texts: Does displaying HMAC hashes of user inputs compromise the HMAC validation?

texts:
Here is the scenario:

"SECRET" is a secret key that is kept private and only used in this one application.
The application allows users to enter in any "VALUE" (within various open-ended limits such as numeric > 50, max length 20, etc... depending on the field)
The application creates an HMAC-SHA2-256 "HASH" from VALUE and its field name using SECRET as the key
HASH is displayed to the user

"CONTROL" (comparison) scenario:

Only a certain number of field VALUEs and their corresponding HASHes are shown to users
Users cannot input additional VALUEs to see the corresponding HASHes

Other information:

The HASHes are used to prevent the VALUEs from being changed while being sent to a third party application.
If a user tries a HASH with a corresponding field name and VALUE, either it works or an error message comes up.
There are no limits or precautions against automated testing other than network speed.

Real-life application (not necessary for the question):

The hashes are used as an easy (==low cost) alternative to IPN validation for products sent to FoxyCart, a Javascript-powered secure checkout.
The hashes prevent a user from spoofing exact values but cannot handle complex conditions such as minimum and maximum values of a user-chosen option. For such situations, FoxyCart provides a special hash value that disables validation of that field.
The easy solution would be to validate the user input on the server and hash it before forwarding it to FoxyCart.

Questions:

Does allowing users to test VALUEs increase the likelihood that SECRET will be broken or illegal hashed values generated, relative to the CONTROL scenario?
By how much?
How is this calculated or proved?


texts: How does the key size in supersingular isogeny schemes relate to their security level?

texts:
I'm looking at the De Feo, Jao, and Plût 2014 paper:

Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies.

My understanding of section 3.2 Key Exchange, is that Alice's private key is the isogeny $\phi_A : E \rightarrow E_A$, which can be represented by 2 integers; private key: $(m_A, n_A)$.

Her public key consists of the curve $E_A$, represented by the polynomials $a,b$ from its Weierstrass equation $E_A: y^2 = x^3 + ax + b$, and the images of the two torsion bases $P_B, Q_B$ under her private isogeny, which appear to be 2 complex points each = 8 integers. Public key: $(E_A, \phi_A(P_B), \phi_A(Q_B) )$. So my fuzzy understanding thinks that the public key should contain around 10 - 16 pieces of information, depending on how those polynomials are represented.

In the experimental section, section 7, there's a table comparing runtimes of the key exchange algorithm for key sizes of 512 bits, 768 bits, and 1024 bits.

My question: Where do those key sizes come from? Do they ever state the bit widths of the different components of the public key, and which one(s) they are varying to change the key size? Better yet, did I miss an analysis of the relationship between the key size and the security level of the system?


texts: what does output parameters of lwe estimator stands for?

texts:
I want to use lwe estimator to find classical and quantum security of my proposed key exchange protocol. On this website, I want to understand the output of sage code on  lwe estimator given bellow.

sage: load("estimator.py")
sage: n, alpha, q = Param.Regev(128)
sage: costs = estimate_lwe(n, alpha, q)

The output is

usvp: rop:  ≈2^57.2,  red:  ≈2^57.2,  δ_0: 1.009214,  β:  101,  d:  349,  m:      220
dec: rop:  ≈2^61.5,  m:      229,  red:  ≈2^61.5,  δ_0: 1.009595,  β:   93,  d:  357,  babai:  ≈2^46.8,  babai_op:  ≈2^61.9,  repeat:      293,  ε: 0.015625
dual: rop:  ≈2^81.4,  m:      376,  red:  ≈2^81.4,  δ_0: 1.008810,  β:  111,  d:  376,  |v|:  736.521,  repeat:  ≈2^19.0,  ε: 0.003906

What is rop, red, δ_0, β, d, m stands for in the output. I search many official documentation of lwe estimator like this (they give brief description of other parameters like bop in section 7) and this. But they provide information about input parameters and algorithms used and not about the output parameters. Any help is appreciated.


texts:
The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous versions.

My question is: In practice, when do clients such as web browsers for example use TLS in PSK mode? Does the existence of a website in the browser History entails the use of PSK mode? Can you list the cases where clients will use PSK instead of exchanging fresh keys?


texts:
Does there exist an encoding/hashing/encryption scheme whereby the original string can always be derived in its entirety given the entire encoded/hashed/encrypted string, and nothing else (no key/password). But also, no portion of the original string can be derived given any portion of the encoded/hashed/encrypted string.

Basically this would be an algorithm that deterministically and reversibly jumbles up a string in such a way that the reversal algorithm requires the entire jumbled string.

Does such a thing exist? If so, what search terms should I use to learn more about it? I don't know enough about the subject to know the right words to find more information.


texts: Does the DES s-box only provide confusion, or does it also provide an avalanche effect?

texts: In DES, does the s-box provide an avalanche effect or does it only provide confusion in the ciphertext?


texts: Deriving Minimum Description Length of Substitution Key

texts:
Given a plaintext:

  Now is the time for all good men to come to the aid of their country
  because the quick brown fox jumped over the lazy dog.

and a substitution ciphertext:

  Mpe od yjr yo,r gpt s;; hppf ,rm yp vp,r yp yjr sof pg yjrot vpimytu
  nrvsidr yjr wiovl ntpem gpc ki,[rf pbrt yjr ;sxu fph/

It is trivial to come up with the substitution cipher.  However, in this case, the minimum description length of the substitution cipher is not to simply pair each character with its bijection, but rather to describe the QWERTY keyboard layout parameterized with "shift your fingers right one place".

In this case, the "key" contains a 2D structure -- the QWERTY keyboard layout.

Are there general mathematical theorems capable of extracting such hidden structure?


texts: What is the maximum key size for a 128 bit AES?

texts:
What is the maximum key size for AES 128,
Will using a key greater than maximum gives extra security or error? Is there a minimum key size?

Suppose a key is 128 bit, does it means The key is of length 16characters

Suggest me a good password to key function.


texts: Can a digital signature scheme also be an encryption scheme?

texts:
Using Schnorr signatures, one could devise a system where a single public key can represent multiple signers. Do signature schemes like that represent crypto systems usable for encryption?

In that case, could you say that a signature scheme and an encryption scheme represent the same thing?


texts: The interaction between the malicious Adversary and the Simulator and Real-Ideal' views

texts:
This example is from “Efficient Secure Two-Party Protocols-Carmit Hazay-Yehuda Lindell”.

And the security proof of the above example is this:

I have drawn a picture that is deduced from the above security proof.

Picture1:

[

Picture 2:

I have several questions:

Please, explain to me how the simulator and the adversary interact with each other? I mean what kind of requests can the simulator send to the adversary and vice versa. (what kind of requests can the adversary send to the simulator).
According to the security proof and the picture 1, why does the simulator get input x from the adversary and not from corrupted P1?
Should simulator trust the adversary? I mean is it possible that the adversary, in picture 1, modifies input x, deliberately, and then give it to the simulator? If yes, how will the simulator figure out this modification?
Would you please explain to me what is the real view for P1 and P2 in both pictures? Please explain to me what must the simulator simulate in picture 1 and picture 2?

Page 24:

According to the above definition 2.3.1 and the description on page 24, I think the answer is like this:

Case1: When P1 is corrupted: real view of P1 is (x) and real view of P2 is (x, y, x ^ y)
And simulator must simulate P1’s view and P2’s output.

Case2: When P2 is corrupted: real view of P1 is (x) and real view of P2 is (x, y, x ^ y)
And simulator must simulate P2’s view and P1’s output.

If my answers are not correct, please correct them.


texts: About Primitive roots mod n in Diffie-Hellman

texts:
I'm on the study of Diffie-Hellman and its related math (multiplicative group of integers $\mod n$).

In some crypto papers and documents I've read that $g$ needs to be a primitive root mod $n$ ($g$ order in $G = \phi(p)$), but we actually use $g$ as a generator of a large subgroup of order $q$, where $q$ is a large prime extracted from $(n-1)/2$ ($p$ is a safe prime). So $g$ isn't a primitive root modulo $n$, because $g$ doesn't generate the entire group of $n-1$ but generates a subgroup of length $q$.

I understand that if a prime number (say 'x') divides the group's order then a generator exists whose order in G is 'x'. This is the current schema in the implementations of Diffie-Hellman (like I said before).

Example: $q = 1349363$; $p=2q+1=2698727$. So $\phi(p) = p-1$, $q|p-1$ so a generator $g$ exists whose order in $G$ is $q$.

And here's my opinion: I think this is used because doing modular exponentiation on big generators is slow, so we can use $2$ as a generator. It will generate a lower subgroup of elements, but if $q$ is big enough, it will increase the math performance without being insecure. Correct me if I'm wrong.

But I wish to clear the following doubts:

Why is not recommended to use a primitive root mod $n$ in Diffie-Hellman?
Why do some crypto papers say that a primitive root modulo $n$ is needed?

According to For Diffie-Hellman, must g be a generator?
So a primitive root modulo $n$ (or a true generator) isn't chosen because its order in $G$ is composite. Thus it reveals information about the private exponent. Instead, a generator of a subgroup of order $q$ (factor of |G|) is used, where $q$ is prime and large enough. Is this correct?


texts: What is the quickest calculation to check if a number, a, is a primitive root modulo P, a prime?

texts: Trying to find a quick calculation to check if my value is primitive rather than working out every a^n (modP) for n= 1 to p-1?


texts: *feasible* pre-image attacks against reduced SHA-1

texts:
(tldr: see last paragraph)

Although SHA-1 is vulnerable to collision attacks, it is still resistant to pre-image attacks. SHA-1 was designed to be resistant until a brute-force attack of $2^{160}$ is possible, as 160 is the block size of SHA-1.

(Round-) Reduced pre-image attacks are attacks that try to find pre-images for less than the 80 rounds. The best reduced pre-image attack against SHA-1 I could find takes $2^{159.3}$ for 57 rounds. This leads to the following:

The normal 80 rounds of SHA-1 are still fully 160-bit resistant against pre-image attacks.
This (and most other I could find in literature) reduced pre-image attacks are of a theoretical nature: They show that less rounds can be done slightly better than brute-force, but are still impossible to carry out practically.

This makes me wonder what's the status of feasible/practical attacks. For example, there's a masters thesis that cracks 23 rounds between the lines, but doesn't claim it and doesn't say anything about the state of science on this subject.

When given a 160 bit string, how many rounds have been claimed by science to feasibly find a (round-reduced) pre-image in SHA-1? Say someone could pre-image $000...000$ for x rounds and proves so by showing a pre-image, what should x be to have something worth an article?


texts: Mapping points between elliptic curves and the integers

texts:
My primary question is:

Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the order of E)?

To phrase it a second way, given a point on the curve that is chosen with uniform randomness, can you translate it into a uniformly random integer in some interval (or group)? I'm also interested in mappings that are statistically close to uniform.

(I thought of using a random extractor, but this generally requires 2m bits of min-entropy in the input to produce m bits of near-uniform randomness)

I was reminded of this question when reading the Telex paper, where they encounter this issue. Their solution is to use two specially selected curves, a curve and its twist, and only map the x-coordinate.

Secondary questions:

Using a curve and twist, is there a way to use the y-coordinate to select which curve so that the mapping is one-to-one?
If there is an approach, does it also work with pairing-friendly curves?


texts: How blockchain system manages it's memory limit for nodes?

texts: As we know, in the blockchain system every node has historical data that contains all previous transactions to maintain the integrity and approve the future transaction. What if blockchain is implemented in everyday life and people makes billions of transaction in a day, then a node must run out of memory sooner or later. How this is maintained or designed?


texts: Is it possible to deduce the value of a string when given its hash and multiples hashes of the string + other known strings?

texts: To be clear, I have access to $H(S)$ and as many $H(S||K)$ as I want. Every string $K$ is known. Can I use the extra information to my advantage and try to deduce $S$, without requiring bruteforce? Or do you still have to bruteforce but try less combinations since you have more information?


texts: Do practical blind signature schemes make compromises?

texts:
I am fascinated by the idea of blind signatures and their applications introduced by David Chaum for electronic cash and voting and his provided analogy with carbon copy is quite compelling. However looking into some schemes, as one in Wikipedia, I see that in contrast to an ordinary cryptographic signature scheme where the hash of a message is signed in blind signature schemes message is signed directly as provided by the user. Is it a security issue for such schemes?
For example, let's consider a transparent setup where blind signatures are published in one list (together with identities in the roster) and their decryptions into another one in randomized order. Additionally, an adversary has access to unlimited queries (for example, through a coalition) as he wishes. Would that allow an adversary to either unblind the signatures, forge them or even extract signers key?


texts: Is CLEFIA block cipher really lightweight?

texts:
CLEFIA is ISO/IEC 29192-2 standard in lightweight cryptography. According to this, the total GE area (I took the minimum) using .13 um is 2,488 (encryption mode) compared to piccolo-128 with GE area of 1,776  (encryption mode) and others lightweight block ciphers  . (reference).

On the software side, CLEFIA consumes large memory (2 8-bits boxes and 2 MDS matrix), it cannot be implemented using 512 bytes (ROM) or 64 bytes (RAM). It  is implemented minimally with a ROM size of 800 bytes compared to Present (164 bytes) LED(298 bytes), Prince (424 bytes), Piccolo (275 bytes) , TWINE(232 bytes)  and others such as  SIMON and SPECK .(reference)

In term of performance, figure 1 shows the speed of ciphers with 1024-byte ROM and 128-byte RAM, I see that piccolo lower number of cycles/block compared to CLEFIA in addition , this reference shows that Piccolo-128 with Encryption has GE area of 1776 produces throughput of 193.9 Kbps (@100kHz) compared to CLEFIA-128 has GE area of 2488 produces throughput of 39 9 Kbps (@100kHz). Piccolo looks has better advantages. (reference)

In term of security , CLEFIA uses  128, 192 ,256 bit keys compared to the rest lightweight block ciphers which they use 64 and 128 bit keys.

Another point is during my literature, I do not see CLEFIA is included in comparisons with other lightweight ciphers (Triathlon of Lightweight Block Ciphers for the Internet of Things). This triggered my question: How did CLEFIA got standardized as lightweight block-cipher?


texts:
The Trivium encryption algorithm has two inputs, key and IV, both of which are 80 bits long. Let's call it Trivium(key, IV) → keystream. My question is whether doing Trivium(key, input) and taking the first 80 bit of keystream would result in a secure PRF.

I have found another way to create a PRF from a stream cipher, but that seems to be for stream ciphers that do not have an IV input, so such a complex construction might not be needed for one that does. Based on reading the Trivium algorithm description paper and the Trivium design paper I feel like my construction should be secure but I have no idea how to go around proving it.

This question was spurred by wondering whether I could implement authenticated encryption using only Trivium as a primitive. If I could turn it into a PRF, as far as I understand I could construct something similar to CBC-MAC from it. (Of course this doesn't make much sense to because rekeying the cipher, which you'd need to do for every 8 bytes, is quite slow.)


texts: What is the translation for "hash" in french?

texts: I am doing a French presentation on basic cryptography, and the generation of random numbers. Most terms are easily translatable, but I can't seem to find a word for hash, as in cryptographic hashing, in french. The closest I can come up with is gâchis, which means "mess" or "failure.


texts:
I am studying about blockchain and have been focusing on encryption protocols that allow authentication. The digital signature of public and private key seems solid, I have focused on the algorithm ED25519.

But in some places, some people say about not exposing the public key because through the public key and signature it would be possible to derive the private key. Some say that quantum computers will easily accomplish this task.

At first, I thought the reason for the bitcoin addresses was to make the public key "human-readable." But I see that there are some security points having a public key hash.

So I have some doubts:

Is it really a risk of exposing the public key without any treatment?
If so, what are the alternatives?
How does bitcoin, for example, validate the transaction signature with a public key hash and not the public key itself? (After all, it would be "impossible" to reverse a sha256 hash to its origin)


texts: How to encrypt a vector $e\in Z^{m}$ using LWE

texts:
I have a vector $e \in Z^{m}$, now I want to encrypt it by using LWE (Learning With Errors).

Because in LWE, we have to encrypt of a bit $\{0,1\}$. How can I encrypt a vector $e \in Z^{m}$?


texts: Calculating equivalent substitutions to AES operations(MixColumn/ ARK)

texts:
When the AES algorithm is implemented in a table lookup(SubByte, MixColumn) fashion, how many substitutions required in full round encryption?
When AES is encrypted without using the table lookup(only SubByte is table lookup) how many substitutions are required for the same encryption?
Also, is there any mechanism to calculate the equivalent substitution operation required when it is not implemented using table lookup? This is same saying that if there is any way to tell the n numbers of substitutions is equivalent to one MixColumn/ ShiftRow/ ARK operation?


texts:
There seems to be a distinct lack of implementations of RSA signatures using OAEP to pad the digest. Other than the old, funky, padding schemes, it's PSS all the way.

PSS seems to have the whiff of patents about it. OAEP, on the other hand, is accompanied by long diversions about its theoretical safety presented as claim and counterclaim.

Is it, in principle, very wrong to use OAEP with RSA for signatures? How wrong? As bad as those first generation padding schemes? Has the stench of patents lifted from PSS? If there's one thing more confusing than the underlying maths, it's the organisation of crypto standards: is this combination actually rather common, detailed well in a PKCS or RFC, and I've just missed it?


texts: difference between the uniform and non-uniform probabilistic polynomial algorithms (ppt)

texts:
I am reading the book "Efficient Secure Two-Party Protocol". A question came to my mind. why has the author used a probabilistic polynomial time algorithm for security definition of ideal/real model in the semi-honest model, but used a non-uniform probabilistic polynomial time algorithm in the malicious model?
Thanks for considering my question.


texts: The dth root unity in the Pollard Rho Algorithm

texts:
In the original paper of Pollard's Monte Carlo Methods for Index Computation (mod p):

When the epact is reached, i.e. $$x_i = x_{2i}.$$ then the following equation is formed
 $$q^m \equiv r^n \pmod p,$$ where where $m=a_e- a_{2e} \pmod{p - 1}$ and $n = b_{2e} - b_e \pmod{p - 1}$.

with ext-GCD, the Bézout's identity calculated  $d = \lambda m + \mu (p - 1).$ Raising the above eqution to the $\lambda$ power gives
$$q^d \equiv r^{\lambda n} \pmod{p}$$

After this, it is claimed that $\lambda n$ is of the form $dk$ and then

$$q \equiv r^k \theta^i
 \pmod p,$$ where $\theta \equiv r^{(p-1)/2}$ is a $d$ root of unity, and $i (0 \leq u \leq d-1)$ remains to be determined.

Questions:

Why $\lambda n$ is of the form $dk$
In Wikipedia's sample code for Pollard's Rho algorithm, there is no such determination of $i$ (note that the $i$ in the article is not the counter of the code). Why is this so?


texts: Is it possible to prevent length extension attacks without using any other hash algorithm than SHA-1?


texts:
I'm pretty new to all of this and I apologize in advance if (as, I'm sure it has) this question has been asked and answered a million times previous, but I couldn't find anything through searching (which might speak to my less than ideal google-fu).

I understand intuitively that the Vigenere cipher is insecure because the fact that the keyword is shorter than the plaintext will inevitably lead to repeated patterns and that probabilistically you can then crack the whole thing. Then, using Shannon's theorem, we know that the KEY must be at least just as long as the PLAINTEXT and therefore key-sharing gains us nothing.

But, what would be the problem with sharing some resource as our keyword. Like for instance, what if we agreed that our keyword would be Moby Dick? Then, we only need to share the TITLE of the book and then we have access to something that could be longer than the plaintext? Or, even more secure, what if we pick a de dicto key - something that picks out a changing element. For instance, if we choose "The Leftmost Column of the NY Times" - that changes on a day-to-day basis, but is always going to be secure?

I'm just a bystander curious about what he's missing and/or misunderstanding. Thanks.


texts: AES-CBC ciphertext manipulation with known IV and plaintext!

texts:
I'm currently practicing on a purposely flawed login page, where I have to change the value of a cookie to enter. The cookie is an encrypted and encoded form of a simple JSON string with fields "admin", "username", "password". The admin field is set to 0, and the user/pass fields accepts anything. To login, I have to change this ciphertext such that the admin field is set to 1 when decrypted.

The encryption function works like this:

A raw string is padded, then encrypted with AES-CBC and a random IV.
Then, this cipher text appends the IV (concatenation; IV+cipher).
Then, this is Base64 encoded, and returned.

So, to decrypt, we simply decode it with Base64, and split the result so that the 16 first characters are the IV, and the remaining is the ciphertext.

Now, I want to know the ciphertext when one character of the plaintext is changed.

Specifically, in my example:

The following string is encrypted, appended to the IV, and encoded:

{"admin": 0, "username": "admin", "password": "admin"}

This apparently results in the encoded text (found in cookie):

yMqlNejXMclgcU5+wbL40RY/mvIMW+AvguoMvCv0NemhRYzWzs7EQ2DXpvwsGmFynGpNWNyotYBea+P3Z3XZIvMBoMzdMVb/FtWQ+GV/MmA=

I'd like to know what this encoded text / cookie looks like if the plaintext is changed to {"admin": 1, "username": "admin", "password": "admin"} (note, the 0 changed to 1). The username and password can be anything, only the "admin": 1 part is important.

It appears the key is fixed, but the IV is generated at random every time I try to logout and login again.

Is this possible? If so, how?

Thanks!


texts: How are the four 8-bit permutation tables of Present cipher calculated?


texts: Using related pair of cryptographic keys to open/seal plaintext

texts:
I am using curve25519xsalsa20poly1305/fn.seal from sodiumoxide crate written in Rust language which is a wrapper over libsodium c library and that function calls crypto_box_curve25519xsalsa20poly1305 in libsodium library.

The rust code would look something like this:

let (pub_key, sec_key) = ::sodiumoxide::crypto::box_::gen_keypair();
let nonce = ::sodiumoxide::crypto::box_::gen_nonce();

let data = vec![0; 10]; // plain-text

// Cipher-text
let encrypted = ::sodiumoxide::crypto::box_::seal(&data,
                                                  &nonce,
                                                  &pub_key,
                                                  &sec_key);

println!("Encrypted: {:?}", encrypted);
assert!(data != encrypted);

How much is it a security concern if i use a related key-pair (Public, Secret Key pair) generated through crypto_box_curve25519xsalsa20poly1305_keypair in calling that function?

Will this be regarded as a potential weakness, given that only I intend to encrypt and decrypt it? I know it is better to use symmetric encryption in this case but just for learning purposes – what is the security risk ?


texts:
I have just gone through Feldman-Micali, Dolev-Strong, KatzKoo (basically, most of the literature behind Byzantine agreement), however all of their protocols take a really incredible amount of rounds.

Just now, I read about PBFT from CastroLiskov and I realize that they are making a byzantine consensus that just happens in three phases.

Can someone explain why these two line of work diverge so much?
Are they tackling the same problem of agreement?
Could we not use the construction from CastroLiskov to make byzantine agreement?


texts: Decrypting ciphertext produced by the Trivium stream cipher

texts: Given a message that is encrypted using a Trivium and the key that was used to encrypt it, how does the receiver decrypt the message?


texts: RSA How to select a value K such that $e d = 1 + k \varphi(N)$ holds

texts:
I am learning RSA cryptography. The part I am stuck on is understanding how k and the public exponent $e$ is selected.

Given the formulas;

Decrypting: $c^d \bmod N = (m^e)^d \bmod N$
Which is equal to m the message

Encrypting:
$m^e \bmod N = c$

My question is when generating the private exponent how do we find what the public exponent should be and what k should be in the formula

$$d = (1 + k*\varphi(N))/e$$

I understand it has something to do with the inverse of modules but I don
t get the math behind it.


texts: How should k2 be produced in the RC4A stream cipher (A modification of RC4)?

texts:
RC4A is a slight modification of the simple RC4 stream cipher designed to strengthen it against a number of attacks. Here's that paper.

However in the paper, the second key k2 is only mentioned twice and provides only a loose description of what it should be:

  We take one randomly chosen key k1.
  Another key k2 is also generated from a pseudorandom bit generator (e.g. RC4) using k1 as the seed.
  Applying the Key Scheduling Algorithm, as described in Fig. 1, we construct two S-boxes S1
  and S2 using the keys k1 and k2 respectively.

The main thing here is that k2 is "generated from a pseudorandom bit generator (e.g. RC4) using k1 as the seed", and S1 and S2 are constructed "using the keys k1 and k2 respectively".

In source code implementations of RC4A I have come across two different ways of handling S2, none of which use a PRBG to produce k2. This results in different output for the same input:

S-boxes S1 and S2 are exactly the same (using k1 for both).
All 256 values of S-box S1 constitute the key k2 for S2.

In a cryptography course, it is suggested to use a "nonce" for k2, which has the same length of k1 but doesn't explain how it is calculated from k1 as a seed (which is understood to be how k2 is produced).

Finally, another article appears to show that k2 is produced by feeding a number of bytes from S1 into the original RC4 PRGA, producing a keystream:

  To be more specific, in KSA of RC4, the array S1 is initialized, using the secret key K.
  WK, 16 bytes of keystream, are generated from the array S1 in PRGA of RC4.
  Then, the array S2 is initialized in KSA of RC4, using WK.

I am assuming K refers to k1 and WK refers to k2 in the original article.

Related pseudo-code:

RC4_KSA(K, S1)
For i = 0 … l – 1
WK[i] = RC4_PRGA(S1)
RC4_KSA(WK, S2)

One problem with this approach is that when calculating k2, the RC4 PRGA would swap values in S1, altering it. S1 is used in the RC4A PRGA and would produce a different keystream than if it had not been altered. This can be avoided by using a second copy of S1 for RC4 PRGA, leaving the original unaltered.

So there is ambiguity in how the second key for S2 is produced, with implementations differing in output keystream for same input.

A few questions:

Do the two differing implementations in practice undermine RC4A's
security claims by not using a PRBG/PRGA to produce k2?
Does it matter what k2 is, how it's produced, or if it's the same as k1?
What is the proper way to produce k2 that all implementations should follow?

Thank you!


texts:
I have been given a 4x4 matrix and each entry is an 8-bit long byte. I have been given the 4x4 matrix that I need to multiply each column by of the first matrix by.

$$\begin{pmatrix}2 & 3 & 1 & 1\\\ 1 & 2 & 3 & 1\\ 1 & 1 & 2 & 3\\ 3 & 1 & 1 & 2\end{pmatrix}$$

The method that I have been told to use seems confusing. I have searched around the internet and found many examples with polynomials but I'm not supposed to use this method.

All I have been told is:

Multiplying by 01 does nothing
 Multiplying by 02 corresponds to multiplying the byte by 10 (because 2 is 10 in binary). This
is simply a left shift by one place. If the left-hand bit of the original byte was 1, then XOR the
answer with 100011011.
 Multiplying by 03 corresponds to multiplying the byte by 11 (because 3 is 11 in binary). This is
a left shift, followed by an XOR with the original byte. Again, if the left-hand bit of the original
byte was 1, then XOR the answer with 100011011.

I find the XOR bit strange as well - because that is a string of 9 bits and the bytes are only 8.

Can anyone make sense of this or point me in the direction of a good example?


texts: Can we bound adversarial power in terms of total entropy in universe?

texts:
The strengths of various cryptographic primitives are often explained (though not defined) in terms of how long it would take to break under the current best known attacks. For example, apparently the best known attack against AES-128 reduces it to ~126 bits of security, and that is often explained as "good enough" because even if one were to use all the world's computers together it would still take hundreds of years to break a single key. Assuming (perhaps ridiculously) for the purpose of this question that the current best known attack against some algorithm is actually the best possible attack, this still doesn't seem like quite enough because what if we develop new technologies that let us try combinations faster?

Perhaps this is a ridiculous idea, but for peace of mind it would be nice to know that no one could ever break my ciphertexts (under current best known methods). As far as I can tell, there is only one fundamental limit to the ability to "just try combinations faster," and that's Landauer's principle. According to Wikipedia, Landauer argued that the minimum possible energy required to erase one bit is $kT ln(2)$ where $T$ is the temperature in Kelvin and $k$ is the Boltzman constant. I would like to compare this to the total entropy of the observable universe. According to the linked paper, this is estimated at $\sim 10^{105}k$, although the entropy of the cosmic event horizon is bigger, estimated at $\sim 10^{122} k$, and I don't know nearly enough physics to know what that means so I'm going to use the bigger one.

So it seems, naively, like we should be able to get the total number of possible bit erasures before the universe runs out of entropy, $N$, with the simple equation $NkT ln(2) \leq 10^{122}k$ and get $N \approx 10^{122}$ (assuming that $T \approx 2.7$ due to cosmic background radiation).

Now assume that we have some hash function $H$ that is assumed to have $n$ bits of security under either classical or quantum attack. As far as I understand, this means you have to do at least as much work as running the hash function $2^n$ times. It appears that such a hash function cannot be computed with reversible computing. As such, it seems safe to assume that you must use at least one bit of entropy (or equally erase one bit of information) per run of the hash function, for a total of at least $2^n$ bits. If we let $2^n \gt N \approx 10^{122}$, we get $n \gt \sim 405$, and seem to show that under the security assumption, it is impossible to break $H$ within the life of the universe if $n$ is greater than, for good measure, 410.

So, finally, my question is this: is this analysis correct? Can we really bound entropy consumed based on the "hardness" of the cryptographic problem? (Obviously, it would be off-topic here to talk about the details of the physics behind the problem.)


texts: How are AEAD, GCM, CBC, Poly1305, EtM, MtE and E&M related?

texts:
I am using OpenSSL 1.1.1 to implement a TLS 1.3 communication module so I tried to learn how data integrity and authentication is ensured. I read a lot about AEAD, GCM, CBC, Poly1305, EtM, MtE and E&M to the point that I know what they are, but I do not know how they are related to each other. My Questions are

I know that TLS 1.3 uses AEAD. Does that mean that it is EtM, MtE or E&M?
Is GCM an EtM algorithm for block ciphers?
What does OpenSSL use by default? EtM, MtE or E&M? Which are supported?


texts: Does hashing PII in logs provide any real security?

texts:
I have PII in my logs that I would like to replace with hashes (e.g. sha3-256(salt + email)). The idea is that I can always go back to my logs and find all the log lines with that email address, by searching on the hash result of sha3-256(salt + email).
How hard would it be for folks to retrieve the original email address? I'm assuming the salt is fixed, and kept secret and the salt is >= 32 bytes.
Will this setup provide any real security if the logs are leaked?
/W


texts: Differential Privacy: What is the 'game' between data holder and adversary?

texts:
I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the 'setting' of response release.

What I don't get is, the traditional definition of Differential Privacy says that any two neighbors should be indistinguishable from each other under an event. Since this holds for any neighbors and any possible event, all the individuals in the database are 'hidden'. But, what is the setting behind this definition? For example, some potential settings may be (with counter-examples):

We let the user (adversary) send the same query about the true
database at hand (say $D$), and since we have DP, then the true
query will not be able to found by the adversary.
Counter-example: The adversary can ask the same query many times, average responses, and obtain the true query.
We give the user a single response. We also let the user know the true distribution of the additive noise. Then, he can try any possible 'candidate' database, and try to find the true database, but he will fail since the DP definition holds. Counter-example: After we send the response to the user, we should disappear and the user should try figuring out $D$ himself. This does not make any sense. Although, the most convenient mathematical definition to me is "even if the adversary knows the true noise distribution, and just one sample of our response, he won't figure out $D$"
We let the user ask a query only one time, so we never release multiple responses. Counter-example: If this is a one-time thing, then DP definition wouldn't make much sense. We can just sample a standard normal noise, and since we give  a single sample of our response, the adversary won't be able to figure out anything. So DP should be of use in a repeated setting.

I lack knowledge in database systems. I just want to learn, in what setting does the DP definition makes sense? What kind of a game is going on between the data holder and the adversary?


texts: Why Salsa20 rotates columns vertically to optimize for SIMD?

texts:
I'm writing a school assignment and I'm trying to fully grasp the differences between Salsa20 and ChaCha.

I've come to understand that by rotating upwards the initial matrix columns, DJB says that thanks to SIMD each quarter-round will run in parallel for each column, effectively running four quarter-rounds at the same time.

But if the following round has to be run on diagonals how can this be optimized for SIMDs? Will it rotate again columns to make the diagonals into rows? Will this rotation affect performance or the benefit of the SIMD beats this?


texts: Private key which becomes invalid after specific timestamp

texts:
Sorry for my dumb question, as I'm not crypto guy.

Is there any algorithm, which allows to encrypt some message with the public key, but the associated private key is only valid for specific period of time?

E.g. private key is valid till 2018/01/01, and after that date I'm unable to decrypt the message with that private key. Will it require some centralised solution?


texts: ed25519 ssh public key is always 80 characters long?

texts:
I am creating some ssh keys using ed25519, something like:

$ ssh-keygen -t ed25519
$ ssh-keygen -o -a 10 -t ed25519
$ ssh-keygen -o -a 100 -t ed25519
$ ssh-keygen -o -a 1000 -t ed25519

But I notice that the output of the public key is always the same size (80 characters):

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB8Ht8Z3j6yDWPBHQtOp/R9rjWvfMYo3MSA/K6q8D86r
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILYAIoV2OKRSh/DcM3TicD/NK/4TdqwwBPbKgFQKmGZ3
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICpuH/fqCFLbAConChyVH6rZzSaxlnHSwQk6qvtPsf5E
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICip4hl6WjuVHs60PeikVUs0sWE/kPhk2D0rRHWsIuyL

Is there an option/param like when creating RSA keys that may influence the length of the key, or by design will always be 80 (68 removing the ssh-ed25519) characters?


texts: Is there any digital watermark technology for raw text?

texts:
I have a demand to protect my data which can accessed by my client privately.
My data is not in any document but in plain text, e.g., a JSON string.
I want to protect my data against being modified, then redistributing without my permission.

I researched online for a while, and concluded that,

there are digital watermark methods for protecting images, audio, videos or documents (pdf, MS Word doc or other format),
but there is no such methods for raw text.

I want to know if there is any cryptographic way to achieve my goal?


texts: Why use variable p, q, g for Diffie-Hellman?

texts:
In the book Cryptographic Engineering, it is said that fixing p, q, g for a key negotiation protocol based on DH is a bad idea (page 228 1st ed).

But allowing for flexible p, q and g requires a lot of checks and protocol tricks (e.g. requesting a lower bound on p / q)

Why do we need this flexibility? Do we add something essential with selectable parameters?


texts:
The example of two round iterated cipher(each round is cubic function) here shows polynomial after two rounds with 9 terms.

however if we find the polynomial for two rounds, it has 22 terms

one clue i have is, the difference in number of terms may be because of underlying mathematics difference, (use of finite field in case of 9 terms, so similar terms getting cancelled out instead of being add up)

and is there some formula to just find the number of terms in expansion, like explain here


texts: AES-128 (CBC) brute force given 90+ rightmost bits of key, known IV and Ciphertext?

texts:
Given:
Known ciphertext (in hex) (ciphertext is the exact length of the message (i.e. non-padded). It is known that the cipher was developed using CBC. There is one and only one ciphertext message that was grabbed.  The exact ASCII range of the plaintext is known.

Known IV in Hex

Known partial key! (in binary) 91 bits (rightmost) of the key--meaning the first 37 bits are unknown.
This key is: XXXXXXXX.XXXXXXXX.XXXXXXXX.XXXXXXXX.XXXX1100.00000000.00000000.00000000.00000000.00000000.00000000.00000000.00000000.00000000.00000000.00000011

This should translate to 00000000_0C000000_00000000_00000003 in hex  unless I've done something wrong.  In the translation the 0's to the left of the "C" should be unknown (so F's in keymask).  The zeros between the x and the 3 are known "0s" and should be there.

Key mask to search this should be something like "FFFFFFFF_F0000000_00000000_00000000"

What would a method try to brute this? Is this even realistic?  Is there software already developed (open source) that already has the ability to plug in a known portion of a key, the cipher, and IV to try to brute without re-inventing the wheel?

As for complexity, wouldn't the complexity be something like $n^{37}$. since the other 91 of the key are known? Or is there another mathematical factor that I am missing here?


texts: Nonces being used in SSL and MAC to prevent replay attacks

texts:
I'm a bit confused in the way nonces are used in these processes to prevent replay attacks.
Heres How I think it works during SSL:

Nonces are exchanged during stage one of the handshake protocol. Nonces of the other party will be different so the keys will be different. The random numbers are used to create symmetric keys using the master_secret. Even if Eve could use the same random numbers as in the previous connection, the server will most likely not, therefore the keys will be different in the attempted replay connection.

Is that correct? I'm a bit confused how they work in MAC.


texts: Prevent a Man-In-The-Middle attack whilst transmitting a PSK for first time

texts: I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them with a pre-shared ECC key. However, how should these PSKs be transmitted in a secure way to prevent MITM attacks that change the PSKs??


texts:
How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)?
Is it possible to make libraries like BouncyCastle safe against timing-attacks?

I know that even in C it is very hard to get those things right – and in C you can take a look at the resulting assembly-code and at least predict how your target-CPU will execute it.

In JVM-languages, you don’t know how the JVM will translate your code to machine-code or which runtime-optimizations will be performed.

Edit: I’m not really worried about local timing-attacks but about remotely-exploitable ones.


texts: What is the relation between Discrete Log, Computational Diffie-Hellman and Decisional Diffie-Hellman?

texts:
How are the three problems Discrete Logarithm, Computational Diffie-Hellman and Decisional Diffie-Hellman related?

From my understanding, since the Discrete Log (DL) Problem is considered hard, then so is CDH.
And since CDH is considered hard, then so is DDH.

On the Wikipedia article for DDH it mentions that DDH is considered a stronger assumption than CDH. What does that mean?


texts: Mapping between NIST test and TRNG features

texts:
Each of the NIST tests are generally explained in Random Bit Generation - Guide to the Statistical Tests. I was wondering if some one can help me understand them better. For example, which tests show the robustness, independence, ergodicity, stationarity, etc.

Based on the description provided on NIST website, I think, the mentioned features can be understood from following tests:

robustness: cumulative sum test
independence: random binary rank test
ergodicity: Maurer's universal statistical test or linear complexity test
stationarity: cumulative sum test

I was wondering if these are correct. In addition, if other NIST tests can be summarized.


texts: How fast would a polynomial time factoring algorithm compute?

texts: I know factoring is the chief means of breaking RSA keys. I know an algorithm that runs in polynomial time would be able to break an RSA key pair "quickly". But how quickly is "quickly"? Note, I'm not talking about any quantum computing at all here.


texts: homomorphic encryption E(x+y)=E(x) . E(y)?

texts:
I'm new to cryptography and I was trying to familiarize myself with ZKsnarks .
here is an explanation on this blog : https://blog.z.cash/snark-explain/
in the middle of the page from $E(x) = g^x$  it reaches to $E(x+y)$ = $E(x) \cdot E (y)$ which doesn't sound right to me because generally we have :

$$[a \cdot b] \bmod n = [ (a \bmod n) \cdot (b \bmod n) ] \bmod n$$

there fore the equation above should be :

$$E(x+y) = [E(x) \cdot E (y)] \bmod p$$

and same goes for the multiplicative property of RSA .
could you please tell me what is it that I'm missing ?


texts: Streaming API to authenticated encryption

texts:
In regards to NaCl, I asked DJB he had any intent to add a streaming API to an authenticated cipher. His response was obvious in retrospect, that one should never release a decrypted plaintext before verifying the authenticator.

However, this got me to thinking. Streaming is important — for instance, when working with extremely large datasets. Is it possible, or even advisable, to mimic a streaming interface?

One simple approach would be to chunk the data every certain number of blocks. Once you've received enough blocks, output the IV and a complete ciphertext into the cryptostream. When you've received the next set of blocks to complete a chunk, generate a new IV and repeat. To decrypt, take the first block of the cryptostream and consider this to be the first IV. Read a full chunk, and decrypt. Output the result as the first chunk of plaintext. Repeat.

This runs all the data through an authenticated cipher and verifies the authenticator before releasing the plaintext, but it does not verify the whole ciphertext before releasing some plaintext. Is this problematic, or is it generally considered safe? Is it safe in some circumstances, depending on your particular problem? Or does it invariably introduce serious flaws?

I realize that this is well into rolling-your-own-crypto territory, and do not plan to implement this myself. That said, what's the verdict on the approach? Are there alternative solutions to the problem? Is there a general approach that one can use to safely encrypt extremely large datasets with authenticated modes, or are any solutions still highly dependent on the exact problem being solved?

Update: Hoang, Reyhanitabar, Rogaway, and Vizár published a paper which defines the "STREAM" protocol that addresses this problem.


texts: Lamport signature: How many signatures are needed to forge a signature?

texts:
Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never publish or use. Preferably she should delete them; otherwise, others gaining access to them would later be able to create false signatures.

If Lamport's signature scheme would be used incorrectly, say you would use it more than once. How many signatures of distinct messages would you need to forge a signature?

I'm thinking if you have one signature and then the "opposite" message (not really message but the message's hash sum) so every 0 in the first message is a 1 and 1 is 0. If you had those two signatures you would have everything you needed from Alice's private key.

But that's probably not realistic to think that you get exactly those two messages. Is there some general formula for how many signatures you would need?

Thanks!


texts: Diffie-Hellman: difficulty of computing $g^{x^2}$ given $g^x$?

texts:
Hoepfuly a simple question.
Given a group where the CDH problem is hard, if the adversary sees a public key $g^x$, is it easy or hard for the adversary to compute $g^{x^2}$?
My intuition says it should be hard, but I don't know for sure.


texts:
Is this encryption method sensitive to weak keys? Is there any reference in the NIST on the AES key's entropy? (For example, must it have been generated from a TRNG?)

Can I safely use the Microsoft CAPI for key generation? (pseudorandom number generation)

Am I required to use true random number generation?


texts: How Secure Is Splitting A Bitcoin Private Key?

texts:
NOTE: This question cannot be posted to Bitcoin SE because it will not render there due to the mathematical notation. Since the mathematical notation is part of the question, this is the more appropriate forum to post on, with tag 'cryptocurrency'.
I wonder how secure it is to split up a printed Bitcoin private key into parts and keep the parts in separate secure physical locations, such as safe deposit boxes, like the Winklevoss twins.
I am considering a standard Base58Check encoded compressed WIF-format Bitcoin private key of length 52, starting with a K or L.
Imagine it was cut up into 4 pieces and 3 were found. To guess the last 13 base58 characters by brute force would require $58^{13}$ operations, taking time :
$$t = t_0 \left(\frac{\Delta t}{C}\right) \hspace{1em} \mbox{(years)} $$
where $t_0 \simeq 2.7$ million, $\Delta t =$ time per operation (per single core) in nanoseconds, and $C =$ number of cores running in parallel, where each operation requires :

form the full 52 char key
base58 decode it to 38 byte binary string
check the checksum in the last 4 bytes equals first 4 bytes of the double SHA256 hash of the first 34 bytes
if yes for step 3) verify private key maps to desired bitcoin address

To guess k more characters than that would take :
$$t = t_0 \left(\frac{\Delta t}{C}\right) \cdot 58^k \hspace{1em} \mbox{(years)} $$
Thus for splitting into 2 pieces ($k = 13$), guessing one half of the key would take :
$$t = 2.2 \times 10^{29} \times \left( \frac{\Delta t}{C} \right) \hspace{1em} \mbox{years} $$
However how low a $\Delta t$ could be achieved in practice ? And what kind of a value could $C$ realistically have, the number of cores that could be marshalled?
In particular I wondered whether splitting into 2 pieces is absolutely secure. And how long into the future it would be before that was no longer the case.


texts: Homomorphic Encryption vs. Garbled circuits

texts: I'm currently trying to understand all the differences between homomorphic encryption and garbeled circuits. As I understood the use of homomorphic encryption hides either the data or the computation from the computational party, but what about the circuit? Is only the data hidden with homomorphic encryption?


texts: How to attack a "many-time pad" based on what happens when an ASCII space is XORed with a letter?

texts:
I've already sent my correct solution to a homework exercise from Dan Boneh's Introduction to Cryptography class on Coursera:

"Let us see what goes wrong when a stream cipher key is used more than once. Below are eleven hex-encoded ciphertexts that are the result of encrypting eleven plaintexts with a stream cipher, all with the same stream cipher key. Your goal is to decrypt the last ciphertext, and submit the secret message within it as solution.
Hint: XOR the ciphertexts together, and consider what happens when a space is XORed with a character in [a-zA-Z]."

I managed to get the key by XORing ciphertexts #1 and #2, then XORing the result with the string " the " at each possible position.  Combined with a lot of guesswork, this gave me the first plaintext.
My question is: What would I have to do if I want to follow the hint? I know that if I XOR a space with a letter, I change the case of the letter, but then what?
I don't understand how I can recognize spaces!  Suppose I see a letter in $c_1 \oplus c_2$; how can I tell if there was a space in one of the plaintexts?


texts: Can you help me understand how RC4-52 is done using pen-and-paper?

texts:
I've played a lot with VIC and enjoy its complexity and effectiveness as a field cipher. However, RC4 has caught my attention lately and I've read there is a RC4-52 variant that can be done by hand.

Can anybody describe the rc4-52 algorithm? Is it with a deck of cards and just a swap of the values, or must they still be added somehow?


texts:
I read something about cache attacks like this:

  Enter KSM (Kernel SamePage Merging). KSM enables the kernel to examine two or more already running programs and compare their memory. If any memory regions or pages are identical, KSM reduces multiple identical memory pages to a single page. This page is then marked copy on write. If the contents of the page is modified by a guest virtual machine virtual machine, a new page is created for that guest virtual machine. This means that cross-VM cache-timing attacks would now be possible.

I am confused about this statement:

  This means that cross-VM cache-timing attacks would now be possible.

Can someone explain about this?
source link


texts: Generating the keys for the RSA cryptosystem in probabilistic polynomial time

texts:
In general every public key cryptosystem ``has'' a probabilistic polynomial time algorithm $G$ such that $G(1^k)=(\textrm{public key}, \textrm{private key=trapdoor})$; $G$ is called the key generator. Now for the RSA cryptosystem the keys, can be found in the following way:

  Bob decides the key length $k$, then $G(1^k)=((n,e), d)$ where $n=pq$
  with $p$ and $q$  prime numbers, $n$ has length $k$ (as bit string),  and $e\in\mathbb
 Z^\ast_{\phi(n)}$. The two primes $p$ and $q$  and are chosen in a
  random way, $\phi(n)$ is simply $(p-1)(q-1)$, $e\in\mathbb
Z^\ast_{\phi(n)}$ is randomly chosen and finally $d$ is calculated  in
  polynomial time with the extended Euclid algorithm. The couple $(n,e)$
  is setted as  the public key, whereas $d$ is the secret key.

I don't understand why this algorithm has probabilistic polynomial running time. Who ensures that I can find two random primes and $e$ in a reasonable time?

thanks in advance.


texts: Generate a per data shared secret vs per session

texts:
I have read about SSL that they persist the shared-secret for the entire session. However, someone in stackoverflow suggested a way of generating a shared secret for each data to send and then send that shared-secret encrypted by client's public key with the intended message/data. The client would then have to decrypt the shared-secret first for that message using its private key then decrypt the message by the decrypted shared-secret.

The opposite is true for client to server connection.

My question is what advantages this has over the persistent shared-secret per session?


texts: Impacts of not using RSA exponent of 65537

texts:
This RFC says the RSA Exponent should be 65537.  Why is that number recommended and what are the theoretical and practical impacts & risks of making that number higher or lower?

What are the impacts of making that value a non-Fermat number, or simply non prime?


texts: Why AEAD instead of encrypting with a simple hash?

texts:
I hear a lot about AEAD encryption (GCM, EAX, ...). Why is it unsecure (it seems to be as AEAD exists)
to do do that: Imagine a block of data, hash it, append the hash to the data, then encrypt the result (data + hash) ? I would intuitively think that it is not possible to currupt the data then corrupt the hash to hide the changes as both are encrypted.
EDIT: I found something that that made me realise the utility of the header in AEAD, it stores informations like the algorithm used, however I don't need a header in my case, so is it ok to encrypt(data + hash(data))?


texts: How exactly are public and private keys used to encrypt and the decrypt data?

texts:
In asymmetric encryption schemes, a public key is used by an outside source to encrypt data to be sent to the holder of the private key.

It's my understanding that public keys are generated from the private key using a one-way, or trapdoor function, rendering it computationally infeasible to reverse-engineer the private key from the public key or its encrypted message.

My question is not why private keys can't be reverse-engineered, or how public/private keys are generated.

My question is exactly HOW the public key is used to encrypt the data, and the process by which the private key can decrypt it. Can anyone give an example of a very simple public and private key, and how exactly they're used to encrypt, and then decrypt some data?

For the sake of simplicity and ease of understanding, perhaps an example could utilize multiplication as the one-way function to frame the keys, and a small string of ones and zeroes could be used as the data to be encrypted and then decrypted.


texts: Permutation of first $k$ prime powers as a one-way function?

texts:
Let $a_1$ through $a_k$ be some permutation of the first $k$ primes. Let $n \in [1,k!]$ be a parameter specifying the exact ordering by taking the $n$th permutation in a sorted list or by some other simple mechanism.

Then define $f(n,k)=a_1^{p_1}+a_2^{p_2}+\ldots+a_k^{p_k}$, where $p_i$ is the $i$th prime, and the $a_i$ are the permutation of the primes indicated by $n$.

e.g. $f(5,4)=2^2+7^3+3^5+5^7=78715$.

I conjectured that all such sums may be distinct. Supposing that were true, this appears like it could potentially serve as a bijective one-way function using a suitably high value of $k$ and an effectively randomized permutation.

For very small $k$ (up to $20$ or so), the $f(n,k)$ sums are spread far apart and have little opportunity for individual terms to overlap, making it easy to greedily home in on the correct inputs. Beyond that, it quickly becomes more difficult. Barring some tidy solution that I cannot see, finding $f^{-1}(f(n,k))$ seems totally intractable once it's extended to $k>1000$ or more, while $f(n,k)$ is trivial to calculate to very large values. Accordingly, my question:

  Could $f(n,k)$ conceivably make a suitable one-way function?

In particular, I'm looking for advice on whether there is likely to be some way to efficiently find $f^{-1}(f(n,k))$ after all, and also whether $f$ looks like it has other properties that would make it either a strong or poor choice for this purpose.


texts: Demo a Proprietary Signal Processing Algorithm Without Cheating

texts:
I have a proprietary signal processing algorithm, $F(s)$, which I would like to demo to my customers. The demo starts with the customer uploading a binary signal $S_0$ to my website. I then generate a response signal $R = F(S_0)$ and return it to the customer. The customer then adds some amount of noise to the response $R^{'} = \Psi(R)$, and uploads the noisy signal $R^{'}$. Finally I generate a close approximation of the original signal $S_1 = F^{-1}(R^{'})$ and return it to the customer for comparison to the original $S_0$.
How can I do this so there is no doubt that I am being honest and using only $R^{'}$ as the input to $F^{-1}$ to generate $S_1$?


texts:
OpenSSL supports TLSv1.3 record padding:
https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html
but I'm not sure if it works like I think it does. If I would choose a factor of 2 it would make the record (=packet/payload length???) twice the original size. Is that correct? If so, wouldn't random padding be better? Otherwise you could just divide the packet by 2,3,4 ... to get to the real value?


texts: Will rehashing an SHA256 hash continually, eventually produce every possible value?

texts:
So let's say you had infinite time and energy. You have a hashed string of some sort. Because you have infinite time and energy, you can produce a collision(or the original value) easily enough. But, there is a problem. The hashed string was hashed an unknown amount of times. (ie, it may have been produced by sha256(sha256("foobar")) or by sha256(sha256(sha256(sha256("foobar"))))).

You were given a hint by your adversary though. They give you (say) 10 strings, of which one is the initial value that is hashed.

Is it possible to determine with absolute certainty that you chose the correct string? Is it possible that hashing "foobar" recursively an infinite amount of times will eventually yield any arbitrary hash value?

Although my question is about SHA256, I'd be equally curious of other hash algorithms as well


texts: How to handle points in extended finite field

texts:
Following the response to my previous question, I would like to know if you could give me some information or give me a link on how to perform arithmetic operations once I changed a point from the field $\mathbb{F}_p$ to $\mathbb{F}_{p^2}$ ?
If I have an elliptic curve $Y^2 = X^3 + 1$ over $\mathbb{F}_p$ and I want to make a distortion map $\phi(x,y) \rightarrow (\beta x,y)$ to have a point of the form $\{a+bi : a,b \in \mathbb{F_p}\}$ in $\mathbb{F}_{p^2}$.
How can I compute the addition of two points in $\mathbb{F}_{p^2}$ for example since the field arithmetic is not the same ?
Thank you for your answers


texts: Where can I find standardized implementations of lightweight cryptographic ciphers?

texts:
I am working on a project that requires encrypting messages with different ciphers. I am looking for the following ciphers:

PRESENT,
CLEFIA,
LEA,
Hill cipher,
Affine cipher,
Elliptic Curve Cryptography.

In the past, I used AES from openssl UNIX utility which is pretty much standardized.
I found some implementations on github which may be faulty as there is no associated confidence with them. Since the whole project actually relies on this step, it is desirable that I use the most standardized implementations of these ciphers.

I might also implement them on my own but there is no use reinventing the wheel. I feel there exist standardized ones out there. I searched at NIST website too but to no avail.

Please let me know if you know of some standardized implementations that most of the community uses. Apologies for sounding like a newbie. I am quite new to the interesting world of cryptography.
Thanks a lot!


texts:
Hi I am new to cryptography and am confused as to how HKDF generates two separate keys from one single key/password. Is it as follows?

Key 1: HKDF-Extract(salt, IKM) -> PRK

Key 2: HKDF-Expand(PRK, info, L) -> OKM

OR is it that

Key 1: HKDF-Extract(salt, IKM) -> PRK

Key 2: SHA-512(PRK)

Where Key 2 would be HMAC-key?

Could it be that one key is derived using pb-kdf and hmac-key is derived using hkdf?


texts: Breaking the 40 bit DVD CSS stream cipher

texts:
This is from the transcript of Dan Boneh's Coursera Crypto course
https://www.coursera.org/learn/crypto/lecture/mQAkP/real-world-stream-ciphers

So it turns out this is easy to break in time roughly two to the
seventeen. Now let me show you how. So suppose you intercept the
movies, so here we have an encrypted movie that you want to decrypt.
So let's say that this is all encrypted so you have no idea what's
inside of here. However, it so happens that just because DVD
encryption is using MPEG files, it so happens if you know of a prefix
of the plaintext, let's just say maybe this is twenty bytes. Well, we
know if you XOR these two things together, so in other words, you do
the XOR here, what you'll get is the initial segment of the PRG. So,
you'll get the first twenty bytes of the output of CSS, the output of
this PRG. Okay, so now here's what we're going to do. So we have the
first twenty bytes of the output. Now we do the following. We try all
two to the seventeen possible values of the first LFSR. Okay? So two
to the seventeen possible values. So for each value, so for each of
these two to the seventeen initial values of the LFSR, we're gonna run
the LFSR for twenty bytes, okay? So we'll generate twenty bytes of
outputs from this first LFSR, assuming—for each one of the two to the
seventeen possible settings. Now, remember we have the full output of
the CSS system. So what we can do is we can take this output that we
have. And subtract it from the twenty bites that we got from the first
LFSR, and if in fact our guess for the initial state of the first LFSR
is correct, what we should get is the first twenty-byte output of the
second LFSR. Right? Because that's by definition what the output of
the CSS system is. Now, it turns out that looking at a 20-byte
sequence, it's very easy to tell whether this 20-byte sequence came
from a 25-bit LFSR or not. If it didn't, then we know that our guess
for the 17-bit LFSR was incorrect and then we move on to the next
guess for the 17-bit LFSR and the next guess and so on and so forth.
Until eventually we hit the right initial state for the 17-bit LFSR,
and then we'll actually get, we'll see that the 20 bytes that we get
as the candidate output for the 25-bit LFSR is in fact a possible
output for a 25-bit LFSR. And then, not only will we have learned the
correct initial state for the 17-bit LFSR, we will have also learned
the correct initial state of the 25-bit LFSR. And then we can predict
the remaining outputs of CSS, and of course, using that, we can then
decrypt the rest of the movie.

I don't understand what he means by the sentence which I have bolded - "Now, it turns out that looking at a 20-byte sequence, it's very easy to tell whether this 20-byte sequence came from a 25-bit LFSR or not."
How do you tell this whether the 20-byte sequence came from a 25-bit LFSR?


texts: How to generate many passwords from one passphrase, so that knowledge of one password does not compromise the others?

texts:
The limitations are:

it should be a function.
passphrase is so weak, that if hash of it is known (or big part of hash), then it can be brute forced.

I want to get N passwords from one passphrase. Lets imagine, that N hackers have web sites with login pages, and I want to use my N passwords as passwords for accounts on their web sites. I don't want one hacker to be able to find my password for another hacker's web site.

First what comes to mind is to divide passphrase to N parts, and use each part as a key. Like

f("MyWeakPassphrase") = {"My", "Weak", "Passphrase" }

(It satisfies restrictions)

But are there better ways?

update
Most of answers suggest to use kdf with salt + counter or something similar. It is still a hash, and if broken, all other passwords revealed. I thought there might be an algorithm, so that brute forcing passphrase will reveal only part of a passphrase if only one password is known. Like function above, but better.


texts: Why does error propagation in CBC mode encryption affect two blocks?

texts:
From Wikipedia:

Error propagation
It was common to discuss the "error propagation" properties as a selection criterion for a mode of operation. It might be observed, for example, that a one-block error in the transmitted ciphertext would result in a one-block error in the reconstructed plaintext for ECB mode encryption, while in CBC mode such an error would affect two blocks.

I read this similar post before. And I can understand that in CBC decryption, only two blocks are affected due to error propagation (error in 1 block).
But, for the same case in CBC encryption, why are still only two blocks affected? It looks like all the following blocks will be affected.


texts: Does the ability to influence the key of a MAC effects its security?

texts:
If a PPT adversary can influence the key of a MAC function, is it still secure?

For example, if we define $f$ as follow:

$f(r,x) = HMAC_{(k\oplus r)}$(x)

If the adversary has oracle access to $f$, how likely he can predict the key $k$?

For respecting the persons who have answered the above question, I do not change it. The actual scenario is as follows:

I have a module that gets $(m,r)$ and generates $(m,x,HMAC_{k \oplus r}(m \parallel x))$ where the $k$ is the secret of the module and $x$ is the message added by the module. So:

$f(m,r)=(m,x,HMAC_{k \oplus r}(m \parallel x))$

Can I claim that every tuple $(m,x,t)$ s.t. $t=HMAC_{k \oplus r}(m \parallel x))$ is generated by the module?

P.S. I am still curious about the above claim. But, I just noticed that if I change $f$ as follows:

$f(m,r)=(m,x,HMAC_k(m \parallel x \parallel r))$

then, I can claim every tuple $(m,x,t)$ s.t. $t=HMAC_k(m \parallel x \parallel r))$ is generated by the according to the definition of MAC.


texts:
I'm trying to use a java implementation of ed25519.

In the code, I can't find any functions that generate keys.

My experience with cryptography is limited to about three weeks of asking questions on stack.

Does the code generate keys?  If so, which function?


texts: Are there any bijective one-way functions not based on number-theoretic hardness assumptions?

texts:
I'm trying to find a bijective function $y=F(x)$ which should be easy to compute in one direction but hard to compute in the other, where the one-way property is not based on a number theoretic assumption.

The hard direction should be preferably as hard as computing hash preimages, but it could also be that there is only some practical asymmetry (such as taking 1000 times as long to compute one direction than the other).

Poligh-Helmman encryption, LUC encryption and RSA encryption can provide some form of one-wayness since decryption/encryption take very different times, but they are all number theoretic based and require changing the plaintext and ciphertext space to avoid weak plaintexts.


texts: Should number of iterations of PBKDF2 stay secret?

texts:
Let's say I encrypt my passwords with PBKDF2 and store it somewhere. Now let's say it was stolen and the hacker, who stole it knows it was hashed with PBKDF2.

Does a knowledge of number of iterations make it easier to brute force the password?
Reasons?


texts:
I want to ask again about distinguishing attack on CBC MAC, based on the paper published by Ketting Jia, Xiaoyun Wang, Zheng Yuan, and Guangwu Xu: Distinguishing Attack and Second-Preimage Attack on the CBC-like MACs.

That paper says: "The adversary makes $2^{(n+1)/2}$ queries with $m$-block messages that have the same last $m−1$ blocks."

What I want to ask is why the authors choose $2^{(n+1)/2}$?

As we know, block cipher's input width is usually even, so if we operated it with $2^{(n+1)/2}$ the result will not be an integer, but fractional.


texts: How to prove that a function is not pseudorandom?

texts:
I am currently enrolled in a cryptography course, which uses the book by Katz and Lindell. I'm struggling with the exercies which ask for proofs, like the following one:

  Let G(k) be a PRG with |k| = n, and G'(k) the output of G(k) truncated to the first n bits. Prove that $F_k(x) = G'(k) \oplus x$ is not pseudorandom.

The only thing I can say is that $F_k()$ has a very specific structure, not chosen randomly from $1/2^n$.

Any hints?


texts: What is the size of codomain of a function $G(x) = F^A(x) \oplus F^B(x)$, where $F(x) = \text{Keccak-}f[1600](x)$?

texts:
Assuming that $m$ is a multiset of bitstrings where all bitstrings have the same length, let $D(m)$ denote the number of distinct elements in $m$. That is, $D(m)$ is equal to the dimension of $m$. For example, if $$m = \{00, 10, 11, 10, 11\},$$ then $D(m)=3$.

Let $F(x) = \text{Keccak-}f[1600](x)$, the block permutation function of SHA-3 (for $64$-bit words). We can define the following notation: $$\begin{array}{l}
{F^0(x)} = x,\\
{F^1(x)} = F(x),\\
{F^2(x)} = F(F(x)),\\
{F^3(x)} = F(F(F(x))),\\
\ldots
\end{array}$$

Assuming that $A$ and $B$ are two different natural numbers greater than or equal to $0$, let $G_{A, B}(x)$ denote a function defined as $$G_{A, B}(x) = F^A(x) \oplus F^B(x),$$

where $x$ denotes a $1600$-bit input and $\oplus$ denotes an XOR operation.

Assuming that $L = 2^{1600}$, let $S_i$ denote an $i$-th bitstring from a set of all possible $1600$-bit inputs:
$$\begin{array}{l}
S_1 = 0^{1600},\\
S_2 = 0^{1599}1,\\
\ldots,\\
S_{L-1} = 1^{1599}0,\\
S_L = 1^{1600}.\\
\end{array}$$

Let $A$ and $B$ denote two arbitrarily large, but different natural numbers (one of them is allowed to be equal to $0$). For example, $$A = 0, B = 1$$ or $$A = 2^{3456789}, B = 9^{876543210}$$ are valid pairs.

Then

$$\begin{array}{l}
S_{A, B}[i] = G_{A, B}(S_i),\\
C_{A, B} = \{S_{A, B}[1], S_{A, B}[2], \ldots, S_{A, B}[L-1], S_{A, B}[L]\}.\\
\end{array}$$

The question: can we assume that $D(C_{A, B})$ is expected to be approximately equal to $$(1-1/e) \times 2^{1600} = 10^{481} \times 2,810560755\ldots$$ for all (or almost all) pairs of $A$ and $B$?


texts: secp521r1 elliptic curve base point coordinates

texts: According to Standards Recommanded Elliptic Curve parameter for Cryptography, for each given curve, the base point is given in compressed and uncompressed form, but personnaly I do not understand how to use it with that form, I need the (X,Y) coordinates for my application, thanks to show me how to find them from the given form.


texts: Signing data packets increases data size too large for packet to contain

texts:
In a setup where the client signs then encrypts outgoing data packets to a VPN server / onion network, an ECDSA signature appended to the plaintext before encryption could cause the data to be too large to be contained in the packet. How is this avoided??

Side note: Encryption will be with a stream cipher, so the data size wont increase after encryption of the ECDSA signature appended to the plaintext.


texts: Recover key given partial key, IV and cipher text using CBC mode

texts:
Given a known IV and a small part of the key (not enough to use brute force)
is there are any way to break CBC encryption with only one cipher text?


texts: Diffie-Hellman and man-in-the-middle attacks

texts:
See here for the man-in-the-middle attack on Diffie-Hellman that I'm concerned about: What is Diffie-Hellman?

How do we combat this? I have two questions:

Is one solution for both Alice and Bob just using a certificate authority, then they can each look up the other's certificate and know the secret key without really communicating (through Eve)?
The other solution I heard about is using RSA for signatures. My question in this case is that, if Alice and Bob are using RSA, why doesn't Alice just send Bob a secret symmetric key using Bob's public RSA key (signed with her private RSA key)? Isn't this basically what PGP does? I don't see the point in using DH if we're using RSA anyway.


texts: Doubt on elliptic curve over a finite field and binary representation

texts:
I'm a programmer, i.e. agnostic to the mathemathics behind most of cryptographic scheme, but I'm trying to remediate. I'm writing this premise for any possible error or imprecision that I probably put in this question.
However, I'm studying Elliptic Curve and I got to Elliptic Curves over Finite fields topic. For what I understood an elliptic over a finite field $F$ are the points that fulfill the Weierstrass equation where coefficients and coordinates belongs to $F$.
So far I always thought of F as the integer modulo $p$ (with $p$ prime). Point addition, doubling must be thus performed modulo p and all the points that pop out along with the point at infinity form a cyclic group. Ok, I got this.
Now problems begin: reading some handouts that a professor of mine gave to me, I read two things that I couldn't figure out.
First, they say that the order of a finite field is always a prime power (and such a power is named extension degree that he denotes with $m$): of course I trust this result but I couldn't figure out a field of order, say, $4$, $8$, $9$ or $16$. What are examples of such fields?
Secondly, if $p=2$, $m>1$ and $q=p^m$ (binary field), they say that (I'm citing):

The elements of the a binary field of order $q=2^m$ cannot be represented as integers modulo $2^m$. A convenient way to represent them is by means of binary polynomials of degree less than m.

Why can't they be represented as integers modulo $2^m$? Any answers and/or reference is appreciated.


texts: Can I use PGP to sign a message without providing cryptographic non-repudation?

texts:
The difference between a digital signature and a MAC is non-repudiation. A message with a digital signature proves that only the sender could have signed the message, whereas a message with a MAC proves that either the sender or the recipient could have signed the message.

Can an OpenPGP implementation, such as GPG, be used to sign a message without providing non-repudiation?

Please note that I am referring to non-repudiation in the cryptographic sense, not in the legal sense.


texts: Is Diffie Hellman key exchange based on one-way function or trapdoor function?

texts:
I have a question for my information security lab, which I am not able to find online.
As the title says, is Diffie Hellman key exchange based on a one-way or a trapdoor function?

In case of RSA I would say it is based on a trapdoor function, since it is hard to factorize the modulo, if you don't know p and q.

Is Diffie Hellman also based on a trapdoor function, since it is hard to reverse the discrete logarithm, if you don't know the secret key?


texts:
I want to partially encrypt a large block of data using AES. Meaning: given plaintext[0:1100], I would like to encrypt plaintext[0:1023]. The plaintext is generally machine code, but might have snippets of text.

Does this expose what I encrypted to any realistic challenges in the context of my application (for example: copy protection)?


texts: XTS mode of operation and authentication

texts:
I'm wondering if XTS is used (Random Access is needed) what the best solution for authentication is. If I wouldn't need random access, I would take AES-GCM or AES-CBC-HMAC but random access is a must.

What mode of operation would be prefered for random access with authentication?


texts: Are there any practical use cases for performing homomorphic operations on encrypted Strings?

texts: Does anybody know which practical use cases there are to operate on encrypted strings? Even niche problems that can be solved using homomorphic encryption on strings are interesting to me, but not academic ones.


texts: Where is Challenge/Response and Certifcate Verification in TLS-DHE

texts:
We have been give a task to identify the following three components in TLS-DHE:

Diffie Hellman Key Exchange

I am fairly certain that this Part can be found in the Exchange of SKE and CKE, since they contain the public Key with Signatures and can be used by the other party to derive a shared key

Challenge/Response

I am having trouble identifying this part. Since this part is usually something you would do before exchange a key, i reccon it can only occur in the Part with the CH. However, i fail to see how CH (CHallenge?) is a challenge for the Server S, because usually challenges are solved by using private information

Certificate Verify

I know the Certificate consists of Public Key and digital Signature, but how can a Certificate be authenticated here without having established a shared secret yet? I do not see any Certification Authority here as well, so i am clueless


texts: I haven't really seen what computational complexity class of decryption of AES is. Can anyone provide reference papers or answers here?


texts: Encryption algorithms larger than 256 Bit for “big data” encryption?

texts:
I'm somewhat new to encryption. When looking at encryption programs for big data, I frequently see a maximum of 256 bits.

Why do we generally restrict our (symmetric) keys to 256 bits? Can more powerful encryption algorithms be used practically, or is there a specific reason for that 256 bit maximum?


texts: How do I encrypt a bunch of messages by different authors, shared with that group of people?

texts:
I'm still getting my head around public/private key cryptography, and I can't quite work out how to ask the right question to get an answer for this problem, but here goes!

Alice, Bob, Carol, and Dave are all in a secret society which writes exquisite corpse stories.
First Alice writes a line into a file; then she sends this file to Bob, Carol and Dave. Each of them might write a line too, and share it with the group again.
Nobody outside the secret society should be able to read their story, but each of them should be able to read the whole story.
After a while, Alice invites Edgar into the secret society. He can now read all the previous lines in the story, and add his own.

How would I make this scenario happen? Does each person have their own key? Is there a single key pair representing the society as a whole? Is there any reading I could do or terms I could search which would help me understand this scenario?


texts: Is it safe to derive a password from a signature provided by ssh-agent?

texts:
I'd like to use a password-based system on a remote host (accessed via SSH) without having to copy-and-paste the password and without storing it on disk.  Using the system with some other form of authentication is not an option.

One possible solution is to talk directly to ssh-agent and have it sign a constant token and then use, say, the signature's base64-representation as the password.  This password can always be re-generated, assuming access to the private key and knowledge of the token.

https://gist.github.com/mprymek/10415576 shows that this technique is being used in the wild.

Is this approach (deriving a password from a signature) cryptographically sound?
Is this approach secure?  For example, when SSH agent forwarding is used, is the signing request and response (exchanged between remote host and local ssh agent) safe from eavesdropping?

EDIT: draft-ietf-secsh-agent-02 section 4.2 says that forwarding happens through an SSH channel, and the abstract of RFC 4254 says that "channels are multiplexed into a single encrypted tunnel" which I believe means that agent forwarding is fully encrypted.


texts: How to properly cypher 16 bytes message containing a CRC checksum?

texts:
This question arose from a new context under early developments. If cryptographic operations are not well chosen or badly sequenced, please do notice it along your answer or comments: I am a layman in cryptography. If you think this post should be improved, any constructive feedbacks are welcome, I am new to this stack.

Imagine I have an IoT sensor that needs to send few bytes of data over a wireless network. The physical payload from sensors is about 11 bytes, then we would like to construct from this a network payload as this:

Pad physical payload to 12 bytes;
Compute checksum using CRC32 and append to padded physical payload;
Encrypt 16 bytes with a cryptographic algorithm such AES with CBC mode.

Provided it is a good idea to proceed as stated above: How must I setup the cryptographic part to make it robust, mainly:

Is this cryptographic standard relevant for this kind of task?
How do I chose the key size?
How do I chose the Block size?

Last but not least, is it known if: Does CRC32 stored in a message reduce the strength of the cryptography as it introduces a relationship among bits in the message?


texts: Why do people criticize and mistrust the e-voting based block chain?

texts:
I am planning to implement an e-voting system based on hyperledger fabric blockchain, however, I came across many criticisms from well-known security experts like Josh Benaloh and others. The problem is I couldn't find any proof that the e-voting is definitely insecure. In my opinion, I think Blockchain can be considered the best solution compared to the current voting system as it covers many security aspects.

can anybody explain to me thoroughly with tangible examples and proofs?


texts: Interpreting the Hash type in a TLS ciphersuite

texts:
There are ciphersuites with SHA256, and SHA384.
In the following TLS ciphersuite, the SHA types is not specified. Does this always refer to SHA1 (there is SHA0 as well) so which one of them?

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA


texts: After Google's collision attack, is RSA-SHA1 signature still safe?

texts:
Google succeeded to get a collision in SHA-1 last year in an attack called shattered. Does this fact make certificates based RSA-SHA1 Signature risky for  creating fraud certificates?

If RSA-SHA1 signature is still safe, why is that (because the attacker doesn't have the private key)?


texts:
Comments on Cryptographic Entropy Measurement seems to challenge the heart of NIST SP 800-90B, which proposes min-entropy as a conservative measure of entropy produced by hardware source.

[The idea of using min-entropy] has been taken to heart in the NIST SP 800-90 documents, using the most conservative measure, min-entropy. While this may make sense for cryptographic random data, it makes no sense when measuring entropy in raw random data. [section 1, page 2]

Why does it make sense to use min-entropy for measuring cryptographic random data?  I would have thought it was the other way around --- sensible for measuring raw random data, not cryptographic random data --- because entropy is produced in raw random data; cryptographic random data is processed random data, which cannot increase entropy, only possibly reduce it.

The central limit theorem does not hold and confidence intervals are
not well defined for [min-entropy].  If minimum entropy does not
satisfy the requirements set out by either Shannon or Rényi, why is it
used as the foundation for measuring entropy in cryptographic
applications? [section 3.1.1, page 6]

Does min-entropy satisfy the properties of an entropy measuring function laid out by Shannon?  If not, why is it being used for measuring entropy?
Update. @kodlu, the properties an entropy function $I(p)$, where $p$ is the probability of a certain event $s$ should have are:

$I(p) \ge 0$
$I(p_1, p_2) = I(p_1) + I(p_2)$ for independent events.
$I(p)$ is a continuous function of $p$.


texts: Hash algorithm for user accounts passwords in macOS 10.12, 10.13, 10.14

texts:
I study this article: How to Hack a Mac Password Without Changing It
and get interested in what hash algorithm is used for hashing user accounts passwords in macOS 10.12+?

My hypothesis is that it is PBKDF-SHA512.


texts: Is it necessary to generate a private key for each encryption process?

texts:
I read about Asymmetric key cryptography like EG-ECC , RSA, ECDH. I understand the concept of mathematics to these algorithms. But I have wondered about the public key for sender and private key for recipient. In other words,

Any other user who wants to send an encrypted message can get the intended recipient's public key from a public directory. They use this key to encrypt the message, and they send it to the recipient. When the recipient gets the message, they decrypt it with their private key,
How much is the length of the message here is it necessary to have the message length smaller or equal to the length of the public key or the message can be any length of random words, can be divided into more than one block in this case we will use the sender's public key  more than one time. Is the process of generating keys occur in the process of block encryption or message (size greater than size key) encryption?


texts:
We know reusing IV can compromise our secrecy. I have some questions aiming to clarify the use of an IV/Nonce in CTR/GCM:

Is it OK to use the same key for encrypting plain-texts in authenticated encryption (GCM) and confidential only encryption (CTR) if we use a random IV to encrypt each plain-text? How many time we can reuse the same key in this way?
What's different between "IV" and "nonce" in CTR or GCM mode? (I know there is a counter within the algorithm, but there is some IV before the counter to encrypt each block. From Wikipedia, I thought the correct term was IV+counter instead of saying nonce?)
What is the right way to generate the IV for CTR or GCM modes? Should we use a TRNG or CSPRNG? Some comments imply the nonce shouldn't be random - why is this?


texts: In the OAEP padding/armoring scheme for RSA encryption, the seed used is masked  (with the masked data block) in the end. Why is that necessary, since the seed is random anyway?


texts:
I'm curious about the security of RSA signing with the same public private key pair when the same message is sent multiple times. It's my understanding that once you generate the hash of the message you wish to send, that you then sign this message with your RSA private key, then transfer both this signed hash and the original message. The receiver then uses the original message to generate their own hash and compare against the result of decrypting the signed hash with the server's public key. Now that you know my understanding of the process on to the question.

Scenario: A client connects to a server and retrieves a command as well as a signed hash of this command. The server's public key is hard coded into the client. Only this server should be able to issue commands, commands will be reused

1) Is it possible for an attacker to simply log the hash of a command and then replay this hash on a server of their own thus defeating signing?

2) Assuming question one is correct how can this be prevented, I can't see a random index, being added on the end of the command, working because the server must send the original message thus exposing the "secret index" that was intended to change the hash each time.

I understand how RSA is secure when data is only sent once, but when it's sent multiple times how is it/can it be made secure? I'm looking for a possible solution. Thanks for reading.


texts: Can you please explain weak keys of the following 2-round DES?

texts:
2-rounds DES (M-DES)

• $|M|=|P|=|K|=2^4$;

• S-boxes: $S_1 = [1 0]$ and $S_2 = [11]$;

• The initial and the final permutation are the identity permutation;

• The expansion function is the identity function;

• The key schedule function is defined as follows: For a key $K = (k_1k_2k_3k_4)$, the
round 1 key is $K_1 = (k_4k_1)$ and the round 2 key is $K_2 = (k_2k_3)$.

A key $K$ is called a weak key for the cipher $E$ if $E_{K_1}(E_{K_2}(x)) = x$ for all $x \in M$.

Please explain M-DES Weak Keys.


texts:
From Wikipedia:

XTS mode is susceptible to data manipulation and tampering, and applications must employ measures to detect modifications of data if manipulation and tampering is a concern: "...since there are no authentication tags then any ciphertext (original or modified by attacker) will be decrypted as some plaintext and there is no built-in mechanism to detect alterations. The best that can be done is to ensure that any alteration of the ciphertext will completely randomize the plaintext, and rely on the application that uses this transform to include sufficient redundancy in its plaintext to detect and discard such random plaintexts."

I am researching secure ways of backing up data on a regular basis (using deduplication or versioning).
The backup would be stored in low security location (meaning an attacker could have access to the data over long amounts of time and over multiple backup cycles).
Should I be worried about XTS tampering when encrypting backups using VeraCrypt?


texts: Demystifying homomorphic multiplication in RNS FV variant

texts:
I am trying to understand a full RNS FV SWHE variant proposed in this paper.

My problem is with the homomorphic multiplication. Original ciphertexts are represented in RNS representation using base (say $q$ with $k$ co-prime moduli). In order to accommodate for coefficient growth, an auxiliary RNS base (say $\mathcal{B}_{sk}$ with $\ell$ co-prime moduli) is introduced. Note that $\{ q \cup \mathcal{B}_{sk} \}$ moduli are co-primes too and $k$ needs not to be equal to $\ell$. What I don't understand is the step (S3) in Algorithm 3 in page 13:

The function "FastBconv" takes as input an extended ciphertext$^*$ in base $\{ q \cup \mathcal{B}_{sk} \}$. How to convert it to obtain a ciphertext in base $ \mathcal{B}_{sk}$ only?
There is also a strange notation of dots ($\dots$) used in the same line in the algorithm, what is that supposed to mean?

*: an extended ciphertext can be viewed as a matrix of $k+\ell$ rows and $n$ columns where $n$ is the underlying ring's polynomial modulus degree.

I appreciate any help in explaining the algorithm.


texts: Cryptographic Systems Involving Modular Exponentiation

texts:
I am going through an "Introduction to Cryptography" chapter in my Elementary Number Theory course, wherein I'm studying cryptographic systems involving modular exponentiation.
The textbook (By David M. Burton) says that:

A user who wishes to conceal information might begin by selecting a (large) prime p to serve as the enciphering modulus, and a positive integer 2 < k < p - 2, the enciphering
exponent. Modulus and exponent, both kept secret, must satisfy gcd(k, p - 1) = 1. The encryption process begins with the conversion of the message to numerical form M by means of a "digital alphabet" in which each letter of the plaintext is replaced
by a two-digit integer. It is assumed that the plaintext number M is less than the enciphering modulus p; otherwise, it would be impossible to distinguish M from a larger integer congruent
to it modulo p.

Can someone please clarify the last line for me (in italics)? Possibly, by giving an example as to why will it be impossible to distinguish M from a larger integer congruent to it modulo p. What exactly happens when M is greater than p?


texts: How does a preimage attack on MD5 break the security of HMAC-MD5?

texts:
It was mentioned in an answer to a different question that

  it's possible that, any day now, someone might figure out a way to
  turn those into a preimage attack, which would compromise the security
  of HMAC-MD5.

Reminder: $\text{HMAC-MD5}_K(x) = \text{MD5}(K \oplus opad \mathbin\| \text{MD5}(K \oplus ipad \mathbin\| x))$

Given that the input to the MD5 calls in HMAC includes the keys I don't immediately see how this turns into an attack. Could somebody clarify?


texts: Why does RSA give better security on longer messages?

texts:
I am trying to understand the notion of RSA security.

Choosing a public exponent where $e = 3$ facilitates the calculations, considering that it is secure if the plaintext or message is long.

If the message is short, it affects security but why?

Does that relates to the $2^n$ possibilities, if the message is short the probability of knowing the message is high?


texts: Exactly what part of SIDH is proven to be NP-hard?

texts: SIDH is quantum secure, why is it quantum secure? Exactly which part of the algorithm is proven to be NP-hard? Computing the isogeny function?


texts: Sane implementations of Bitcoin cryptography routines w.r.t. side-channel attacks

texts:
Bitcoin uses SHA-256, Base58Check, ECDSA (Sep256k1) and RIPEMD-160 as the basis of its encryption (see this article for a short guide on how addresses are created).

I would like to create an iOS-based wallet app that offers reasonable security.

OpenSSL is not available on iOS, and is quite a large dependency. What I'm looking for are specialized libraries that mainly focus on the Bitcoin algorithms. The OpenSSL code also is very hard to understand, making me wonder if there is really no better way.

libbitcoin and the official Bitcoin-Qt client both use OpenSSL.
OpenSSL generally has a mixed reception.
OpenSSL also added to the transaction malleability problem that recently made its round in the news, as OpenSSL has more relaxed criteria to accept a signature than strictly necessary.

bitcoinj uses Spongy Castle, also a large collection of algorithms.
Another option of an algorithm collection is Crypto++ which I haven't seen in existing Bitcoin clients so far.
Apple's Security framework only supports RSA on iOS.
Chromium includes Go-sources for ECDSA.
There is sipa's implementation for Sep256k1 that has a reputation of being very efficient. It is also listed under gh/bitcoin.

Many recent attacks in publications used side-channel attacks, making it necessary to have algorithms with constant-time execution (to avoid timing-related attacks) and additional protections against cache-based attacks and recently even audio-related attacks where noise that the hardware itself produces can be used to gain knowledge of the private key.

Even though many attacks require gathering of multiple signatures, one cannot know how the app will be used by the end-user. I do not want to rely on the assumption that the users doing transactions only a few times per day in different shops and exchange their Bitcoin addresses frequently.

My questions are:

Is there a "sane" implementation of the algorithms used by bitcoin? e.g. are there high-quality implementations available that incorporate defenses against side channel attacks?
Does OpenSSL already protects against side-channel attacks?

A mobile app is more open to side-channel attacks than the desktop PC standing at home, so what's reasonably secure on a desktop machine may not be secure enough for a mobile app.
As OpenSSL is probably the most used cryptographic library, it's probably also the most attacked one, and therefore, ahead when looking at general security. However, specialized libraries may have a higher quality for the few algorithms they implement, as the code base is much smaller and easier to understand.

How can I train myself to evaluate whether an existing implementation is vulnerable to certain types of attacks?

Cryptographic algorithm implementations are often only poorly documented and optimized to a point where the code consists of magic numbers chained together with arbitrarily seeming operators.
One aspect I already mentioned is the concept of constant execution time, which counters timing-related attacks.

Are there good resources that explain how to implement those algorithms myself? I do not intend to use my own implementation for the app, but I am interested in understanding how the stuff works I'm using. Entry-bar seems quite high. Can the "Guide to Elliptic Curve Cryptography" book be recommended?

PS: I know that Apple doesn't favorably treat Bitcoin-related apps in their store. However, this discussion is out of scope of this question.

PS2: Base58Check is only used as a special encoding to make Bitcoin addresses and keys more readable to the enduser. There is no cryptography involved there, and it's easy to implement - I only included it here for completeness.