texts: What problems with "random" data would cause this result from Ent?

texts:
I'm playing around with a novel kind of source of "random" data and Ent is currently giving me results like this:

Entropy = 7.977080 bits per byte.

Optimum compression would reduce the size
of this 13239 byte file by 0 percent.

Chi square distribution for 13239 samples is 422.94, and randomly
would exceed this value less than 0.01 percent of the times.

Arithmetic mean value of data bytes is 127.5968 (127.5 = random).
Monte Carlo value for Pi is 3.180417044 (error 1.24 percent).
Serial correlation coefficient is 0.009151 (totally uncorrelated = 0.0).

The Monte Carlo Pi value and Entropy results get even better as you increase the N value, but the Chi squared results get higher and higher and over trivially small N values you keep seeing the chi squared percent at less than 0.01.

What kind of non-randomness in the data does this suggest we're looking at?

Edit: It was recommended I specify that I understand that these high chi squared values suggest that the data is non-random.  I'm trying to understand the data a bit better so I'm wondering what properties of the data would make it so good at all of these other entropy tests while failing at the chi square test in a specific way every time.

Edit 2: Running the program for a couple of days and I will report in with the Ent results and maybe put a hex dump of the data up when it's done.  It would be a really big help if someone could just figure out exactly what makes this data "less than" random


texts: Can Paillier ,RSA or any other schemes be used for universal re-encryption like elGamal?

texts:
ElGamal, RSA, and Paillier cryptosystem have homomorphic property, and can be used fro re-encryption purposes. I want to use the encryption to re-encrypt ciphertext(as in  proxy re-encryption but differently/different scenario / may be like universal re-encryption)
Requirements:

Encryption:
Encryption: choose some random number r1 with other parameters like public key, private key, mod, message:m ,C1:ciphertext etc. The key pair (private key,public key).
C1=Encrypt(m,public key,r1).

Decryption: m=Decrypt(C1,private key)

Re-encrypt: choose random r2 (used to re-encrypt/re-randomize cipher text)
C2=Re-enc(C1,public key,r2)

Decryption: m=Dec(c2,private key) (may be 2 time decryption to retrieve m)

Note:
I want to  generate decryption key from receiver environmental variable(i,e from ip address etc), so that it can automatically decrypt when received by correct machine and the algorithm must have some random number in encryption used to re-encrypt (randomize) cipher text. I want re-encrypt cipher text without knowing the private key.
ElGamal: ElGamal meets all the above requirements exactly.
(I want some other cryptosystem like ElGamal)
RSA: I try RSA but RSA haven't used random r for encryption, so re-encrypting cipher text will issue. Is there solution for RSA?
Paillier: Another public key cryptosystem, have used random r and hence can have possibility to re-encrypt cipher text but the issue is private key lambda, lambda =LCM(p-1,q-1). So it can not be environmental key(because it is dependent on p and q). How to resolve this.
Is there alternate solution?
Any suggestion will be appreciated.


texts:
Please, could someone explain to me how the Key feedback mode (KFB) mode works and what the IV in output block stands for? And what properties does the "constant input" has to provide? Should it be random / unpredictable / fixed ?

Then it's encrypted with $K$ which is previous output and then it's xored with the plaintext. So the IV is there to encrypt the first block I suppose. Is that its function?

The KFB mode of operation graphic from Wikipedia:

Section 2.4.1 of the KFB specs (NIST) isn’t really any help either:


texts: What are some "must-read" papers for someone getting into Quantum Cryptography?

texts:
I'm a graduate student that just finished a first course on quantum computation. I've also done a graduate-level course in (classical) cryptography.
I'm interested in Quantum Cryptography and would like to know what people would consider the most important papers for me to read if I want to get an intro to QC, for someone of my background. Any help would be much appreciated.


texts: Which parts of CRYSTALS-Kyber and CRYSTALS-Dilithium are compatible?

texts:
The papers CRYSTALS-Kyber and CRYSTALS-Dilithium both have been written by quite different authors. It seems that at least the key generation is very different from each other. CRYSTALS mainly seems to be a suite of algorithms based on the hardness of module lattices.
From CRYSTALS-Kyber:

CRYptographic SuiTe for Algebraic LatticeS – a package submitted
to NIST post-quantum standardization effort in November 2017), a portfolio of post-quantum cryptographic primitives built around a key-encapsulation mechanism (KEM), based
on hardness assumptions over module lattices.

Where the KEM part is obviously specific to Kyber, not to Dilithium
Which mathematical operations can be shared between implementations of both? What kind of percentage of these algorithms could use that shared implementation of (low level) primitives?


texts: A novel encryption method using only a (huge) lookup table. Is this remotely secure?

texts:
So I've come up with an (admittedly impractical) encryption method using a lookup table. The table is a shuffled list of all unsigned 32-bit integers, effectively making it a 32-bit unkeyed PRP. I have this in a 16 round Feistel network, bringing the block size up to 128 bits and adding a 128-bit key.

Ignoring implementation issues like timing attacks, or the impracticality of carrying around a ~4 billion item lookup table, is the concept here sound? Are there any glaring issues I'm missing? Needless to say, this won't be going into anything important regardless.

Assume $E$ is an ideal unkeyed PRP (stored as a 16gb lookup table). The method starts with the simple key schedule. $Key_{n}$ is a list of 32-bit key blocks, and $RK_{n}$ is the resulting round keys for the Feistel network.

$$RK_{n} = \begin{cases}
n\in[0,3] & E(Key_{n})\\
n\in[4,15] & E(RK_{n-4})
\end{cases}$$

The plaintext is given as the 32-bit blocks $A_0, B_0, C_0, D_0$. Encryption is as follows.

$$A_n = B_{n-1}\\
B_n = C_{n-1}\\
C_n = D_{n-1}\\
D_n = A_{n-1} \oplus E(RK_{n-1} \oplus E(B_{n-1}) \oplus E(C_{n-1}) \oplus E(D_{n-1}))$$

The values $A_{16}, B_{16}, C_{16}, D_{16}$ are the resulting ciphertext.

Decryption is a simple reversal of the above.


texts: Why isn't the maximum security of triple DES 48 * 2 vs 56 * 2?

texts: The security of quadruple or even more encryption isn't much more than that of double encryption. But each round also counts as one encryption. So why isn't triple DES only 96-bits secure?


texts: How can Bob validate Alice’s certiﬁcate?

texts:
Suppose that Alice has a certiﬁcate CA1 << Alice >> issued by the certiﬁcation authority CA1, and Bob has a certiﬁcate CA2 << Bob >> issued by a diﬀerent certiﬁcation authority CA2.

It is known that CA1 possesses a certiﬁcate CA2 << CA1 >> issued by CA2. How can Bob validate Alice’s certiﬁcate CA1 << Alice >>?

I think CA2 is the root authority but I’m not sure how to proceed with this problem.


texts: Can you help me understand this pseudo random generator example?

texts:
I'm new to crypto. I'm learning according to the book "Introduction to Modern Cryptography". I'm having troubles with understanding of PRG and how to prove if some function is PRG or not.

I'm trying to solve this simple example:

  G(x1,x2...xn) = x1,x2,...xn, x1 xor x2 xor x3... xor xn

  Is G a PRG?

Well, according to the book I need to check if

  $$|Pr[D(r)=1]-Pr[D(G(s))=1| <= negl(n)$$

  where $r$ is chosen uniformly at random from $\{0,1\}^|G(s)|$
  the seed $s$ is chosen uniformly at random from $\{0, l\}^n$,
  and the probabilities are taken over the random coins used by $D$ and the choice of $r$ and $s$.

but I don't know how to calculate $D(r)$ and $D(G(s))$... I'm feeling like I'm missing something here. Can you help me grasp what I’m missing?


texts: Does CP-ABE have any disincentive to share secret keys

texts:
I want to use a CP-ABE scheme to encrypt data to be accessed by multiple unknown (at time of encryption) users.

Reading the papers related to CP-ABE, there does not appear to be any disincentive for users to leak the secret keys they are given as the SK is not used by the user for signing or authentication.

Is this a valid interpretation or are there disincentives built into CP-ABE.


texts: Thoughts on secure hashing and the "mds" algorithm

texts:
Almost a decade ago Raymond Chen blogged [1] about the "hash reset
attack" cautioning developers to record the content length in addition
to the message digest.

Recently I came up with a variation on the MD5 hashing algorithm that
incorporates the file size. I've called this algorithm 'MDS' for
'Message Digest + Size' but hilariously "MDS" is a "cancer"... :P

You can see the javascript or PHP implementation of MDS [2].

So, is this a good idea? Do you think it would raise the bar for
collision generation? I'm way out of my depth... sort of seems like a
good idea, but I'm not armed with facts.

Perhaps, as I have been cautioned, I shouldn't be using MD5 at all..?

[1] http://blogs.msdn.com/b/oldnewthing/archive/2004/05/19/134937.aspx
[2] https://svn.jj5.net/jjrepo/mds/trunk/src/


texts:
I need to implement a simple approach on a Linux system to encrypt/decrypt data and I would appreciate any feedback from you. Basically, I need to change a bit the behavior of the functions read/write.

I've checked some options such as EncFS, but they only perform encryption/decryption at file level (decrypt/encrypt the entire file at once). However, I need some solution at a fine-grained level, such as at block level. To make things easier, we only append data at the end of the file and we don't change existing data of the file.

Consider the following use case, as an example:

File foo.txt is empty
Write 10 bytes to file foo.txt

Encrypt the input (10 bytes) and write it to the file foo.txt. Depending on the encryption algorithm, the plaintext and ciphertext sizes might differ.

Read 6 bytes from file foo.txt

How should you handle this situation? Should you decrypt everything you have and extract only 6 bytes?

What I have seen is that you most likely have to keep also metadata about the encrypted files as well (number of blocks, etc.). Thanks in advance!


texts:
I am having difficulty solving part (ii) of Excercise 5.17 from Becker's Cipher Systems.

Exercise 5.17
$\quad$If $f(x),g(x)$ are any two polynomials over $GF(2)$ with $f(0)=g(0)=1$ show that
(i) $\Omega(f)\cap\Omega(g)=\Omega((f,g))$
(ii) $\Omega(f)+\Omega(g)=\Omega([f,g])$.

It is easy to prove that $\Omega(f)+\Omega(g) \subseteq \Omega([f,g])$, but could I have some hints to prove $\Omega([f,g]) \subseteq \Omega(f)+\Omega(g)$?


texts:
I have been reading some papers on cryptography based on multivariate systems and I have a question. How does one relate the difficulty of calculating Gröbner basis (GB) of a multivariate system with its degree of regularity?

From what I understand, for a lot of cryptosystems, there are ways of getting a system of polynomial equations, and a solution for such a system will give us the secret key (let us suppose this is unique). Once we have such a system, we can 'linearize' and solve them (like in Arora-Ge) or we can attack the system by calculating its GB and finding the root from there.

From Bardet's paper, for semi-regular systems, there is a quantity called a degree of regularity (there is also a way to calculate it) and she also gives how to estimate the difficulty of GB calculation using this quantity.

My question is: what if we don't know if our system is semi-regular? This degree of regularity seems to be roughly the highest degree term in the GB. If so, how can I estimate the highest degree term of the GB of a system of polynomials that I have in my hand?

There seem to be a few papers which go into any sort of detail in these topics, so I will be glad if I could also get some papers to read.


texts: Is there a security risk associated with using a PBKDF for an AES encryption key and Sha256 for a hash using the same password text?

texts:
I am writing an encryption program using C#. My goal is to secure files even if the computer is stolen and somehow logged into.

Assumptions

The code used to write the program is visible to a malicious user
The password hash used in the program's login process is also visible

Concerns

I am using the same password to:

Derive an AES encryption key using Rfc2898DeriveBytes
Login to the software by comparing a stored SHA256 hash

I don't know if the stored hash can be used to figure out the encryption key

Notes

I use two different salts: one for the hash and the other for the key. I'm not sure if this really helps though because they are both stored in plain text along with the user's password hash.

Does using a PBKDF and a SHA256 hashing algorithm on the same password text present a security risk in a single computer application?


texts: Calculating probability of finding collisions in an invertible hash function

texts:
Assuming we have an invertible hash function H that takes inputs of size 2n and outputs hashes of size n, I use the following algorithm to find collisions:

Choose a random M as input.
Compute its hash E = H(M)
Compute the inverse of the hash M' = H-1(E)
Collision if M != M', fail otherwise.

I'm trying to calculate the probability that the algorithm finds a collision. We have 22n possible inputs, and 2n possible outputs. This means that on average we have 22n / 2n = 2n preimages for every output hash. The probability of the algorithm finding a collision is then the probability of randomly choosing two unique values out of the hash's preimages (2n). So: (2n - 1) / 2n.

At least this is my solution. From the notes I have, the TA solved it something like this:

x = 22n/2n = 2n/n = 2
Probability(M == M') = 1/x = 1/2
Probability(M != M') = 1 - 1/x = 1/2

Am I wrong? Where is my mistake?


texts: Security of a sha-256 based stream xor cipher?

texts:
Provided that I have some data I want to cipher and a password to do it:

I generate a random IV
I define c = sha256(password)
I generate an infinite stream where x0 = sha256(IV xor c) and xi = sha256(xi-1 xor c). This produces blocks of 32 bytes and I yield them byte by byte
output = data xor stream

Would this be secure? In case it's not, how insecure is it?

Note: The NSA isn't going to crack it, I just need it to be secure for a user with average-high cryptographic knowledge.

I know it may look similar to Is it feasible to build a stream cipher from a cryptographic hash function? but it has some differences:

I use a random IV instead of starting with hash(data)
Im xoring c in each phase of the stream generator, so even knowing xi you can't guess xi+1


texts: Using XOR to derive a data key for ECIES

texts:
I have been thinking about a rather simple enhancement for (EC)IES / RSA-KEM. The scheme would allow you to encrypt data while the calculation of the session / data key can be performed afterwards or in parallel. It would also allow you to encrypt for multiple recipients.
Anyway, the scheme would simply be:

Generate a (random) symmetric key: $K_d$;
Encrypt data with key $K_d$ using a symmetric cipher, resulting in $C$;
Generate an ephemeral key pair with public key $\widetilde{P}$;
For each recipient enumerated by $i$:

Calculate a session key $K_i$ by performing key agreement with a static public key of the receiver (followed by a KDF);
Perform $A_i = K_i \oplus K_d$;
The messages consist of a quad $(i, A_i, \widetilde{P}, C)$ where the $i$ is just used to indicate the recipient.

To decrypt you would simply perform the key agreement again, followed by $K_d = K_i \oplus A_i$. For RSA-KEM the ephemeral key pair derivation is not required, and $\widetilde{P}$ is replaced by the result of the RSA-KEM operation with the public key of the receiver.
This seems to be a specific version of a simple Multi-Recipient Symmetric Encryption Scheme using Secret Sharing combined with (EC)IES or RSA-KEM. Obviously you'd have to store the $A_i$ values with the ciphertext, so that is a disadvantage compared with the normal ECIES approach.
Are there any particular problems with above approach? Are there more secure / flexible / efficient schemes to do the same?


texts: Indistinguishable encryptions in the presence of an eavesdropper

texts:
I'm trying to understand how the messages $m_0$ and $m_1$ can be distinguished here. I understand the adversary game, so in short: Adv chooses $m_0$ and $m_1$, one them is encrypted and Adv is able to tell which one has been encrypted.

My understanding is that (ignoring the ctr for the moment, because its the same for each encryption):

$F_k(1+ m_{01}) = F_k(1111), F_k(2+m_{02})= F_k(1111)...$
$F_k(1+ m_{11}) = F_k(0001), F_k(2+m_{12})= F_k(0010)...$

We know if $m_0$ is encrypted then each block will be the same, if $m_1$ is encrypted instead we should get some random. If someone could explain if my understanding of $F_k$ is correct and if there is some significance in $m_1$ and why it's all 0. Or am I overthinking this...


texts: Using a block cipher with timestamp instead of counter

texts:
I have a system where machine A sends updates to machine B. The updates are sent over the internet, where each update is a single UDP datagram. Machine A sends a local timestamp in each update (we can assume that the timestamp increments for each message). Messages can vary in length, but there is a maximum size (consider it <1kb).

I would like to secure this communication. Specifically I require that:

Machine B can verify that an update is from machine A, and no tampering has occurred.
An attacker cannot decrypt the updates.
The implementation on machine A is simple and lightweight.

It's okay for an attacker to drop, reorder and replay the updates. (The timestamp in the update mitigates such attacks.)

I can arrange for both machines to share a symmetric key.

My initial thought is to encrypt each message with a block cipher in ECB mode, where each message fits in a single block. I believe the timestamp in the message mitigates the problems with ECB, performing a similar function to the incrementing counter in CTR mode. Are there problems with substituting a timestamp in place of a counter?

One problem here is that the messages are larger than most cipher block sizes. I could instead use a stream cipher, but I'm not sure of the consequences of doing so. Alternatively, there are apparently constructions to make a block cipher with a larger block size, but I'm not sure how they work either.


texts: Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

texts:
I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of each nonce.
In the paper "Recovering Secrets from Prefix-Dependant Leakage"

In Section 5 "Application to ECDSA", the authors stated that if we have a group of size n, and we are able to know k bits of the nonce of each signature,
then the number of messages that we need (which is also the dimension of the lattice) is given by:
d = n / (k - c),
where c = log2(sqrt(πe/2)).

I am not understanding where did they get this relation from, neither where did the constant c come from.
I have read many papers but couldn't really identify the origin.

I could be really thankful for your help.
Thank you!


texts: Is creating an OTP of a key to some data a secure secret sharing scheme?

texts:
Suppose I have some data that has been encrypted with a known, secure algorithm and a key k. I want to distribute "pieces" of the key to n of my colleagues, and only be able to access the data when all keys are used.

I create a one time pad and XOR the key, then give that OTP to colleague 1, and reapeat this for each colleague. I have a couple questions about this:

Once the key has been encrypted, does it matter which piece was originally the key, or are all pieces now equal?
Suppose my colleagues all meet without me, for a total of n-1 keys, is there anything they can do with the collective data?
Could creating so many one time pads somehow create a vulnerability, or does the strength of an OTP hold with each subsequent piece created?


texts: Can key hardening compensate lack of entropy?

texts: In the context of an offline brute-force attack on encrypted data at rest (say, a password-protected AES encrypted file), is a password with 64 bits of entropy and 65536 rounds of key hardening just as strong as a password with 80 bits of "true" entropy (and no key hardening)?  I guess what I really want to know is, can I get away with using a shorter password if I know that key hardening is applied?


texts: How is asymmetric cryptography safe if one of the keys is public?

texts:
Let's suppose $A$ is sending a message $m$ to $B$ using asymmetric cryptography.

To guarantee the authenticity of a message, $A$ encrypts $m$ with $A$'s private key: $E(m, k_A) = m_A$.

Then, $A$ sends $m_A$ to $B$.

$B$ can check that $m_A$ was sent by $A$ using $A$'s public key $p_A$, by doing $D(m, p_A) = m$.

If the public key $p_A$ is, by definition, public, if an attacker intercepts the communication and get $m_A$, he could easily find $m$.

How is asymmetric cryptography safe under these conditions?


texts: Should I be concerned about padding oracle attacks if the lifespan of my key is ~1 minute?

texts:
I'm using 4096-bit RSA to encrypt a 256-bit AES key generated client-side.  The RSA ciphertext is then sent to the server, and the server decrypts the RSA ciphertext to acquire the AES key.  Information is then exchanged between the server and client using the AES key in CBC mode.

I generate a unique IV using a secure RNG for each message and send it with the AES ciphertext.

I am aware of three weaknesses to this system so far:

An attacker gains access to a client system and manages to adjust the RSA public key.  As far as I am concerned, if an attacker has access to a client system, I have bigger problems to deal with anyway.
Anyone can communicate with my server provided they have my RSA public key.  Again, not too worried about this, as a password is required to be sent to the server before it will perform any operations on behalf of the client.  If a password is leaked, once more, I have bigger problems to deal with.
A Padding Oracle attack due to my use of CBC Cipher Mode, so:

The exchange of keys and commands between client and server will last, at most, around 1 minute.  Normally this time period is far less.  Since the AES key that is used exists for such a short period of time, and given that it is not stored anywhere other than in memory, is it possible for a padding oracle attack to crack the key?


texts:
I'm looking for a way to perform encrypted nightly backups of a server I administer, without storing the decryption key on the server.

A form of PK encryption seems ideal for this, as I can store the public key on the server, and the private key somewhere else private (like on a post-it attached to my monitor, or for real security, under my matress).  If I need to restore from backups, I can get the private key out of hiding.  At least, so goes the theory...

However, only a small amount of data can be encrypted with an RSA public key, so this needs to be a symmetric key used for the actual encryption, which must be generated at the time of file encryption and stored alongside the backup so I don't have to store this on the server.

Given the above, do the following two simple shell scripts make security sense, and what (if any) existing and proven Open-Source software is available to do something like this?

#!/bin/bash
#this is the encryption system used like this: ./crypt.sh publickey.pem mycleartextfile.txt

PUBKEY=$1
CLEARTEXT_FILE=$2

SESSION_KEY=`openssl rand 256`
echo "$SESSION_KEY" | openssl pkeyutl -encrypt -pubin -inkey "$PUBKEY" -out "$CLEARTEXT_FILE".key
echo "$SESSION_KEY" | openssl enc -in "$CLEARTEXT_FILE" -e -blowfish -out "$CLEARTEXT_FILE".openssl -pass stdin

...and the decryption script:

#!/bin/bash
#usage ./decrypt privatekey.pem encrypted-file-session.key encrypted-file
PRIVATE_KEY=$1
SESSION_KEY_CRYPT=$2
CIPHERTEXT_FILE=$3

openssl pkeyutl -decrypt -inkey "$PRIVATE_KEY" -in "$SESSION_KEY_CRYPT" \
| openssl enc -d -blowfish -in "$CIPHERTEXT_FILE" -out "$CIPHERTEXT_FILE".out -pass stdin

Any thoughts on this are much appreciated.


texts:
I recently read questions about "MAC then Encrypt/Encrypt then MAC" which made me curious about how they actually use the algorithm.

MAC only calculated once either case (according to what I read). However, in my experience surfing website via HTTPS, I think we should check the authenticity in every chunk of data received.

For example if I assume the MAC was appended at the end of encrypted data, how a browser is so confident so they execute Javascript before the HTML complete downloading.

Further more when downloading large file via HTTPS the browser seem to write the decrypted data to the harddisk before receive all portions of the file.

I think we should use updatable MAC in this case and verify each chunk of data received. However, with this approach it still vulnerable if the objective of an attacker is to discard some portion of data for example "the attacker want the first Javascript to be executed but the second one".

So, I want to ask what scheme browser used to make it sure enough to perform some operation without receive all portions of the file? Or is my info wrong at some point?


texts: Is there a way to change encryption scheme from AES to FHE without data leakage?

texts: So let's say that we have encrypted some data using symmetric encryption in this case AES. And we want to change it to homomorphic encryption but without decrypting the data and encrypting it again using FHE. Do you know if this is possible in any way?


texts: How hard is to figure out the ENCRYPTION key given message and clear text?

texts:
How feasible is to brute force the ENCRYPTION key if you have

the clear-text message
the encrypted-version of the same message
you know that Rijandel is the encryption algorithm
you know that the salt is 2 bytes long


texts:
I have the following question:

  What polynomial, when factored over the field $GF (2^8)$ based on the irreducible polynomial that is used in Rijndael, will factor into all the polynomials in the field?

As I understand it, the polynomial should be an irreducible polynomial and this polynomial must factor all the polynomials. How can I get this polynomial? What steps should I follow?


texts: implementing a cryptographic hash with a block cipher

texts:
How can a cryptographic hash function be implemented/created using the block cipher?

I was wondering if we can use AES in cipher block chaining mode to implement it.


texts: Cryptanalysis of Marvin32 compared to SipHash

texts:
So I am curious about the security analysis of Marvin32, the randomized hash algorithm used in .NET (to prevent hash-table DoS). I found the source code here: marvin32.h, marvin32.c.

At first glance, the construction looks really similar to that of SipHash, but:

Marvin32: 1 round per block and 2 finalization rounds
SipHash: 2 rounds per block and 4 finalization rounds
Marvin32: 64-bit key space (seed)
SipHash: 128-bit key space

Nevertheless, the construction seems so similar that it looks like MS was trying to build something like a PRF. The 64-bit key space is certainly too small for a general-purpose PRF, but assuming that 64-bit is enough, is this a secure PRF? Do you see anything else wrong with the construction (key expansion, hash)?

To me it looks like the rounds are too short for this to be a crypto-grade PRF (again, ignoring the key-space for a moment), but maybe it's enough to thwart the hash-table DoS assuming the key is changed from time to time using a CSPRNG?


texts: Is HMAC necessary if the AES ciphertext of a message includes the CRC of the message?

texts:
I've seen that encrypting an image with AES-CBC then calculating the HMAC-MD5 value for authentication is a somewhat common and sound way to secure data. Alternatively, can I just calculate the CRC of the data, and then encrypt the data+CRC with AES-CBC?

I am concerned about a ciphertext-only attack modifying the data and that data then being decrypted and executed/processed. Can I assume that it is unreasonably difficult to maliciously modify encrypted data in a way that results in the same CRC or modifies the encrypted CRC to match? If that assumption can be made, then is it necessary to also do an HMAC-MD5 calculation of the encrypted data?


texts: What are the practical impacts of Wassenaar Arrangement to crypto development?

texts:
Wassenaar Arrangement limits transport of high-grade crypto hardware/software since decades, if I don't err. What are its practical impacts in that direction?

In particular, does it hinder in any sense publication of highly secure codes in proceedings of scientific conferences, on the Internet, or sending of the corresponding implementations as attachments via emails anywhere in the world?


texts: How to derive a private/public keypair from a random seed?

texts:
For RSA, my understanding is that large primes are found randomly to build a private/public keypair. If a static seed can be used in that random search process, it should be possible to derive the same public/private keypair reliably.
For a repeatable discovery of foundational large-primes, the search for random primes might begin with an initial random large number. Then a sequential evaluation of large numbers to detect if they are prime.
This could be used to virtually create a TLS-PSK kind of system but using the more widely deployed TLS algorithms (PSK isn't widely deployed). Therefore, TLS is leveraged and induced to work like a PSK-based system, by using the random seed to find the large primes. That is, the seed value is virtually the PSK "symmetric key". Both parties derive the same private/public keypair from the large primes from the shared seed.
Are there major security flaws with this approach? Are there existing schemes that accomplish such a random seed process?
Advantages achieved:

Simple central distribution (PKI) - a central control server distributes "seeds" in the same manner as "symmetric passwords" that could conceivably be changed every 15 minutes.
Tooling - TLS protection with common libraries (eg. C# .Net Framework) - with a "symmetric password" like framework. (DTLS isn't common)

Compared to central keypair generation and distribution:

Processing is decentralised and more scalable if the central control server only needs to generate a cryptographically-random seed. (The search for the primes happens N times, where N is the amount of nodes using the shared seed).
Fewer bytes to communicate. If the seed value is fewer bytes than communicating a public/private keypair.

I have a conceptual new secure communication system in mind that would use these advantages.


texts: Why random number used in RSA padding but not in AES?

texts: I noticed that people use a random number in the RSA-OAEP padding scheme to avoid deterministic encryption. But in pkcs#7 people just use the padding size rather than some random bits. Doesn't it make AES deterministic?


texts: What is the best way to accurately describe this statistical probability?

texts:
I am in the process of writing some information for an App. I need to express the probability of something happening but in a way that is correct but easy to understand. I'm confused on the actual math for this. I'll simplify the numbers here.
Assume a system has 1,000 possible unique codes and I have used 10. I set a computer to search for the codes at a rate of one per hour. How many hours statistically before I find a code ?
On the face of it, I am assuming 100 hours. But I have a feeling that this wouldn't be correct ?


texts: Generating a strong unique Initialization Vector

texts: How can I determine if I am generating a unique and strong Initialization Vector? If my mode is generating Keystream? Is there any scientific explanation in generating a unique and strong Initialization Vector?


texts: Random numbers for Master Key and Key_block

texts:
Exploration through RFCs concludes that random numbers used in the creation of Master Key and Key Block(Key material for Encryption Key and Mac Secret) are from ServerHello.random and ClientHello.random. Only these random numbers are used in both the cases. No separate Client and Server randoms for Key Block and Master Key.

Is this correct ?

If Yes, In the TLS KDF why there are separate set of random numbers for generating Key Block and Master Key ?

TLS KDF pdf : http://csrc.nist.gov/groups/STM/cavp/documents/components/askdfvs.pdf


texts: In DSA digital signature, why does k have to be random and unique each for each signing?

texts: If we repeat k, I think there is little chance for s to repeat since user's private key x is random which is also used to calculate s.


texts: How to estimate time / difficulty to brute force scrypt (or similar) hash at various short fixed lengh outputs?

texts:
My particular use case is a hash function that:

Is slow / computationally expensive. It would take a pretty long time, or be infeasible to guess the input, if the hash output and the algorithm are provided.
Has a pretty short output. The shorter, the better, want a trade-off between difficulty and size

I am a cryptography hobbyist (so not too knowledgeable yet), and want to use this for a small experiment. I am aware of the scrypt algorithm which is intentionally slowed and bloated (resource wise) to make brute forcing more difficult. I found this online tool where it outputs the hash with a given input, optional salt, output length, and options for CPU difficulty, memory difficulty, and parallelization difficulty adjustment.
I want to determine the relationship between making something infeasible to brute force while reducing the output size the most. Since scrypt seems to handle my use case I am thinking might use this function, but I want to know how to use it effectively, and how to determine that I'm doing so.
I think that increasing the memory difficulty a certain amount can prevent ASICs as well as current GPUs from attempting these calculations, limiting to only CPUs. I think that's an effective way to achieve my use case. What is this difficulty level, or how would I determine it?
Also, given that the output will be small, I'm looking to reduce collision resistance. I think that using a random number salt would achieve this. Is there some kind of limit on the upper bound for the salt value, or something that relates the salt space (I don't know the terminology) to the collision resistance? Hopefully my mental model of this checks out, let me know if not, as I'm pretty new to some of this.


texts: What is "electronic" in electronic codebook (ECB)?

texts:
This is an honest question regarding terminology. I believe that I understand why one mode to use a block cipher is called a codebook. But I wonder why electronic as a work appears here?

Is it fair to say this is just a fancy/stylish addition?
Should it relfect that often encyption is used with electrical devices?
Would ECB be impossible for a mechanic setup?


texts: Given a prime exponent e and a prime number n, find b, where b^e = 1 mod n

texts:
Can anyone help me with the following problem.
Given  a prime exponent $e$ and a prime number $n$, find $b$, where  $b^e \equiv 1 \bmod n \land b > 1$. For example, $b^5 \equiv 1 \bmod 11$ how to find $b$ ?
Can anyone describe me the steps please.


texts: Is Paillier secure from known plaintext attack for single character message?

texts:
Assuming I have three messages m1,m2,m3 where m1=m2=m3=1 and I compute c1,c2 and c3.

Does that mean that c1=c2=c3 in cipher-text from ?
If not, how many times can I encrypt a message m=1 and still produce a unique cipher-text ?

if not possible, can I solve the problem by putting Zeros as padding and still use the additive property ? (e.g. m1=01...m2=001 and m3=0001 and when I calculate x=c1+c2+c3 the decrypted result D{x}=3)

I just started working with cryptography, so please be understanding. :-)


texts:
I am only taking baby steps in RSA.

If $p=11$, $q=7$ and $e=3$,

$$\phi(n) = 10*6 = 60$$

Then:

$$d = (2 (\phi(n)) + 1 ) / 3 = 121/3$$

Should $d$ be kept as a non-integer or is such a $d$ invalid?


texts: Do the session keys have the same value on both sides during TLS?

texts:
I have two questions about the sessions keys generated during the last steps of the Handshake phase:

Do the "client write key" and the "server write key" have the same value, even though both keys are generated independently on both sides?

(Same question) Do the "client write MAC key" and the "server write MAC key" have also the same value?

General question: Do the client and server arrive at the same results while generating the session keys?


texts: Birthday attack for combination of hashes

texts:
I have to answer the following question for a homework assignment:

  You have a hash algorithm that converts a $2\cdot n$ bit number to an n bit
  number. How many hash values do you have to calculate to find a
  collision for $h(x) \oplus h(y) = h(r) \oplus h(s)$

I know that a you can find a collision after $2^{n/2}$ evaluations. But I don't know how this is affected by the fact that a $2\cdot n$ bit number is hashed to a $n$ bit number and the $\oplus$ of the hashes.


texts: Is a secure deterministic MAC always a PRF?

texts:
Given a secure MAC scheme $ \Pi=(Gen, Mac, Vrfy) $, wheres $ Gen $ produces uniformly distributed keys, and the algorithm $ Mac $ is deterministic, is $ Mac $ necessarily a pseudorandom function?

I think that it is a PRF: since there is no forger A that can somehow obtain information from the given tags, and thus deduce something about how the $Mac$ function is built (i.e. how a tag is created), I conclude that there's no distinguisher D that can distinguish between a tag and a random string emitted by a random function.

Is my intuition right? If not, I'd like to have some intuition as to why a deterministic MAC can't be a PRF. (An example of such a MAC would be great.) If yes, further intuition would be great as well.


texts:
Assume we have a somehow unorthodox implementation of RSA whereby:

$p$ and $q$ are chosen primes of length $n/2$ where $n$ is the number of bits desired in $N=p\,q$ and
$$\begin{align}
\phi &= (p-1)(q-1)\\
d &= p\\
e &= d^{-1}\bmod \phi
\end{align}$$

I can see that there is a weakness here but I'm unsure of how it translates. Playing around a bit I see that I end up with:

$$e = \frac{\phi j + 1}p $$

Further assuming that $\frac{1}p$ can be considered infinitesimal:
$$e ≈ j\left(q\left(1+\frac{1}p\right) -1\right)$$

So basically:
$$e ≈ j(q-1)$$

Is that right? Am I missing something?


texts: Zero-knowledge proof with only a ciphertext

texts:
Suppose there is a plaintext p, which is encrypted with a symmetric cipher using a key k, resulting in a ciphertext c. Bob knows both c and k, but Alice knows only c. Is there any protocol by which Alice can be certain (maybe with some probability) that Bob indeed does know p, without revealing to her p itself?

Also, it be great to not have to have any third-party involved.


texts:
I´m implementing the AES-encrypt algorithm for the SSE2 instruction set.

For the Subbyte function i use movzx, having loaded the S-box in the cache of the CPU for more performance. That cost about 56 OPS wing CPU.

I was wondering if you could calculate the value of the bytes without having to change the vector so seriously?
In particular, I would like to ask if you can significantly improve on a round of AES-128-Encryption taking about 108 OPS?


texts:
I am developing a product based on the NXP LPC11C24 microcontroller. It will communicate with PC software to perform its work. I am attempting to build a secure firmware update functionality. The PC program will download firmware images from us and send them to the device, decrypting, verifying, and writing the image to its flash memory.
I want this mechanism to be secure against PC software analysis and trivial attacks on the encryption. Assuming the attacker has full knowledge of the device and PC protocol, uploading an unauthorized firmware image should be more difficult than, e.g., defeating the chip's code protection, clock glitching, side-channel attacks, or similar.
The difficulty is space limitations. I have a hard limit of 4KB of ROM (ARM Cortex-M0 code, for size reference) and a firm limit of 1KB of RAM, of which I can budget perhaps 2.5KB and 600 bytes, respectively, to the decryption and authentication process. In light of this, I chose AES-128 CBC encryption with CRC-32 authentication. My method is to create a random IV, split up the firmware image into 256-byte blocks, and add a CRC-32 checksum after each block, repeated four times to pad to the AES block size, then encrypt the 272-byte block. The checksum is to catch data corruption during the transfer from PC to device (the PC can use SHA-256 to verify integrity from the web) and to authenticate the block. The PC cannot do the authentication because the PC-to-device protocol would be trivial to intercept.
The firmware update process would be as follows:

Enter firmware update mode
Receive IV, initialize AES
Receive encrypted 272-byte block
Decrypt block with AES-128 CBC
CRC-32 checksum first 256 bytes, verify checksum matches last 16 bytes
If verification fails, stop the process. If successful, write 256 bytes to flash.
Repeat from 3 while blocks remain

I have done some research, and it seems this CRC then AES method is trivially vulnerable (detailed in this other answer), but the attacks rely on known or chosen plaintext, which will not be the case here. Only us, the manufacturer, will be releasing updates, and they will always be encrypted. Is this then sufficient protection for my scenario, or at least harder to break than decapping the chip or exploiting the chip manufacturer's code protection system? Is there a better way that will fit the extremely tight memory requirements?


texts: If the AES S-Box is replaced with a linear or affine transformation, for instance the identity mapping $\sigma(x)=x$, does the cipher become entirely affine and hence trivially weak?


texts: How can Alice and Bob safeguard their message exchanges against replay attacks?

texts:
Assume Alice and Bob communicate over an insecure channel using one-time perfectly-secret encryption together with one-time secure message authentication code. Say Eve has the ability to eavesdrop and to inject messages into this insecure channel, but not to block or delay messages (i.e. Eve can mostly only replay authenticated encrypted messages).

Of course we can design scenario damaging to Alice and/or Bob. How can they protect themselves against such replay attacks?


texts: Differential representation of binary curve as a public key

texts:
Given elliptic curve $E$ over binary field $k$, a public key is the pair $(x,y)$ in $E$ and $x$ and $y$ in $k$.  The differential representation of $(x,y)$ is $w = x + y$.

What security implications are there from using $w$ as the public key, rather than $(x,y)$?

Assume the curve is BBE251 (http://binary.cr.yp.to/bbe-20090604.pdf).


texts: Finding public key out of ECDSA certificate

texts:
I got an ECDSA certificate and now I'm trying to find out the public key. I'm not very familiar with this topic, so I hope you bear my (maybe silly question).

The reason I'm doing this is, because my task is to test the encryption part of a software. Well, actually it doesn't work fine, so the first thing I need to find out is, whether the issue is in the program, or I am the issue.

So I used an ASN1 decoder to read my test-certificate, which told me, that the curve prime256v1 is used and that my public key is

  03 42 00 04 B4 60 C8
  AA 5C 2A 63 20 84 79 D4  E7 73 53 67 A4 9D B9 D0
  9D 56 B1 03 14 D9 65 9B  2D 04 76 CC 0E F9 79 AB
  C3 E5 75 72 25 33 6C 05  FF 40 BA 55 36 45 76 62
  F1 5A 52 6F 57 E8 AB 0E  E0 84 DF 39 3F

If I understood things right, the first octet 03 isn't interesting for me. The second octet 42 tells me, that the key consists out of 66 octets.
Now we come to the interesting part;
The 00 04 tells me, that I'm lucky and no point compression is used, which means, that the abscissa and ordinate Key are easy to find out.

Because of my prime number (related to my prime256v1) I know, that length of X and Y Key is 32 octets. So I take the first 32 octets to form the X-Key and the last 32 to form the Y Key, so

X_Key = B4 60 C8 >AA 5C 2A 63 20 84 79 D4  E7 73 53 67 A4 9D B9 D0 9D 56 B1 03 14 D9 65 9B  2D 04 76 CC 0E

Y_Key = F9 79 AB C3 E5 75 72 25 33 6C 05  FF 40 BA 55 36 45 76 62 F1 5A 52 6F 57 E8 AB 0E  E0 84 DF 39 3F

Because my program requires 36 octets for X- and Y-Key, I add 4 leading zeros to get my result.

I would appreciate, if anyone of you can check the way I painted here and tell me whether I made some mistakes or not.

Thank you very much!


texts: RSA - factorizing $N$ to get $p$ and $q$

texts:
I need to decrypt a message encrypted using RSA. I only know the public keys $n$ and $e$.

I need to get the private key $p$ and $q$ in order to get the decryption exponent $d$. Now to do so, I know I have to factorize the value of $n$, but when I do so using the ifactor function in Maple 2015, the answer given to me is a multiplication of many numbers instead of just 2 like it did in the past. I am clueless on how I should proceed in order to factorize this $n$, any advices would be greatly appreciated

n := 74752948599375228832232800265920355903229476316972757692116239589318799769667409077851878093676056216568921626754052480650902973870821108799

ifactor();
$(3445752473)\space (1246180487)^2\space (91139)\space (84229)\space (82799) (47563)^5\space (31847)\space (21787)\space (15629)\space (89189)\space (58337)\space (30631)\space (45853)\space (91951)\space (88411)\space (11987)\space (74797)\space (25561)\space (65287)\space (73417)\space (45817)\space (27847)$

Thank you in advance for your much needed help


texts: Trivial Broadcast Encryption Scheme for video conferencing how well does it handle users joining or leaving a call?

texts:
Consider the trivial Broadcast Encryption Scheme for video conferencing, where each user shares a long-lived key with the broadcaster, and the session key used to encrypt a multicast message (or stream) is sent to each participant encrypted under their long-lived key.

How well does it handle users joining or leaving a call?


texts: How does BB84 fare against an attacker who can entangle qubits?

texts:
Consider the following attack on the BB84 quantum key exchange protocol (as far as I can tell, it should work similarly for E91):

After Alice sends her key bits encoded in qubits with randomly chosen bases, Eve intercepts them without making a measurement.

She uses her quantum computer, prepares it in a |0⟩ state and, for each bit, does a CNOT with her own qubits as targets and Alice's bits as controls, thus entangling them.

Then, she sends Alice's bits on to Bob, who measures them.
This projects them into an eigenstate of Bob's chosen base.
It also projects Eve's qubits into the same states.

After Bob and Alice have publically announced their bases, Eve measures her qubits in the same bases that Bob chose, getting the same result.

This way, she will not learn which bits Alice sent, but she will learn which bits Bob received, which is enough.
She will also not be detected when Alice and Bob compare part of their keys, because she makes her measurements only after Bob makes his.

Does this attack (theoretically) work?
If not, what's the problem?
If it does, why is BB84 considered (theoretically) secure?


texts:
In the following, all the operations and polynomials are defined over a finite field of prime order, $\mathbb{F}_p$, where $p$ is a sufficiently large prime number. All polynomials and values below are non-zero.

Let $F(x)= R(x)\cdot \phi(x)+Z(x)$, where the degree of each of the polynomials $R,Z$ and $\phi$ is $d>1$. Also, let $Z$ and $R$ be two polynomials picked uniformly at random from the field.  Note $\phi$ is a fixed polynomial.

Question 1: Is $F(x)$ a MAC of $\phi$(x)?

Question 2: Is polynomial $\frac{F'(x)-Z(x)}{R(x)}$ a random polynomial distributed uniformly among polynomials of degree $d$ over $\mathbb{F}_p$? where $F'(x)$ is a fixed polynomial known by the adversary.


texts: Is there any cryptographic primitive bijective (one-to-one and onto) function for creating cryptographic tools like symmetric encryption/decryption, Hash code generator, MAC, HMAC and Random number generator?


texts: how to calculate maximum data size of an RSA signature

texts:
I am reading a content, and am not sure if I follow how they come up with the maximum data size which can be signed by an RSA key. The author states:

  "... if you are trying to sign a message using a 2048-bit RSA key whose public key size is 256 bytes, the maximum length is 256 bytes minus the encoding parameters, in this case 11 bytes. Therefore the maximum length of the data message that can be signed directly is 254 bytes ..."

I am not sure if I need to know a little more about RSA to know what the 11 bytes of encoding parameters are. My question(s) are:

How did he come up with the 254? 256 - 11 = 245
How did he get the maximum of 256 bytes?


texts: Examine whether a hash function is collision-resistant

texts:
Assume a collision-resistant hash function $h$ which compresses sequences of length $2n$ to length $n$. It must be examined whether the hash function which compresses seqs. length $4n$ to $n$:
$$
h_1(x_1 || x_2 || x_3 || x_4) = h((x_1 \oplus h(x_2 || x_2)) || (h(x_3 || x_3) \oplus x_4))
$$
is collision-resistant or not. ($\oplus$ is XOR, $||$ is concatenation and $|x_i| = n$).
Attempt:
Assume we can easily find two distinct sequences $(y_1, y_2) = (x_1 || x_2 || x_3 || x_4, x_5 || x_6 || x_7 || x_8)$ such that $h_1(y_1) = h_1(y_2)$.
Then, we can easily find $(y_1, y_2)$ such that:
$$
h(g(y_1)) = h(g(y_2))
$$
where $g(y) = g(x_1||x_2||x_3||x_4) = (x_1 \oplus h(x_2 || x_2)) || (h(x_3 || x_3) \oplus x_4)$.
But then, if we can easily find such $(y_1,y_2)$, we can also easily find $(g(y_1), g(y_2))$ and thus $h$ is not collision-resistant.
In case the above argument isn't valid, another idea would be to state that $g(y_1), g(y_2)$ cannot be distinct (with non-negligible probability) since $h$ is collision-resistant and continue with solving $g(y_1) = g(y_2)$ etc until we get $y_1 = y_2$.
It'd be very helpful if someone pointed out to me which of the two (if any) is the correct proof.


texts: How does DJB's nistp224 manage to fit compressed points into 224 bits?

texts:
DJB's nistp224 program purports to be an implementation of elliptic curve Diffie-Hellman relative to the standard NIST P-224 elliptic curve.

To the best of my understanding, ECDH relative to this curve should produce 225-bit public messages (compressed points consisting of a 224-bit x-coordinate and a 1-bit y-coordinate), which require 29 bytes to encode (in SEC1 format).  Yet somehow nistp224 manages to produce 28-byte messages, which are therefore one bit short.

How does it do this?  I find the source code utterly unenlightening.

(Rationale for question: It sure would be nice if I could shave a byte off my messages on the wire.)


texts:
How does Blom's scheme work? Is the polynomial expression of it a normal one?

A few additional questions:

How big does the prime modulus need to be? Can it be bigger than the size of the derived key?
The implementation used by HDCP 1.x uses addition and no multiplication in the calculation of the shared key. Simple examples I've seen in handouts for courses at universities posted online include multiplication as well. Why the discrepancy?
Does the scheme require any special operations like those used in finite field arithmetic?
What is the term for the scheme? Is it a key establishment scheme, a key agreement scheme, a key exchange scheme, etc.
This is the first scheme for key agreement that I've seen that doesn't rely on Diffie-Hellman or public key cryptography. Are there any other alternatives?


texts: Format Preserving Encryption FF1 Samples

texts:
NIST published methods for Format-Preserving Encryption and there is a link in the document giving examples for FF1  methods.

I am confused by the value of R given in the examples. $R$ is the output of PRF, and it should be 16 bytes. But all the $R$ values listed in the file are 32 bytes. Why is that?

For example, Page 1 , Round #0 , Step 6.ii:

R is [ 195, 184, 41, 161, 232, 100, 43, 120, 204, 41, 148, 123, 59, 147, 219, 99, 1, 2, 1, 0, 0, 10, 10, 5, 0, 0, 0, 10, 0, 0, 0, 0]

The first 16 bytes is actually the output of PRF with the given arguments and I have implemented this, but the remaining 16 bytes (starting from 1, 2, ...) is actually the same as the value of $P$ given in Step 5:

P is [ 1, 2, 1, 0, 0, 10, 10, 5, 0, 0, 0, 10, 0, 0, 0, 0 ].

What is actually going on here?


texts: Question on PKCS11 2.40 spec and AES_CBC wrap

texts:
PKCS11 cryptoki version 2.40 Current mechanism specification (section 2.8.5), says below statement for AES CBC wrap:

  For wrapping, the mechanism encrypts the value of the CKA_VALUE attribute of the key that is wrapped, padded on the trailing end with up to block size minus one null bytes so that the resulting length is a multiple of the block size

Questions:

if any key has NULL bytes (or zeros) at the end, how the unwrap knows how many padded bytes are added?
Also, I'm the beginner for cryptography so I'm not sure whether any secret key can end up with zeros or not. Please clarify me this also.


texts:
Why was such a weak key schedule chosen for IDEA?

The key schedule of IDEA works like this:
Divide the key (128 bit) into 8 round keys, each 16 bit long. This are the first 8 "round" keys (6 keys per round). Rotate the original key by 25 bit to the left. Repeat this until we got the needed 52 round keys for 8.5 rounds. (4 keys for the last "half" round.)
This key schedule is fully linear and patterns in the key exist even in the last round keys with nearly no change. A high number of zero bits in the key is very problematic for the cipher because the number stays the same through the whole key schedule. Many attacks exploit this behavior.

This can be seen with a small example encryption. (Key ($K$) and plaintext ($P$) in hexadecimal formatting, leading zero bytes were omitted. )
  $$ K = 00, P = 00, \operatorname{IDEA}(K,P) = \text{0001 0001 0000 0000} $$
  $$ K = 00, P = 01, \operatorname{IDEA}(K,P) = \text{0013 fff5 0012 0009} $$
  $$ K = 00, P = 02, \operatorname{IDEA}(K,P) = \text{0191 0059 011c ff32} $$
  $$ K = 00, P = 03, \operatorname{IDEA}(K,P) = \text{038f 0099 02d6 fe33} $$
  $$ K = 00, P = \text{01f0}, \operatorname{IDEA}(K,P) = \text{1841 fbc1 ef20 f270} $$
  $$ K = \text{0d50}, P = 00, \operatorname{IDEA}(K,P) = \text{3fb2 5ff2 055d 16a6} $$
(Source: IDEA calculator (Java))

Further analysis of the data and the encryption process shows very slow avalanche effect when high amount of zero bits were in the plaintext or ciphertext. Why was this not recognized and solved? Was this kind of problem not known at the time as IDEA was invented? Or is this no real problem because of the low probability of this effect on random keys?

The paper "Weak Keys for IDEA" (1993, PDF) shows that even a small correction could solves this problem, like the XOR of a constant to every round key before using it. The constant $\text{0dae}$ (16 bit, hexadecimal notation) was chosen as an example, but the exact value is not critical to solve the problem as stated by the paper.

Are there any papers which descripe the development process of IDEA? Maybe they could explain some thoughs about the key schedule.


texts:
My question is rather practical and specific. I am trying to setup an efficient CKKS scheme in Palisade. To this end, the automatic choice for secure parameters has to be turned off and I rely on the LWE estimator which estimates the security of an LWE instance. Now, the estimator provides a security estimation for an LWE instance $\mathrm{LWE}(n,\alpha,q)$, where $n$ is the dimension/ring dimension, $\alpha$ depends on error distribution, and $q$ is the ciphertext modulus. However, in Palisade there seems to be no possibility to setup the error in CKKS (this is easily possible in BGV). This way, $\alpha$ remains unknown and the security can not be estimated.
Therefore, how is the error chosen in Palisade for CKKS and how can this value be accessed?


texts: Why does my SSH private key still work after changing some bytes in the file?

texts:
I (for a test) just randomly altered a private RSA key by opening it up in Vim and changing a few bytes. It is the private part of an SSH key pair used for logging in on a remote system. Puzzlingly, it still allows me to login.

I did some research and found that it is a base64 encoded ASN.1 container, so I pulled all the relevant integers out with OpenSSL and it seems only $d$, the private exponent, has changed (and only slightly at that). Is it possible the additional cached values are therefore being used to decrypt the value sent from the server, in order to still allow me to be logging in? The public key can (as expected) still be derived due to the other integers in the ASN.1 still being the same.

As I'm an encryption dufus I'd appreciate some guidance on how the above is possible. I've found when I modify the key in Vim by larger amounts it rejects me as expected. Thanks.


texts: How can I proof that in Fermat's primality test the probability of going wrong after k iterations is $\big(\frac{\phi(n)}{n-1}\big)^{k}$?


texts: What is the purpose of the "Explicit Nonce" in TLS for AES-GCM and AES-CCM?

texts:
TLS uses an explicit (secret) 32-bit nonce in combination with the 64-bit sequence number to create the IV for AES-GCM and the nonce for AES-CCM. However, I wonder why TLS needs the explicit nonce.

In general, the sequence number is used to prevent the reuse of the IV in AES-GCM, or nonce in AES-CCM. The sequence number does not wrap (RFC5246) since the keys have to be renegotiated if the sequence number would exceed its limit. Thus, it should not happen that a sequence number is used twice under the same key.

So why is there an additional 32-bit nonce added to the sequence number?


texts: Can we reverse a hash when we know part of the input?

texts:
While I read that hashes are not meant to be reversible, but assuming we have part/half of the message/input of a hash? Is there any method that we can use to recover the remaining message via this part of the message that we have?

Thanks in advance


texts: Confused about terminology in the many flavors of security

texts:
I am learning about cryptography from diverse sources, and I have found terminology a bit confusing.

In principle, I understand the difference between the symbolic model and the computational model. However, then I am confused when I see things like :

information-theoretic security,
computational security,
concrete security,
asymptotic security,
perfect security.

What is the relation of all these with the symbolic and computational models? What are the relationships between them?

Is there a source where I can make sense of the terminology in a unified fashion?


texts: Schnorr Ring Signatures - wrong hash results

texts:
I don't know if I've placed the question right, It is half maths, half programming.
I'm writing Schnorr Ring Signatures on Elliptic Curves in Java and I have a problem. I've found scheme on integers and translated it to elliptic curves.

In point 3 on page 11

$R_s = g^a \prod_{i \neq s}(y_i^{-H(m, R_i)}) \ mod \ p$

and in my elliptic curve version

$R_s = aG + \sum_{i\neq s}(Y_i*-H(m,R_i))$

where $G$ is a generator, $Y_i$ is a public key of i-th user, $m$ is a message and $R_i$ is $a_iG$ where $a_i$ is random.

I have

basepoint $G$
cofactor $h$ to the order of $G$
order $n$ of $G$
points $A$ and $B$

My question is how to perform a modular inverse of $H(m,R_i)$. In Java I have a modInverse method on BigIntegers but I have to know value of $p$. How to find value of $p$? Or how to calculate $-H(m,R_i)$?

EDIT:
OK, thakns. I've found $p$ value. But still I'm getting wrong results. If someone would be so nice to look at it here is my sample code. Thanks in advance for help


texts: Perfect shuffle possible with limited raw entropy?

texts:
I am trying to shuffle a standard 52-card deck in a perfect way (every outcome should be possible at an equal chance). I am not, at this point, concerned with cryptanalysis attacks against it.

I have run into some problems/questions that are probably answered in cryptographic theory:

Most PRNGs run off some sort of internal state. A deck of cards has 52! shuffles, which is a 220+ bit number. Is it possible to generate all shuffles with a PRNG that has 64, 128 or 160-bit internal state? My intuition says no. Even though to shuffle the deck I only need 52 small random integers, a PRNG with internal state size below 52! probably cannot generate all the different 52 number sequences needed. Is this true or am I completely wrong?
In case I am right above, does that mean I cannot generate a true shuffle in most modern programming languages? Java's SecureRandom only has 128bit internal state and even /dev/rand uses a SHA-1 based PRNG on MacOS (160bits), so even using the "golden standard" cryptographic random source it isn't going to be enough. What are my options? What about JavaScript.. what are my options in the browser?
The option I came up with is to use CPU's built-in RDSEED command to get 256 bits of a really random seed, then I would like to use a PRNG with 256 bit internal state to shuffle the cards. Is that a sensible choice? What's the simplest way? Some sort of SHA-256 hash-based PRNG?


texts: Why inversion and multiplication operations are costly in elliptic curves?

texts:
There are several algorithms for efficient scalar multiplication of an arbitrary point P(x,y) by some positive integer k in elliptic curves defined over $F_{p}$ or $F_{2^{m}}$.

The scalar multiplication deals with point doubling (adding P(x,y) to itself) and point addition(adding two different points (P(x,y),  Q(X,Y)). These point doubling and additions, fundamentally,  further deal with additions, squaring, multiplications and inversion operations.

My question here is that though there are considerable addition and squaring operations involved in scalar point multiplication, ( for example, a single point addition requires 8 additions, 1 squaring, two multiplications and one inversion ) why is the inversion multiplication ratio (I/M) is of special interest for researchers in performance evaluation of different algorithms for scalar point multiplication ?

I do understand that the inversion and multiplication operations are dominant in elliptic curve arithmetic, but aren't these addition and squaring operations, not dominant enough to be considered ?

I would encourage the readers to go through the table 3.13, page no. 145 in this  book so that you may get a clear idea of my question. Please have a look at the last 2 columns titled "EC operations" and "field operations" in this table.


texts:
Hello I'm working in a school project and I'm trying to resolve an issue.
I have a server, a BLE device and a computer.
The BLE device is constantly advertising data, I'm using 7bytes of the data leaving 17 bytes left and I want to use the rest of the bytes to check the authenticity of the BLE device.

So, when a computer is capturing the packages, I need to confirm that that package is really from an authentic device. My idea is:

The BLE device will sign the data (7bytes) with his private key (RSA method).
As the signature is much more than the 18bytes, it will generate a Hash of the signature.
The payload broadcast will result in the data (7bytes) + the hash (16/18bytes)
The computer will catch the broadcast message
The computer will send to the server the entire payload.
The server will have the BLE device private key and will sign the data (7bytes)
The server will generate the hash and will compare it
If it matches the server will send a successful code otherwise an error code.

My concern is it is possible to get the private key by getting the hash of a signed message? I think it is, but I'm not sure, maybe the hash can help in the guess of the private key, I don’t know.

And, this is a good and secure solution? If not do you guys know one better? Thank you.


texts: Why does LastPass use exactly 100100 PBKDF2 rounds

texts:
LastPass encryption scheme is recently changed to use more PBKDF2 rounds, specifically 100100. This seems like a really weird number choose. From what I understand brute force time scales linearly with rounds because more rounds simply mean that each hash takes longer/more memory to compute. Being just over 100k, it feels like there could be some weird prime number tricks that they are trying to avoid, but I honestly can't come up with anything, and it doesn't seem to be for backward compatibility with un-upgraded vaults either because those used to be 5k rounds IIRC, which would make it 105000 if they just slapped the extra 100k rounds on top.

So, why did they pick such a weirdly specific number instead of just straight up 100k? I don't get it.


texts: How to compare security between S-Box and Addition in the block ciphers?

texts:
I'm studying a block cipher based on ARX(Addition, Rotation, XOR).

In a block cipher, nonlinearity comes from S-box or modular addition($Z=X\boxplus Y$ mod $2^n$).

As far as I know, in the case of S-Box, its security can be explained in the algebraic aspect.

How to explain the modular addition($\boxplus$ mod $2^n$) in the algebraic aspect?


texts: Difference between actual attacks and theoretical attacks on SHA cryptographic series

texts: Could anyone tell me what the difference is between a theoretical attack (Like the one done on SHA-1) and an actual, practical attack (Like the one done on SHA-0)? Is a theoretical attack a proposed method of attacking, that no one has ever done due to lack of resources (like computing power)?


texts:
I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography.  The book presents a padded RSA:

${\bf Key Generation:}$ same as Textbook RSA (given security parameter $1^n$, generate public key ($N,e$), secret key ($N,d$), such that $N = pq, ed \equiv 1 \mod{(p-1)(q-1)}$)
${\bf Encryption:}$ given public key ($N,e$), and message $m$ of length $l(n) \leq 2n - 2$, choose random bit string $r$ of length $2n - l(n) - 1$, and interpret the padded message $r||m$ (where $||$ is concatenation) as an element of $(\mathbb{Z}/N\mathbb{Z})^*$.  Output the ciphertext $c := (r||m)^e \mod{N}$.
${\bf Decryption:}$ given secret key ($N,d$), and cipertext $c$, compute $m' := c^d \mod{N}$, and ouput the $l(n)$ low-order bits of $m'$

The book claims that if $l(n) = O(\log{N})$, then the padded cryptosystem is CPA-secure.  Unfortunately, it states that the full proof is beyond the scope of the book.  Where can I find the full proof of the CPA-security of this version of padded RSA?


texts: Should I be using PKCS1 v1.5 or PSS for RSA signatures?

texts:
I am implementing an application where a user needs to sign some data that they have created, store it in an untrusted place, then later retrieve that data and verify it is still authentic before using it. The user already has a RSA keypair for doing encryption throughout the application so I would like to re-use it for this signature (or else I would normally just use HMAC).

I see that I have two schemes available with RSA signatures: PKCS1 v1.5 and PSS.

Which of these should I be using? PKCS1 v1.5 seems a bit simpler to implement.
Are there security concerns with each schemes I should be aware of?
If I need to use PSS, what digest should I be using? Is SHA1 a concern if used?


texts: i am having problems understanding how CBC works! I know that it is a chain and the IV is XORed with the PT but then what? I mean we encrypt it with key k and the result is the CT which we use for the next chain-XOR but my question is HOW the encryption works? For example in Stream ciphers i just had to XOR the K with the M (or C) to get my result, but on block ciphers i am completely lost...


texts:
On the Wikipedia page of SHA-2, the following is written:

Currently, the best public attacks break preimage resistance for 52 out of 64 rounds of SHA-256 or 57 out of 80 rounds of SHA-512, and collision resistance for 46 out of 64 rounds of SHA-256.

Can someone explain in simple terms what that means?
Also, for SHA-1, the Wikipedia page currently states:

Since 2005, SHA-1 has not been considered secure against well-funded opponents;[4] as of 2010 many organizations have recommended its replacement.[5][6][7] NIST formally deprecated the use of SHA-1 in 2011 and disallowed its use for digital signatures in 2013. As of 2020, chosen-prefix attacks against SHA-1 are practical.[8][9] As such, it is recommended to remove SHA-1 from products as soon as possible and instead use SHA-2 or SHA-3. Replacing SHA-1 is urgent where it is used for digital signatures.

All major web browser vendors ceased acceptance of SHA-1 SSL certificates in 2017.[10][11][12] In February 2017, CWI Amsterdam and Google announced they had performed a collision attack against SHA-1, publishing two dissimilar PDF files that produced the same SHA-1 hash.[13][2] But SHA-1 is still secure for HMAC.[14]

Microsoft has discontinued SHA-1 code signing support for Windows Update on August 7, 2020.

So, ten years after the original publication, the hash algorithm already wasn't deemed secure enough to be trusted anymore.
SHA-2 was published in 2001. Given the advancements in computing power, does it even make sense to use SHA-2 in new technology? Isn't it reasonable to expect that very soon it won't be trustworthy anymore, seeing how SHA-1 wasn't trustworthy after ten years? Shouldn't we use SHA-3-512 wherever possible to be on the safe side looking forward?


texts: How hard is the Solitaire cipher to crack?

texts: Assuming your deck  is completely random and that it is not retrivable, how hard would it be for a casual person to decrypt a message encrypted with the Solitaire cipher?


texts: Meaning of "Security can be reduced to a problem"

texts:
I'm studying reductions in cryptography and confused about the way people use the word "reduction".
My question is almost the same as a past question, but what I want to ask is slightly different.

A lot of papers or articles (e.g. Wikipedia "Reduction (complexity)" or "The Algebraic Group Model and its Applications" by Fuchsbauer et al.) say that a reduction $R$ from a problem $P$ to a problem $Q$ is an algorithm such that for every adversary against $Q$, $R$ uses it as a subroutine to solve $P$ correctly.
In other words, if $P$ can be reduced to $Q$, $Q$ is "no less hard" than P.

In a security proof of a protocol $\Pi$, we often assume the hardness of a problem $P$.
In this proof, for every adversary $\mathcal{A}$ against $\Pi$, we show that there is an adversary $\mathcal{B}$ against $P$ whose advantage is (essentially) no less than $\mathcal{A}$.
I think this is a reduction from $P$ to $\Pi$ and this means $\Pi$ is no less hard than $P$.
More formally, breaking $\Pi$ is no less hard than $P$ and since we assume $P$ is hard breaking $\Pi$ is hard.

However, some people say "the security of a protocol $\Pi$ can be reduced to the hardness of $P$" in this case.
I think this is the wrong way of using the word "reduction" since we actually reduce $P$ to breaking $\Pi$.
Others say "the security of a protocol $\Pi$ is based on the hardness of $P$", and I think this is true.

Am I right or wrong?
Thanks in advance.


texts: Is it safe to hash a packet with a shared secret to prove authenticity?

texts:
I am developing an online game, where the server is written in Node.js and the client uses Godot. The issue is that Godot has no cryptographic functionalities (it can only encrypt and decrypt files, not elements in memory).

As implementing cryptographic functionality would be out of my capabilities with Godot, I've been thinking of a way to authenticate UDP packets.

I have the following idea: client logs in via HTTPS and gets a refresh token, and a shared (with the server) secret. The refresh token is used to renew the secret every 10 mins.

To authenticate UDP packets (which are sent unencrypted), the packet contents are hashed with the secret included, the packet is sent with the hash. Then the other side verifies that the hash with the secret is valid.

Is this approach secure enough? Considering that the secrets would be randomly generated long strings, would an attacker be able to calculate the secret by analizing several packets? My options for hashing are MD5 and SHA256 which are the algorithms available in Godot.

Being that UDP is only used for game events which don't need extreme security (so no personal information, payment details etc are ever sent in this channel), would this work?


texts: Are there any symmetric Partial Homomorphic Encryption Schemes?

texts: Note that I am asking specifically for Partial Homomorphic Encryption (PHE) schemes and not Somewhat Homomorphic Encryption (SHE) schemes. I believe there are several SHE schemes that are symmetric but I am not familiar with any PHE schemes that are symmetric.


texts:
While there are plenty of PAKE protocols, especially those augmented ones which are practical in C/S model, actually they seem to be not widely used. Even TLS-Standardized SRP, the most popular one among them, I just know it's used in apple's iCloud. In addition, J-PAKE was used in Mozilla's synchronization but aborted for its weird usage.

So, Is there any situation or famous system in which PAKEs are widely used that I don't know? If no, why are they not used even when their patents are expired?


texts: Detail about reactive simulatability framework

texts:
I'm trying to understand the framework of reactive simulatability using *"PfWa2_00AsyncModel"* from this publication which is a tech report behind the paper A model for Asynchronous Reactive Systems and its Applications to Secure Message Transmission by Pfitzmann and Waidner.

I'm troubled with the remark 2.7 on page 6. Can anybody comment, why the configuration $conf_{1s}$ is in $Conf^f(Sys_1)$ if the port $p$ is not a port of $M_1$?


texts: How does Schnorr signature actually work?

texts:
I'm trying to get a grip on how Schnorr signature works. Suppose Alice sends Trent a tuple $(P, M)$, which contains a payload and a message to be signed by him. She then passes the certificate to Bob who verifies it.

Using Wikipedia's description (http://en.wikipedia.org/wiki/Schnorr_signature), is Alice supposed to compute $r = g^k$ and then passes it to Trent who then computes $e = H(M \| r)$ and $s = (k - xe)$? If that's how it works, then isn't Alice supposed to transform what she receives rather than passing $(s, e)$ straight to Bob? Bob could take $(s, e)$ to Trent and find out about Alice's payload.

Thanks


texts: "Practical" operations supported by functional encryption?

texts:
I'm curious about what operations have been developed into functional encryption schemes.

What I mean by that is: what operations can be performed over encrypted ciphertexts? Obviously homomorphic encryption allows for $+$ and $*$. Deterministic encryption allows for equality comparison ($==$). Order-preserving encryption allows for $<$. What other schemes exist that allow for other operations?

I'm primarily concerned with schemes that are implementable so that their running time is fast enough to be practical. I am aware of the recent result for general case functional encryption, but it is far from being useful because it is so slow.


texts: Post-quantum candidates for asymmetric cryptography with small key sizes

texts: One of the things that I have come to like about elliptic curve cryptography is that the key only needs to be twice as long as the desired security level. That's a very small expansion (I also like it aesthetically). The sizes for the public key and private key are also the same. Unfortunately, ECC is not secure against quantum algorithms and quantum computers capable of breaking uses of elliptic curves seem to be coming up within a decade or two. What is more is that many post-quantum cryptosystems—the ones I am familiar with, at least—have idiotically huge keys and signatures. The best key sizes seem to be achieved by lattice-based cryptosystems and one variant of code-based cryptography. Are there any candidates with smaller key and signature sizes? Any as small 10 times larger than the desired security level? Any as small as ECC ones?


texts:
I'm trying to create a ISO8583 Rev93 message.
What is the standard way of generating MAC key in ANSI X9.9
DES-CBC encryption algorithm is used to encrypt the message and generate the MAC.

How many bytes should I take from the encrypted byte array based on ANSI X9.9 standard? 8 or 16? I think I should take 4 bytes (8 ASCII characters) and place them on field 128 (MAC). But very doubtful about that.
The MAC key that the customer has provided me is 16 characters. (like 1234567890123456). Should I convert it to an 8 byte key? or a 16 byte key? (Based on ISO8583 Rev93 and ANSI X9.9)

Thank you.


texts: RSA: How to calculate the private exponent?

texts:
I have this problem: In RSA algorithm considering $n=33$ (modulus) and public exponent $e=3$, calculate the corresponding private exponent $d$.

I know that $d = e^{-1} \pmod{\varphi(n)}$ and $\varphi(n) = (p – 1) (q – 1)$ but I don't know $p$ and $q$.

How can I do this?


texts: Which hash function to be used with DSA 2048

texts:
I'm preparing for an examination of an Information Security course at university, but I'm not sure about an explanation I created for a specific exercise. The question is:

  There are now DSA versions using a 2048 bit prime number. Which hash function would you choose?

My answer:

The goal of the hash function is to provide enough security, while not being overkill for it's application. DSA works by choosing a prime number p (of length 2048 bits in this case), and a prime number q (160 bits for the 1024 bits case of p, so more than 160 bits for the 2048 bit case). Then the value s is generated by calculating s = [k^-1 * (H(M) + x * r)] mod q (with x being the private key and r being a value that was generated earlier in the process). Now because the generated value is calculated mod q, the result is no longer than q itself.

It is thus pointless (or overkill) to use a hash function that produces values with more than |q| bits. We know that |q| > 160 bits (and it will presumably be no longer than 256 bits). This allows us to choose for SHA-256 as an appropriate hash function, as it is not yet known to be broken, and produces the smallest hash values not known to lower the degree of security of our DSA algorithm.

Is this a correct explanation for this problem? I can't seem to find the rational behind some hash function choices for DSA elsewhere.


texts: How do encrypted radios perform key exchange?

texts:
I'm having difficulty finding documentation for the over-the-air protocols used by encrypted public safety radios.  It seems that most systems are based on Project 25, previously known as APCO Project 25, now simply called P25, and that this encryption standard is based on AES-256.

FPIC published a report in September 2016 entitled "Best Practices for Encryption in P25 Public Safety Land Mobile Radio Systems".
Clark et. al at University of Pennsylvania published a paper at Security 11 in which the P25 protocol was analyzed and found wanting. (Full Technical Report here.)
I found this NPSTC paper which strongly implies that there is no public key availability in the standards, but that paper is from January 9, 2018.

What's not clear to me:

Is P25 the state-of-the-art, it it an aspirational system that hasn't been deployed yet, or is it legacy?
Is everything done with hard-coded symmetric keys, or is there public key to exchange the AES keys?


texts: Are there any known problems performing a One-time pad with 2 keys stored separately - AKA 2 part Symmetric key exchange over TLS

texts:
If this is something that already has a name, please tell me to look at that, but I have not been able to find one yet.

I am considering this process for storing some data securely.  I want to provide a way that neither party can decrypt the value by themselves, ( and no way for the original value to be retrieved if only 1 parties storage is compromised ), but would need a portion of the key provided by both parties in order to decrypt it.

The data stored will be near to but less than 128 bytes.

Party A ( Adam ) will generate a 128 byte key ( Key A ) and share it temporarily with Party B over TLS.

Party B ( Bob ) will generate a 128 byte key ( Key B), use that to One-time pad the "Secret Information! " creating "Bob's Secret Information".

Party B ( Bob ) will user Adam's Key to One-time pad the "Bob's Secret Information" creating "Adam&Bob's Secret Information"

Party B ( Bob ) will discard Key A, then store Key B and return "Adam&Bob's Secret Information" to Adam over TLS.

( Or that is equally to say: Bob will Combine Key A and Key B into Key AB - then protect the Secret, creating "AB Secret", then discard Key AB and A, keeping only Key B )

When Adam later wants to use the "Super Secret Information" to do something, he will send "Adam&Bob's Secret Information" and Adam's Key A to Bob over TLS, and Bob will decode the secret information and return it over TLS.

This process would not re-use any key, and each piece of information stored would have new keys generated by both parties.

This looks remarkably like the classic simple example I remember seeing of how DH key exchange works ( sending locked padlocks and keys ), but being done with Symmetric keys instead of Asymmetric.

So, is anyone aware of any obvious flaws with this process that I am just missing, or does it already have a name?


texts: Encryption that does not allow the encrypting party to decrypt

texts:
I am very new to cryptography, and am having a lot of trouble googling my way to an answer to the following problem.

We have an external party (telephony provider) recording phonecalls for us. We would like to make very sure these can only be listened to when appropriate. The ideal solution would be for the external party to encrypt them using a key, that can not be used for decrypting them. We would then deposit the decryption key with a third party (ie. lawyer). That would mean that if I wanted to listen to a conversation illicitly, I'd have to convince both the telephony provider to hand over the recording and the lawyer to hand over the decryption key. separate instances, who would not know each others identities.

Does such an encryption scheme exist?

I've looked at asymmetrical decryption like RSA, but from my reading of http://logos.cs.uic.edu/340%20Notes/rsa.html it would seem like if I encrypt using a public key, then knowing that public key should be enough to decrypt a file, even without knowing the private key? Or am I misunderstanding this?


texts: is the functional signature result relies on f(x) or on x where x is a message and f is a function?

texts:
I am new on cryptography and I have a question about the functional signature scheme. The notion was introduced in this paper.

In a functional signature scheme, there is a standard signature and verification key pair, as well as an algorithm to derive functional signature and verification keys, for any function f. The signature scheme allows signing any message m in the range of f.

Can anyone please tell if the resulted signature corresponds to the result of the function f over the data m or a signature of a message m corresponding by the function f?


texts: Terminology: Is a block cipher in counter mode still considered a block cipher or is it classified as a stream cipher?

texts: I'm confused about what terminology to use. I see people referring to such a cipher-MOO combination using both terms.


texts: I was wondering what the known metrics are for studying the randomness of TRNG (besides NIST tests).  For example, for PUFs, there are known metrics such as uniformity, uniqueness, BER, etc.


texts: Modification of block cipher in CBC mode

texts:
I know that CBC is not secure against data modification. Can someone explain to me by illustrating at an example how I could change the last block if I have the encryption of "0"?

Thanks in advance


texts: Finding collisions for the DES F-function

texts:
It's known that for a given subkey, the F-function of the DES is not injective (see Is the DES F-function injective for a given subkey?). I am interested in efficiently finding collisions for this function, i.e. for a given subkey $k$, I want to find two different inputs $x$ and $y$ such that $F(x,k)=F(y,k)$.

I am wondering if there are shortcuts that make finding such key values easier than plain brute-force?


texts: Proof that a particular algorithm has been used

texts:
I’m looking for the existence (or the proof of non-existance) of a method to prove (with arbitrary certainty) that a particular output is the result of a particular algorithm applied on a particular input.
$$ f(x) = y $$
How can I prove the above equation holds by knowing all of its constituents but without actually applying the function?
This would be akin to a zero knowledge proof but could be easily used in blockchains to embed AI algorithms.
Given some constraints on the inputs (correlated) or the algorithms (linear) do you know of any such method?


texts: Why is appending the key to a mesage and then hashing that insecure if the hash isn't weakly collision resistant?

texts: Suppose I have H(M|K) and that H is not weakly collision resistant. If I have a message mac pair (M,MAC), how is it possible to find another message mac pair (M2,MAC2)? My thinking for this problem is that if the hash isn't weakly collision resistant, then I can find another message M2 such that H(M|K)=H(M2|K) and thus, I have a new pair (M2,MAC2). Is this a sufficient explanation for explaining why H(M|K) is insecure if the underlying hash function is weak?


texts: There are a lot of theories of Paillier cryptosystem with references to e-voting. Are there any real-world E-voting systems in use with the Paillier cryptosystem?


texts:
I read that brute force attacks against a plaintext encrypted in OCB with unknown key and IV has approximately the same complexity as an attack where only the key is unknown.

Why is that?
Is there a description of this attack? If not, could you give me a hint on how this attack might work?


texts: How to invalidate decryption key in multi user model?

texts:
I want to develop an application that will allow a user to create a public/private key pair, and encrypt it symmetrically with a key such that once they enter their password, they will be able to decrypt the key pair and retrieve its contents.

However, it is desirable for someone else that they trust to be able to decrypt the key as well, in case they lose access or have a reason for someone to be able to access the key pair (like a joint account).

Let's say that a user John has given Adam, Emily, and Scott access to the key pair, but it turns out that John no longer trusts Emily and wants to invalidate her access. Since she has already seen the private key, he has to generate a new one, but wants to do it in such a way that Adam and Scott will still have access without having to enter their password or do anything additional.

How can this be accomplished? Is this possible?


texts: How to hash similar strings to the same hash value?

texts: Suppose that $s_1$ and $s_2$ are two stings that have a small hamming distance. Is there a preimage resistant "hash" function ($H$) that can map them to the same value i.e., $H(s_1) = H(s_2)$?


texts: Is there any use for PBKDF with empty password?

texts:
As the name suggests, password based key derivation functions are used for deriving a cryptographic key from, well, a password.

Is there any use for PBKDFs with empty password? Does it give any advantage over simple hash or HMAC? More specifically, in the case of PBKDF2-HMAC it would mean applying HMAC with an empty key, simplifying it to a double hash.

For example, according to its documentation, OpenSSL allows calling PKCS5_PBKDF2_HMAC() with no password given, but RFC 6070 does not define test vectors for empty passwords (which IMHO would be an important edge case for test vectors).


texts:
I am having trouble understanding the prime number theorem.

As part of some revision for an exam, I am trying to answer the following questions (but seeing as I don't understand the concept of the prime number theorem, I'm not doing too well):

Question 1:

What is the proportion of numbers that are prime up to 1,000,000?

Question 2:

If we use prime numbers of size 1536 bits to generate an RSA modulus of 3072 bits, what is the proportion of numbers of size 1536 bits that are prime numbers?

I understand that using 1536 bits means that is it pretty much computationally infeasible to stage a brute force attack on an RSA key, but I don't understand why. In our lectures, we are given an example of $ln (2^{512}) = 355$ which means that 1 in every 355 numbers of size 512 bits is a prime. But I'm not really sure how to translate that to help with the two aforementioned questions.

Can anyone please shed some light and explain the answers to those questions?


texts: ElGamal: Why is reusing the same $k$ not secure?

texts:
I have a question on the encryption process of ElGamal:
$$
  Y = g ^ a \bmod p \\
  C = g ^ k \bmod p \quad\text{($k$ is chosen randomly)} \\
  D = m \cdot y ^ k \bmod p \\
  \text{Decryption:}\qquad m = C^{(p-1-a)}\cdot D\bmod p
$$

My professor told us we should know why it's bad to use the same values for the variables $a$ and $k$ more than once, but he didn't say why. I guess that if the same values for $a$ and $k$ are used several times, the attacker could calculate the unknown values if he is able to capture the traffic, but I don't know how.

How could an attacker proceed there?


texts: What is a good AES mode to use on file encryption?

texts: I'm new to encryption and cryptography, I was wondering if there is a good or best suited AES mode for file encryption (Planning on zipping a folder and encrypt it as a file). If there is, how complex is it and is it easy to implement on python (preferred language)? Thank you.


texts: How can a hash function that implements random oracle model have collision resistance?

texts: ROM is considered to be collision resistant. Does ROM assume there is an infinite set of outputs, or assume the output set is always larger than the input set? Because by the pigeonhole principle, ROM is guaranteed a collision given a large enough set of input, even when the output is generated randomly.


texts: Let's say we have a scheme in which 40 bits M are padded with 24 zeroes, encrypted using a secret DES key K, and the result truncated to the first 24 bits, C. If I wanted to determine a key that behaved identically to K, i.e. for each (or at least the majority of) M produced the same C, how many pairs of M/C would I require to find such a key with reasonable chance?


texts: Recovering plaintext from AES-128 given round key 10 and ciphertext

texts: I'm working on an old CTF challenge where AES-128 was used on a 16 byte block. I have the round 10 key and the ciphertext. What techniques exist for obtaining the plaintext?


texts: What makes AES look like an ideal cipher?

texts:
There are 2128! permutations on 128-bit inputs. AES supports a maximum key length of 256 bits, therefore offers at most 2256 permutations. The total number of 128-bit permutations is much larger than what offered by AES, which means AES actually only explores a very tiny portion of the permutation space.

Questions:

Given AES doesn't support > 256-bit key length, what makes people believe AES (or any "good" cipher currently being used) would look similar to the ideal cipher that chooses a 128-bit permutation randomly? Put it another way, what makes people believe AES is better than another cipher with 256-bit key length which can give 2256 different permutations?
Is it possible to develop an ideal cipher with enough key length which runs encryption and decryption in polynomial time? The key length would be at least log((2128)!). My poor math gives a result somewhat close to 128*(2128). So I guess the answer to this question would be no. But it strengthens Question 1 by giving an idea how insufficient AES key length is: The ideal cipher requires an exponentially larger key length.


texts: Maximum secret key length from a time series shared signal

texts:
Alice and Bob share a common time series signal.

1. What can be the largest possible secret key?

2. Will the entropy and secrecy of system depends on this length?

Ideally if after passing though analog to digital converter(ADC) number of bits a signal gives depends on $N_S$ sampling rate. Suppose I had s 1 second window of signal. Through ADC I got $N_S$ samples. I apply threshold on these samples and generate keys. Maximum length hence is $N_S$ bits of secret keys.

Is this the best key? I mean is there any relation between entropy/secrecy of the key vs length I choose from $N_S$?


texts: AES-CBC and IV -- Encrypting multiple blocks of a file with the same IV?

texts:
I have large files which are broken into blocks of 512 KB and uploaded to a server. In my DB I store the IV, and the user knows the security key themselves.  When downloading, I use the same IV and key.

However, is it insecure running AES-CBC on each different block with the same IV? Won't this give away information -- e.g. 1 512 block encrypted will equal the next 512 block if they are both identical? And if I can't load the entire file into memory at once, is the only safe way to do it storing many IV's? (100 GB file would have 200k IV's...)


texts: I have a MD5 hash which is obtained by hashing certain strings appended by a pipe character ( | ). (I know the values of these) A secret key is added as a suffix to this (I don't know the secret key). My question is, is it possible to crack the secret key if the resulting hash and the hash without the secret key is known?


texts: Match any string from list to a single hash

texts:
This might be a noob question, I've searched the web but couldn't find anything remotely close to what I would like to achieve. Maybe I don't have the correct jargon, so please bear with me.
Basically, I am building an application based on microservices with a single authorization server that distributes JWT's, which are being verified by the various apps. The problem is, each user will have access to different parts (and parts of parts) of the whole system and storing all the permissions in a JWT seems like a waste, let alone a security issue, but I would also like to avoid hitting the database on each call to any app.
Say, a user has an access to a list of playgrounds which there can be tens or more of, distributed across multiple apps in the ecosystem (please don't question the architecture, it is very specific). Also, the their permissions might be different in each playground. I would need to verify this against the JWT if they tried to access any of them.
I was thinking - besides hashing each playground's and permission (to add a bit of security at least) and appending it to a list in the JWT, inevitably making it huge - is there a way I could take a list of id's (think uuids) and turn them into a single hash that could be matched against any single of them?


texts: PAK Diffie-Hellman vs. sharing high-entropy key

texts:
In order to setup an authenticated shared secret key between two clients, I am faced with the choice between two possibilities:

Let users set a (low-entropy) shared password and then perform some password-authenticated key exchange that is resilient to low-entropy secrets (as described here, for example).
Generate a high-entropy shared key and use it directly as a shared key.

Are there any advantages to “1.”, especially when users must communicate the password/key through a separate channel in both cases?

Nota Bene: The resulting shared key is used only once per client (Alice $\rightarrow$ Bob and Bob $\rightarrow$ Alice) and subsequently destroyed.


texts: Public Key Encryption for Message Confidentiality

texts:
In public-key encryption, if the decryption algorithm is
$$\text{Dec}(k_i,\text{Enc}(K_i,p))=p$$
where $k_i$ = receiver's private key and $K_i$ = receiver's public key
what would be the algorithm for encryption? Would it be
$$\text{Enc}(K_i,\text{Dec}(k_i,c))=c$$
Just looking for some clarification.