texts: Double randomised HMAC verification to prevent timing attack

texts:
A way to prevent timing attacks for hash string comparison is to perform additional HMAC signing in order to randomize the verification process (see Double HMAC Verification).

In addition to the second HMAC hashing for each hash, a random salt of random length is added to both in order to make the hashing timing / process even less predictable.

My PHP implementation of this look like this:

function hmac_verify ($hash_original, $message, $key) {

    $hmac_salt = '...'; // was added at the original HMAC signing
    $random_salt = openssl_random_pseudo_bytes (rand(16,96));

    $raw_hash = hash_hmac('sha512', $message . $hmac_salt, $key, true);
    $hash_compare = base64_encode ($raw_hash); // $hash_original is in base64
    $hash_compare_safe = hash_hmac('sha512', $hash_compare, $random_salt, true);
    $hash_original_safe = hash_hmac('sha512', $hash_original, $random_salt, true);

    if ($hash_compare_safe === $hash_original_safe) return true;
        else return false;

}

The function is called in this way after decrypting the encrypted text in order to verify the decryption result:

if (!hmac_verify ($hmac_hash, $plaintext . $cipher_text, $key . $iv)) return "HASH ERROR";

Will this successfully prevent a timing attack? Am I doing anything unnecessary? Could something be improved?


texts: What is the most efficient lattice problem solving algorithm?

texts:
I've recently become very interested in post-quantum cryptography, specifically lattice-based cryptography. As of this posting there exists no quantum algorithm that can perform better at solving lattice problems than a conventional computer.

There are, however, algorithms that exist that theoretically can solve lattice problems, albeit slowly.

I'd like to study one or more of these algorithms myself to help me better understand lattice cryptography and lattices in general.

So, what is the most efficient lattice problem solving algorithm and why is it so efficient?


texts:
Is it dangerous to use plaintext as IV in CBC?

For example: I want to encrypt $p1$, $p2$ with CBC. However I use $p2$ as the IV for CBC purposes.

What would be the risk of not using a IV based on random number(s)?


texts: Complexity leveraging is a technique that is generally used to prove adaptive security of a selectively secure scheme. Eg: We can prove adaptive security of Yao's garbling scheme using complexity leveraging. Many papers mention about complexity leveraging, but does not present in detail. I would be grateful if someone could explain complexity leveraging with a detailed example.


texts: Changing SHA-1 constants an functions: Does it affect security?

texts: I have been looking into the SHA-1 algorithm. I found that there are a set of functions and constants in the algorithm that have been standardized (section 5 of RFC 3174). If I want to use SHA-1, which I know is not advisable, does changing the constants and altering the functions have a positive effect on the security of the algorithm, assuming the attacker does not now of this alteration?


texts: Is it necessary to stretch/derive an AES key when I already have enough bytes from a 'cryptographically secure RNG'?

texts:
I'm using AES-CBC-256 with PKCS#7 compatible padding. I already have 32 bytes that come from a 'cryptographically secure random number generator'. In this scenario, does it make sense to use PBKDF2 to derive the key eventually used for encryption/decryption?

My scenario is that I need to port old code to a new stack. It all works fine, but I haven't yet implemented key derivation. In the old lib, the input is 32 random bytes + 32 bytes salt (all generated using https://www.cryptopp.com/docs/ref/class_auto_seeded_random_pool.html for the initial random bytes), which is treated as 'password', and PBKDF2 with 65536 iterations is used to derive the final key.

I thought PBKDF2 is supposed to derive a bigger secret from a short user password, but here it is used to derive a 32 byte secret from 2 * 32 byte blocks.

I get my 32 bytes from what is considered a 'cryptographically secure random number generator', which would mean I already have enough entropy. Do I need to derive the key? Does is add any security?


texts: Can someone explain to me the concept of hashing versus the concept of encryption?

texts:
I'm a bit confused over the difference between hashing and encryption. Could someone help explain this to me in simple and concise, yet comprehensive layman's terms?

I'm not asking for any specifics in how they work, but rather how the essential concept of each work in layman's terms


texts: What weak symmetric cryptographic algorithms shall I use to educate myself about cryptoanalysis methods?

texts:
Are there any simple to understand and implement, but nontrivial cyphers and hash functions which are easily broken by modern cryptoanalysis methods (for example, ones listed in Wikipedia)?

Ideally it should be encryptable/decryptable/hashable using pen and paper (without computer), allow simple cracking using the methods also using pen and paper, but not trivially crackable by brute force (or at least requiring much more paper and tedious calculation if use dumb methods)?

Retired "production" cryptos look too complicated, and it's not obvious for non-specialist if they can be "downscaled" from some 64 bits to 4 bits while also preserving analysis-over-bruteforce advantage.

Maybe there are dedicated algorithms for this? Maybe some of them are specifically constructed to lead to analysis methods if one thinks about them, trying to crack?


texts: Does adding OWF of the private key to encryption scheme hurts security?

texts:
Suppose I have a symmetric semantic-secure encryption system $\Pi = (Enc, Dec)$ and an OWF $f$.

Now, define the following encryption scheme $\Pi^{'} = (Enc^{'}, Dec^{'})$ where , $Dec^{'} = Dec$ and $Enc^{'}(k, m) = Enc(k,m)\mathbin\|f(k)$

Is that encryption still secure? I already tried to formally prove this claim with a hybrid argument, i.e. claim that

$Enc(k, m0)\mathbin\| f(k) \approx Enc(k, m0)\mathbin\| f(r) \approx
Enc(k, m1)\mathbin\| f(r)  \approx Enc(k, m1)\mathbin\| f(k) $

However, this proof turned out to be wrong (for example, maybe $Enc$ and $f$ both reveal the first bit of $k$ in the clear).


texts: SHA1 collision for first 32 bits for two different messages

texts:
Is it possible to create a program to find the collision of 2 different messages with the same first 32 bits using sha1 hashing? I tried using a while loop, but it ran endlessly as though no match were found. I am doing this in Java. These 2 messages must contain "abc123".

My while logic is adding a number to the end of the string, but it fails.

Below is my sha1 hashing (let's just call it) pseudo-code:

public static String sha1Hashing (String message) {
    String sha1 = "";
    StringBuffer sb = new StringBuffer();
    try {
        MessageDigest mDigest = MessageDigest.getInstance("SHA1");
        byte[] result = mDigest.digest(message.getBytes());

        for (int i = 0; i < result.length; i++) {
            sb.append(Integer.toString((result[i] & 0xff) + 0x100, 16).substring(1));
        }
    } catch(NoSuchAlgorithmException e) {
        e.printStackTrace();
    }
    //return first 32 char
    sha1 = sb.toString().substring(0,32);
    return sha1;
}


texts: Is reverse engineering SHA256-HMAC function possible?

texts:
Assume HMAC function is used to generate a 6-digt integers time-based onetime password. As follows:

$$K_h =\operatorname{HMAC}(k,t) = H((k\oplus\text{opad})\mathbin\| H((k\oplus\text{ipad})\mathbin\|t))$$

Then:

$$T=K_h \bmod 10^6$$
where $t$ is time, $k$ is a secret key, and $T$ is a one-time password.

Now assume that an attacker knows t and can observe unlimited number of one-time passwords. Is it possible for him to solve for the secret key ($k$)?
References would be nice.


texts: Is my high school cryptography/steganography science fair project practical?

texts:
I'm a 12th grade student interested in a science project in cryptography and steganography for my school's science fair. I chose this path of computer science partly because my coding skills are weak (even though I've taken computer classes for 3 years) and partly because I wanted a more math-oriented field. After doing my research, I found that for my science project, I wanted to test how to implement both cryptography and steganography techniques to maximize data security in a message. My plan to execute this is skewered by the fact that my topic is very advanced and usually requires years of complex math. So far, this has been my plan:

Q: which cryptographic algorithm and which steganography technique put together will result in the most efficient, secure data?

I will be testing 3 cryptographic algorithms: DES, AES, and RSA
I will be testing 3 steganography techniques: Adding bits to a file, and Least Significant Bit (LSB), and RGB color encryption

The purpose is to see which two combination of methods offer the most security, and at the moment there are 3x3=9 combinations of tactics I can test to see which is strongest.

So far example, using the crypto library in Java, I would be able to implement one of the cryptographic algorithms into my code for encryption. Then, using a steganography software tool, I would then hide the file using one of the steganography techniques. I was thinking the security of the combined techniques could be measured by the encryption time (the higher it is, the less efficient and secure), but my main concerns are:

Is this a practical project? Can this be executed like a true science fair project
and
In what way other than encryption time should I measure the 'effectiveness' of the two techniques?

I have to start collecting data very soon, and I feel as though I'm underestimating how complex this experiment is. But I would really like feedback!


texts: The difference between being not strongly collision resistant, and not weakly collision resistant?

texts:
So I understand the two concepts:

(Strong) collision resistance: it is infeasible to find a pair $x \neq x'$ such that $h(x) = h(x')$
Weak collision resistance / 2nd-preimage resistance: for all $x \in D$ it is infeasible to find $x' \neq x$ such that $h(x)=h(x')$

But I'm confused as to how to negate the two. This is what I end up with:

h is not (strongly) collision resistant if: it is feasible to find a pair $x \neq x'$ such that $h(x)=h(x')$
h is not weakly collision resistant (not 2nd-preimage resistant) if: there exists $x \in D$ such that it is feasible to find $x' \neq x$ such that $h(x)=h(x')$

These two negations seem the same. Suppose I show h is not (strongly) collision resistant, because of $x \neq x'$ where $h(x)=h(x')$. Surely this then shows h is not weakly collision resistant when the $x \in D$ is $x$ or $x'$? (sorry for the different uses of $x$ there!) A similar argument would say that any $h$ that is not weakly collision resistant is strongly collision resistant. But it's absurd that the negations of the two concepts are the same! Where have I gone wrong?


texts: Can i modify data "protected" by a CRC16?

texts:
There are 100 bytes with a CRC16.  However I only know the first 50.

I want to change byte 5 from a known value X to another value Y, and fix up the CRC16 to be valid - without knowing bytes 50-100.

This is possible with the TCP checksum, because it's just  addition.  But CRC16 is a polynomial.  Is it still possible?


texts: SHA3-512 troubleshooting - is there a worked example for hashing the "zero-length string"?

texts:
(I wondered if this question should be asked on StackOverflow instead because it's a programming related issue, but it's bound to the intricacies of SHA3, which I figured was a better fit for Crypto.SE.  If this is unsuitable I'd appreciate it if a moderator could migrate this for me.)

I have faulty home-brew implementation of SHA3-512 that I'm trying to fix.  The output is the right length and changing a single bit in the input message causes an overwhelming change in the output digest (the avalanche effect appears to be working to some extent).  In other words I'm 99% of the way there, but I'm struggling to find the fault in my code.

I've been using the zero-length string "" as the input Message, as it is desirable to keep the message length minimal during debugging.

I've been working strictly to "FIPS PUB 202" as the specification for the algorithm.  (http://dx.doi.org/10.6028/NIST.FIPS.202).

Question

Does anyone know of some document or tutorial that gives a worked example of each step in using SHA3-512 to generate a digest of the message "" (or some other short message), giving detailed step-by-step values for all variables in the algorithm?


texts: Encrypting a key with the same key, for instance using AES

texts:
I am new to crypto and trying to understand if it would be insecure to use a cipher such as AES to encrypt a key with the same key. If it is insecure, then why would it be insecure?

Basically, something like this:

encrypt(key, key)

What happens when both key and message are the same (128 bits)?

The obvious question would be why would I want to do that. If I have a secure channel to send the key, why encrypt it? My question is more for understanding.


texts: What is a cyclic group of prime order q such that the DLP is hard?

texts:
On the original paper on Linked Ring Signatures, in order to construct its scheme, the author relies on this:

  Let $G = \langle g\rangle$  be a cyclic group of prime order $q$ such that the underlying discrete logarithm problem (DLP) is hard. Let $H_1 : \{0, 1\}^∗ \to \mathbb Z_q$ and $H_2 : \{0, 1\}^∗ \to G$ be distinct hash functions viewed as random oracles.

What, specifically, is that group he mentions? Are there many ways to construct such a thing? If so, is there any that is easy to implement, yet hard to attack? Or am I looking for some kind of library? Moreover, how should one make such an $H_2$ that can be viewed as a random oracle?


texts: Confidential data encryption on ethereum

texts:
I already built a supply chain that is able to collect product information on Ethereum. Now, that data can be confidential, but I still want to do Matrix calculations on it. I came across homomorphic encryption, but I'm not sure if it would help me. My product information has a JSON format like that:

{
"Timestamp": UNIX,
"Materials": [
{
 "Chemical1": XXXX mol,
 "Chemical2": XXXX mol,
}
],
"CO2": XXX kg,
"Energy": XXX kWh,
"Water": XXX m²,
"Price": XXX €,
"Amount": XXX,
"Totalprice": Price * Amount
}

I want to be able to extract the specific information I want from that file and calculate with it but it also has to be confidential/encrypted. Does someone have an idea which method would be the best to do that and is there maybe a JavaScript package for that?


texts: How can ECDSA signatures be shortened (to be used as a product key)?

texts:
So I made my own serial key generation software, using ECDSA, for use in my own applications and it works great so far! To keep the serial key short enough I use a 128 bit EC curve. My final signature (which I use as the product key) ends up containing two BigIntegers, 128-bit each, so the final key ends up being 32 bytes long. This is an ok solution and I can get my final key down to about 50 characters (not counting any delimiters like dashes) by doing some custom base conversion to convert this into a readable string.

Now I found a software called ellipter where the key for a 128 bit key strength only ends up being 30 characters (if you look at the screenshots on their page). Is this even possible? Or are they using a 64-bit curve? I can't understand how they do it. I would love to get my keys shorter also but I can't see how it can be possible?


texts: Can you correct my understanding of Argon2?

texts:
I'm a bit new to the cryptography field (completely new), and could really use your guidance.

Please, correct my understanding, as defined by the following statements.

The Argon2 Hash Generator has won the Password Hashing Competition, and is therefore believed to be the best solution at the moment for safely hashing passwords. Is is recommended to be used instead of bcrypt or pbkdf2
The Argon2 requires additional configuration, through parallelism factors, memory cost, iterations and hash length in order to be used in the most effective. However, default parameters are usually just fine.
The Argon2 also requires a 'salt' for security reasons - this one is meant to be generated using Cryptographically Secure Pseudo Random Number Generators (CSPRNGs for short), but any reasonably random value can be used here.
Some implementations of the Argon2 (such as this one), allow to secret keys and additional data to the function, but these are optional and are not required for the resulting hash to be secure.
Since any reasonably random value can be used as a salt, the result of another hashing function, such as Blake3, could also be used as a salt.
If I want to store both email hash and password hash securely in a database, for the potential attacker to have as little information about the user as possible, I could:

Store the registration date (RD) of a user
Generate the Argon2 hash of the email address, using the Blake3 hash of the RD as the salt
Generate the Argon2 hash of the password, using the Blake3 hash of the Argon2 hash of the email as the salt

The point above would not compromise the security, offered by the Argon2 hash, and would make it quite difficult for anyone, even those with a direct access to the database and the source code, to figure out what the email and the password of the user actually are - but would make it trivial to verify whether the user's input was correct or not

Any criticism, comments, thoughts, opinions (grounded in facts) - are more than welcome.

Correction: as Marc pointed out, 6.2. doesn't make any sense - it would make it (nearly) impossible to look the email up for a registered user. If we substitute the step 6.2. with a random scrambling of the user's email - such as Fisher-Yates Shuffle, repeated for X iterations - to make it consume time, using a random generator from this function, with a seed number derived from the email once again, would the rest still make sense?


texts: Encrypt and decrypt data accessible by multiple users within a team

texts:
I'm currently working on web services which allows to send and retrieve data.

The data belong to a team.
A team is composed of users.

Each authenticated user can send and retrieve data to/from their team.

I need to add encryption to this with the following requirements:

Data are encrypted on the server and the server doesn't store (might handle, but not store) any key
Each user has a different key or password to decrypt the data
Each user encrypts the data before sending it (data must of course be "decryptable" by other team users)

After searching for hours, I came to this solution, however I would like to have some comments whether this seems to be good or not, and if I could improve it.

Each user, at creation time, receives a RSA public and a private key, the keys are generated by the server, the public key is stored in the database, the private key is immediately sent back to the user via SSL secured connection and removed from server memory.
When the first user is added to a new team, the server generates a 64bits key (for AES). The user public key is used to encrypt the AES key.
The encrypted AES key is stored in the database (user/team pair).
When a user receives/sends some data, he first has to get the encrypted AES key from the server. The user uses his private key to decrypt the AES key.
For "send" action, he uses the AES key to encrypt the data.
For "receive" action, he uses the AES key to decrypt the data.
When a user needs to be added to a team, the existing team member will use the new user public key to encrypt the AES key then send the new user info to the server (user info + encrypted AES key for the new user/team pair)

Two things I don't like:

If a user needs to be removed from a team, he still could have saved the AES key.
This is not a major problem has he won't be authenticated anymore and therefore won't have access to the encrypted data anymore.
AES requires an IV, which should be different for each encrypted piece of data, so I would need to store an IV for each piece of data.

Do you think of any better solution ?

Thank you


texts: What is the difference between an anonymous-encryption scheme and an authenticated-encryption scheme?

texts:
I was going through Indy-SDK when these two schemes were referenced. I want to know the precise differences between the two.

Indy-SDK links for reference to:

authenticated-encryption scheme

anonymous-encryption scheme


texts: Can one design an asymmetric encryption scheme based on any secret sharing scheme? Are they that closely related?

texts: I've seen both asymmetric encryption and secret sharing schemes based on graph 3-coloring, and I'm curious if this is a coincidence due to some peculiar property of graph 3-coloring alone.


texts: Statistical saturation attack on block ciphers

texts:
I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack
against the Block Cipher PRESENT.

What I really need is basic explanation of the attack itself with a small example if possible such as any basic block cipher that you could come up with with 3-4 rounds. This is for my personal understanding so any input is more than welcome.


texts: Can a commutative block cipher be indistinguishable from a random permutation, for fixed key?

texts:
Define a commutative block cipher with keyspace the finite set $K$, and data space the finite set $S$, to be an application
$$\begin{align}
E:K\times S&\mapsto S\\
(k,x)&\mapsto E(k,x)\text{ also noted }E_k(x)\\
\text{such that }&\forall k\in K,\forall x\in S, \forall y\in S,\text{ if }E(k,x)=E(k,y)\text{ then }x=y\\
\text{and }&\forall k\in K,\forall k'\in K, \forall x\in S,E(k',E(k,x))=E(k,E(k',x))\\
\end{align}$$
Note: the first property states that the application $E_k$ from $S$ to $S$ is injective, implying that it is a permutation of $S$ given this is a finite set, and that's standard for a cipher; the second property is what makes the cipher commutative.

Question: what commutative block cipher do we have that is

conjectured computationally indistinguishable with effort polynomial in $\log(|K|)$ from a random permutation for unknown random fixed key $k$, assuming the attacker can obtain ciphertext for iteratively chosen plaintext;
efficiently computable, at least in the encryption direction (and preferably for decryption as well)?

If there was none: do we have some proof this can't be achieved?

In this answer, I explored a variant of the Pohlig-Hellman Exponentiation Cipher $(k,x)\mapsto E_k(x)=x^k\pmod p$ but stalled with something that remains distinguishable from a random permutation due to a multiplicative property similar to that of naked RSA: $\forall k\in K,\forall x\in S, \forall y\in S, E_k(x\cdot y\bmod p)=E_k(x)\cdot E_k(y)\bmod p$.

Update: the question as is was perfectly answered by poncho. Here is take two.


texts: How did this group discover m wasn't random?

texts:
In this video a group of "hackers" describe how they discovered private keys for the PS3 that was using this ECDSA algorithm by discovering that the "random" integer $m$ (or $k$ in the wiki link) was actually static, allowing the private key to be solved for. The attack is actually mentioned in the wiki link for the algorithm, and basically says the same thing as the video.
My question is, how did they discover $m$ was static, and how did they even know that particular ECDSA algorithm was used to generate the private key? Even once they knew these two things, wouldn't they need the particular curve sony used?


texts: An efficient PACE protocol with curve25519

texts:
The PACE protocol is a password authenticated key agreement which is widely used. For instance, in the electronic ICAO passports as the so called SAC protocol. PACE is standardised in ICAO DOC9303 Part 11.
PACE is rather complicated. For instance, it needs 2 Diffie-Hellman exchanges and a specific $G' = s*G+H$ mapping function. The complexity stems form the fact that PACE needs a function, which hashes a random value into a curve point. The function must also be timing invariant and may not lead to offline dictionary attacks.

Now I think with Curve25519 and Montgomery arithmetic we can remove all those difficulties and make a very simple PACE variant. The main reason for simplicity is that mapping a random value in the curve is easy on Curve25519. First, one can simply using that random value as the x-coordinate, because one does not have to find an x-coordinate lying on the curve.  Second, Curve25519 uses the x-coordinate only. So, one does not have to calculate a corresponding y-coordinate. And finally, Curve25519 arithmetic is timing invariant.

Now let's construct the simple PACE protocol:

Let $Enc_k(x)$ be an encryption function (e.g. AES) , where k is somehow derived form a password. The same for $Dec_k(x)$ as decryption function.

\begin{array}{lcr}
Terminal & & Passport \\
& & s \xleftarrow{$} \{0,1\}^{128} \\
s \leftarrow Dec_k(s')  & \xleftarrow{\hspace{1cm}  s' \hspace{1cm}    } & s' \leftarrow Enc_k(s) \\
x \xleftarrow{$} \{0,1\}^{256} & & y \xleftarrow{$} \{0,1\}^{256}\\
h_x = s^x & \xrightarrow{h_x} &  h_y = s^y \\
z \leftarrow h_y^x & \xleftarrow{h_y}  & z \leftarrow h_x^y  \\
\end{array}

Looks too good to be true!
So, do you see any problem here?

P.S.  As Poncho made clear, this doesn’t work.
But maybe someone sees an advantage of using curve22519 for PACE or any other related PAKE protocol (e.g. SPEKE).


texts:
What are the best practices for IV generation for AES and other algorithms?

Is RNG enough?

What if I cannot use RNG and need to use a variable that is related to some characteristic of the encrypted message? For example, file number or ObjectGUID? Will encryption of the IV do the job?

If encryption of the IV is a solution shall I use the same key that encrypts the actual message or a different key?


texts: blockcipher-based MACs with variable length that are UF-CMA secure?

texts: There are may papers and notes explain why CBC-MAC is only UF-CMA secure for fix length messages. Are there any other blockcipher-based (blockcipher and hash combined included) MACs that is UF-CMA secure with variable length messages?


texts: Integrity check of a binary firmware file with hash function

texts:
I need to provide a mechanism that it is possible to verify the integrity of a firmware image flashed on an embedded system. The procedure should be, that if someone has doubt on the firmware’s integrity, he can read the binary image via a debug port (JTAG) and then compare it against a public available hash code.

The request came from the fact, that the product is used in a custody transfer application and must be therefore protected against tampering (only tampering detecting is enough). There should be an easy way to verify the firmware, like by comparing the hash code, printed in the manual and compare it against the calculated one, loaded from the individual device…

My first approach would be to take for this the commonly used MD5 hash function, also to make it much handier for the customer (only 16 byte or respectively 32 hexadecimal characters). But then I was remembering on some news of the last years about collisions and that MD5 or even SHA-1 are (at least almost) broken. So, I wanted to choose the latest hash algorithm with the best reputation for best future viability and therefore I tended to SHA3-224 (which implicates 28 bytes or 56 hexadecimal characters).

Some colleagues in my company said to me, MD5 should be more than sufficient to cover our needs. But I don`t think this is correct, since we have a 128 KiB Firmware image, with only about 100 KiB are used the other 28 KiB can contain "random data".
Therefore, I would say, this is more than enough to create at least one single collision with the identical programmatically functionality.

Is SHA3-224 an overkill for this purpose or is it reasonable in terms of future viability?


texts:
I'm studying Authenticated encryption with Associated Data (AEAD).

My questions are

About AE - I heard that when it comes to Encrypt-then-MAC, if an attacker forges the ciphertext then he gets the wrong MAC value and can't decrypt the ciphertext to plaintext. Is this correct? If so, what is happening Encrypt-and-MAC and MAC-then-Encrypt? Isn't there a filter like Encrypt-then-MAC that filters out invalid ciphertext?
Questions about the history of AE and AEAD. I wonder what the limitations of AE have led to the emergence of AEAD. In some papers, the limitation of AE is that it cannot effectively authenticate by binding associated data to ciphertext. If so, I would like to ask the following question: "Do I have to bind the associated data to the ciphertext?"
About AEAD. The input of the encryption process is key, nonce, plain text, and associated data, and goes through some algorithm to return a ciphertext and a tag for authentication. The input of decryption process is key, nonce, ciphertext, associated data, tag, and plaintext if authentication is completed successfully, and an error is returned if there is a problem. However, for attackers, the key is not known during the decryption process. Moreover, I thought nonce was not even known by the attacker. In my opinion, the only information the attacker knows during the decryption process is ciphertext, related data, and tags. So, is the attacker attacking without knowing both key and nonce? So is AEAD called a strong cryptographic algorithm?


texts: Is there any advantage using this kind of ROM-based randomized hashing in digital signatures?

texts:
The said randomized hasing is actually a sort of padding, and it goes like this:
Parameters:
1. hash function H()
2. length N in bytes of the output of the hash function.
Input:
1. M the message to hash.
Generate:
1. Generate r := N/2 random bytes.
2. Compute lo := H(r|M)
3. Compute hi := r xor lo
4. _Return (hi|lo)
Verify:
1. Compute r := hi xor lo
2. Compute v := H(r|M)
3. _Return v == lo

Is there any advantage to it other than slightly better verification of the correctness of the padding?


texts: Yao's Garbled circuit: Does Bob ever see the circuit?

texts:
I asked a question about whether the circuit structure for Yao's garbled circuit needs to be rearranged. I understand from Yehuda Lindell's response that the circuit structure itself does not need to be changed or garbled, only the gate ciphertexts need to be garbled.

New question: does this mean it is safe for Bob to be able to know the structure of the circuit? He should not be able to know the values on the wire, but is it fine for him to know for example which gates are AND gates?

It seems to me that this would not be safe. Here is my reasoning:

Let us say gate $g_s$ is an AND gate in the circuit with input wires $w_i$ and $w_j$ and output wire $w_k$. Based on this summary if $g_s$ is an AND gate, Alice has computed the following values:

$$X_s^{0,0} = K_i^0 \oplus K_j^0 \oplus K_k^0$$
$$X_s^{0,1} = K_i^0 \oplus K_j^1 \oplus K_k^0$$
$$X_s^{1,0} = K_i^1 \oplus K_j^0 \oplus K_k^0$$
$$X_s^{1,1} = K_i^1 \oplus K_j^1 \oplus K_k^1$$

She has shuffled and renamed these values $X_s^1,X_s^2,X_s^3,X_s^4$ and sent them to Bob. $K_i^0$ is the key for $w_i$ when it's value is 0 and so on.

Bob also has access to hashes of the two keys for each wire, though he does not know which key represents that wire being 0 and which represents 1.

Say Bob has $K_i^{v_i}$ and $K_j^{v_j}$ where $v_i,v_j\in\{0,1\}$ are the values of the wires $w_i,w_j$.

Say Bob calculates $K_j^{v_j}\oplus X_s^{0,0}\oplus X_s^{0,1}=K_j^{v_j}\oplus K_j^0\oplus K_j^1 = K_j^{1-v_j}$

He will still not know whether key $K_j^{1-v_j}$ is $K_j^0$ or $K_j^1$, but he will then have both keys for wire $w_j$.

Now, he may not know which two $X_s$ values are $X_s^{0,0}$ and $X_s^{0,1}$. But he can try all 6 combinations. Since Alice has given him $AUTH(K_j^{1-v_j})$ (where AUTH is a trapdoor function) Bob can apply this function to all 6 values and see which one matches the value that Alice gave him.

In the same way Bob could find the key of $K_i^{1-v_i}$.

Bob still does not know which keys represent 0s and which represent 1s. But he does know it is an AND gate, so if he calculates the value of the output wire key value for all 4 combinations of the input wire key values. For three of these, the output key will be $K_k^0$ and one of these will be $K_k^1$. So Bob will know which key represents 0 and which represents 1.

As far as I understand, Bob has also not deviated from the algorithm, since he can still compute what he is meant to compute and send Alice the output. So Bob is still honest-but-curious.

So it seems that if an honest-but-curious Bob knows what types of gates the circuit has he could discover which keys represent 0 and which represent 1.

Is there a flaw in this reasoning?

Thanks in advance.


texts: Inside attack (attack from participants) in secret sharing

texts:
I have considered a $(t,n)$ secret sharing scheme with $n$ secret, say $a1,a2....an$. It's third party secure, but it has inside adversaries. While reconstructing secrets, a group of $t$ qualified participants upload their data to a public server.
If $t-1$ participants are cheaters, they can fool the remaining participants by changing the secrets.
How I could make this attack scheme such that the $t1$ participant can assign a chosen polynomial (i.e., chosen secrets) to fool the remaining participants.
I am aware that the number of secrets is one (i.e., constant term in the polynomial), which M.Tompa & H. Woll proved.


texts: Does preimage resistance and/or collision resistance imply the infeasiblility of finding fixed points in hash functions?

texts:
For example, if $H$ is a secure cryptographic hash function, is it infeasible to find $x$ such that $H(x)=x$ or such that $H(H(x))=x$ ?

What about finding $x, y$, and $z$ such that $H(y||H(z||x))=x$ ?


texts: How do you make Fermat's primality test go fast?

texts:
This small Lisp-function implements Fermat's primality test in a very simple way and it is very slow at $n >= 10^6$ because we reach into bignum territory.

(defun prime-p (n)
  (= 1 (mod (expt 5 (1- n)) n)))

What am I missing? I assume that this is not the form that is actually used in implementations of RSA to find appropriate primes, what is actually used?


texts: What is the fuss about 'dot blockchain' and music metadata?

texts:
and how does it work?

http://wmot.org/post/music-money-and-metadata-promise-blockchain#stream/0

claims that this is an answer to the metadata woes of the music/recorded media industry.

I don't see how it can possibly prevent rewriting the file.


texts: Secret Sharing and Multiplication Triples

texts:
I do not understand the multiplication technique using triples and secret shares of the inputs. Could somebody explain me where I'm wrong?
It works like this:
The inputs are secret shared in XOR shares.

Alice holds $[x]_a$ and $[y]_a$ and a share of a multiplication triple $[a]_a,[b]_a,[c]_a$ s.t. $a \cdot b = c$.
Bob holds the other shares.

Now multiplication is supposed to work as follows:

Both parties do the following:
$$[d] = [x] \oplus [a]$$

$$[e] = [y] \oplus [b]$$

Both parties reveal their shares of $[d]$ and $[e]$ to each other.
Then both calculate
$$ [z] = [c] \oplus e[x] \oplus d[y] \oplus ed $$

To reveal the result of their computation one party sends the other party its secret shares.

My questions:

How is reconustruction working? If I XOR the two shares of $z$, the last bit ($... \oplus ed$) cancels out.
I have seen this trick in many lecture notes and in all of them they analyze the correctness for showing that $xy = c \oplus ex \oplus dy \oplus ed$, but I don't see how this directly relates to the shares.


texts: Can you update a (k,n) scheme to a (k+t, n+t) scheme (assuming old keys can be deleted)?

texts:
I know that $(k,n)$ can increased to $(k+t,n-s)$ one, by generating a random polynomial $p(x)$ of degree $k+t$ with constant term $0$, and then ordering each agent $a$ to add $p(a_x)$ (where $a_x$ is an agent's public x-coordinate) to their share (if $k$ old shares are compromised, the secret is compromised, but we are assuming enough old shares are destroyed to prevent this) (we get $n-s$ by either ordering $s$ agents them to destroy their share, or, if it is already compromised, not sending an update to that agent.)

Also, I know a $(n,n)$ XORing secret sharing scheme can be increased to $(n+t,n+t)$, by generating $n+t$ bit strings that XOR to $0$, and sending the first $n$ to each agent to XOR with their current share (and send the rest to $t$ new agents). This in particular means there exists a secret sharing scheme $(k,n)$ can be updated to $(k+t, n+t)$ via this.

Can a $(k,n)$ shamir secret sharing scheme can be updated to a $(k+t, n+t)$, without any agents having to reveal their share?

Note: Remember, we are assuming that enough old keys can be destroyed to prevent the secret from being reconstructed from old keys alone (which is why this doesn't apply.)


texts: Can a billion elliptic curve keys be generated on a laptop in less than an hour?

texts:
I want my application to generate an EC key pair.

The first four bytes of the sha256 hash of the public key should contain a known IP address.

As hashes are one-way functions, I need to brute force this by generating four billion keys.

Is this possible, in under an hour, on a laptop?

Openssl is not the way to do this - generating just a thousand keys takes few seconds.  Four billion would take six months at 4s/thousand.

#!/bin/bash
time for a in {0..999} ; do
  openssl ecparam -genkey -name secp256k1 -noout -out key.priv.pem
done

Is openssl doing something which is unnecessary in making keys just to check the hash?


texts: Pre-Image Resistance of repeated, patterned SHA2-256 digests

texts:
Suppose $H = \operatorname{SHA2-256}$.

Let $H_1 = H(\text{“Alpha1”})$.

Let $H_2 = H(\text{“Alpha2”})$.

…

Let $H_N = H(\text{“AlphaN”})$.

So all these digests are based off a common pre-image post-fixed with the index.

Question 1: Does knowing the values $H_1, \dotsc, H_N$ and the length of common pre-image substring "Alpha" leak any information about "Alpha"?

Question 2: Would double-hashing make any significant difference to pre-image security? E.g.: $H_i = H(H(\text{“Alpha”} \mathbin\| i))$


texts:
Here's an authentication scheme I had in mind that combines the simplicity of HTTP Digest Authentication and the security of real crypto primitives. I have in mind the user-level authentication, ie login/password, not the TLS level.

I'd like to see if anything can go wrong with such a scheme:

Registration

User chooses password $p$
User generates salt $s$
User generates key material $m=KDF(s, p)$
User generates assymetric authentication keypair, say DSA, using $m$ as the "random" source, where randomness comes from the salt: $priv/pub$
User sends server $s$ and $pub$ as authentication material

Login

Server generates challenge $c$
Server sends challenge $c$ and salt $s$ to client
Client re-generates the private/public keypair with $s$ and $p$ and signs the challenge with the signing key
Client sends the signed challenge, server verifies with $pub$

This scheme has some advantages over other methods of authentication:

Actual password never leaves the client
User doesn't have to generate and keep a certificate, a password is enough
Instead of depending on the password only, the $priv/pub$ keypair also depends on a salt so that 2 users with the same passwords don't accidentally share anything

I guess the most important thing to consider here is whether the salt generation is "random enough" to accommodate even the worst case (everyone has the same password)

Would that scheme be sound to implement ? Are there any flaws that would make it foolish ?


texts: Unique assignment of X.509 certificate to each client

texts:
I'm trying to implement a short scale electronic voting application in a domain comprised of no more than 100 clients. System administrator is able to create new election instances and each client is able to cast his vote once for each election.

I do believe that a PKI (e.g. OpenSSL) is necessary here in order to issue a X.509 certificate for each client. Upon registration client will provide a unique identification code to the system so an obvious choice is to store this value in the "subject unique identifier" field which is possible in version 3.

What I'm trying to understand is how will the CA conserves the uniqueness of this field? Does it compare the value supplied for a new certificate with each certificate previously issued? Is this even a logical solution for this problem?


texts: ephemeral-ephemeral ECDH and MITM attack

texts:
ephemeral-ephemeral ECDH is it susceptible to MITM attack ? if yes, can you please give me a detailed answer ( Workflow that can be followed by the attacker) and how we can prevent this attack (static-ephemeral or we can keep ephemeral-ephemeral and change some parameters)?

Thank you in advance


texts: Desirability of chaining an LCG in an authentication scheme

texts:
Suppose that:

$E(k, x)$ is the encryption of data block $x$ with key $k$ using a block cipher.
$L_{Key}$ is the key size of the block cipher in bits.
$L_{Block}$ is the block size of the block cipher in bits.
$F(x) = (a \cdot x + c) \mbox{ mod } m$, so it's a linear congruential generator.
$m = 2^{L_{Block}}$ is the modulus to be used in $F$.
$a$ and $c$ are such that $F$ has a full period.
$K \leftarrow \{0, 1\}^{L_{Key}}$ is a secret key to be used with the block cipher.
$J \leftarrow \{0, 1\}^{L_{Block}}$ is a value that is derived in some way from $K$, perhaps through using $E$ and a constant.
$T \leftarrow \{0, 1\}^{L_{Block}}$ is an authentication tag.
$i$ is a one-based index.
$x_{i} \leftarrow \{0, 1\}^{L_{Block}}$ is the $i$th block in a stream of data to be verified.
$s$ is the number of data blocks.
$y_{i} = x_{i} \oplus J$.
$t$ is an intermediate value that is calculated prior to $T$. It is first calculated as $t = F(y_{1})$, after which it is recalculated as $t = F(y_{i} \oplus t)$.
$T = E(K, t)$.

Seems secure enough to me (I know that isn't a good assurance, but I know jack about cryptanalysis), assuming the block cipher is secure. Block ciphers typically invoke one or more modular addition operations, so I don't think computing $b \boxplus c$ (where $b = m \cdot x$) is going to be a slow operation. I have no clue as to how much slower the multiplication would be. Would it be too slow to make for a good authentication mode?

Update #1: If $a = 65537$, then computing $a \cdot x$ would only require shifting $x$ to the left by four places and then adding $x$ to the result, which would be much faster than if $a$ had a larger Hamming weight. How much of an improvement in speed would this provide over GCM?


texts: Is Wikipidia wrong about Schnorr Signatures?

texts:
Wikipidia says Schnorr signature generation is defined like this:

Y = x * G //this is the key we are trying to provide a signature for
k = random scalar
r = k * G
e = Hash_to_scalar(r || message)
s = k - xe
signature = (s, e)

This seems correct, but then to verify it's defined as:

r = s * G * e * Y
e = Hash_to_scalar(r || message)

Shouldn't it be:

r = s * G + e * Y
e = Hash_to_scalar(r || message)

because:

r = k - xe * G + ex * G == k * G; //this works
r = k - xe * G * ex * G != k * G; //this doesnt work

Or have I made a silly mistake somewhere?


texts:
$c(y) = (03)y^3 + (01) y^2 + (01) y + (02)$
Let $d = (01)b$ in the AES field $GF(2^8)$.
Provide exact equations for the bits $d_i, 0 \leq i \leq 7$, in terms of the bits $b_i$ of b.

Can some give me an example or hint? I don't know where to start..


texts: (key) Target Collision Resistance (kTCR)?

texts:
The enhanced Target Collision Resistance (eTCR) game implies that an adversary is allowed to choose a target message $M$.
Upon choosing this target message, the attacker learns the function $\mathcal{H}_{K}$ (by learning the key $K$) and wins after presenting a new message $M'$ and a (possibly new) key $K'$ such that $H_{K}(M) = H_{K'}(M')$.
Is there a formal notion/definition similar to this, but instead the adversary wins if able to present a new key $K'$ such that $H_{K}(M) = H_{K'}(M)$?
What I'm asking here is slightly different than the (weaker) TCR notion where the attacker, under this same setup, wins after presenting a new message $M'$ such that $H_{K}(M) = H_{K}(M')$.


texts: What does pseudo pre-image of a hash function mean?

texts: So finding a pre-image means given the hash value, one tries to find a message that gives this value using the function's standard IV. What about pseudo-preimage?


texts: How can you determine how long the MAC for GCM must be?

texts:
I want to use AES-GCM to encrypt 7 Byte data chunks.

A 16 Byte MAC seems like overkill to me and the library I'm using gives me the option to make the MAC smaller.

Are there any criteria for choosing the length of the MAC or are fewer bytes always less security?


texts: Limiting how many key pairs someone can generate without compromising their keys

texts:
Is there any way to assign someone a limited quota for how many cryptographic key pairs they can generate (ECC, RSA, any algorithm), and preferably non-interactively? By non-interactively I mean there is no multiple handshake or multiple round trips between me and the person doing the generating and the relationship could perhaps be anonymous.

I'm imagining something where I generate, say, 50 tokens/certificates/whatevers and give them to someone. That person is then able to generate 50 key pairs and I am able to test to ensure that those 50 key pairs were properly entitled.

Of course the person could generate more key pairs without using my entitlements, but those would not check out.

I have a sense that something like this could be possible with homomorphic encryption or zero knowledge proofs or something similar but I can't think of a way to do it.


texts: What is a quantifier in game-based definitions?

texts:
I'd like to know what are quantifiers in game-based security definitions (in cryptography)
Some relevant examples and sources are also much appreciated.

Edit: for example, in a formal definition, we say for any security parameters, any function $F$, etc. My question is what should be included in these quantifiers (shall we include everything picked deterministically by the experiment?)is there any clear rule we need to follow?


texts:
I have been reading about “Timing Attacks on RSA: Revealing Your Secrets through the Fourth Dimension” by Wing H. Wong. I was wondering if this attack is feasible while signing with RSA and, if yes, how?

Also, how this kind of attack is applied with DH?

Talking about timing attacks in general, in which way AES is affected and how to solve it? (I mean, with RSA the "problem" is at multiplication level, while for AES where is the problem that makes the cipher implementation key or data dependent?)


texts:
For implementing a hash function, we can use Davies-Meyer Construction. In Katz crypto book it is written:

Let $F$ be a block cipher with $n$-bit key length and $l$-bit block length. We can then define the compression function $h:\{0,1\}^{l+n} \rightarrow \{0,1\}^l$ by $h(k,x)=F_k(x)\oplus x$.

My question is what is the point of XORing $x$ with $F_k(x)$?


texts: How to handle modular arithmetic with regard to two's-complement negative numbers?

texts:
The reason for asking, is that this occurs in real life with CRT calculation of RSA decryption/signing. In CRT RSA, there's the need to calculate subtraction, and it's known negative numbers could occur, especially with multi-prime cases.
While RSA would eventually phase out when moderately-sized quantum computers are available, before QCs can reach that scale, scaling RSA parameters (especially towards using more primes) may be more feasible than rushing to adopt post-quantum schemes in the short term, therefore, it's still a bit relevant.
While it's easy to to do modular arithmetic in variable-time, it seems very difficult do it in constant-time and with limited space for holding working variables.
Q1: Is there a way to implement efficient constant-time modular arithmetic for signed two's-comlement integers in constant time?
Additional Q2 for refuting the use of such implementation: Is there alternative methods for computing CRT RSA decryption/signing that uses no more (or even less) number of working variables? (these "working variables" are big integers).


texts: An alternative hashing method, how does it compare?

texts:
Say that I have good, collision resistant hash function H. Given a message M, the typical usage is h=H(M) to get it's hash.

Now, I want to propose two alternative methods of using this hash function, and compare them to the original function. First, I split my message M into equally sized chunks M1, M2, ..., Mn.

First method: the hash would be h=H(M1)⊕h(M2)⊕...⊕h(Mn) (⊕ is XOR).

Second method: the hash would be h=H(M1,1)⊕h(M2,2)⊕...⊕h(Mn,n), where comma means concatenation.

Now, it's obvious that the first hashing method is poor - I can shuffle the chunks around, and add two equal chunks without changing the resulting hash. But what about the second method? Are there any attack vectors? How does it compare to the original hash function?


texts:
With the knowledge of the trapdoor, we are able to compute the same digest for differents messages.

I've read that given two messages $m$, $m'$ and two numbers $r$, $r'$ such that
$Ch(m,r)=Ch(m',r')$, computed by the owner of the trapdoor, we are able to find other collisions and sometimes we are able to find this trapdoor information (for log based chameleon hash, in a work from Tal Rabin and Hugo Krawczyk, http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.50.3262 ).

I don't really understand the purpose of chameleon hash functions, since computing colluding messages lead to attacks. What are the subtleties ?

Thank you.


texts: Does SIV mode work for asymmetric encryption?

texts: In ECIES and similar asymmetric schemes, is it possible to use a hash of the plaintext as the IV?


texts: Is is safe to use MtEtM? (MAC-then-Encrypt and Encrypt-than-MAC)

texts:
Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability?
This is what I mean about doing MtEtM:
K0 ≠ K1 ≠ K2
addMAC(msg, K) = msg || MAC(msg, K)
ciphertext = addMAC(encrypt(addMAC(msg, K1), K0), K2)

If I understood correctly, EtM has the advantage of ensuring that the recipient doesn't even use the decryption key when a message is tampered. But MtE is harder to forge.
Intuitively it sounds that combining both would make the system at least a bit more secure, but I am worried about some sort of timing attack.
Also, is the use of HMACs instead of generic MACs here a potential problem?


texts: Can I use a random number generator with seed for key derivation?

texts:
I don't know a thing about cryptography so I'm judging by what I see in APIs docs.
I want to use ECDSA or ECDH in my project. And what I know so far about key derivation in this systems is that they:

generate a random private key $d$
then do some fancy stuff with it to get a public key $dG$

My question is: can I use a random number generator that works with seeds?

Like if we say thatrandom(seed) produces random numbers from set A.
And if
random(seed1) -> set A,
random(seed2) -> set B,
seed1 != seed2,
Then A != B or at least A is as far as possible from being equal to B


texts: How to encrypt data and know it will be secure for at least a few decades?

texts:
I want to encrypt a small amount (few kilobytes) of data and be fairly confident it will be secure against brute force decryption and advances in cryptanalysis for at least a a few decades (or more). I am flexible on the amount of time it takes (even a minute is reasonable) to encrypt as this will run on the client machine, and not on a server.

My thought was to combine a few encryption algorithms over an iterative process - each iteration with a fresh key. The reasoning being:

Multiple iterations increases the time necessary for each brute force attempt.
Multiple algorithms means a failure in any one algorithm doesn't compromise the whole encryption.
Multiple key effectively increases the key size to astronomical.

So it might look like this:

CipherText = AES(TwoFish(Serpent(PlainText)));

Except with many more layers of nesting (repeating the selected algorithms). Each layer will have a CSRNG generated Key and IV and use CBC.

Is this a good idea?
Does the nesting increase the security, or does it somehow introduce a new vulnerability?
If this is a good idea, which algorithms would be best to use?
Would it be better to use asymmetrical algorithms instead of symmetrical ones?
How many iterations is enough?

I'm fine with it being overkill. Just want to make sure it isn't going to make things worse.

Updated to specify resistance to cryptanalysis, use of CSPRNG for Key and IV and using CBC. Also removed references to outdated algorithms.


texts: Counting points on elliptic curve over binary field

texts: How to count number of rational points on elliptic curve over binary field?


texts:
As I gather, a normal practice for choosing a cyclic group for ElGamal key generation is to find a safe prime $p$ and use a multiplicative cyclic group with modulus $p$ and order $q = (p-1)/2$. However, generating safe primes of a large length can be quite time-consuming. Would it be safe to use a Schnorr group as an alternative?

If there is no safe way, what minimum size can I use for a safe prime so that it would be both secure and not terribly long to choose?


texts: What is the more accurate way of stating the correctness of a PK encryption scheme?

texts:
Is it more accurate to state that a public key encryption scheme is correct if for all $m \in M$ and $(pk, sk) \in \operatorname{Gen}(1^k)$
a. $\operatorname{Dec}_{sk}(\operatorname{Enc}_{pk}(m))=m\;$ or,
b. $\Pr[\operatorname{Dec}_{sk}(\operatorname{Enc}_{pk}(m))=m] = 1 - \operatorname{negl}(k)\;$ or,
c. does it depend on the scheme or some other factor?


texts: What are the steps for decryption of RC4?

texts:
I've seen a lot of algorithms posted everywhere about how to encrypt using RC4. For example, this wiki article https://en.wikipedia.org/wiki/RC4 explains the KSA and PRGA steps.

After it generates bytes, they are XOR'd with a message to encrypt the message. What are the steps for decrypting the message when it is received by the intended entity?

It's probably the inverse of KSA / PGRA, but can someone write out the steps for it? I've tried looking online and can't find an article on it, and I'm trying to fully understand the decryption part of it.

What I'm guessing is, the entity receiving the message generates the same bytes using the key as well (with the KSA / PRGA algorithm), then XORs the encrypted message with the bytes?


texts:
I am looking for a secret sharing scheme that is robust against noise, the shares are going to be noisy. We do not want to reconstruct the secret perfectly and a noisy reconstruction with a bound on noise is good enough.
Assume we are using $(n,k)$ Shamir's scheme to distribute a secret among $n$ parties so that we need at least $k$ of them to recover. If we add noise to the shares, using $k$ points, the reconstructed polynomial would be very noisy. However, having access to an infinite amount of points would result in a perfect reconstruction. Are there any works that quantify this reconstruction noise?
If you know of any other idea or another sharing scheme, that would also be great!


texts: Using cryptography: How to handle this real life situation?

texts:
For my class in applied information security I'm asked to find a cryptographic solution to the following problem:

  The government of country X wants to simplify the process of issuing driving licenses.
  The idea is that the person do not need to go physically to a driving institution to pick up a card, but instead they can download something that somehow certifies that the person has been granted a driving license.
  The validity of such ''something'' must be verifiable by public competent authorities at any point in time, for example, when stopping a driver and asking him/her for his/her license.
  On the other hand, it should not be possible to issue fake licenses.
  What cryptographic solution would you give to this situation?

(I'm sorry if the translation is not perfect, I hope it's clear).
The first thing that came to my mind was digital signatures.
I was thinking that the government could have a server with a database holding all social security numbers.
To generate a license, the server would pick up the corresponding ID and generate some license information from it (like type of vehicles the person is allowed to drive), let's call this string LIC(ID).
Then the server would hash this info H(LIC(ID)) with SHA-3 and then it would sign it with RSA Sign under a private signing key sk, obtaining a string s = Sign( H(LIC(ID)) ), which will be the string that the person with social security number ID can download.

Now, to verify a license, a device takes the verification key and runs the verification algorithm on ( LIC(ID), s ).
This can be done offline, without any interaction with the server.

Intuitively, this solution works because generating fake licenses corresponds to forging signatures, which shouldn't be possible.
However, I'm a bit concerned about some practicalities of this.
For example, how could I handle licenses that will become invalid at some point in time? also, what happens if the secret key gets compromised? I was thinking that maybe it is too idealistic to think on a secret string keep being secret for many years, so I thought that renewing the key pair every year or so could be a good idea because in this case we could only accept licenses signed under the latest secret key, and old licenses just would get licensed again (people would need to download the string again).

How would this be handled in real life? is there a real-life analogue situation I could take a look at? I apologize, it's clear I'm not an expert on this, but I'm just trying to learn :)

Thank you so much for your time!


texts: How does the time complexity of block cipher change with increase in key length?

texts:
I am interested especially in the case when the keylength exceeds the length of the plaintext.

Intuitively, it should be harder to crack the key with an increase in key length even if it exceeds the plaintext length but does it actually hold true or there any caveats to this particular scenario?


texts: AES-GCM - what are "Payload Length" and "AAD Length"

texts:
For the AES-GCM mode within many cryptomodules, their FIPS-validation certificates list the options:

Payload Length: 504, 512, 1016, 1024
AAD Length: 0, 504, 512, 1016, 1024

For example in OpenSSL, "int aad_len" is the term for the 'AAD Length'.

What do these numbers refer to?

Are these maximum allowed, minimum allowed, or the exact length required for the payload (cyphertext) and additional authenticated data (AAD) (plaintext)?  Do they refer to AES-GCM input or output?  Is there a default (like with a 96-bit IV)?

As a newbie developer using AES-GCM what should I be concerned with picking / using these values?  Does anyone have online references to these?


texts: question on encryption of multiple distinct messages

texts:
When I study symmetric encryption, it is quite straightforward to understand the following: in the presence of eavesdropper, simply using a PRG $G(k)$ and XORing multiple messages won't provide indistinguishability in the similar fashion as for a single message.

But what happens for multiple distinct messages? Will a simple PRG $G(k)$ provide indistinguishability?

I know there is discussion on deterministic CPA-secure schemes which could use synthetic IV, etc. But do we really need to go that far?

What is the difference? the distinct messages make the (key, message) pair distinct already? does it depend on how we define indistingushability?

Thanks!


texts:
When I was in grad school, I invented (discovered?) a new PRNG algorithm.  This algorithm has an infinite period length (given infinite memory).  This in itself cannot be new, because all you need to do to accomplish this is simply take digits from an irrational number.  What does make this different, is that it is able to use any size of key.  1 bit, 1 GB, whatever.

The next logical step for me was to turn this into a symmetric key algorithm. simply by generating the bits based off of the seed, and XORing the source file bits with the resulting output.

I am in the middle of developing this into an Android app.  My problem is that 100% of my experience has been academic.  I know that this algorithm (Binary Lagged Fibonacci) is valuable academically, but does it have a practical value?  Does the flexible key size alone give it a benefit over, say, AES?

I have sent some emails out to a few companies, and I am trying to find out why no one has responded at all.  My best guess is that 1. they get 1000 crackpots emailing them every day.  Or 2. I sound like I have no idea what I am talking about.  The second one is definitely true.  I just learned the other day I need to be salting the seed when it gets passed.


texts: Is it possible to check if a number is the product of two primes without factorizing it?

texts:
I have a large number which I suspect may be a private RSA key (although its size, at 613 bits, seems a bit unorthodox).

I have started to run a factorization algorithm on it, and after a few hours it still has not found any factors. But I wouldn't want to keep the algorithm running for a couple more days (or pay for a few EC2 instances to run the factorization on) only to find out that it is simply the product of three or more somewhat large prime numbers.

So, I was wondering if there was a way (even theoretical!) to check if that number was indeed the product of two prime numbers without actually having to factorize it.


texts: Zero knowledge-proof for discrete log that is not honest-verifier

texts:
Take a cyclic group of prime order. The Schnorr-protocol for proving knowledge of the discrete logarithm of some group element is honest-verifier zero-knowledge, meaning that if the verifier chooses his challenge randomly, then he learns nothing about the log.

However, I'm looking for a zero-knowledge proof of knowledge of discrete logs that is not honest-verifier zero-knowledge; I want it (and particularly the simulator) to be able to deal with any verifier, honest or not. Preferably as efficient as possible, on the prover's side. My Google-fu seems to have deserted me; does anyone have any pointers?


texts:
I'd like to find out the cryptographic algorithm which uses only lowercase letters and numbers to encrypt a message, and it has 256 bits (always).
For example:

  fff51ebcad2c44c75d7d5d4c5184b3e4


texts:
Using RSA public key (n,e) the encryption of a message is

c= (m^e) mod n

and the corresponding message is decrypted as

m = (c^d) mod n

How does the RSAES-OAEP algorithm specified in PKSC#1 v2.1 differ from the above basic method?

Is it possible to decrypt a text encrypted using RSA PCKS1 v2.1 RSAES-OAEP algorithm with Raw rsa decryption method (ie, m = (c^d) mod n ) ?


texts: Do Rabin Fingerprints have any advantages over CRC?

texts:
Background

In both, bitstrings are interpreted as a polnomical over GF(2) and they each can be used to implement a hash over a sliding window. The definitions of each are as follows:

Rabin Fingerprint: $M(x) = Q(x) \cdot G(x) + R (x)$

CRC: $M(x) \cdot x^{n} = Q(x) \cdot G(x) + R (x)$

Where $M(x)$ is message polynomial, $G(x)$ is the degree-$n$ irreducible 'generator' polynomial, $x^{n}$ represents $n$ zeroes added at the end of the message, $Q(x)$ is the quotient polynomial (ignored) and $R(x)$ is the remainder polynomial (the hash itself).

The Question

According to page 7 (labelled as page 135) of the paper LFSR-based Hashing and Authentication, CRC offers some improvements for hashing under encryption.

Assuming $G(x)$ is the same for the implementation of each algorithm (i.e. ignoring that polynomials under Rabin should be random) and an identical $M(x)$ is used for testing, does the Rabin Fingerprint offer any advantages over CRC? If not, is there any reason why the Rabin Fingerprint is moderately popular in file chunking (using the sliding window technique mentioned above)? For example, 1, 2 and many others on the web. By contrast, I can find very few implementations of a sliding window version of CRC or mentions of it being used for chunking.


texts: Would this method allow fast authenticated encryption using only a single encryption operation per block?

texts:
[This approach is flawed. A different speculative approach using an RNG instead of the cipher as a source of entropy was posted as a separate question]

Assume $E$ is a block cipher, $C_0 = IV$ and $P_0 = 0$

Encryption:

Add an additional block to the message and store the key in it, ie. $P_n = Key$.
Encrypt all non-final plaintext blocks $P_k, 0 < k < n$ in the following way:
$C_k = P_k \oplus E(C_{k-1} \oplus P_{k-1})$
Encrypt the final plaintext block $P_n$ (containing the key) in the following way:
$C_n = E(P_n \oplus E(C_{n-1} \oplus P_{n-1}))$

Decryption:

Decrypt all non-final ciphertext blocks:
$P_k = C_k \oplus E(C_{k-1} \oplus P_{k-1})$
Decrypt the final ciphertext block:
$P_n = D(C_k) \oplus E(C_{n-1} \oplus P_{n-1})$

Authentication

Verify $P_n = Key$

Note the number of encryption operations is actually $n+1$, so the title is slightly inaccurate (mentioning that would have made it too long). Also, it may not be completely essential to store the key - A non-secret value might work, but I'm being cautious for now..

Please try be constructive, as even if this is flawed in its current state it might be possible to fix it without adding a significant amount of expensive operations.


texts:
Can somebody please explain how an initialization vector works.

My current understanding is that it is used to prevent 2 of the same messages looking identical after encryption, but isn't this the same as what a salt does?

How is it different from a salt?


texts:
How is it possibile to cryptographically make a document truly read only? As in read only I imply that the user can obviously view it which can be achieved by coding which pixels have which colors. But how is it done in the industry? and what's more important is it possibile to password-protect it too?
I have considered a few solutions but I would like input from someone who has more knowledge than I in cryptography and security.


texts: A problem exists with the security proof in the secure AND example in the malicious model

texts:
Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world is as:

Real view: $X, Y = 0$ and $output = 0$

Real World

Now, imagine the simulator wants to simulate the real world’s view in the ideal world. In order to simulate $x$ (honest party’s input), the simulator must send $1$ to the trusted party and then receives $x$ from it. Thus the simulator succeeded to simulate $X$, but now the simulator computes the output as
 $X$ && $(Y = 1)$ = $X$, which is not the equal of the output in the real view $X$ && $0$ = $0$. Thus the simulator cannot simulate the output in the ideal model.

Ideal World

Definition 2.3.1 in the malicious model

The definition says that for every adversary A for the real model must exist a simulator S for the ideal model. Considering this definition, I could find an adversary (who sends $y = 0$ in the real world) that there is no any simulator for it, so the protocol is not secure in the malicious model. In the Lindell’s book-page 27 (the below proof), it is said that this protocol is secure!!! I am so confused. (I found a scenario where the protocol is not secure).

Proof of the protocol


texts:
assume i have:
One-key cipher: E.
Hash: H
My application is authentication. I have a shared secret key with Bob for the One-key cipher.
So, when I send an message to Bob, I also send an authentication code. It is over an insecure channel, so I may have man-in-the-middle attack, etc.
I wonder if below schemes for authentication code are safe or have special weakness.

M and H(E(M))

I apply one-key-encryption to the message and then hash it.
any problem with this scheme?

M and E(H(M))

I hash the message then apply one-key-encryption to the hash value.
in this scheme, the attacker may change M and H(M), but without knowing the secret key, no way for him to generate E?
(they key point is not to argue that E can be an insecure scheme. the question here is, over an insecure channel, if E is secured by a shared secret and H is collision resistant, is that any difference to H(E(M)) and E(H(M))? any comparative advantage or disadvantage to these two schemes.. appreciated for advice)
it seems to me both schemes are same and fine, but I am not sure..


texts: How to deal with different setup in Multikey FHE?

texts:
The scenario : using a Multikey FHE scheme, let's say LTV-FHE scheme, parties delegate the computation of some function to the mighty cloud. In LTV-FHE scheme the parties generate their keys and encrypt their messages independently.

If parties have different moduli ladders then what rings should the cloud choose for its computation ? Or the parties should have a common setup in what regards the moduli ladder ?


texts:
I'm a little confused as to what constitutes a single AES round.  Most sources say it's this:
t0=Te0[s0>>24]^Te1[(s1>>16)&0xff]^Te2[(s2>>8)&0xff]^Te3[s3&0xff]^rk[4];
t1=Te0[s1>>24]^Te1[(s2>>16)&0xff]^Te2[(s3>>8)&0xff]^Te3[s0&0xff]^rk[5];
t2=Te0[s2>>24]^Te1[(s3>>16)&0xff]^Te2[(s0>>8)&0xff]^Te3[s1&0xff]^rk[6];
t3=Te0[s3>>24]^Te1[(s0>>16)&0xff]^Te2[(s1>>8)&0xff]^Te3[s2&0xff]^rk[7];

If so, then (by my testing) it requires 3, not 2, rounds for diffusion. It's also hard to implement an even number of rounds because it seems to require I begin and end on a t0=... round (vs. the alternating s0=... round).


texts: Deviation from CCM specification - security impact?

texts:
The following question is about a specific protocol that uses a modified version of the CCM mode. Since I'm not a cryptographer, the protocol specification provides no reasoning for this change to CCM or proof of security, I'd like to know if this might have any practical or theoretical implication for the security of the encryption and authentication.

In NIST 800-38C and RFC 3610 the CCM mode creates the $S_0, ..., S_m$ by encrypting the counter blocks in the following way:

For $j=0$ to $m$, do $S_j=CIPH_K(Ctr_j)$

Then the $S_1$ to $S_m$ are concatenated to form $S$. Note this doesn't use $S_0$:

$S = S_1 || S_2 || ... || S_m$.

The encryption of the plaintext $P$ is done by xoring it with the $Plen$ most significant bits of $S$ and the MAC $T$ is xored with the $Tlen$ most significant bits of $S_0$:

$C = (P \oplus MSB_{Plen}(S)) || (T \oplus MSB_{Tlen}(S_0))$

The step where the protocol in question deviates from the standard CCM is in the construction of $S$. It includes $S_0len - Tlen$ of the least significant bits of $S_0$ into $S$.

$S = LSB_{S_0len - Tlen}(S_0) || S_1 || S_2 || ... || S_m$

The ciphertext is still created through:

$C = (P \oplus MSB_{Plen}(S)) || (T \oplus MSB_{Tlen}(S_0))$

It is ensured that the $MSB_{Tlen}(S_0)$ and $LSB_{S_0len - Tlen}(S_0)$ never overlap.

In my layman's eyes it seems like a strange change. However, since the $Ctr_0$ is constructed in the same fashion as the other counter blocks and the particular bytes used for xoring aren't that same between the encryption and authentication, it might not degrade security? Is there any obvious reason why someone would want to include parts of $S_0$ into the encryption?


texts: How to impersonate Alice = A in this protocol based on replaying a compromised session key

texts:
the protocol given in past exam paper:
(1) A → S : A, B, Na
(2) S → B : {A, B, Na,Kab}Kas, {A, B, Na,Kab}Kbs
(3) B → A : {A, B, Na,Kab}Kas, {Na}Kab, Nb
(4) A → B : {Nb}Kab

my answer when replaying the compromised session key to impersonate A:

(1)A -> S : A, B, Na
(2)S -> B : {A, B, Na, Kab}Kas, {A, B, Na, Kab}Kbs // comment assume Kab is compromised
(3)I(S) -> B : {A, B, Na, Kab}Kas, {A, B, Na, Kab}Kbs
(4)B -> I(A) : {A, B, Na, Kab}Kas, {Na}Kab, N’b
(5)I(A) -> B : {N’b}Kab


texts: I am trying to solve the BM algorithm to find the shortest LFSR and the feedback polynomial but i keep getting stuck. Is there anybody who could solve any binary code so the steps could be little clear. I had seen the algorithm on Wikepedia but too many letters without any implemented examples are very confusing for me. I would be very grateful if someone could explain the steps with actual numbers. Any numerical example would work.


texts: Question about second preimage resistance of hash function combiner

texts:
Let $\Pi=(Gen_1,H_1)$ and $\Pi=(Gen_2,H_2)$ be two hash functions. Define $(Gen, H)$ so that $Gen$ runs $Gen_1$ and $Gen_2$ obtaining $s_1$ and $s_2$ respectively. Then let $H^{s_1,s_2}(x)=H^{s_1}(x)\|H^{s_2}(x)$, is it second pre-image resistant if at least one of $H^{s_1}$ and $H^{s_2}$ is second pre-image resistant?

I have found the paper Multicollisions in iterated functions, application to cascaded constructions.by Antoine Joux and it showed that the hash function $H^{s_1,s_2}(x)$ is not secure. But does this approach work for every hash function?


texts: Why do we get the following equation in case of a One Time Pad?

texts:
If m: message, M: message space, k: key, K: keyspace, c: cipher, C: cipher space and $E_k$: encryption function, such that
$E_k(m) = c,\ m,m^* \in M,\ k\in K,\ c\in C.$

My first question is, is the following equation correct for One Time Pad encryption?

$$P[E_k(m) = c] = \frac{ \sum_{m_ i\in M} \sum_{k_ i\in K} P[E_ {k_ i}(m_ i) = c] } {|M|.|K|} $$

And, my second question is, why do we get that?


texts: File using same key on XOR cipher. Using CBC

texts:
I have some files that are encrypted using an unknown key and it's using the CBC method to encrypt the files.

When I XOR two files together the first two bytes are always the same, but different for each files (make sense for each file)

From that is it possible to recover the real key?
First bytes of the file :

1a 1a 14 54 08 0b 02 59

When xoring it to a another file using the same key the first few bytes are :

3a e5 1f 01 3a e5 1f 01

Another beginning of xoring with different file

bf fb 22 10 bf fb 22 10

As you can see the pattern repeats for those only 8 bytes. It does that for every file that I xor. Does that mean the key length is 4? And from that how can I recover the text ?


texts: Have I made any glaring mistakes in my use of Yao's garbled circuits?

texts:
I would like to use garbled circuits to provide a service that allows people to vote where they do not need to reveal their votes to my server or to anyone else. Let's assume that I have secure ways to generate garbled circuits, perform oblivious transfer for the inputs, and to evaluate the circuits. Let's also assume that every person who will vote has a login to my service, that they have a working public/private keypair, and that the server has a copy of their public key. I will use this because in this scenario voters won't be able to easily connect to each other, and must communicate through the server.

This is just for a school project/my own interest. I will be very clearly advertising that the project was not done by security experts.

This is how I have envisioned the general flow of information:

The server, knowing the number of voters and having the ids of all the voters (as in, their logins to the service), crafts a garbled circuit which will compute the outcome of the vote.
The server gives this circuit to every voter, as well as the public keys of every other voter that will be participating.
Every voter retrieves their input from the server using oblivious transfer.
Each voter then encrypts their input with the public keys of every other voter. They then send their encrypted input back to the server.
The server then distributes every voter's input to every voter by giving them the version encrypted with the receiving voter's public key.
Every voter decrypts the others' inputs with their private key.
Every voter evaluates the garbled circuit.
Voters send the output of the circuit to the server.
If the server notices any of the outputs are different, it broadcasts that the vote is bad. Otherwise, it broadcasts the outcome of the vote.
Each voter checks that the broadcasted outcome is the same as the outcome they computed.

Have I missed anything obvious here? Do you see any ways to make it more efficient?


texts: How to calculate a multiple-character checksum for authentication using a tabula recta?

texts:
I am not sure if this is possible to do using a tabula recta, but I would like to know how to calculate a multiple-character checksum of a text.  For a single-character checksum, it's easy.  You just begin on the table at the first letter of text, go down to the second, left/right to the third, up/down to the fourth, left/right to the fifth, etc., then make a 90-degree turn and keep going until you hit the last letter of text.

How would one calculate a double-character checksum?  In other words, the sum of the text with a modulus of 676 in base 26 [A-Z].


texts: Are there any practical attacks that create a printable chosen prefix MD5 collision?

texts:
I would like to create two ASCII text messages with the same MD5. Is this possible? If not, is there a similar but less strict attack that could work?

Or to rephrase my last question: what are the minimum prerequisites for the message alphabet?

Also: Do the Flame and Hashclash attacks have different prerequisites?


texts: Are block ciphers vulnerable to “key reuse” and/or “bit-flipping” attacks?

texts:
I know that almost all stream ciphers are vulnerable to “key reuse” and “bit-flipping” attacks.

Because AES also uses $XOR$ in its algorithm, is it possible for block ciphers – like AES – to be vulnerable to “key reuse” and/or “bit-flipping” attacks?


texts:
One of the conditions that a one-way function has to satisfy is the following:

$$Pr[A(f(x))\in f^{-1}(f(x))] \leq negl(n)$$

Now, suppose that we have the following function that's not one way:
$$f(x) = x + 123$$
We know this isn't one-way since we can easily invert; that is:
$$f^{-1}(x) = x - 123$$
But from the perspective of the adversary, if we have f(1) = 124, it would still essentially "brute-force" its way in order to find the inverse, right? In other words, the adversary would input random x's into f(x) until it finds a solution of 124 rather than formulating an inverse function (like a human normally would).

Is my understanding correct?


texts: Why do we need Collision Resistant Hash Function for the Merkle Tree Signature Scheme?

texts:
I am studying Merkle Tree Construction for digital signature. I don't quite understand why we need collision resistant hash function for Merkle tree construction.

There are few papers like XMSS that try to lower the requirement from collision resistant hash function to second-preimage hash function by introducing bit mask. However, does it implies longer public key, more works need to be done on verifier side?

is there a known attack on traditional Merkle tree that only uses second preimage resistant hash function?


texts: What if an attacker knows 1 bit of a OTP ciphertext

texts: I want to know the  answer for the question above, given that we encrypt a message that ends with a "0" and the encryption key is concatenated with a "0" to, in that case that case the cyphertext would also end with a zero, knowing that the attacker would know that the last bit of the key and the message is the same, would that cause a problem in case we're using a OTP to encrypt our messages?


texts: Is the AES-GCM encryption using the SHA256 hash of the plaintext as IV secure?

texts:
I want to encrypt a list of unique values and I want the property of when I encrypt the same value I get the same ciphertext (determinism). The adversary only observes the ciphertexts of a unique set of plaintext values. In this context would the following encryption algorithm be secure:

I generate the sha256 hash of the plaintext value
I use the hash as the IV to AES-GCM to encrypt the plaintext value

Is the resulting ciphertext which includes the hash of the plaintext value secure?


texts: How is encryption using XOR represented?

texts:
I know this is a dumb question and i probably have a fundamental misunderstanding of encryption, but when we want to encrypt, let's say a word like ''Hello'' for example, which is represented at binary level as 01001000 01100101 01101100 01101100 01101111 we XOR it with a key which also has a binary representation. The output of which is the encrypted text.

How is this process actually translated to a something like a shift cipher? Does XOR = addition? What about when we used some other cipher or algorithm to encrypt? Is XOR still used? What mathematical operator does XOR represent?


texts: CBC variant: why encrypt the nonce with a different key?

texts:
I am a newbie at cryptography. I understand the CBC encryption, somewhat. You don't want to use the same "IV" for every message because then the ciphers are not very random. My question is regarding the nonce-based CBC. My main question is why does the nonce needs to be encrypted with a different key than the rest of the message?

And a side question is does the nonce needs to be different? Or can it be predictable and reusable?

Below is a picture of what I am referring to. This image shows excellently the point I am referring to but does not explain it. Why can't k1 = k?

(From A Graduate Course in Applied Cryptography by Dan Boneh and Victor Shoup, problem 5.14)


texts:
I need to establish potentially infinite secure streams of data between many remote devices with very few resources. Chacha20 is lightweight enough, but I do not trust myself to implement a reliable nonce agreement protocol between devices.

One option is to use XChacha20 and random nonces, but I can not afford the performance reduction. Other option, the object of this question, is to generate a random 128 bits nonce and use it as both the conventional 64 bits nonce and the 64 bits counter.

Is there any references about the security of such a construction?

Some notes:

All devices use same secret key.
Public key cryptography is not an option due processing power and memory constrains.
Devices are mobile, so any connection can fail at any time, requiring to reconnect again.


texts: RSA by hand - did I do something wrong? (c = m on encryption)

texts:
to understand RSA better I am doing a little calculation by hand, this is what I got:

Choosing:

$p = 3\\
q = 5\\
n = 15\\
\varphi(p\cdot q) = 2 \cdot 4 = 8\\
e > \varphi(n) \implies e = 13\\
e \cdot d = 1 \pmod 8\\
13 \cdot d = 1 \pmod 8\\
(13 \cdot 5) \mod 8 = 1$

So there has to be $m \le n$ and I choose $m = 7$

Encryption:

$c = m^e \mod n\\
c = 7^{13} \mod 15\\
c = 7$

And if I decrypt it's nice coming back to 7. But it looks a bit weird to me having $m = c$ but I don't find what I should be doing wrong.. ?


texts: How to use the Extended Euclidean algorithm to invert a finite field element?

texts:
I was doing some practice on cryptography (I'm new to this topic) and was wondering what the following question even means or what it is asking me to find. I do know how to do Extended Euclidean algorithm, but I have no idea how to apply it to this problem. I do not need the answer to it but I would appreciate someone explaining to me what the question is asking for.

  Calculate by hand, using the Extended Euclidean algorithm:
  $(\mathtt{0x35})^{-1}$ in $\operatorname{GF}(2^8)$ with the irreducible polynomial $m(x) = (\mathtt{0x11B})$. (2 marks)

  (Note: this is the finite field used by AES, ‘$\mathtt{0x}$’ denotes the hexadecimal representation.)


texts: If we change the irreducible polynomial of the AES to someother irreducible or primitive polynomial, what effect will it have in security?


texts: How long to reestablish PKI if Diffie Hellman and Factoring are in classical $P$?

texts:
Supposing there is a classical (no need quantum) $O(\log N)$ algorithm to factor integers $N$ and supposing there is a classical (no need quantum) $O(\log p)$ algorithm to find $g^{xy}$ given $g^x$ and $g^y$ over cyclic groups of cardinality $O(p)$ (which includes elliptic curve cryptography) where the constants in $O(\log N)$ and $O(\log p)$ are very small then current $PKI$ breaks apart.

What alternatives are there to reboot the internet with a new public key infrastructure and how long would such an effort take?

I would think certain post quantum cryptosystems will also be deemed useless.

Note I am not assuming Discrete Logarithm is broken and since equivalence between Diffie Hellman and Discrete Logarithm Problem is still open I believe we will have something similar to PQC situation but not identical.


texts:
Simple answer (and I know this is a simple yes or no) is it possible to write an encryption that is 100% uncrackable, as long as I keep certain parts private? It's just for personal use.

I'm a computer programmer and need my own encryption to encrypt things like my passwords. Is this possible so that its 100% uncrackable, or is it simply not possible?


texts: Is Indistinguishability Obfuscation Real?

texts:
I've recently stumbled upon an interesting Quanta Magazine article. It states that indistinguishability obfuscation (iO) 's theoretical feasibility has been proven, referencing a relatively recent paper by Jain, Lin, and Sahai. However, the Wikipedia article for iO states that the work presented in this article relies on the "dubious" assumption that there exists a PRNG in $NC^0$. The authors of the paper explicitly list this assumption, but what makes me stumble here is the Wikipedia article's wording. I've taken a look at the paper referenced in the Wikipedia article. I've got some base knowledge in cryptography and some more refined knowledge in complexity theory, but not enough to fully understand any of both publications. However, I've taken from glimpsing at the Applebaum paper that the question about the existence of said PRNG indirectly touches on the $P−NP$
question, making it seem to me like an unlikely-to-be-soon-settled question.
So I'm now very confused about the reliability of that Quanta Magazine article. As you've probably gathered by now, I'm not from the field of cryptography. But I took from the article that this technology (if truly feasible) could potentially revolutionize the way we think about cryptographic protocols, which makes me wonder why it didn't make bigger waves.
My question is this: Is that proof of IO reliable (i.e., can one by now safely say that IO is theoretically possible, ignoring all of the troubles of practical implementation and application), or does it stand on some for-now-unverifiable assumption?


texts: Is the encryption more secure if we apply Pohlig-Hellman cipher twice with different keys but with the same modulus?

texts:
To encrypt a message $M$, we compute $C=M^k \bmod p$
and to decrypt a Cipher-text we compute $M=C^{k^{−1} \bmod (p−1)} \bmod p$

But if we use Pohlig Hellman twice like $C_1=M^k \bmod p$, and then $C_2=C_1^k \bmod p$,
So is this more secure than doing it just once or not.

And what if we do it multiple times like a Cascade?


texts: Is there a method to encrypt relations in between values of a cyclic value set and generate values out of this set with pseudo RNG? (all at user PC)

texts:
Is there a pseudo RNG and function $f$ with
1.) The RNG produces a value $v_0$ out of $N$ different values (set $S$).
2.) Independent of the RNG the function $f$ generates $v_{i+1}=f(v_i)$

Requirements:
$\bullet$ $v_{i+N} = v_i$
$\bullet$ $\forall i$:  $\{v_{i+k}, 1\le k \le N\} = S$
$\bullet$ $v_{i+j} = f^j(v_i)$ so it needs $O(N)$ computations (hard to compute)

All this is computed at the users PC. He has access to all variables. Given two random values genereated by the RNG the user should not know how to compute the second out of the first (= how often $f$ need to be applied).

Question: Is there any cryptographic method which has such conditions?

Further notes:
(*..) ... in further text means an optional simplificaion

$\bullet$ each $v_0$ is part of the same cycle (*or part of one out of a max of 10 cycles of equal size (+/-5%))

$\bullet$ There should exit no faster way to compute $v_{i+j}$ out of $v_{i}$ except in $j$ $(\mod n)$ steps (or $N-j$ steps) (*linear speed up of less than 5 times is ok)
$\bullet$ (*The result set of function $f$ can be larger than those $N$ values (up to ~1000 times)(and with this the cycle size) but there need to exists an efficient function to prove if it is one of those $N$ values.)

$\bullet$ There need to be an efficient way to (pseudo) randomly generate values $v_0$ (*not all values in $S$ need to be generated by the RNG but at least $N^{2/3}$)
$\bullet$ (*The RNG dont need to be uniform distributed among those $N$ values (but it can). It's fine if no probability of one value is much higher than 1000 times than any of a subset containing 80% of all values.)

Examples

$\bullet$Using unknown methods:
A random cyclic permutation (with cycle size N) with function $f$ which generates the next value in that cycle and the RNG could be a random number between 1 and $N$.

$\bullet$Too easy to compute:
The discrete logarithm in $\mathbb{Z}/N\mathbb{Z}$ with prime $N$ and a primitive root $g$ as generator with $f(v)=v⋅g$. The RNG would just give a random value between $1$ and $N−1$. If now the user gets two such random values he does not know how to compute one out of the other (how often multiply with $g$) even if he knows all internal variables. But it can be solved in about $O(\sqrt{N})$ steps. For small numbers that would be too fast to compute. I'm looking for something similar but with $O(N)$ (or bigger).

Example use case:
 _

 _

The green square is value $v_0$ generated by the RNG.
A-F are members of set $S$.
The relation from one value to the next is equal in each picture (modulo 9).
E.g. to get from value D to E it is always 1 square to the right and 1 below.
If now $N=80$ and $f$ delivers the next value in the cyclic permutation (with size N) the following blue square can be generated like:
with $v_{i+1} = f(v_i)$ then shift horizontal $= v_{i+1} \mod 9$ and vertically $= \operatorname{roundDown}(v_{i+1}/9)$

This can lead to multiple values at same position but values which are close in cycle also share almost equal other values. Values at the other end of the cycle still share more than half of the values. This property is not needed, equal values all the time would be better.

If now given only two random values e.g. D and G it should be as hard as possible to derive the position of G starting at D.

The grid will be 3D and about 100k x 100k x 100k tiles. Neeed about $10^{12}$ unique values. Only need to be safe for standard PC (>10.000 hour compute time, not supercomputer, grid, hardware)

Besides the 'next' function $f$ also the inverse can exists. Except just a single function also a function for each dimension can exists. If that's the case only the adjacent square gets computed. It need to be independent  of the order of function execution and there should exist no (easy) way to reduce a given value to its dimension values. Else finding the way between two random values would be too easy.


texts: Is a password cyphered by itself as secure as hash?

texts:
My Question(s)

I am wondering if I have a password (long enough) and I cypher it by itself (let's ignore the salt) in this way:

cy_hash(mypassword)=cypher(text=mypassword,key=mypassword)

Then, is cy_hash as secure as md5, sha1, sha512, etc?

Also:

Is there any theoretical comparison between these methods?
Has this method ever been used in practice? If not, why?
Is there any research on this hash?

My research efforts

As for my research efforts, I have looked around and found the following Q&As:

Is it safe to encrypt a string using same string as key?
 (at StackOverflow)
how much is secure to encrypt a password using itself (as encryption key) for storing it on a unsecure media? (at Crypto.StackExchange)

but those Q&As do not answer my question. You can safely skip linking to them.


texts: Vertical bar and comma in hash function input

texts:
I came across to a definition of a term PMKID while studying 4-way handshake in IEEE 802.11i. It is defined as:

PMKID = H(PMK,"PMK name"||AA||SPA)

I know the vertical bar || in the input of the hash function means concatenation, i.e. joining them end-to-end. How about the comma? Any difference?

And also, does "PMK name" means that the string is converted into binary form and serve as part of the input or is it there for demonstration purpose only?


texts:
I am trying to find a list or table of safe prime  numbers i.e. the ones that are based on the Sophie Germain primes i.e. $N = 2p + 1$ where $p$ is also prime.

All I found till now is this database.
However the problem with that database is that all Sophie Germain primes in this database have at least 1000 digits. So, is out there any database that has the Sophie Germain primes  including the one that are less then 1000 digits long?

I am looking for Sophie Germain primes that will allow me to calculate safe prime numbers that are 512, 768, 1024, 2048, 4096  bit long.


texts: Differential and Linear Cryptanalysis on Random Sbox

texts:
Assume that we use the key to perform a uniform permutation to generate a sbox. The literature is rich supporting the statement that a random Sbox can make any cryptographic scheme weaker. I have tested and found the randomly permuted sboxes possess weak nonlinearity and high differential probability. We know that to perform differential and linear attack the DDT and LAT should be handy. If we make the sbox key-dependent and every distinct key results a distinct sbox(best case).
Now if someone tries to perform a differential/ linear cryptanalysis then will it be logical to consider the Bruteforce complexity of guessing the proper sbox?
If it is logical then what should be the approach to such an attack?


texts: What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

texts:
It seems the only specified CTR mode ciphers in TLS are all GCM based.

GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field arithmetic ("GHASH") - and the latter seems to be difficult to get right in software (side-channel attacks, constant time) or require CPU hardware support (e.g. Intel AES-NI / PCLMULQDQ) which in turn might be manipulated/weakened via microcode updates/implants.

On the other hand HMAC-SHA256 seems relatively simple to do right in software and when used together with AES-CTR and a encrypt-then-MAC scheme.

So why are there no modes like TLS_DHE_RSA_AES128_SHA256?

The closest I could find is this unfinished, expired IETF draft.


texts: Why does DESX break if one removed post whitening?

texts:
DESX uses whitening to strengthen against brute force attacks. What is an attack one could use to recover DESX's pre-whitening key with only two known ciphertext/plaintext pairs, given that the attacker can successfully disable the post-whitening step?

So far I have come up with this:

The attacker could use an active fault injection attack to reduce DESX to return the results after round 1, effectively skipping rounds 2 to 16.
Starting from the two ciphertexts, the attacker could then find all inputs to the s-boxes to recover all s-box input candidates.
Starting from the two plaintexts, the attacker can find E(whiteningKey) xor roundKey combinations that produce the same s-box input candidates.

My problem now is this: The attacker has no way other than brute force to separate the whitening key from the round key in the equation above. Given the fact that brute force takes on average 2^55 attempts, this would be incredibly slow without special FPGA hardware.


texts: Are there simpler FHE methods than Craig Gentry's original paper?

texts:
Craig Gentry's 2010 paper on FHE is very cool, and I'm planning on implementing a basic proof of concept FHE.

I was wondering though, are there any simpler methods that have been discovered since then?

The bootstrapping and the multiplication pre shared table would be nice to get rid of if possible.  (I'm sure the whole world agrees, but is glad it can be done at all).

Anything simpler out there yet?

Here are the references I've found / have been using while trying to implement it.  Note that I have been looking to implement it myself after understanding the theory, so haven't been looking for existing implementations, although definitely would look at them if having problems implementing.

http://windowsontheory.org/2012/05/01/the-swiss-army-knife-of-cryptography/

http://outsourcedbits.org/2012/06/26/applying-fully-homomorphic-encryption-part-1/

http://crypto.stanford.edu/craig/craig-thesis.pdf

http://researcher.watson.ibm.com/researcher/files/us-shaih/fhe-implementation.pdf

And then of course the links provided by people as comments in response to this question!


texts:
Is there an existing format out there that not only encrypts data but also protects against loss of data much like the QR codes can lose up to 33% of it's bits and the message is still recoverable.

I don't want to say encryption with RAID 5 but I guess it's the same concept.


texts: Can OTP still be broken if there are several messages being sent with only a slight variation in a password?

texts:
If an attacker were able to get a hold of 2 encrypted messages that were both encrypted in a one time pad with a password that were each similar but had one change in the first character, could it still be cracked?
Let's say my first set of data was encrypted with "1password" and my second set of data was encrypted with "2password". Could it still be easily cracked?


texts: Is there a method to break an EC curve for all key-pairs (Q,d) such that (Q=d*G) faster than breaking every single key-pair?

texts:
Related to this question: Is there any memory trade-off that helps such attack?

Obviously if the field size is very small (say 40 bits) it´s possible, but what if the field size is 160 bits long? or 256 bits?


texts: Symmetric and Asymmetric indistinguishabilty experiment

texts: In each of those experiments, we have a function $Gen(x)$ who generates the key or a pair of keys respectively for symmetric or asymmetric algorithms. $x = 1^n$ : I read on other questions that is a $1$ string bit of length $n$, but I didnìt understood why it is used value as input to generate the key.