texts: RSA: given (N,e,dP), is it possible to find d?

texts:
Assuming that you are given the public modulus $N$, the public exponent $e$, and the private number $d_P = d\mod (p-1)$, is it possible to recover $d$?

If not, is it possible to recover $m$, also given a $c$?


texts: Forge CBC-MAC given the MAC of two messages and of their concatenation

texts:
I found this question about CBC-MAC forging and want to make sure I understand it:

  Let a and be be two strings of block length one. Suppose the sender sends $(a, \text{CBC-MAC}(a)), (b, \text{CBC-MAC}(b)), (a||b, \text{CBC-MAC}(a||b))$. Find new messages / MAC pair which the attack can now forge from the messages / MACs given above.

I have:
$\text{CBC-MAC}(x) = t$ and
$\text{CBC-MAC}(y) = t'$,
then $\text{CBC-MAC}(x || y \oplus t) = t'$.
Then can I forge the permutation combination of the given pairs with that formula?
i.e. if $\text{CBC-MAC}(a) = x$ and $\text{CBC-MAC}(b) = y$, then $\text{CBC-MAC}(a || b \oplus x) = y$.


texts:
Given the desire to have unique salts for each user of your system, is it actually necessary to create a cryptographically-random salt for each user?

If your system already has some other unique user identifier (be it an ID, user-name, or an Email address) is there any effective decrease in your security if you simply use that value as your salt? It results in a unique salt for each user, and does not require the additional generation and tracking of a new value per user.


texts: Decoding Base64 message encoded with a key. I only know the ciphertext and code

texts:
import binascii
import re
import base64

ptext = input("Enter Plaintext\n\n\n")
print(ptext)

key = input("Enter Key\n\n\n")
print(key)

ptext01 = ""
key01 = ""

for c in range(0, len(ptext)):
    ptext01 = ptext01 + ("%x" % ord(ptext[c]))

for c in range(0, len(key)):
    key01 = key01 + ("%x" % ord(key[c]))

i = 0
j = 0
s = ""

while j < (len(ptext01)):
    while i < (len(key01)):
        if len(str(hex(int(key01[i:][:+2], 16) ^ int(ptext01[j:][:+2], 16)))[2:]) == 1:
            s = s + "0" + str(hex(int(key01[i:][:+2], 16) ^ int(ptext01[j:][:+2], 16)))[2:]
        else:
            s = s + (hex(int(key01[i:][:+2], 16) ^ int(ptext01[j:][:+2], 16)))[2:]
        i += 2
        j += 2
        if j >= len(ptext01):
            break
    i = 0

result= int(s, 16)
encodedBytes = base64.b64encode(str(result).encode("utf-8"))
encodedStr = str(encodedBytes, "utf-8")

print(encodedStr)

This is the code used to cipher the text, and this is the ciphertext:

  NDcyMDI5MDYwMzI3MjM5NDgxNjc0NTgxMDI5OTYxMzIxMDQ1MjMxOTA3OTI1MDg5NDU3MTEyNTc2ODcyMzAxMzQ2NTAzMDMzNTgzMzc5MDMwNzYyODQ2NTU2NjQ2MTQ4MzQ1NjAwODQwOTgyNTc3MzM0NDk2Mjk1MTM2MjA5OTEzMTc5ODUwNzg2NzQ3MTU3NDc5MjQ4OTc4MDk0NDQ1Njk4Mzc1ODIxNDI5NjkwNDQ5NzAyMDIwMjUyMzIyMTY2MTI0MzM1MDc3MTc1MDI2OTcwNzMzMDI4NjI4Mjg0OTcxNzA3Nzc4MDY5NDI4NzIzODQxNzM3MzE1NTgxMDA5MjIzMzQyODQ2MDAwMTY1OTU4NzA1MDM3Mjg0MzYxMzQyOTMzNDA2MTMzMTA4OTkxNDg3MTQ2Mjk1ODM0NTI1MDEzOTU5NDgwNzg5ODMyMDYwMTcwMzQ3NTk1NjQyNjQzOTgzOTAzODQzMTAzMDQ4Nzg0ODE1MTc2MzQwNTQxOTUwMzI0MDM2MTg2NDg2OTk4MDY5NDExNzI0OTQ2NDQ0MTU5ODMzNTczMTM2NzgwMzA1NjQwOTk0MTM1MTAyMjAzNTc5MTE5MzQxNzAwNTgxMDc3MDM5Mjc1MjM2OTE2NDYxOTEzMjI3NjgzNTIwMzU0MTA3MzY0ODY5NTE2MTY3NTMzNDIxMjQ0MTYxNzU4NzUzMTkzOTkwMzgwOTYxMTMzNzk2NTA1NDc3MTEyMDc2NzQ4NzAxMDYyNzI1MDUyNzkyMzk2MTMwNDg2NTc0NzU1MzI1NDkzOTUyODIwMTE0NzY3MjgwOTgxMTU3MDAxMjQ3MDU2OTA1NDcxMjUxODQ4OTA2NDIyMDUxNzQwNTI0Mzg5NjExNDM2Mzg0NTk4MDEzNzQ4Mjc5NTYwNTc3OTM2MzM1Nzc2NTI0MTMxNDEyNjEwNzc5MzI1Mjk0NjU4Mjc1NzU5Mzc1OTQyOTgwNTk0MTMzMjExMDc5NzQwNTQ1OTMxMDIwNTg1ODMyOTkyODEzNzczNzcxNjUyMzIyODQwNTIwOTk2ODYyNDQ3NjAzMzIwMjM3MTY3MzcxMTA5NTY1MzM2ODY3OTI4NDE0OTkyNjk1NjkyODU5NDUwOTQ2NTgxOTA2Nzc1ODczOTMzNzgwMDM5OTE=


texts: About the security of GnuPG private key on-disk storage

texts:
GnuPG on-disk storage of secret key material is encrypted with AES-128, with an encryption key generated via an iterated and salted SHA-1 hash of the given passphrase.

Is this usage of the SHA-1 hash function secure, and, if so, will it remain secure, even in the distant future?


texts: how to calculate surge of cpu cycles consumption of an ipsec tunnel with aes256/sha512/dhgroup21?

texts:
The project I'm involved with needs to establish around 2500 simultaneous ipsec connections between roadwarriors clients and the ipsec concentrator/gateway.

In order to be able to estimate the appropriate hardware solution I'd like to be able to calculate the amount of processing power needed to sustain the moment of a surge in computation (like when all clients are connected and the concentrators' link goes down and when it comes back it gets flooded by all 2500 client attempting reconnects).

What would it take for example to carry 2500 simultaneous initiating ipsec connections using aes-256,sha512 and dh group 21 or 24 (as advised on https://supportforums.cisco.com/document/12276506/diffie-hellman-groups)?

The clients won't be generating more than few packets/s once connected (less than 10, for sure)

I've been lookin at this similar question but I'm still confused.


texts: Uncompress password protected WinRar file without password

texts:
I would like to know how to extract contents of the password protected WinRar file without the password.

I have downloaded that WinRar file from a file hosting website and found out that it was password protected after I downloaded it. I would like to know is there any way to “unprotect” a password protected file so I can decompress the contained files.

Brute-force attacks take ages. One thing is that I found out that brute force attacking tries every combination of words from the word-list. Therefore, I would like to know if it is possible to brute force attack the file using individual passwords one-by-one, instead of going through all possible permutations of all the individual passwords contained in my word-list.


texts: What is the technical name for a public key container in DER format?

texts:
I have a public key in the following (format-neutral; the type is specified by the DER bytes) format:

$ cat pubkey.der | openssl asn1parse -inform der -i
    0:d=0  hl=4 l= 290 cons: SEQUENCE
    4:d=1  hl=2 l=  13 cons:  SEQUENCE
    6:d=2  hl=2 l=   9 prim:   OBJECT            :rsaEncryption
   17:d=2  hl=2 l=   0 prim:   NULL
   19:d=1  hl=4 l= 271 prim:  BIT STRING

$ cat pubkey.der | openssl rsa -inform der -pubin -text
Public-Key: (2048 bit)
Modulus:
    00:ac:f3:c2:c6:60:c2:9b:1e:db:fb:b6:32:67:45:
    09:25:be:b0:d9:66:21:a0:80:ac:52:be:d4:59:1c:
    7f:85:c0:45:ed:4e:85:69:55:80:a9:1e:36:94:93:
    19:ce:30:8b:89:5d:1a:8e:9a:d6:7a:88:6a:1a:68:
    6d:72:57:5e:11:a2:ec:9e:44:b7:64:06:6a:1c:d0:
    81:b2:18:cb:a1:82:7f:ef:ad:ef:1a:61:52:46:54:
    d0:50:1f:73:14:ad:2c:8e:4c:d8:90:74:9a:f5:37:
    e7:54:91:3b:79:0a:2e:af:7e:f3:de:98:1c:3c:fd:
    d6:67:73:63:7b:10:7d:b7:77:04:ab:42:17:33:4d:
    28:79:ed:4c:a1:96:71:94:32:bf:2d:49:d6:bd:b2:
    c5:26:42:ad:3e:f4:bb:8e:e8:70:1d:7f:cc:3b:a6:
    04:6c:be:6f:1a:a2:40:c4:a5:ee:d5:83:87:44:a5:
    90:22:c5:96:14:69:3c:ae:65:76:9c:45:41:4b:5f:
    04:03:27:b6:74:a5:3b:c4:27:d4:83:7c:0a:18:b4:
    5d:36:95:6f:9b:08:f4:14:37:8d:33:be:bd:e0:46:
    11:89:9e:f9:5b:49:f7:9e:c6:2f:86:5e:96:83:5e:
    47:9c:c0:3a:60:91:ea:41:98:7f:3e:85:a5:ab:73:
    b0:59
Exponent: 65537 (0x10001)
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArPPCxmDCmx7b+7YyZ0UJ
Jb6w2WYhoICsUr7UWRx/hcBF7U6FaVWAqR42lJMZzjCLiV0ajprWeohqGmhtclde
EaLsnkS3ZAZqHNCBshjLoYJ/763vGmFSRlTQUB9zFK0sjkzYkHSa9TfnVJE7eQou
r37z3pgcPP3WZ3NjexB9t3cEq0IXM00oee1MoZZxlDK/LUnWvbLFJkKtPvS7juhw
HX/MO6YEbL5vGqJAxKXu1YOHRKWQIsWWFGk8rmV2nEVBS18EAye2dKU7xCfUg3wK
GLRdNpVvmwj0FDeNM7694EYRiZ75W0n3nsYvhl6Wg15HnMA6YJHqQZh/PoWlq3Ow
WQIDAQAB
-----END PUBLIC KEY-----

What is the technical name for this format? I keep wanting to call it PKCS#8, but I think that would be incorrect, since PKCS#8 is a private key format. What do we name the PKCS#8 equivalent DER format for public keys?


texts: Is my password database encryption flow secure?

texts:
I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it
Things I know/think are problematic

using base64 digest + getting the first 32 char reduces key size, right?
where should the salt be generated and stored
should the encryption include some kind of counter
should the aes IV be new each time the vault is encrypted?

Here are the diagrams of getting/setting the password file from and to the server:
Blue values are input by the player in a prompt
orange values are stored in a file on the client after authentication (not included in the diagrams)


texts: Multiplication and squaring the binary polynomials

texts:
I have tried to calculate $trace$ of a coordinate $X$ of EC in binary representation. Before that I tried to pre-calculate traces of the various bits of $X$ using formula:
$$Tr(X) = Tr(\sum_{i = 0}^{m-1} c_ix_i)= \sum_{i = 0}^{m-1}(c_i Tr(x_i) )$$

For the field $F_{2^{163}}$ that i use  we have only 2 cases $x_i$ that yield  $Tr(x_i) = 1$ to common $trace$. This cases  when $i$ - 0 and 157. With 0 is ok
but for others cases squaring the polynomials and reduction by modulus lead to the performance issues.

I would be appreciated if anyone proposes a more effective approach to such calculations. Or any references to ready implementations or services which can be used to calculate traces


texts: Low complexity implementation of a small blocksize cipher (< 64 bit)

texts:
Searching for "small blocksize cipher" finds a number of discussions on the topic, mostly refering to FPE.

This one in particular suggests using AES as the round function of a Feistel network.

The problem is on some embedded devices, the use of AES is too complex, so a tradeoff between cipher strength and complexity is required.

In searching for a Feistel based cipher with low complexity, the TEA cipher seems a good choice, but uses 64 bit blocksize.

For a sub 64 bit block of data, say 44 bit, tweaking TEA by masking the output of each Feistel round with a 22 bit mask (0x3FFFFF) seems to work correctly.

The question is, does masking in this way break the TEA algorithm?
(other than weakening due to a smaller blocksize)


texts: Concerns about using a hash to determine if specific input data has already been encrypted

texts:
A system is used to securely store account numbers.

When an account number is added to the system it is securely encrypted and stored in a database along with the IV and a reference to the encrypted record is returned (so that the encrypted record can be retrieved at a later date).

If a second request for an identical account number is made, rather than creating a new record, the existing reference must be returned to avoid duplicate entries in the database.

Storing a hash of the account number along with the record would provide a means to determine if a particular account number has already been stored, but my concerns are whether there are any implications for the hash being used to identify the account numbers.

I gather that all secure modern-day cryptographic hashes have pre-image resistance (so the hash can't be "reversed"), but if the account numbers themselves come from a limited set then presumably the account numbers could be determined via the hashes by brute force?

Are the ways to protect against this?

Would increasing the number of hash iterations slow down any brute force attempts to the point where the hashes wouldn't be considered a security issue? When selecting iterations to use other than the general size of the iterations (1000, 10,000, 100,000) are there other things to consider... is there any value in selecting a non round number such as 993 hash iterations rather than 1000?

When using a hash as a lookup value like this individual record level salts aren't usable, but I presume using a system specific salt would still be useful (to minimise the use of pre-built rainbow tables?) Would storing the system salt in a different location to where the hashes are stored (i.e. not in the database) offer any value (or is that just security through obscurity?)


texts: Are hashes only used to confirm data integrity when used for distributed ledgers?

texts:
I have a couple questions related to hashing and data. Please let me know if the questions I have are too broad for this site, or if clarification is needed.

I have read a lot about hashing as it relates to distributed ledger technology (DLT) like blockchains and directed acyclic graphs (DAG), but I am I am wondering if hashing is only to confirm that the data being hashed was unaltered, so I have some questions:

Can hashes be used in other ways? For example, can a hash be used as an address to locate data?
Since a hash is only one way I am guessing someone cannot obtain the original data before hashing, which means a hash is only a confirmation that data is unaltered?
If data in the past is altered, the current hash encompassing previous data will change, but where is the original hash to compare it to that lets a user know that a hash has changed? I am guessing the correct hash is held by a majority of people in the DLT?


texts: Which encryption method supports random reads?

texts:
I have a file containing 16-bit samples and I want to encrypt it, but the problem is that I need to be able to read any random 16-bit value from the file, and be to able to decrypt it, without reading larger (or surrounding) blocks. Because else it would require huge modifications to the device and driver.

It doesnt need to be very strong encryption, so I thought about just XOR-ing each 16-bit value with a another (fixed) value. But thats not really secure once the plain-text is known. And there are many samples with the value '0' at the start of the stream, so it would be easy to deduce the secret XOR value just by looking to the startblock.

Is there a similar method, that is almost as efficient and low-memory, but offers a little more security than my example above? The encryption may only take a few CPU cycles because its for an embedded MCU, however the decryption will be done using very fast CPU's.


texts: Are there any non Canonical Verifiable Cryptographic MACs

texts:
In the 2. edition of the Modern Introduction to Cryptography, by Katz and Lindell, there is a definition for MACs;

  Canonical verification. For deterministic message authentication codes
  (that is, where $\text{Mac}$ is a deterministic algorithm), the canonical way to perform verification is to simply re-compute the tag and check for equality. In other words, $\operatorname{Vrfy}_k(m, t)$ first computes $\tilde{t} := \text{Mac}_k (m)$ and then outputs $1$ if and only if $\tilde{t} = t$.

Then, later

  It is not hard to see that if a secure MAC uses canonical verification then it is also strongly secure. This is important since all real-world MACs use canonical verification.

All of the cryptographic MACs, that I know, use canonical verification.

Is there any non Canonical Verifiable Cryptographic MACs?
If not, then this definition is redundant, or is this definition is defined for future MAC schemes?


texts: Are Blind Signatures Fundamentally Different From Signatures of Hashed Values?

texts:
I've been reading up on blind signatures and am trying to wrap my head around the concept - specifically in the context of anonymous blockchain transactions using vouchers.  One particular issue I'm having with this is understanding what precisely a blind signature consists of.  Do these differ from signatures of hashed values?

Would the following qualify as a blind signature:

Someone (A) hashes some data and signs it.
Hash sent to another party (B) who also signs it.
Data and hash and signatures are sent to yet another party (C) who can verify it all.

Or are they meant to mean that A creates data and blinds it, B signs the blinded data saying A created it and/or was authorized to do so, C receives blind signature and data without being able to relate it back to A - but by way of B can tell the data was created in a valid manner?

Is the objective just for C to never know who A is, but confirm that it was created in a valid manner via B?


texts: Secure double encryption using CPA and CCA

texts:
Do you mind if you give me any hints, links or ideas about how to improve the security of double regular encryption and decryption, by using CPA game and CCA game, it sounds interesting question, and I'm still discussing it with my classmate. Given the following info,

The key generation algorithm $(PK, SK) \leftarrow Gen(1^λ)$:

Compute $(pk, sk) \leftarrow gen(1^λ)$
Compute $(pk', sk') \leftarrow gen'(1^λ)$
Set $PK := (pk, pk')$ and $SK := (sk, sk')$

The encryption algorithm $C \leftarrow Enc(m)$:

Compute $c \leftarrow enc(m)$
Compute $C \leftarrow enc'(c)$

The decryption algorithm $\tilde{m} \leftarrow Dec(C)$:

Compute $\tilde{c} \leftarrow dec'(C)$
Compute $\tilde{m} \leftarrow dec(\tilde{c})$

If both $\pi$ is CPA-secure, then will the new scheme $\Pi$ be CPA-secure? If so, please
prove it. If not, please disprove it. Same as for CCA.
Kind Regards


texts: Why is the proof on the commitment correct?

texts:
In the paper "Efficient Zero-Knowledge Proofs for Commitments from Learning with Errors over Rings", they gave a commitment from Ring-LWE: to commit to a polynomial $m$ in $Rq(Zq[x]/(x^n+1))$, choose vector $a$, $b$ in $Rq$ randomly, then the commitment is $c = am+br+e$ (where $r$ is random in $Rq$, $e$ is the error).
They gave the proof on the hiding the binding properties in Theorem 3.1 in the paper, but it seems that they only proved the binding property provided that the adversary choose m randomly. Why can we assume that?
My understanding: we should prove that when the public parameters are fixed, then it's difficult to find such $m$ such that $am+br = f'^-1e'-f''^-1e''$ (Theorem 3.1 in the paper)


texts:
Biggest flaw in VeraCrypt(or other Encryption programs)  is Hash Algorithm.
VeraCrypt hashes (SHA,Whirlpool,Streebog) it is the only point where can break an encrypted disk. Because break algorithm (AES,Towish,Camellia,Serpent,Kuznyechik) it is practically impossible.
VeraCrypt hashes can be broken by Police with the appropriate cash input. Hashcat can break VeraCrypt hashes.

How to protect against it?
Will longer mouse movements help?
And hashes are really so dangerous?

I invite to the discussion.


texts: How robust is RSA-FDH against distribution bias?

texts:
Suppose we want to use the RSA-Full Domain Hash (-FDH) signature scheme. This essentially works precisely like textbook RSA but instead of signing $m$ directly, we sign $H(m)$ with $H:\{0,1\}^*\to\mathbb Z_n^*$ being reasonable model-able as a random oracle (we need the ROM for the security reduction).

Now my question:
Are there any known attacks when $H$ exhibits a minimal (1-bit) bias?

In particular consider $H$ where $m$ is mapped to the first $\lfloor \log_2(n)\rfloor$ of SHAKE128(m), ie where we generate a hash output as long as $n$ but always zero the MSBit out.

Motivation: If we had such a bias for the generation of $k$ in (EC)DSA, this would probably allow for an attack and I talked in the past about how RSA-FDH is one of the applications of XOFs.


texts:
Reading many papers in the homomorphic encryption domain and in cryptography, a lot of schemes operate on bits as 1 and 0.

If I wanted to implement a scheme, for example, Gentry's FHE, would I have to encode inputs as "bits" or just use bytes (C & C++ (char), Golang(byte), etc)?


texts:
I am interested in learning more about NIZK proofs in the CRS model.

The CRS must be random but 'trusted' by all parties.

How does these data get generated both in theory and in practice?


texts: How can an unlimited adversary distinguish PRF's from Truly Random Functions (TRF)?

texts: I'd like to know which strategy is adopted by an unlimited adversary to distinguish PRF's from Truly Random Functions


texts: I know DES is outdated, but will is is secure in CBC mode? Can anyone help me understand why not?


texts:
I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without crypto). The library I've modified is called microecdsa, and the way it chooses k is as follows.

for (;;) {
        // generate random number k
        for (i = 0; i < 8; i++) {
            k.val[i] = random32() & 0x3FFFFFFF;
        }
        k.val[8] = random32() & 0xFFFF;
        // if k is too big or too small, we don't like it
        if (k.val[5] == 0x3FFFFFFF && k.val[6] == 0x3FFFFFFF && k.val[7] == 0x3FFFFFFF && k.val[8] == 0xFFFF) continue;
        if (k.val[5] == 0x0 && k.val[6] == 0x0 && k.val[7] == 0x0 && k.val[8] == 0x0) continue;
        // compute k*G
        scalar_multiply(&k, &R);
        // r = (rx mod n)
        mod(&R.x, &order256k1);
        // if r is zero, we try different k
        for (i = 0; i < 9; i++) {
            if (R.x.val[i] != 0) break;
        }
        if (i == 9) continue;
        inverse(&k, &order256k1);
        temp = 0;
        for (i = 0; i < 8; i++) {
            temp += (((uint64_t)read_be(priv_key + (7 - i) * 4)) << (2 * i));
            da->val[i] = temp & 0x3FFFFFFF;
            temp >>= 30;
        }
        da->val[8] = temp;
        multiply(&R.x, da, &order256k1);
        for (i = 0; i < 8; i++) {
            da->val[i] += z.val[i];
            da->val[i+1] += (da->val[i] >> 30);
            da->val[i] &= 0x3FFFFFFF;
        }
        da->val[8] += z.val[8];
        multiply(da, &k, &order256k1);
        mod(&k, &order256k1);
        for (i = 0; i < 9; i++) {
            if (k.val[i] != 0) break;
        }
        if (i == 9) continue;
        // we are done, R.x and k is the result signature
        break;
}

The issue is, using this code above I can only generate legitimate signatures occationally. If I modify the first few lines to be the following the signatures always validate. Leaving the code unmodified leads to the signatures being invalid semi-regularly.

// generate random number k
for (i = 0; i < 8; i++) {
        k.val[i] = 1;
        if(i>0 && i <8){
            k.val[i] = random32() & 0x3FFFFFFF;
        }
}
k.val[8] = 1;

Is this a safe modification? Meaning that the I've only eliminated 48 bits of entropy and we still have 224 bits of entropy, or am I misguided. If an attacker knows the first four bytes and the last two bytes of k, can they compromise the security of the key.

Also as a side note if you know of any safe and low resources ecdsa secp256k1 implementation please let me know.

Thank you.


texts: TLS AES_XXX_CCM mode of operation is encrypt-then-mac or mac-then-encrypt?

texts:
There are number of definitions completely confusing me.
in https://en.wikipedia.org/wiki/CCM_mode we have

"As the name suggests, CCM mode combines the well known CBC-MAC with the well known counter mode of encryption. These two primitives are applied in an "authenticate-then-encrypt" manner, that is, CBC-MAC is first computed on the message to obtain a tag t; the message and the tag are then encrypted using counter mode. One key insight is that the same encryption key can be used for both, provided that the counter values used in the encryption do not collide with the (pre-)initialization vector used in the authentication."

again in NIST  800-38C specification and RFC6655 we have

"In generation-encryption, cipher block chaining is applied to the payload, the associated data, and the nonce to generate a message authentication code (MAC); then, counter mode encryption is applied to the MAC and the payload to transform them into an unreadable form, called theciphertext"

but RFC7366 states than TLS should follow encrypt-then-mac policy


texts: DES f function injective for no fixed subkey?

texts:
Let $f$ be the function used in a round of DES, as defined in FIPS 46-3:
$$\begin{align}
f:\{0,1\}^{32}\times\{0,1\}^{48}&\to\ \{0,1\}^{32}\\
(R,K)\ &\mapsto f(R,K)\underset{\mathsf{def}}=P(S(E(R)\oplus K))\end{align}$$
where $E$ is the expansion, $S$ is the combination of S-boxes, and $P$ is the permutation.

Prove or disprove:

$$\forall K\in\{0,1\}^{48},\ \exists R,R'\in{\{0,1\}^{32}}\text{ with }f(R,K)=f(R',K)\text{ and }R\ne R'$$

or equivalently: the DES $f$ function is injective for no fixed subkey.

The answer is independent of $P$, because a permutation is injective, and injective functions compose. It depends on $S$ and $E$. If it is trivial for those of DES, I missed it.

Inspired by the question DES F function never injective?, where the OP intends never to mean if we change the S-boxes, a possibility that we disregard.


texts: Explanations for the complexity values for second preimage attack on GOST?

texts:
I've been reading the article "A (second) preimage attack on the GOST hash function" by F. Mendel et al (link) and I'm having some difficulty to grasp some of the values of complexities/probabilities in the attack. Specifically:

On page 228, how is the probability that two pairs lead to the corresponding values $x_1$, $x_2$, and $x_3$ amount to $2^{-192}$?
On page 230, how is $2^{128}$ used in the calculation of the complexity of the compression function?
On page 230, why construct $2^{32}$ pseudo-preimages for the last iteration of GOST?
On page 231, how was the value for the probability of finding the right $M_{257}$ in the list $L$ obtained?
Finally, on another issue, what operation is referred to by the squared $\ominus$ symbol on page 231: $\Sigma^m = \Sigma^t \ominus M_{257}$. [My guess: subtraction modulo $2^{256}$ -- am I right?]

Thanks very much.


texts:
I ask myself some questions about the compression function of SHA-2 (and SHA-1) hash function. Are these compression functions based on a block cipher? I've not found this information on Wiki... So, I think that these compression functions have been designed from scratch, without relying on a block cipher.

What about the compression function of MD5?

Thank you for your answer.


texts:
I'm working on a web service application which uses a self signed certificate. I apologize up front if this turns to be a dumb question. When using openssl for generating private key, it reveals (as per my understanding) the encryption algorithm and initial vector. A bit of googling showed it follows PKCS5. These information of algorithm and key was not present in another private key which followed PKCS8.

Does this mean that PKCS8 has better security ? At present which is most popular and secure, while there is a requirement to store private key in filesystem?
Private key is encrypted with a passphrase and I use the hardcoded passphrase in the code to decrypt it. Is this the right way of using it?


texts:
In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that:

  Hashing the shared secret point prevents an attacker from gaining more information about the EC private keys used to generate the shared point.

Could someone give me an example of how to get information about the private key with a shared secret that isn't hashed?


texts:
I don't quite understand why AES CBC was removed in TLS1.3.
From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that).
It only needs a TRND IV and has not been broken. If you pair it with a decent HMAC I guess It's at least as secure and AES-GCM.
So why is AES-GCM preferred and the CBC support was removed?


texts:
I am implementing hmac-sha-512 in an integrated system. However, one subsystem is only supports the use of 256-bit keys.

I read in https://tools.ietf.org/html/rfc4868 that:

  However, note that [HMAC] strongly discourages a key length less
  than the output length.  Nonetheless, we describe handling of
  shorter lengths here in recognition of shorter lengths typically
  chosen for IKE or IKEv2 pre-shared keys.

And also:

  These key length restrictions are based in part on the
  recommendations in [HMAC] (key lengths less than the output length
  decrease security strength, and keys longer than the output length do
  not significantly increase security strength), and in part because
  allowing variable length keys for IPsec authenticator functions would
  create interoperability issues.

In what way does using a 256-bit key rather than a 512-bit key with HMAC-SHA-512 decrease its security strength? Is it not advisable to proceed with a 256-bit key?


texts: Secure way to derive separate encryption and MAC keys from a single master key?

texts:
I want to derive a 256 bit encryption key and a 256 bit MAC key from a single 256 bit master key for an authenticated encryption scheme.

I was considering the following construction to derive the two keys using a secure 256 bit hash algorithm e.g. Keccak:

Key 1 for encryption = H(master key | '0')
Key 2 for MAC = H(master key | '1')

The advantage of this is that if the MAC key is compromised, it will not lead to decryption of messages as it should be hard to find a pre-image for the one-way hash to determine the master key and thus the derived encryption key.

Also, if only the encryption key was compromised, then this would also not compromise the master key so the attacker should not be able to determine the MAC key and be able to forge future transmissions.

Is this a secure method to derive two keys from one key? If not, what is a more secure method?


texts: Working Precision and Time-constant Arithmetic with ECC?

texts:
I am interested in Elliptic Curve Cryptography and found algorithms for constant-time multiplication.
Within these algorithms arithmetic operations must be performed (like addition and multiplication).

I have two questions about these 'internal' arithmetic operations:

these 'internal' operations must be performed in constant-time, too, right? Then I guess the precision of all intermediate variables must be the same.
But what precision is necessary here (e.g. if I multiply two 256 bit numbers, I need 512 bits for the result, I guess).
What are good algorithms for performing these 'internal' arithmetic operations in constant time?


texts: AES - Size of T-Boxes and obtaining T-Box values

texts:
In article "A high performance ST-Box based unified AES encryption/decryption architecture on FPGA" (http://www.sciencedirect.com/science/article/pii/S0141933115001945) two 32Kb dual-port BRAMs are used. Each BRAM includes four coefficient groups: $T, T^{-1}, S, S^{-1}$ and each of this groups - according to article - needs 8Kb of memory.

AES Proposal (http://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.pdf p.20) describes implementation of Look-Up Tables (T-Boxes) by generating four T-Boxes with different coefficients. Each T-Box uses 8Kb of memory ($256 \cdot 32 = 8192$), so for all four we need 32Kb.

As far as I know, each of dual-port BRAM's port uses same memory as the other, so one can obtain exactly the same value in each of two BRAM's ports using the same address.

How is it possible, that four T-Boxes ($T_0, T_1, T_2, T_3$) of size 32Kb fitted in $\frac{1}{4}$ of 32Kb dual-port BRAM?
How one can obtain correct coefficients for different elements knowing that 10bit address contains only 8bit value and 2 control bits (Encrypt/Decrypt and T-box/S-box select)? 8bit value is not conclusive when we are dealing with four types of T-Box.


texts:
I have two keys (K1 and K2) at both the client and the server. I hope to use HKDF in both client and server side to concatenate the keys.
I will use the same salt value at both the client ad the server. Then will I be able to arrive at the same key by applying HKDF at both the client and the server to K1 and K2?


texts: Is this a sensible cryptographic protocol intending to reduce the impact of compromised security?

texts:
I'm in the process of designing a cryptographic protocol which will reduce the impact an attacker will have if they gained root access to a server storing data.

The basic crux of it is that keys which were used to encrypt data are not stored on the server and are only ever in memory for a short period of time.

The basic description is that:

a Public/Private Key pair is generated on both client and server.
The data is encrypted with both public keys by the client and transmitted to the server
The server's private key is used to decrypt the data by one level (Still encrypted using client's pub) and stored on the server
If the server needs to decrypt the data for ananlysis, this is initiated by the client who does this by sending their private key, encrypted by the server's public key (*This is the weakest point I think?)
The client's private key is decrypted and use to decrypt the data (Then thrown away)
Analysis results are then stored using client's public key (And optionally transmitted to the client)

A picture showing this can be seen :

Please be as brutal as you like - I'd like to try to get this right.

Also please note - I'm aware that if a baddie has root access to the box he'd be able to listen for the client's key transmission and decrypt that using the stored server private key and then compromise the data, but I'm trying to minimise the impact of server compromise, not remove it completely.  I want to work with the assumption, that a hack would be detected before they had time to wait for a client to send their key.

EDIT:
To Clarify - there's an assumption that the data can't be transmitted back tot he client for analysis - lets say because it's too large to make that efficient
There's also an assumption that network traffic is monitored so an attacker would only ever have limited time on the server to attempt to steal the data.


texts: Testing PRNG quality from ECC public keys?

texts:
Having a large set of ECC public keys $P_i = n_iB$ on a fixed curve $E$ over a prime field, is there a way to determine if coefficients $n_i$ were generated using a bad PRNG?

In other words, can a quality of PRNG be tested by knowning the ECC public keys?


texts: What is the purpose of implementing cryptographic algorithms in a token?

texts:
In particular, in PKCS #11. Not a lot of information on the web; I found this explanations. Ignoring the empty marketing talk like “heightened security” and “centralized and secure management”, I managed to extract the following benefits:

secrets do not leave the token,
tamper-resistant audit of the usage of secrets.

In practice, “secrets do not leave the token” is not benefitial. In order to use a secret, a user needs to upload that secret to a program with a user interface (UI). For example, a banking application. This program is not able to execute on a token since tokens have insufficient UI. Hence this program will execute on a UI device to which the token is attached.

Suppose that the UI device is breached.

If cryptographic algorithms are implemented in the token, the attacker can execute any operation that the user can as long as the token is attached.

If cryptographic algorithms are implemented in the UI device, the attacker posesses the user's secrets.

In practice, option 0 is as bad as option 1. For example, for a banking application, the attacker can sign a payment in either case.

Suppose that the UI device is not breached. Then we have equal security independently of where cryptographic algorithms are implemented.

Implementing cryptographic algorithms in the token has disadvantages:

AFAIK, PKCS #11 does not allow backups. If you store all your secrets in a token, it will be valuable not only to attackers, but to you too.
Restricted set of cryptographic algorithms. Only algorithms implemented in a token.
More complex hardware interface and API. [Update 2021-02-15. Here I am comparing to USB mass storage. If a token does not implement cryptographic algorithms, it is essentially an information storage device.]

Am I right?


texts: IND-CPA for permutation based encryption

texts:
My encryption function is some permutation using a permutation key.
An input to the encryption function is encoding of my plain text where one plaintext is mapped to many encodings.
Can we prove semantic security of this encryption?
If so how? Can any one please help me out?
Note: Both Plaintext and its encoding are binary strings (0's and 1's)


texts: Encryption schemes and pseudorandom permutations

texts: Can an encryption scheme (deterministic or not) be viewed as a pseudorandom permutation taking as input a message and returning a value of the same bit-encoding length?


texts:
I stumbled upon an AES implementation that uses boxes with multiples of 2 and 3 for its MixColumns operation. When inspecting the m2 box, I saw that the first line is :
0x00,0x02,0x04,0x06,0x08,0x0A,0x0C,0x0E,0x10,0x12,0x14,0x16,0x18,0x1A,0x1C,0x1E,

So nothing abnormal, but once we reach 0xFE, the next line is :
0x1B,0x19,0x1F,0x1D,0x13,0x11,0x17,0x15,0x0B,0x09,0x0F,0x0D,0x03,0x01,0x07,0x05,

Why does it become so weird ? How were those boxes computed ?


texts: Construction of a MAC with decryption mode of a block cipher

texts:
Assume we have a hardware device with build-in AES decryption and support for ECB and CBC mode (but no support for AES encryption). It only receives data and decrypts it. Minor modifications of the hardware are still possible, but you can't add AES encryption.

Now assume we want to add a MAC for ensuring integrity. CBC-MAC can't be used, as it requires the encryption mode of the block cipher.

Are there MACs you can construct with only the decryption mode of a block cipher?

I thought about using the CBC-MAC scheme and simply replace the AES encryption with the AES decryption, but I'm not sure this would result in a secure MAC.


texts: Is there FHE (fully homomorphic encrpytion) for string/text processing?

texts:
I had a quick look at FHE libraries like SEAL, HeLib, and Palisade and they deal with addition or multiplication of encrypted data.

Is there a FHE that deals with string? If no, is that because it is computationally expensive or there is a better/simpler way to work with text/string-based encryption?

Example of string-based processing here, would be to check if a string is an email address and maybe return 1 if Gmail and 2 if Hotmail

Any clarification is very much appreciated.


texts: Difficulty to find any preimages $a$ and $b$ for given $V$ so that $H(a) \oplus H(b) = V$?

texts:
Suppose I have the values $a$, $b$, and $V = H(a) \oplus H(b)$ with inputs $a \neq b$ and $H$ being SHA-224. None of these values are a secret.
How secure is it to assume that no other possible values $a'$ and $b'$ (except the case of $a'=b$ and $b'=a$) can be generated that result in the same $V = H(a') \oplus H(b')$?

Are there recommended procedures to combine two hashes into a single value and meet the following properties:

$V$ has same (or nearly same) size as each of both input hashes
Any single unknown value ($V$, $H(a)$, or $H(b)$) can easily be deduced from two known values.
Cryptographically hard to obtain different pre-images $a'$ and $b'$ with same $V$


texts: Is it possible to make two files with the same size and the same MD5 and CRC32?

texts:
I have seen a lot of different files with the same MD5s. For CRC32 is quite easy to find collision. But is is it possible to make size, and two different hashes the same?

I have seen many linux packages has only one SHA test-sum, why not to increase security with another hashing function?

(I am not asking about SHA family - answer is YES, possible, but MUCH MORE UNREALISTIC)


texts: Generating random non-repeating numbers from a small group

texts:
I read this Q&A which gave a clever solution: feed an incrementing index into a block key cipher as a way of producing non-repeating random numbers. The problem is the block size of all the good algorithms is often way too big. What if I just want to iterate through all 16-bit numbers, or all N-bit numbers where N is determined by the problem at hand? Nobody in their right mind would make a 16-bit block cipher, but that's what I would need.

One idea I had to iterate pseudo-randomly through all n-bit numbers was to use a binary field. Randomise the modulus polynomial, $Q$, ensuring it's irreducible. Then take a random starting point, $a$, and multiply repeatedly by a random primitive element, $r$, to generate the pseudorandom series.

$n_i = a r^i \pmod Q$

Something tells me this isn't good enough. Predicting the next elements can be interpreted as a discrete logarithm problem if $i$ is the plaintext which must be found from $n_i$. The discrete logarithm is difficult, but when $n_i$ are all given in order, can the problem of finding $r$ and $Q$ from the sequence still be interpreted as the discrete logarithm problem? Does the problem have a name? How hard is it?

If this method of iteration is no good, I had an idea to make it a lot harder: pad the index $i$ with some random bits before encryption, so if the index is a 16 bit number, encrypt it to 20 bits with four random bits. Would that be enough to ensure an unpredictable pattern? What method of iteration would ensure sufficient difficulty in finding a solution? One downside to this modification is that although the sequence generated is non-repeating, it doesn't cover the entire output domain. Is there a way to cover the entire output domain?


texts: Is AES in OFB mode with same IV more robust than ECB mode?

texts: I am looking at implementing AES128 bit encryption of a data stream. Since AES128 is a block cipher, which is inherently less robust than a stream cipher, I have considered configuring AES128 as a stream cipher in OFB mode as shown here. If I use the same IV, will it be more robust than standard ECB (block) mode?


texts: Generating a key pair using a signature generated by an existing key

texts:
I’ve built an app in which each user has a private/public key pair and I want to generate a second one for them, however I cannot store the second private key anywhere.

What would be the drawbacks of deterministically generating the second private key from static information signed by the first one, compared to generating it randomly? I could generate it again each time a user opens the app but is it safe?

This is in the context of a web app on Ethereum, which uses deterministic ECDSA.


texts: Are there any pseudo-random permutation algorithms for any number of words in the input independently of the word size (as in MD6 core function)?

texts:
I am interested in fixed pseudo-random permutation algorithms that are defined for any number of words in the input (but there might be some minimal number of words, e.g. 8), where the word size may be 8/16/32/64 bits. Such permutation may be used as the core function in sponge construction for hashing the message.

The only example that I have found is MD6 core function (although it may be slow, and I don't know if it can be used as a basis of the sponge construction).

Are there any newer (maybe experimental, with unknown cryptographical security) algorithms that match the above requirements?


texts: When will a function $f$ be a truly random function?

texts:
I'm familiar with a definition of a truly random function:

$f$ is a truly random function if it was selected uniformly from the set of all the functions $f(x):\{0,1\}^{n} \to \{0,1\}^{n}$

But I'm having a struggle to figure out if a new function $g$ that was constructed with some manipulation over $f$ will be also truly random.

For example:
$g(x)=f(x) \oplus f(1^{n})$ isn't truly random because $g(1^{n})=0^{n}$ and that will happens only with a neglected probability if we were choosing $g$ uniformly.
I would be happy to get some intuition for when a function $g$ will likely be truly random and when not.
(maybe we can start with reasoning if $g(x)=f(x)\oplus f(\lnot x$) is random or not.)


texts: If two hosts are using a transparent IP level authentication and encryption, is their communication subject to both MITM or replay attacks?

texts:
Encryption process for any outgoing packet to the specified "remote IP":

-original payload P is encrypted (the bytes after the IP header) using RC4 with the preestablished key KEY to obtain encrypted payload C=RC4(P, KEY)

-The encrypted payload C is concatenated with the 16 byte output of MD5(C|KEY), and the IP header is adjusted accordingly (increasing the packet total length, re-calculate the checksum) so that the outgoing packet will have payload C | MD5(C|KEY) and destination "remote IP"

Decryption process for any incoming packet from specified "remote IP":

-Check the packet payload for the MD5 authentication with the same given "key"
Specifically, divide the received packet payload (those bytes after the IP header) as two parts C, A where A is the last 16 bytes of the packet payload and C is the rest.

-If MD5(C|KEY) == A, decrypt C using RC4 to obtain
P=RC4(C, KEY), change the payload of the incoming packet from C|A to P, and adjust the IP header accordingly (decrease the packet total length, re-calculate the checksum) so that the incoming packet will be restored to its original form without keyed md5 authentication before sent to the receiving process


texts: Linear feedback shift register tap charts are availale for registers of length 3 to 168. Does anyone have a chart for register lengths from 168 to 256 or beyond?


texts:
It is very interesting to see @tylo's answer on ElGamal with elliptic curves.  Instead of mapping the message to the elliptic curve point it just reduces an elliptic curve point to its $x$ coodrinate. The scheme now becomes like this:

function $x^P$ denotes the $x$ coordinate of a point.

Encryption: choose random $k\in F_q$ , then calculate $C=kP$ and $c=x^{kY}$. The ciphertext is the point $C$ and the product $c\cdot m \bmod{q}$.

Decryption: From a point $C$ and a value $d$ calculate $c'=x^{xC}$. Retrieve the message with $m=d/c' \bmod{q}$.

Could anyone please clarify if the above scheme is additive homomorphic even if we set the ciphetext to be $c+m \bmod{q}$.


texts: In Simplified DES algorithm, the plain text is 8-bit & the key is 10-bit, why is that, why can't both be of 8-bits each?


texts: Why haven't we proven many things computationally secure yet?

texts:
Brute Force is infeasible for just about every algorithm we use today. Yet, attacks are feasible. This is because weaknesses keep coming up in our algorithms. Why?

We have proven lower bounds for things like sorts, the information security of things like OTP and Shamir's Secret Sharing, proven many problems as hard as any that can be checked in polynomial time (NP-complete), yet we haven't proven anything computationally secure.

Like, we can say that "if this assumption holds, this is secure" but the assumptions are obvious or definitional, like you would expect from axioms, but conjectures that are introduced just so they can be used to prove stuff, and are not in anyway self-evident. Are trust for them goes as far as "a bunch of people have tried to break it, but haven't." As far as I know, we don't even have many cryptographic algorithms for which breaking is NP-Complete.

Why is computational security so hard to prove? Why don't we have any, say, public-private key system that is NP complete to break?


texts: i am trying to generate the nonce for AES-GCM. I know people usually generate it by Counters and LFSRs. I am confused about the meaning of Counters. Is that means Counter (CTR)? Why it can generate unique nonce?


texts: What is the point at infinity on secp256k1 and how to calculate it?

texts:
I hear that there should be a point at infinity on secp256k1. I wounder how to calculate it and what does it even mean. I tried to calculate it as $P_{inf}=P+(-P)$ but this gives different results for different P. Are there more than one point at infinity?

Geometrically thinking on an elliptic curve, adding two points that are symmetric against x-axis, should not be feasible because any vertical line on x-y plane will only intersect the curve at TWO points not THREE.


texts: RSA algorithm: Must $e$ be less than $\varphi(N)$?

texts: I understand why $e$ must be co-prime to the totient of $N$, but I see in many explanations of RSA that $e$ should be less than $\varphi(N)$. Is there a reason for this? Is it for ease of a small number or is there some law in play here?


texts:
I did a CRT challenge yesterday and there`s one problem I was unable to solve, probably due to my lack of understanding advanced crypto math.

It`s about RSA. There are ten given pairs of N and E (modulo and exponent). E is always the standard exponent 10001 (hex). N is a 2048 bit number.

The task: factorize all N.

Well, I tried everything known to me (CRT, Wiener, p-1), no luck. Now it occurred to me that maybe 10 pairs aren't given to keep you busy but that maybe the vulnerability is located there?

Any ideas?

no, I don't have the data anymore. :)


texts: What's the difference between word-oriented and byte-oriented ciphers?

texts:
I am currently learning about the RC4 cipher and its improved version called Spritz.

The paper of Spritz says

  We do not consider other stream-cipher proposals here, and expect that for many applications other word-oriented architectures may be a better choice than the byte-oriented RC4/Spritz style.

Now, what I don't quite understand:

What's the difference between a word-oriented and a byte-oriented cipher/algorithm?
When should either a word- or byte-oriented cipher be used, and
What are the advantages/disadvantages of each?

I found some papers that introduce a byte- or word-oriented cipher, but without elaborating clearly what's the idea behind it. To my surprise, googling for "word oriented byte oriented" and checking several Wikipedia pages on computer architecture/CPUs didn't really yield useful results to me.


texts: Discrete logarithm over prime modulo: small input, large exponent, larger prime

texts:
I am considering using modular exponentiation as a one-way hash function. More specifically, here is the scenario.

1) Input ($m$): the input messages are small (16-bit)

2) Exponent ($e$): the exponent is a 160-bit integer, chosen only once, and randomly; the exponent is not public

3) Prime ($p$): a 2048 bit safe prime, chosen only once and is public

The hash of the message is then computed as: $h=m^e$ mod $p$.

My question is whether there exists efficient algorithms to compute the exponent $e$ given a certain $h$, especially since there are only $2^{16}$ possibilities for $m$?


texts: Are there public key schemes that have perfect secrecy? The perfect secrecy notion is defined for symmetric key encryption. If P is a message and C the corresponding ciphertext then the cipher has perfect secrecy if pr(P|C)=pr(P). This equivalently means in terms of entropy that the conditional entropy H(P|C)=H(P). Originally as defined in Shannon's paper the encryption system is not classified as block or stream cipher. In practice it has to be one of the two and the message length is a priori fixed to a maximum. Hence for a public key scheme with the message length fixed perfect secrecy is still meaningful when probability distribution of the maximum length message is considered. In general H(P|C)< H(P). Since all public key schemes are secured in computational sense H(P|C)=0 which means an infinitely powerful adversary can always break the encryption. Can a perfectly secure public key scheme be defined? If there is one which scheme is it?


texts: Elliptic Curve Discrete Log in a Composite Ring

texts: Elliptic curves are usually defined over prime rings (fields), but what if we chose a ring of composite order? Let $n = pq$ for $p,q$ large primes. Say I have elliptic curve $y^2 = x^3 + ax + b$ over the Ring of integers mod $n$. And I have two points on the curve, say $A, B$ such that $A = xB$. From this alone, it should be enough to determine $x$ correct? I have $n$, I have the factorization of $n = pq$, and I have $A,B$. Everything I read on elliptic curves seems to initialize over our prime field. I can find no discussion of what the actual attack is. I understand the hardness of the problem has been reduced to the integers now mod $p$ and $q$, but I don't understand the process to determine $x$ here.


texts: I have studied bit-sliced implementation in SERPENT block cipher and I need to use this technique to implement some 4x4 s-boxes. I couldn't find any procedure to obtain bit-sliced format in any paper or document. I really need this method to use. Please explain me how to do this and what method or procedure I can use from beginning to end?


texts:
I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p

$e: G * G \to G_t$.  be a map with the following properties:

and in one place i found a definition like

my doubt is in the last part. Specifically in m.e(g1,gn)^t
suppose m is any message, g1=3,gn=13 t=6 (for more information v=5,gi=10.no problem whether all the value assumptions are true or not). then how can i compute e(g1,gn)^t part? sorry for my bad math notation


texts: Strong LRSW assumption for type 3 pairing groups

texts: Why does the "strong LRSW" assumption by Ateniese et al. [Untraceable RFID Tags via Insubvertible Encryption, CCS'05] hold ONLY for type 3 pairings and NOT for symmetric pairings? Whereas, the LRSW assumption by Lysyanskaya et al. [Pseudonym Systems, SAC'99] does hold for all types of pairings.


texts: Are the RFC3526 MODP groups Schnorr groups?

texts:
I was wondering if a group like the 1536-bit MODP Group from RFC 3526 was a
Schnorr group?

A Schnorr group must apparently have:

$p$ and $q$ being primes
$p = q\cdot r+1$
$1 < h < p$
$h^r\not\equiv 1\pmod p$

And then $g = h^r\bmod p$ is the generator.

In RFC3526's 1536-bit MODP, there's a prime:
$$2^{1536}-2^{1472}-1+2^{64}\cdot\lfloor2^{1406}\cdot\text{pi}+741804\rfloor$$
(not too sure what $\text{pi}$ is here)
and the generator is $g=2$.

My question is if such a group is a Schnorr group or not?

If it's a Schnorr group, what are the values or $p$, $q$, $r$ and $h$?

References:
RFC3526 MODP Diffie-Hellman groups for IKE
en.wikipedia.org/wiki/Schnorr_group


texts: O(1) EC Linkable Ring Signature Without Group Manager

texts:
I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-voting, E-cash and Attestation, but I'm not sure about two things:

Does it actually require a group manager or did I miss something? I need a solution where the signer sets-up the signature with no need for a trusted party.
The paper's Appendix A doesn't include a setup for the SLRS, and I don't trust myself with an implementation, I prefer something that went through some public review. I'm looking specifically for EC, not RSA.

I'd appreciate any help in either clarifying these issues about the above paper or alternatively suggesting some reviewed source for another implementation.


texts: Is this a zero knowledge password proof?

texts:
Client and Server both know the Client's password.
Client wants to login.  Server sends Client a random string.
Client concatenates the string with their password.  Clients sends the HASH of this to the server.
Server performs the same operation without sending the hash anywhere.  Server verifies their resulting hash equals the hash recieved by the Client.
Server allows Client to login.
I think this is a zero-knowledge proof because the Client proved they know their password without actually sharing their password.
What am I misunderstanding?
The reason I assume I'm misunderstanding something is because this seems too good to be true.  If zero-knowledge password proofs were so simple, people would want to use this instead of something like SRP.


texts: Why are there $ signs in my passwd file?

texts:
I am trying to get access to my eReader and I managed to get the passwd file.

root:$1$hdhxObPx$TYFuTKsB9GGIgo53rF4bi1:0:0:root:/:/bin/sh
bin:*:1:1:bin:/bin:
daemon:*:2:2:daemon:/sbin:
nobody:*:99:99:Nobody:/:
s3c2440x::507:507:root:/:/bin/sh

I expected to see a standard hash string there or just "x" but this reminds me of something I have seen in MySQL databases, can anyone point me in the right direction please? What am I looking at?


texts: Would RSA make sense if we used no computers?

texts: I was recently wondering - would RSA be useful if we brought it to, say, medieval times? Could you choose the keys so that you could encrypt/decrypt messages quite easily, but factoring the private key would, say, take over 1000 days for 1000 people, provided that they used paper and pencil only and wouldn't make any mistakes?


texts:
I am having a hard time understanding how to convert from projective coordinates, back to affine.

I am trying to compute point addition for Edward curves. Say we have the following:
$$\begin{align}
x_i &= X_i/Z_i\\
y_i &= Y_i/Z_i\\
A &= Z_1*Z_2\\
B &= A^2\\
C &= X_1*X_2 \\
D &= Y_1*Y_2 \\
E &= d*C*D\\
F &= B-E\\
G &= B+E\\
X_3 &= A* F*((X_1+Y_1)*(X_2+Y_2)-C-D)\\
Y_3 &= A* G*(D-C)\\
Z_3 &= c* F*G\\
\end{align}$$

[Editor's note: equations match hyperelliptic.org's add-2007-bl]

Now after obtaining values for $X_3$ and $Y_3$, to get back to affine coordinates, would I have to compute $X_3/Z_3$ and $Y_3/Z_3$ to get $(x_3,y_3)$ ?


texts: Number of cryptographic operations required to perform a MitM for 4DES

texts:
Suppose DES is applied 4 times with 4 different 56-bit keys ($k_1$ to $k_4$). By using meet-in-the-middle attack, what is the number of cryptographic operations required for known-plaintext attack?

The given answer:

For each pair of $k_1$ and $k_2$, we need 2 encryptions and 2 decryptions.
There is a total of $2^{112}$ pairs. So the total required is $2^{114}$ cryptographic
operations.

I don't understand why there are 4 operations for each pair of keys. I thought each half of the attack requires ($2^{56*2} = 2^{112}$) operations so the total number should be only ($2^{112} * 2 = 2^{113}$) operations. What am I getting wrong here?


texts:
I stumbled on the concept of Deniable encryption on Wikipedia, with the following scenario:

  Deniable encryption allows the sender of an encrypted message to deny
  sending that message. This requires a trusted third party. A possible
  scenario works like this:

  Bob suspects his wife Alice is engaged in adultery. That being the case, Alice wants to communicate with her secret lover Carl. She
  creates two keys, one intended to be kept secret, the other intended
  to be sacrificed. She passes the secret key (or both) to Carl.
  Alice constructs an innocuous message M1 for Carl (intended to be revealed to Bob in case of discovery) and an incriminating love letter
  M2 to Carl. She constructs a cipher-text C out of both messages M1, M2
  and emails it to Carl.
  Carl uses his key to decrypt M2 (and possibly M1, in order to read the fake message, too).
  Bob finds out about the email to Carl, becomes suspicious and forces Alice to decrypt the message.
  Alice uses the sacrificial key and reveals the innocuous message M1 to Bob. Since Bob does not know about the other key, he might
  assume there is no message M2.

I would like to have examples of ciphers providing this property. The Wikipedia page only gives softwares like filesystems.


texts: In RSA, what is faster attacking "d" when plaintext is known, or factoring when M is unknown?

texts:
I'm aware of two methods to attack RSA:

Brute force factoring, where no plain text is available
Brute force (1/e) mod φ where the plain text is available as described here

Question

Given an optimized solution either in a generic CPU, or custom ASIC, what operation is more likely to take longer, and/or consume more resources?
How close to polynomial time will each of these calculations be?

Ideally I'd like to get a perspective on the number of operations on each approach, and the computational cost.  So far it appears that for key length n, option two is 0.5 * n operations.

My goal is to determine if the computational effort per try is less than what was done in this paper, or any other effort to crack RSA.


texts: Diffusion in Shamir's secret sharing scheme

texts:
The popular command line utility ssss implements the classic Shamir's secret sharing scheme over the generic field $GF(2^q)$ with $8 \le q \le 1024$.

When $q>=64$, the constant coefficient ($c_0$) is not the secret but a transformed version of it, obtained by means of 40 rounds of XTEA-based permutation. As result, the secret is somewhat diffused over the entire $q$ bits.

Why is that? Which attack does it prevent? Does it help when the secret has a short bit length?


texts: Differential bound of the S-Box in GOST R34.11-2012

texts:
In Russian GOST R34.11-2012 LPS-transformation is used. LPS gets all of its non-linearity from the 8-bit S-box S, which apparently has been designed to offer resistance against classical methods of cryptanalysis. Its differential bound is P = $8/256$ and best linear approximation holds with P = $28/128$ . There seem to be no exploitable algebraic weaknesses.

Can you explain what is "differential bound of the S-Box"? I think that it's a probability: P(S($x_1$) $\oplus$ S($x_2$) = b | $x_1$ $\oplus$ $x_2$ = a) for random $a, b$. Is it a correct definition? And LPS seems to be no exploitable algebraic weaknesses because there are 64 S-Boxes and so, differential probability of the LPS at all is $(8/256)^{64}$?


texts: What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$

texts:
I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work.

I thought the only thing I had to change in my code was the irreducible polynomial and the transformation of points for the pairing. So I changed my polynomial from $x^2 + x + 1$ to $x^2 + 1$, I kept the root $\xi = x$ and I changed my mapping from $(x,y) \rightarrow (\xi x,y)$ to $(x,y) \rightarrow (-x,iy)$ where the $i$ is my $x$. Was I wrong somewhere or was there something other to do?


texts: Correct way to hash a unordered collection

texts:
I am trying to find out the correct way to hash an unordered collection. In this collection elements may be repeated and the hash needs to reflect how many times an element appears. If we are unable to hash each element, sort the hashes and then hash the result (for example, because the elements are distributed between many machines which are unable to communicate all the data) what is the next best option?

I have seen three possible suggestions for combining the hashes of each element and I am wondering if they are valid in general or just for specific hash functions:

XOR - Will only work for sets which are guaranteed to not have duplicates as a XOR a = 0
Addition - Proposed as a better alternative to XOR since a + a = a << 1 which seems a good fit as long as addition causing integer overflow wraps and equivalently the bit shift is a bitwise rotation
Multiplication - Another proposal which I have seen in this thread: How to hash a set of elements (not sure what benefits this might have over addition)

Are any of these a valid way to combine a collection of hashes without significantly increasing the chance of collision? Are they valid in general or only for cryptographic hash functions? If this isn't something that is supported by most hash functions, are there any specific hash functions which is designed to supports this use case?

Ideally I'd like to use a fast non-cryptographic hash function such as MurmurHash3, but I can't find any good resources that suggest any the above options are a valid way to combine hashes.


texts:
I am trying to implement a password manager in C and I had a question about the proper steps in implementing the crypto. I looked at some implementations, google talks on crypto and what the standards are.

so I just wanted to list out the steps in the program and I wanted to make sure I was doing it right.

If its a first time the program is being used, it will ask the user for a password to use
This password will then be hashed with some algorithm (SHA1?) and then stored in a file
Then a password storage file is created and the user can add, delete or view the entries
When the user is done, the password storage file is encrypted (use the user password as input to openssl, openssl aes-256-cbc -salt -in test.txt -out test.aes, this is from the command line...I'd have to do the equivalent in C)
exit
when the user reopens the application, the user password is checked against the stored hash
if it passes, the password is sent to openssl to decrypt the password storage file
the user does some stuff and exits, the password storage file is reencrypted

So what do you guys think? Let me know if there are C specific crypto resources I can use.
Thanks for your help!


texts:
In a correct implementation of X25519+XSalsa20+Poly1305, I think I have the right understanding in saying that the Poly1305 message authentication code is a function of the secret key + plaintext.
My question is, on the recipient side, with such a construction, is there a need to supply some extra secret to check the validity of the MAC/Tag?
I guess my question stems from using other primitives such as HMAC SHA-256, where to verify the authenticated hash you need an additional secret to be shared.
In the case of X25519+XSalsa20+Poly1305, is the only secret required to decrypt and verify simply the result of the X25519 ECDH key agreement? i.e. there is no additional MAC secret?


texts: What does signed fixed window method mean in ECC?

texts: I am studying (sliding) window method in Elliptic Curve Cryptography (ECC) but I am confused by the term, signed fixed window method. By the way term is used in a research paper and not in the book that I am reading.


texts: Cryptographic function that can 'pack' numbers

texts:
Is there a cryptographic algorithm that can 'pack' a bunch of strings/numbers and "confirm" if a string/numbers exists (later in the code) while keeping the output hidden?

For example, I have algorithm X, to which I can run something like:

// From Alice's side
algo1 = new X(key);

algo1.pack(100)
algo1.pack(200)
algo1.pack(300)

algo1.finalize()
print(algo1.output) // Prints a bunch of random bytes

//Later, somewhere in Bob's code
algo2 = new X(key, algo1.output);

algo2.has(111) // false
algo2.has(222) // false
algo2.has(100) // true
algo2.has(200) // true

I do realize this can be done with an encrypted database, but I am searching for a solution in an algorithm.

The purpose is data hiding: in case algo1.output as well as key are revealed to an attacker, they would still have to know the values in the set to get a truthful answer (100, 200 and 300 in the case above), which would protect the integrity of those values, even if the key and algo1.output are revealed

They would then have to rely on brute-force methods to extract those values, which could make it expensive for the attacker.


texts: How to find out the block size of Xchacha20 in Libsodium?

texts:
I heard that Xchacha20 works like a block cipher so that even if it wants to encrypt one byte, it will do the work of at least one block.  So technically it works similar to a block cipher in counter mode.
I want to find out the size of this block, which represents the minimum work that Xchacha20 can do.
How to find out?  Specifically in Libsodium.  I want to see it (not just believe it blindly).  Any idea where to look?


texts:
I am given the following problem.

  Consider SHA-256 to be a random oracle in a practical application.
  Construct an (almost) random oracle $\{0,1\}^*→\{0,1\}^{3000}$ based on SHA-256.

Does it mean that the input is any length of zeros and ones and that is should hash to a value which is 3000 digits of zeros and ones? If yes, could I just apply SHA-256 12 times, splitting the input in 12 parts and remove 72 bits, then I will get 3000 bits? Or did I misunderstand?


texts: SHA1 collisions and the impact for ECDSA signatures

texts:
What will it mean for ECDSA using SHA1 when we have practical attacks breaking the collision resistance property of SHA1?

[UPDATE] Added a bit more details to be clear.

If $(r,s)$ is the ECDSA signature for $m$, is it possible to give a different message $m'$ that will have the same signature.


texts: P2P encryption - Do I need a different session key each time?

texts:
I am using AES128-CBC+HMAC for all encryption.

Currently I am using the same encryption and authentication/MAC key (Both derived from a master key with HKDF).

Assuming that forward secrecy is not a requirement for my project:

Is having a different session key each time strictly necessary and why?


texts: What are the integers in an RSA PEM file?

texts:
I have an RSA Private key file my_private_key.pem with the header -----BEGIN RSA PRIVATE KEY-----. I can parse that with the openssl utility: openssl asn1parse < my_private_key.pem

That shows me a bunch of integers: a 4096 bit integer, a 17 bit integer, another 4096 bit integer, and then five 2048 bit integers.

I understand the textbook RSA primitive where the private key is $(p,q,e)$ where $p,q$ are large secret primes and $e$ is the encryption exponent where $\gcd(e, (p-1)(q-1)) = 1$ and you encrypt plaintext $m$ by $c \equiv m^e \pmod{N}$ where $N=p \cdot q$. How does that textbook version of RSA relate to these integer numbers I see in a .pem file?

I'm sure this is a newbie question. Where do I start to read on this?


texts: Could public-key crypto be performed long ago if the idea had been discovered?

texts: Public-key cryptography was not invented until the 1970's. Apart from the idea not existing earlier (as talked about here), is there any reason it could not have been used earlier? For example, are there forms that are easy enough to perform by hand but complicated enough to not be solved (easily) by hand?


texts: Do Chosen-Chiphertext attacks only apply to public-key cryptosystems?

texts: Do Chosen-Chiphertext attacks (CCA-1/2) only apply to public-key Cryptosystem?


texts: How many times can a key be used for HMAC-SHA256 before it needs to be rotated?

texts: If I wanted to use hmac for proving that a value hadn't been tampered with, how many times can I use a key before it needs to be rotated?


texts: How long is the tag T in AES-GCM(Or: Can implementations freely choose t = len(T)?)

texts:
I've started to learn about GCM. In the paper I read on page 4 there is the equation:
$$
T = \text{MSB}_t(\text{GHASH}(H, A, C) \oplus E(K, Y_0))
$$

It's clear to me that the function $\text{MSB}_t(S)$ returns the bit string containing only the most significant (leftmost) $t$ bits of $S$ (defined on the same page).
But I couldn't find any info on the value of $t$.

Wikipedia mentions several possible sizes of $t$ with advantages and disadvantages.

So, can the implementer choose $t$?

Which value of $t$ is used in TLS's AES-GCM cipher suites?

EDIT: Here I can see that RFC 5116 is determining $t = 128$, but how can I see that RFC 5116 is part of TLS 1.2?


texts:
I have this cypher which is as follows :

Take 2 numbers : A=1011 and B=1010

if the ith bit of A is 1 then shift B i times to the left.
So in the end you will get something like

   1010
  1010
1010

So now you Apply XOR on these numbers which results in :

00001010
00010100 (XOR)
01010000 (XOR)
---------
01001110

So you end up getting 2 4-bit numbers from 01001110: that is 0100 & 1110

So now given 0100 & 1110 how do I reverse this and find the initial A & B

PS : I am a complete newbie when it comes to crypto so please explain it like how you would explain it to a noob.


texts: Minimum number of public and private keys depending on signature?

texts:
I'm trying to make sure I understand and intuit things properly here, so I'm going to be somewhat lengthy? With this, as I did a cursory search here and couldn't find exactly the case examples I'm looking at.

As we generally know, this is how public key crypto would be working.

Asymmetric: Two key pairs on each branch, e.g., Joe and Jill must each have a public and private key.  The number of key pairs is N * (N – 1)

Symmetric:  One key per branch, e.g., Joe and Jill share a single key.  The number of keys for N managers is N*(N-1) / 2 implying exponential growth.

Our situation is as thus, and currently ignores man in the middle and other methods of attack that would require additional keys, and we, as a head of department want to communicate with (N-1) staff members and conducting a secure conversation (N total personnel including head of department, let's call them Smith)

1) If we want to send identical information to the other (N-1) using asymmetric cryptography, but also digitally sign the communication so that the other members know it's from Smith and has not been modified. Assume no compromising of keys and the message can be sent in the clear or encrypted.

--My initial thought is, let's say we have 10 personnel including Smith (N=10). Based on the above formula, that is 10*9 or 90 public/private key pairs, however we're going to digitally sign: do I need to just add 10 to the total, or is there something else?

2) The personnel (N-1) must be able to send information back to Smith using asymmetric; assuming the keys are known only to members of the group, how many public and private keys must exist? In this case, Smith does not need to verify the actual identity of the member sending the message. The actual message must be encrypted and all messages should be private with respect to all other members of the group, i.e., no member of the group can read another members messages to Dr. Cooper.

--On this, I want to assume that, it's 9*8, so there would be a lack of need for the key pair from the 10th (Smith) because they're only sending information back to him.

3) The (N-1) members of the group must be able to send information to Smith using asymmetric cryptography. Assuming the keys are only known to member of the group, what is the minimum number of private and public keys to accomplish the task? Smith must be able to verify the identity of each group member sending a communication.

--Again, I'm thinking the same formula of N*(N-1) is still necessary, but I also feel that it needs modification for Authentication and non-repudiation, only I've been unable to find clear information regarding this.

4) The (N-1) members of the group must be able to send information to the Smith using symmetric cryptography.  Assuming the keys are only known to appropriate members of the group, what is the minimum number of symmetric keys to accomplish the task?  Smith must be able to verify the identity of each group member sending a communication and verify each message has not been modified using the digital signature of the message hash.

--This one is a bit different; let's assume our actual N is the N-1, so 9. 9(9-1)/2 or 9*8 = 72 / 2 = 36 keys.

Long story short, what might I be missing?


texts: Decryption Queries and its meaning in identity-based encryption

texts: In identity-based encryption, for security proof, they sometimes describe random oracle for decryption queries. Therefore, I wonder decryption is handled by decryption oracle for all users? Users need help of decryption oracle for decryption?


texts: Why is this function pseudo random (PRF)?

texts:
First, I want to clarify this is not homework. I encountered this question (here How can I prove that a function F isn't a pseudo random function?) while studying for a test coming soon.

$F'_k(x) = F_k(0||x) || F_k(1||x)$
$F'_k(x) = F_k(0||x) || F_k(x||1)$

(Here $||$ representing concatenation, $F$ is a PRF).

I know that the second function is not a PRF and I came up with an adversary for it by myself.

As for the first fuction, I read comments saying it is a PRF, but I couldn't find a way to formally prove this.
I know the method of proving these kinds of questions.

I should assume by contradiction that $F'_K$ is not a PRF, namely it has an adversary $D'$ that distinguishes between $F'_K$ and a random function $f'$ with non-negligible probability.  Using $D'$, I should construct an adversary $D$ that distinguishes between $F_K$ and a random function $f$ with non-negligible probability - which is a contradiction.

I thought of the following reduction for constructing $D$:

Given an input $x$, and a oracle access $O$ (for $F_K$), $D$ runs $D'$ on $O(0||x)||O(1||x)$. Then, $D$ answers what $D'$ answers.

If $O=F_k$ , then $D$'s probability of distinguishing is equal to $D'$'s.
If $O=f$ (the random function) - Well, here I'm stuck.


texts: Is this an acceptable All-or-Nothing Transform?

texts:
I was thinking about AONTs, and designed the one below, I call it CHANT for Chained-Hash All-or-Nothing Transform; it's my very first shot at something of the sort, and was hoping I could get your opinions.

Suppose you have a hash function $H$ of block size (ie. the size of the generated hash) $b$, you'd like to "wrap" a message $m$; CHANT works as follows:

Break $m$ up into blocks of $b$ bits, call the resulting blocks $m_{1}$, $m_{2}$, $\ldots$, $m_{n}$.
Generate a random block of $b$ bits, call that block $m_{0}$.
Now, for each message block $m_{i}$ (with $1 \leq i \leq n$), calculate its wrapped block $w_{i}$ as $w_{i} = H^{i} (m_{0}) \oplus m_{i}$ (where $H^{i}$ denotes the $i$-th iteration of the hash function $H$).
Finally, calculate $w_{0} = H(w_{1} \Vert w_{2} \Vert \cdots \Vert w_{n}) \oplus m_{0}$, the wrapping will then be $w = w_{0} \Vert w_{1} \Vert w_{2} \Vert \cdots \Vert w_{n}$ (where $x \Vert y$ denotes concatenation).

Now in order to unwrap a CHANT-wrapped message $w$, one proceeds as follows:

Break $w$ up into blocks of $b$ bits, call the resulting blocks $w_{0}$, $w_{1}$, $w_{2}$, $\ldots$, $w_{n}$.
Calculate $m_{0} = w_{0} \oplus H(w_{1} \Vert w_{2} \Vert \cdots \Vert w_{n})$.
Now for each wrapped block $w_{i}$ (with $1 \leq i \leq n$), calculate its unwrapping $m_{i}$ as $m_{i} = w_{i} \oplus H^{i} (m_{0})$.
Finally, discard $m_{0}$, the unwrapping will then be $m = m_{1} \Vert m_{2} \Vert \cdots \Vert m_{n}$.

If $w_{0}$ is missing, then there's simply not enough information to retrieve the original random $b$ bits, if $w_{i}$ with $i \neq 0$ is missing, then with high probability, the hash value needed to retrieve $w_{0}$ will be incorrect.

CHANT is basically a (very simple) stream cipher which discloses the (random) encryption key given the wrapped message's hash.

As some of its (in my eyes) pros, I'd mention the fact that it requires nothing more than a hash function and a (pseudo-)random source (but see question 4 below), and that it's very easy to understand (for a layman like myself at least).

As one of its cons, I'd point out the need to add an additional block (ie. $w_{0}$) to the output.

Now, my questions are:

Have I missed something? is this really an AONT?
I'm sure there are faster / better approaches to AONTs, but is this terribly bad? is it any better than others in any respect?
What should be asked of the hash function $H$? collision resistance? pre-image resistance?
Is it having a (pseudo-)random source a bad thing? would it be any better if the construction above were to replace $m_{0}$ (randomly generated) by $H(m)$? would it be any worse? (at the very least, it would make the wrappings of two identical messages the same).

Thank you in advance, and sorry if I overlooked something trivial, it's my first post in this SX site.


texts: How does Hash with random cryptography work?

texts:
I am new in this world of cryptography and while reading some articles I got stuck into something that I did not understand correctly: the use of hash based on random cryptography.

On my knowledge, when I am using any program which needs authentication the program uses a Hash to save the password into the database and then when the user try to access the program, it get the password that the user insert into some textbox, use the same cryptography as used to save to hash the password and compare the insert result with the result saved in database.

How is this possible to do so if the cryptography is random?


texts: Breaking effort on both Weak and Strong collision resistance hash values

texts: I know the fact that the effort of brute force attack to break weak collision resistance hash value takes $2^n$ while in the strong collision resistance takes $2^{n/2}$. Can someone explain why strong collision resistance takes less effort?


texts: In the lets-choose-the-next-aes contest in 1998, they chose Rijndael because of speed. Now, not taking speed into account, is Serpent more secure or not? Since it has 32 rounds (of course that's not that useful if the round algorithm isn't secure,) I thought it's more secure, since it has the same block size, key sizes AND more rounds. But I really don't know the details, so if you threw away efficiency on x86 CPUs and ease of implementation, then Serpent would be more secure, right? If yes, is it superior, or just a tiny bit more secure?


texts: Generating a XOR Hash function for a given group of numbers to maximise collisions

texts:
Given $x$, a vector of $m$ distinct bit vectors of bit length $N$, I want to use an XOR-hash $h$ such that all $x_i$ collide to the same value.
I define an XOR hash $h$ which takes bit vector $q$ as input and performs an AND operation on each bit of $q$ with a bit vector $k_i$ of bit length $S$.
$h(q) = (k_1.q_1)\oplus(k_2.q_2)\oplus...\oplus(k_N.q_N)$
The "AND" dot operation $a.b$ takes bit vector $a$ and boolean/bit $b$ and returns ($a$ if $b$ else 0).
Here $k$ is a vector of bit vectors, and my goal is to find $k$ such that for some constant bit vector $y$ of bit length $S$, $h(x_i) = y$ for all $i$.
Section 4.3 in this paper describes this hash function. http://www.mathcs.emory.edu/~whalen/Hash/Hash_Articles/IEEE/Efficient%20hardware%20hashing%20functions%20for%20high%20performance%20computers.pdf
It is my understanding that when you try to XOR-hash a bit vector of size $N$ to a bit vector of size $S$, there will be $2^{N-S}$ collisions. I want to choose $k$ so that all $m$ bit vectors in $x$ hash to the same value $y$.
For example, take $N=15$, and $m=200$.
I am trying to round $m$ to the next power of 2. In this case, I would like to round 200 to 256 and then have $2^{N-S}=256=2^8$, so that $N-S=8$ and thus $S=7$.
In other words, I can now XOR-hash from a $N=15$-bit space to a $S=7$-bit space with all the $m=200$ inputs colliding to the same output. I understand that there are an additional 56 numbers which are not accounted for. We choose any bit vector of size 15 which is not in $x$.
How do I go about finding $k$ deterministically (or closed-loop fashion) to make all the hashes collide?


texts: Why is $Mac_k(m_1||m_2) = ⟨F_k(m_1), F_k(m_1 \oplus \overline{m_2})⟩$ not a secure MAC?

texts:
I am preparing for an exam and trying to solve the following question I found on the internet:

  Let $F_k$ be a pseudorandom function. Show that the following MAC for messages of length $2n$ is insecure. The shared key is a random key $k \in \{0, 1\}^n$.

  $\operatorname{Mac}_k(m_1||m_2) = ⟨F_k(m_1), F_k(m_1 \oplus \overline{m_2})⟩$

  where $m_1, m_2$ are binary strings of length $n$ and $\overline{m_2}$ is $m_2$with all its bits inverted. What is the minimum number of queries that the adversary has to make to the MAC-oracle to forge a MAC?

To solve both questions I have tried to construct two messages for which the attacker requests tags and then combine the messages and corresponding tags in a way that gives a valid message and tag. Regrettably, this didn't work out since the second part of the tag combines both parts of the original message. Am I on the wrong track with my approach?


texts: What is the difference between $\in$ and $\in_{\small R}$?

texts:
I have a simple question about basic math. When I read different papers bout ABE, I see different methods to choose a random exponent.

What is the difference between the following options?

Choose a random exponent $\,a \in \mathbb Z_p$.
Choose a random exponent $\,a \in_{\small R} \mathbb Z_p$.
Choose a random exponent $\,a \in \mathbb Z^*_p$.
Choose a random exponent $\,a \in_{\small R} \mathbb Z^*_p$.


texts: Is there a standard, or widely accepted convention, for magic constants in crypto software?

texts: Inspired by Magic "Nothing Up My Sleeve" Numbers - Computerphile - YouTube [5:31]. If you just need a constant to begin your algorithm, and the value of that constant isn't important, why not have a widely known convention to always use the digits of Pi or Phi or other well known constant? It would seem that choosing arbitrary numbers is bad because it causes doubt as to the origin of the numbers which may lead some to suspect they were cherry picked for undisclosed weaknesses.


texts: Is TripleDES 168bit vulnerable to Differential Cryptanalysis?

texts:
I was reading this paper. In the table-1 of the paper it says  TripleDES (showing both 128bit and 168bit keysize) is vulnerable to Differential Cryptanalysis. It also says that AES (showing all three keysize) is strong against Differential Cryptanalysis. If AES-128bit is secure against Differential Cryptanalysis then why not TripleDES-168bit as well?

So, is it the paper that the authors haven't made it clear or is it true that TripleDES 168bit keysize is vulnerable to Differential Cryptanalysis attack?


texts: How does the key schedule of Rijndael looks for keysizes other than 128 bit?

texts:
It said in Wikipedia that:

  [....] Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the keysize has no theoretical maximum.

How would the key schedule look for these other key sizes, like a 136-bit key?


texts: Where are the ChaCha20 test vectors/examples?

texts:
I see in the Salsa20 specification there are test examples throughout the document to help an implementer make sure every function works as designed. Consequently the whole algorithm would work perfectly if all the tests pass. Without these test vectors it would be very difficult to know whether the code was working as designed or was giving incorrect outputs. Test-driven development should be the gold standard for developing a cryptographic library.

So it came as a surprise to me when reading the improved ChaCha20 specification that there are no test examples to validate against. I have even had a look on the ChaCha web page but found nothing.

Even though ChaCha20 has better diffusion and is supposedly more secure, I would consider myself actually safer using the Salsa20 algorithm as I have reference test vectors for the code/library to validate against and I would know for sure that it was implemented correctly. Using ChaCha20 would be a risky move in comparison. How do all the other implementers of ChaCha20 e.g. OpenSSH know their implementation is correct? How are other people able to trust that their implementation is correct?

I would like to know where the ChaCha20 test examples are which show the correct outputs from the ChaCha quarter-round and ChaCha matrix? Why aren't they in the specification document?


texts: How can I solve the discrete logarithm modulo 2q+1 if I can solve it in the subgroup of order q?

texts:
As part of my cryptography course I came across an exercise that neither me or my friends could figure out.

The problem statement is as follows:

  Let $p$ be a large prime of the form $p = 2q + 1$ with $q$ also prime. Let $g$ be a
  generator of $\mathbb Z^∗_p$ and consider the discrete logarithm problem: given $h = g^x$,
  find $x$.

  Let $G_q$ denote the subgroup of order $q$ and assume you have access
  to an oracle $O : G_q ×G_q \to \{0, 1\}$ that on input two elements $s, t \in G_q$ with
  $t = s^y$ returns the least significant bit of $y$. Design an algorithm (using the
  oracle) to solve the DLP in $G_q$ and an algorithm (again using the oracle) to
  solve the DLP in $\mathbb Z^∗_p$.

The first part of the question is fairly easy (solve DLP in $G_q$ with the oracle). However, we cannot figure out the second part.

I have solved the first part as follows:

  Run the oracle on $t$. On output 0 you know that the LSB of $y$ is 0, hence $y$ is even. $s^y$ can therefor be written as $s^{2*y'}$, which is still equal to $t$. By taking the square root of $t$, $\sqrt(t) = s^{y'}$ I no longer now the LSB of $y'$, but I know it's 1 bit smaller than $y$.

  Similarly if the LSB of $y$ is 1 I know I can write $t = s^{y} = s^{y'+1} = s^{y}s$, hence dividing $t$ by $s$ gives me a new pair $s',t'$ on which I can unleash the oracle.

  If I repeat the steps above $log_2(q)$ times and store all the LSB's I have found $y$.

Any hints/clues/advice will be most appreciated :).


texts:
First of all, I apologize in advance if I use any incorrect terminology. I am just getting my feet wet when it comes to cryptography and there is a lot to learn.

For the past 12 months, we have been developing an application infrastructure for a Cloud and Mobile Application (iOS/Android). As part of the infrastructure, we require the ability to encrypt $\text{SHA-}256$ hashes using asymmetric encryption and in some cases, encrypt multiple hashes at one time. A non-decryptable digital signature is not sufficient for our requirements. The simple explanation for this is, the digital signatures we have been using thus far, allows anyone with a corresponding public key, to review the contents to ensure they align with corresponding data in the database row. Ownership of the row of data cannot be transferred or duplicate rows created, without the correct signature. Rows have a signature and an owner and two digital signatures validating the product serial number is valid and that the declared owner, does, in fact, own the serial number.

We have built a working prototype that was built on top of our existing framework, which uses PostgreSQL and PHP and preliminary testing using $\text{SHA-}256$ and RSA 2048 has yielded the results of being able to encrypt and insert/update 10,000 unique rows of data every 40 seconds. When inserting 10,000 rows of data, there are 10,000 unique digital signatures that have to be created. The bulk of the work is in creating these digital signatures.

We are wondering what the best way to speed this up is? Ultimately, we need to be able to drastically reduce this time and it would be ideal if we could get 10,000 rows signed and inserted in under 5 seconds.

Is there a faster solution for signing digital signatures with a private key? We have discussed writing this component in C#. We are also wondering if Bitcoin mining hardware (ASIC) could be used for asymmetric encryption? If not mining hardware, would GPU based processing be better? Acquiring specialized hardware, should improve the processing time, which is not a problem.

We eventually need to generate in excess of 1 billion digital signatures per month. Any guidance or help would be greatly appreciated.

EDIT: I forgot to mention we are using OpenSSL with our current prototype.


texts: bcrypt collision probabilities assuming same password and work factor?

texts:
What is the likelihood of 2 bcrypt hashes colliding if they use the same work-factor and input?

Are bcrypt's salts large enough to prevent this from happening?


texts: Is it possible to anonymize web traffic so that the IP Address cannot be determined while still being able to determine distinct IPs?

texts:
I'd like to find a way to anonymize IP addresses in web logs to ensure user privacy given the following requirements:

If given an IP address, there is no way to look up which requests came from the IP address.
Given the set of requests, it can be determined which requests came from the same IP address.

This way no one (including an attacker) can determine the original IP addresses from the log.  An attacker (anyone with access to the log) would be able to determine which IPs are distinct, though.

I'm envisioning something like the this.  Each request is sent through a function that creates a unique identifier for each IP address (notice that request 1 and 4 are from the same IP address, but result in different hashes).

Request 1 - 192.168.0.1 => EIDKSJD
Request 2 - 192.168.0.2 => GIEKDJS
Request 3 - 192.168.0.3 => CIDJSDJ
Request 4 - 192.168.0.1 => DJCUDJS

But there is another function that takes two outputs and determines if they came from the same IP.

same_parent(EIDKSJD, GIEKDJS) returns false
same_parent(EIDKSJD, DJCUDJS) returns true

This method has it's downsides, specifically that searching for duplicates is not efficient.  If there's a method that is efficient for searching and meets criteria 1 and 2 above, I would up-vote twice if I could :).


texts: Is there a way to know if a cleartext substring is present in a hash?

texts:
Let's say I have 4 strings - A, B, C & D. I concatenate and hash them in any order: A + B + C + D or A + C + B + D and send it to another party. Let's call this X.

I can also send a hash of A separately to the same party (but cannot send it in plain text). Is there any algorithm that I can use to figure out whether the string A is used while creating X?


texts: Finding an x such that xP = (11,44) on an elliptic curve

texts:
Given the elliptic curve

$$E:y^2 = x^3+17x+5 \mod 59$$

with point $P = (4,14)$, how do I find $x$ such that compute $x\cdot P = (11,44)$

Is there a mathematical method to compute $x$, or do I simply compute a lot  of $x$'s and hope for the best?

If it helps, I know $8P = (16,40)$


texts: The complexity of Pohlig-Hellman algorithm

texts:
The Wikipedia Pohlig Hellman algorithm says that the complexity of Pohlig-Hellman algorithm is
$$\displaystyle {\mathcal {O}}\left(\sum _{i}{e_{i}(\log n+{\sqrt {p_{i}}})}\right)$$
I understand that the complexity of calulating $(x \mod p_i^{e_i})$ is ${\mathcal {O}}\left({e_{i}{\sqrt {p_{i}}}}\right)$. But which part of this algorithm has complexity of ${\mathcal {O}}\left({e_{i}{\log n}}\right)$?


texts:
For assymetric encryption such as RSA, I understand that Alice can sign a document with her secret key and send it to Bob, which he can then verify.

Sign: $\sigma=m^d \bmod N$

Verify: $v=\sigma^e \bmod N$

This may be a silly question, but what if it was the other way around, Bob wants to send a document to Alice. How would he sign it to say it was from him. Can he do it without introducing "Bob's secret key" and just use the scheme provided, or does he have to do that? or is there better way?


texts: Sigma Protocol with Privacy-preserving Discrete Logarithms?

texts:
I've been reading up on Sigma Protocols and Fiat-Shamir Heuristic. There is a small problem I see here that is possibly already solved, but I'd like to know if it has a solution.

Peggy wants to prove to Victor that she has $x$
They both agree on a constant $g$ and a prime number $p$, as well as a "puzzle", usually in the form of a discrete logarithm $g^x$.

For any verifier, there must be, as semi-public knowledge, the value of $g^x$.

In my head, the value of $g^x$ is constant and it could be used as an identifier against Peggy.

Is there a way to have a dynamic value of $g^x$ that would work just as good to solve the puzzle of proving Peggy's ownership without having it being a constant value, that can be used as a user identifier?

P.S: I do realize that one can utilize a public/private keypair to represent $x$ and $g^x$ respectively. This still means that a public key is user identifiable.

P.S.S: The objective of my research is to prove the equality of two $x$'s, with two separate owners, without sharing a $g^x$ public "puzzle" of $x$. I have a feeling that a Diffie-Hellman tuple could be used here for a one-time-session shared secret, but I am having a hard time understanding how to place all the pieces together...

Many thanks


texts: What is the difference between Argon2d and Argon2i?

texts: I know that Argon2d accesses the memory array in a password dependent order and Argon2i accesses the memory array in a password independent order. What is the difference in computational complexity?


texts: Why would you ever need Key exchange algorithms, when you can use public key encryption?

texts:
Key exchange algorithms make it possible to establish a shared secret key.

But isn't a shared secret always just as powerful as each party creating a public/private key pair and sending each other their public key, and using that for exchanging data?

I always read this is not secure because of the risk that the private key might leak. However the shared key might also leak.

Why the need for key exchange algorithms?


texts:
Here I overconfident in myself state that I can show, that n has two factors.

This is not completely true, can possibly show $n$ is composite - prover generates RSA key with modulo $n$, and gives $e$ to verifier.

Verifier takes random number $x$, and checks if $x^{e*d}=x$, where $d*e=1$ (mod  $n-1$). If it is, then $n$ is prime, if not $n$ is composite and has factors.

Verifier sends $x^e$ to prover, and if prover sends back $x$ we can be sure that prover has factors of $n$. This doesnt, however garanties that there is just two factors.

How to prove-verify that there is only two factors in $n$?

UPDATE: This is not zeroproof, it is interactive here as was pointed in comments. Well, then. Question becomes more broader - can (duh) show that $n$ is not a prime. How to show it has two factors, zero knowledge, without interactivity?


texts: confused about differences between 5 out of 5 threshold secret sharing scheme and 4 out of 5 threshold secret sharing scheme. how would the share and reconstruction schemes be different assuming both of them use xor?


texts: Why is Poly1305, which is based on AES, faster than AES?

texts:
The web pages of BearSSL have the following performance numbers:

Poly1305 1730.92 MB/s, amd64, ctmulq
AES-128 CTR 92.38 MB/s, amd64, ct64

It seems that constant-time Poly1305 is over an order of magnitude faster than AES-128 in the counter mode, without any special CPU instruction support in either.

My understanding is that Poly1305, however, is based on AES (source). Why can something based on AES be faster than AES by a so wide margin?


texts:
Can anybody help me to understand elgamal based decryption mixnet? Pure elgamal can be used in mixnet (re-encryption mixnet) and its very easy, and I have implemented decryption mixnet using RSA also.

See for example, http://courses.csail.mit.edu/6.897/spring04/L18.pdf

But I have failed to gather any idea on the implementation of elgamal based decryption mixnet. Please help...


texts: Will an algorithm that constantly changes the order of 10 hash functions be protected from an ASIC?

texts:
Let's imagine one hash function that is based on 10 hash functions. For every input, it changes the order of the 10 hash functions. So, for example:
Hello, World! -> md5 -> sha256 -> sha512 -> sha3_256 ... -> resulted hash -> sha256 (additionally)
Hello, World? -> shake_256 -> md5 -> sha256 -> sha3_256 ... -> resulted hash -> sha256 (additionally)
Will it be impossible to create an ASIC for such an algorithm? And if yes, what would be effective for brute force?