$ and produces a single signature $\sigma$.
It can create a proof of knowledge $SPK$ on top of signature $\sigma$, with some messages $m_i$ revealed.
Yet, in work on Enhanced Privacy ID from Bilinear Pairing by intel, it seems their BBS+ scheme becomes as a member of a group signing the message anonymously, same as Short Group Signature paper in 2004.
Therefore, I'm confused about BBS+ protocol. Whether it is

a multi-message $m_1, m_2, m_3,..., m_L$ signing protocol producing a single signature $\sigma$ with signature proof of knowledge $SPK$

or

a group signature signed by a member of a group anonymously using a group public key $gpk$?


texts: Why all multivariate schemes restrict themselves to polynomials of degree 2

texts:
If we note all multivariate schemes restrict themselves
to polynomials of degree 2.
I was wondering why they do it. After looking on the internet, I came to know that they do it for the efficiency.
My question is how working with degree 2 is more efficient?


texts: Where are labels of a Labeled data used in homomorphic message authenticator stored?

texts:
In a fully homomorphic message authenticator, Alice can authenticate
some large data $D$ using her secret key $s$k. She chooses a label $\tau$ for it, and the authentication algorithm authenticates the data $D$ with respect to the label $\tau$.

But, how and where are these labels stored?


texts: What does the running transcript hash in RFC-8446: TLS 1.3 do?

texts:
From RFC8446:
In general, implementations can implement the transcript by keeping a
running transcript hash value based on the negotiated hash.  Note,
however, that subsequent post-handshake authentications do not
include each other, just the messages through the end of the main
handshake.
Could someone explain what it means by by keeping a
running transcript hash value ?
I want to implement TLS1.3 on a microcontroller where RAM is limited. For example if I have to calculate HMAC of a message 1000 bytes long, is it possible to calculate first a HMAC of first half of the message, delete the fist half of the message and calculate the final HMAC from the first HMAC and the remaining half of the message ?


texts: Is the RSA cipher alike to the Shift/Caesar cipher?

texts:
I'm sort of a beginner on cryptography so this is probably a really elementary question. I only know the historic ciphers and the general background on cryptography as well as it's general meaning. I'm just starting to dive into modern ciphers like RSA and DES.

When looking at RSA, aside from using different keys for encryption and decryption, it seemed to me that the encryption process is sort of like a substitution cipher or better the shift or caesar's cipher (since this one does some kind of math at least), and that it operates on the characters' Unicode or ASCII instead.

Is there any way in which I'm correct or is there any way that the RSA could be sort of like a shift cipher that operates on the coded text instead of the normal one? I'm probably not correct so if so could you tell me the ways by which it makes it different or unique? Thanks in advance!


texts: Why for achieving the fairness, less than a half of the parties should be corrupted? ($t<m/2$, where $t$ is the number of corrupted parties and $m$ is the total number of the involved parties). How should I prove it? In what kind of network this proposition holds? (Broadcast or peer to peer network)


texts: Information sharing using interactive zero-knowledge system

texts:
I am trying to build a system that would allow information sharing in a kind of zero-knowledge way. Here is the set up:

Let's say there is a trusted third party that has Alice's sensitive info M (e.g. date of birth). This 3rd party encrypts M, so C = E(M, a) where a is a secret key. After that, the 3rd party makes C public (e.g.publishes on their website). Also, the 3rd party shares a with Alice.
Alice would like to give her DOB to Bob, but in such a way that Bob would not be able to give her DOB to anyone else.

This can be achieved using an interactive zero-knowledge system that would work like so:

Assume E is an encryption function and U is a decryption function, such that:

C = E(M, a), where a is a secret key
X = E(C, b), where b is another secret key
M = U(C, a) and C = U(X, b) - basically, the keys can be used to decrypt the values they encrypted
M = U(X, ab), where ab is some way of combining both keys together so that separating ab into a and b is impractical

With this setup, Alice can generate a random key b1 and compute X = E(C, b1). She can then give X to Bob, who in turn would ask Alice to reveal one of the following:

b1 - this would allow Bob to verify that X was derived from C because C = U(X, b1)
ab1 - this would give Bob Alice's DOB because M = U(X, ab1)

They repeat this process but now with new secret keys b2, b3 ... bn until Bob is satisfied with the level of confidence. At the end, Bob will know Alice's DOB, but he wouldn't be able to prove to anyone that this is in fact her DOB.

My Questions are:

Is there a better way to share info between Alice and Bob in such a way that Bob can be sure he has Alice's correct DOB, but he wouldn't be able to prove it to anyone else?
If this is the best way, what is the right encryption/decryption function to use so that you can combine 2 keys together in the way described above?


texts:
Let be $m \in \{0,1\}^{l}$ and $r \in \{0,1\}^{|N|-l-1}$.
I have seen that $m||r$ (where || means the concatenation of the bits) can be seen like an integer, I think using a Big-Endian Convention, and this integer is $m + 2^{l}r$.
The question is why?
What is the way to convert the bits-string $m||r$ to the integer $2^l r$.
I have to understand this because, it is useful to  solve some exercises.

Thank you.