texts: Why is TLS susceptible to protocol downgrade attacks?

texts:
A recent blog post from Ivan Ristić (expert extraordinaire on all things SSL) says:

  all major browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions and force all browsers to back off from attempting to negotiate TLS 1.2, making them fall back all the way down to SSL 3. At that point, the predictable IV design is again a problem. Until the protocol downgrade weakness is fixed, newer protocols are going to be useful only against passive attackers, but not against the active ones.

Why is this?  Why is TLS vulnerable to this?

I know that SSL 3 included special mitigations to prevent protocol downgrade attacks where a man-in-the-middle downgraded two SSL3-capable endpoints so they end up using SSL 2.  This protection in SSL 3 was critical, because SSL 2 had some major problems, and if you could downgrade both endpoints to SSL 2, nasty attacks would have become possible.  Happily, the SSL 3 designers anticipated this risk in advance and made sure to introduce a special mechanism in the protocol to prevent "downgrade-to-SSL2" attacks.

So how is it that TLS ended up without any mitigation to prevent downgrade from TLS 1.2 to TLS 1.0 or even to SSL 3.0?  Is there some reason why it is non-trivial to add downgrade protection?  Did the TLS standard committee just overlook this one?  Or, was it considered a low priority?  Is there a straightforward way for future versions of TLS to address this issue?


texts: Comparing messages given only the ciphertext

texts:
Under RSA protocol I was wondering how a message sent could be verified
under the following scenario

Alice has a private (encryption key) and public key (decryption key)

If Bob sends Alice cipher-text but does not know the plain-text message
he sent to Alice

Can Bob send Alice a second message in plain-text to determine
what he had originally sent? Does Alice send back Bobs message
encrypted using her public key so that bob has cipher-text he can compare?

Can bob only compare cipher-text? or can he do anything else?

With messages bob sends or receives is there anything bob can do
to verify/check if the two message he sent are the same or not?

Can Bob decrypt a message with just the public key? Is he allowed to get private key from alice?


texts:
There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function.  I'll elaborate more precisely.

Definition 1. A point function is a function $f_{v,w}$ defined by $f_{v,w}(x) = w$ if $v=x$ and $f_{v,w}(x)=0$ otherwise.

We know how to obfuscate a point function.  For instance, one pragmatic obfuscation of the point function $f_{v,w}$ is the following circuit:

$$C(x) = \text{if $H(x,0)=c_0$ then $D_{H(x,1)}(c_1)$ else $0$},$$

where $c_0 = H(v,0)$ and $c_1=E_{H(v,1)}(w)$, $H$ is a cryptographic hash function (modelled as a random oracle), and $E,D$ are a secure encryption scheme.  Note that the constants $c_0,c_1$ don't reveal $v,w$ if $v$ comes from a space of sufficiently high entropy, so the obfuscated circuit $C$ conceals $v,w$ if $v$ has high enough entropy.

Now let's consider a slight generalization.

Definition 2. A point-like function is a function $f_{m,v,w}$ defined by $f_{m,v,w}(x)=w$ if $x\land m = v$ and $f_{m,v,w}(x)=0$ otherwise.

Here $\land$ represents the bitwise logical-and operator, so $x \land m = v$ holds when the bits of $x$ selected by the mask $m$ match the corresponding bits of $v$ (I assume $v \land \neg m = 0$).

My question: Do we know of any plausible, practical way to obfuscate the class of point-like functions?

I am fine with any reasonable definition of obfuscation.  I do want the obfuscated circuit to hide the values of $m,v,w$.  I am fine with a scheme that might plausibly be secure in practice, even if we don't have a rigorous proof of security under standard cryptographic assumptions, or even if it requires the random oracle model or the generic group model or somesuch.  I would prefer a solution that is efficient enough that you could plausibly use it in practice.

(For instance, I'm thinking maybe there's some way to do this using schemes for homomorphically evaluating 2-DNF formulas, but I don't know if that direction will actually work out or not.  Maybe there's a better direction.)


texts: Break AES-CFB mode having access to a AES-CTR black box

texts:
I need help for a "simple" problem

Let's suppose an intercepted ciphertext C encrypted with an AES-CFB mode of operation, using key K and some IV (IV is probably at the begining of C)

The system let us access to a black box encrypting any tupple (plaintext, IV) using AES-CTR mode with the same key K.

I succeed compute the keystream of the CTR mode using output of the black box, but I still need the keystream of the CFB mode before decrypting C.

Anyone has an idea how to do it ?
Thanks


texts: Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

texts:
Note: I am not advocating anyone continues using SHA1-signed certificates: they are dead as far as security is concerned and should no longer be used. I'm just trying to clarify my understanding of the theoretical implications of Shattered as they might apply to such certificates.

Prompted by this recent question: After Google's collision attack, is RSA-SHA1 signature still safe?, to which the overwhelming response is "no", I want to ask to what degree does the Shattered result actually show that SHA1-signed certificates are "in danger"?

The existence of the Shattered result is not, I think, in itself a surprise: everyone knows that in theory you can create two streams of bytes that hash to the same value. Google's achievements (which I don't wish to downplay) are (a) that they mustered enough resources to actually do this, and (b) they did so while keeping the colliding file a valid PDF (that also matched the format of the original very closely, and included the "obvious" difference in background colour).

As the accepted answer to Does “SHAttered” only work for PDF files? explains, Google had the "luxury" of an effectively "free-form" block of data that they could alter at will to achieve the collision. As I understand it, the "collision blocks" embedded in the JPG data (itself embedded in the PDF) have no (visible) effect on either the image itself nor on the PDF. Therefore (to grossly simplify things), "all" they had to do was vary this block until a collision was achieved1.

However, in the case of a SHA1-signed certificate, there is nothing like the same freedom to inject unconstrained data: the amount of data that is signed is much smaller; and far less of it is free to be varied without consequence – you might find a collision, but the result is likely not to be usable as a certificate.

So: is it correct to say that while Shattered was a significant event, it does not in itself show that the chances of creating a usable, collided, SHA1-signed certificate are increased, and, in fact, the chances of doing so are still small?

1 As per parts of Maarten Bodewes's answer, I realise that Google's attack wasn't completely random: the "magic" was in their tailoring of the attack and an "academic level knowledge to construct such an attack". While the targeting was important to being able to find a collision, so too was the ability to put arbitrary data into the file without compromising the file's validity. It is the latter aspect I'm asking about, and whether the same freedom extends to X.509 certificates.


texts: Is it possible to reverse Ansible vault data?


texts: Explain the fast Walsh–Hadamard transform in simple steps or pseudocode

texts: I've read that the fast Walsh–Hadamard transform is a way to efficiently calculate the linearity/non-linearity of an S-box. Can I get a description of it in simple steps or pseudocode that is restricted to simpler notation and terminology?


texts:
With this Elgamal variant defined below, we have covered in lecture but I do not still understand how a CCA could work against it. Is the use of the homomorphic nature of the encryption something you could use?

$c=\langle g^r, \mathcal{H}(y^r)\oplus m \rangle$

What could be a CCA against this type?


texts: Sometimes I read that a nonce has to be a random number but I disagree. A nonce just can't repeat itself. You could increase in by 1 every time if you are sure it would never repeat.


texts: RSA: Fermat-Euler Theorem - coprimality of message and modulus

texts:
I understand the implication of the Fermat-Euler theorem and how it applies to RSA and the detailed explanation by user Ninefingers at What is the relation between RSA & Fermat's little theorem? is very useful.

However, the Fermat-Euler Theorem states that $a$ and $n$ should be relatively prime to satisfy the following equation.
$$
a^{\phi\left(n\right)}\equiv1\mod n
$$
But I do not recall RSA stating any exceptions of $a$ which cannot be properly encrypted

Edit: Note that I have seen Does RSA work for any message M? which is very similar BUT the question is different and thus the given answer satisfies it however the answer does not show or prove why the fermat's theorem could still be used.

Edit 2: The reason it is a different question is because I am looking for the number theory function which enables the cryptographic system to work the way it does.


texts:
H = ripemd160(sha256(ECMultiply(A,G)))

A - 32-byte number,

H - 20-byte number,

G - generator point,

ECMultiply - elliptic curve point multiplication.

Is it true that there is many A that have the same H?


texts: Prove that textbook RSA is susceptible to a chosen ciphertext attack

texts:
Given a ciphertext $y$, describe how to choose a ciphertext $\hat{y} \neq y$, such that knowledge of the plaintext $\hat{x}=d_K(\hat{y})$ allows $x=d_k(y)$ to be computed.

So I use the fact that the decryption function is multiplicative: $d_K(y_1)d_K(y_2)= d_K(y_1y_2)$.

Thus we have $d_k(y\hat{y})=x\hat{x}$.

Now if $y\in \mathbb{Z}_n$ is a unit then we set $\hat{y}=y^{-1}$ and thus $x\hat{x}=1$ implying that $x=(\hat{x})^{-1}$

And if $y\in\mathbb{Z}_n$ is a zero divisor then we choose $\hat{y}$ such that $y\hat{y}=0$ and thus $x$ is the zero divisor associated to $\hat{x}$.

Is this correct?


texts:
There are Client and Server.

Client have previously send public keys for x25519 and ed25519 to the server. And now need to prove that it has private keys for them.

I have found similar solutions in description of ssh protocol by Digital Ocean: https://www.digitalocean.com/community/tutorials/understanding-the-ssh-encryption-and-connection-process#authenticating-the-user's-access-to-the-server

And in SSH Authentication Protocol RFC: https://tools.ietf.org/html/rfc4252#section-7

General scheme:

Server generates some 'nonce'. Encrypts it with x25519 public key of the client and sends to the client.
Client decrypts the 'nonce' with corresponding x25519 private key. Signs it with ed25519 private key and sends original data with the signature attached.
Server checks that the data equals to the one was send in (1). And checks signature. Proof-of-Possession is done.

I have two questions:

Is this scheme correct ? What should I review/read to make it correct ?
In the article from Digital Ocean you can find that client doesn't send raw data back to server but gets md5 of it and sends only md5. Why so ? What's the point of that operation ? Should I do the same ?


texts: Is Lamport-Diffie EUF-CMA secure in the standard model?

texts: Is the Lamport-Diffie signature secure in the standard model? I ask this question because I am reading the Postquantum-Cryptography book and the reductions the authors use one-way functions and not hash functions. According to my understanding, ROM is used to replace hash function for random oracles, but in Lamport-Diffie only pre-image resistance functions are sufficient.


texts: When is the Random Oracle model (not) necessary?

texts:
Hash functions are often used in cryptographic schemes and protocols, and that doesn't necessarily mean that their proofs are on the Random Oracle model. That leads to the following question: What is the "turning point" in which the use of a hash function requires a proof on the Random Oracle model?

Is it when the proofs require observability and/or programmability
of the random oracle?
Is it when it is essential to guarantee a random output?
Is it related to the usual characteristics of cryptographic hash functions (i.e., pre-image resistance, second pre-image resistance, collision resistance)? If so, how?


texts: Are password salts equivalent to keystream?

texts:
I was reading up on keystream when I came upon the definition of it:

  A keystream is a stream of random or pseudorandom characters that are combined with a plaintext message to produce an encrypted message (the ciphertext).

  The "characters" in the keystream can be bits, bytes, numbers or actual characters like A-Z depending on the usage case.

I am wondering conceptually if the stream of random pseudorandom  character is equivalent to a salt which are commonly appended to passwords?


texts:
A randomness extractor is a function that takes an input sampled from high entropy distribution and outputs a value that is close to uniform distribution. It is slightly different from a PRG. PRGs take an input sampled from uniform distribution and output a larger length string which is computationally indistinguishable from uniform. Whereas randomness extractors take an input sample from high entropy distribution and output a smaller length string statistically close to uniform distribution.

In my scheme, I use randomness extractors. In the scheme, the extractor takes an element uniformly sampled from a subgroup of $Z_N^*$, where $N$ is a product of 2 large primes. The extractor needs to output a bit string. I want to implement the scheme but couldn't find any implementations of randomness extractors. Are there any randomness extractors in sagemath, or any other library?


texts:
If I am going to use a master key to generate a session key, why the master key must be "stronger" than the session key?

Like should not be distributing 128-bit AES keys derived from a 56-bit DES key.


texts: Does the bias in RC4 drop asymptotically further in the keystream?

texts:
It's well-known that the RC4 keystream has significant biases that become less prominent later in the keystream. The most severe bias is in the second byte, which has a 128-1 bias towards zero. Other biases remain, and it's typically recommended to drop between 768 and 3072 bytes of the keystream.
Will dropping one more byte always reduce the bias, or is there a point when the bias is as low as it is going to get and it won't get lower as the keystream goes on? It doesn't matter if the bias is negligible.
Note that I am only talking about short-term biases, not long-term ones which RC4-dropN can't solve.
Does an N exist that results in minimum bias in RC4-dropN?


texts: How is Shamir's Secret Sharing better than this simple 2-password technique?

texts:
I'm looking for a solution to protect a message, such that both password1 (usually given to trusted person #1) and password2 (given to trusted person #2) are required to decrypt the message.

Thus, person #1 alone or person #2 alone can't decrypt the message.

A solution seems to be given by Shamir's Secret Sharing (using finite field arithmetic).

Question: how is the following simple solution weaker than Shamir's solution, and which are the benefits of Shamir's solution over this:

ciphertext = encrypt(encrypt(plaintext, password1), password2)

(where encrypt is any traditional symmetric encryption solution)?

Example use-case (off-topic but just as an example): plaintext is your digital "will" (containing helpful passwords that you would like to transmit to your loved ones after your death), password1 is kept by your attorney/notary, password2 is given to your life partner.

PS: this simple and obvious technique is discussed here and here.


texts: Multiple (RSA) public key encryption how to verify others received the same information? Non-deterministic encryption

texts:
I have an RSA system between multiple parties. Alice takes the targets (Bob and Oliver) public keys and encrypts a message using them and sends it to them. All parties know each other's public keys and the ciphertexts received.

I wanted to verify that all the targets are receiving the same message, so I thought Bob could take Oliver's public key and encrypt the received message(after decrypting with his own private key) and compare it but I'm using non-deterministic encryption, therefore, the ciphers produced are different for the same message and public key.

I know using deterministic encryption prone to attacks so I was wondering if there are any other solutions out there or do I have to risk using deterministic. For reference, I'm using JavaScript and AES for encryption.

How do I verify that Oliver and Bob receive the same message without them having to send it to each other?


texts:
I was analysing the Chacha20 algorithm and the Poly1305 MAC generation from RFC 7539. It seems that the Chacha20 is quite faster compared to AES on CPUs without hardware support like AES-NI. But Poly1305 tag generation contains 16-byte random integer multiplication with another for each 16-byte block of ciphertext.
Can we achieve a relevant performance boost with this operation offload to a dedicated chip.?


texts: Diffie-Hellman key size to symmetric formula?

texts:
I've noticed that on every site I checked I kept finding the relationship between D-H key size and symmetric encryption equivalent as a table, like:

384 - 56

768 - 80

1792 - 112

2304 - 128

10753 - 256

...

But I never found the formula that is actually used to calculate this equivalence. From what I can see by key size growth there is some square root of asymmetric key employed, multiplied by something, but I couldn't reverse engineer the formula myself.

Could anyone point me in the right direction? Thank you.


texts:
Can anyone comment if the stream cipher described  here is safe? The author claims it to be unbreakable, but does not provide any evidence or proof to support this. For completeness, I have reproduced the algorithm below.

Encryption routine (Alice$\to$Bob)

Calculates a shared secret:
$s=$Curve25519(Alice_private_key, Bob_public_key)
Calculates N seeds $s_1,\dots,s_n$:
$$s_0 = \mathrm{SHA256}(s);\quad s_n = \mathrm{SHA256}(s_{n-1})$$
Calculates N keys $k_1,\dots,k_n$:
$$k_n = \mathrm{SHA256}(\overline{s_n})$$
(where $\bar{s}$ is the bitwise compliment of $s$)
Encrypts the plaintext via xor:
$$c_n = p_n \oplus k_n$$

Upon receipt Bob decrypts the ciphertext by repeating the identical steps, except he derives the shared secret $s$ using his private key and Alice's public key.


texts: RSA signatures that allow hash to move around in block

texts:
I'm looking at a broken RSA signature padding implementation in a real device.  It's a very-badly implemented version of PKCS #1-like encoding, but before PKCS added the DER-encoded hash identifier.

The signature format is intended to be:

00 01 FF FF FF FF FF ... FF FF 00 <SHA-1 hash>

However, for some reason, the programmers saw how the second byte can also be 02 in PKCS and in that case any nonzero padding could replace the FF bytes.  This is misinterpreting PKCS, because that's for encryption padding, not the signature padding.  Allowing encryption-mode PKCS padding is a major mistake.

A second mistake is that the implementation does not require the SHA-1 hash to be flushed right.  (In 01 mode, it does require that there be at least 8 FF bytes, making attacks on 01 impractical.)  Thus, the actual padding format, if abused to be 02 format, is this:

00 02 <nonzero garbage> 00 <SHA-1 hash> <garbage>

If the public exponent were $3$, both the 01 and 02 forms would be trivially broken by taking the floor of the cube root (Bleichenbacher).  Alas, the public exponent is $65537$.

Without an oracle, is there an attack against this?

Note that if there were an algorithm that could generate numbers whose 65537th power contained the desired SHA-1 hash anywhere within the message, leaving the rest of the number corrupted randomly, such an algorithm would succeed in $2^{26}$ or so outputs.


texts: What cipher algorithm is this routine using?

texts:
I transfered a code routine from Java to Python:

import base64
import hashlib

class Cipher(object):

    def __init__(self, key):
        self.key = key

    def decrypt(self, message):
        message = base64.b64decode(message)
        message = bytearray(message)
        a1 = self.make_table()
        results = range(len(message))
        j = k = 0
        for i in range(len(message)):
            k = 0xFF & k + 1
            j = 0xFF & j + (0xFF & a1[k])
            a1[j], a1[k] = a1[k], a1[j]
            n = 0xFF & (0xFF & a1[k]) + (0xFF & a1[j])
            results[i] = message[i] ^ a1[n]
        return bytearray(results)

    def make_table(self):
        key = hashlib.md5(self.key).hexdigest()
        key = bytearray(key)
        results = range(256)
        m = 0
        k = 0
        for i in range(256):
            k = 0xFF & k + ((0xFF & key[m])) + (0xFF & results[i])
            results[i], results[k] = results[k], results[i]
            m = (m + 1) % len(key)
        return results

I'd like to know what algorithm is this code using? so I can refactor it to better Python code. thanks!


texts: If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?

texts: IND-CPA is used to protect against frequency analysis AFAICT. But if RSA is only used to encrypt symmetric keys (AFAICT) then what's wrong with using only textbook RSA because random keys are very unlikely to repeat?


texts: Elliptic curves with field sizes that not byte-aligned

texts: Why there are abnormal field size like 521, 571, 233, 283 bits in prime and binary fields that are defined by NIST?


texts: Good practices for AES key derivation and management

texts:
I'm developping a device based on STM32L4x6. It is connected through BLE to a smartphone and it exchanges encrypted data with it. Data consists of health data of patients.

Encryption is AES-GCM 256 bits and I'm using the reference implementation provided by STMicro.

I have implemented a classical shared secret exchange mechanism using Diffie-Helman protocol on Curve25519. Right now I am using this shared secret directly as the AES key.

I know that I need to derive a "cryptographycally good" AES key from this shared secret.

I was planning to use HKDF-SHA512 for that, because it seems to be a widely used algorithm and also because a reference implementation is also provided by STMicro. Is it a good choice ?

I'm confused about the size and the nature of the salt to derive the key. Do you have any advice for that ?

From what I understood one can use HKDF-SHA512 to generate a key of 256 bits, do you confirm ?

Also regarding the derivation frequency : at what frequency should I derive a new key ?

Thank you


texts: Confused by the definition of Linear Complexity of an LFSR sequence?

texts:
The Linear Complexity of a sequence is defined as the length of the shortest LFSR that produces this sequence. It also corresponds to the degree of the minimal polynomial ( i.e. the smallest reccurence produce the sequence) of the sequence.

Now consider the sequence {0,1} the degree of the minimal polynomial is equal to 1 therefore the LC must be equal to 1, but we need an LFSR of length 2 including both 0,1 (an arrow going out from stage 0 box, to backward feedback itself). No need a  connection coefficient for stage 1 box. Thus LC is equal to 2 according to this definition.

So there must be a problem in the definition of LC being equal to the length of smallest LFSR? It looks like if the definition would be the "length of the LFSR for the periodic part or nondegenerate part of the sequence" then the two definitions would coincide.

Which definition is correct? What is the Linear Complexity of this sequence; 1 or 2, and why?

By the way both definitions are from Rueppel's book.


texts: Does PBKDF2 reveal any knowledge about the salt?

texts:
DK = PBKDF2(PRF, Password, Salt, c, dkLen)

When PBKDF2 is used for key derivation (not password hashing), is it possible for an adversary who doesn't know Password to learn anything about Salt when given DK?

Edit

To clarify this question a bit, let's fix c and dkLen and simplify the function a bit:

DK = PBKDF2(PRF, Password, Salt)

This function has 3 inputs and 1 output. When given PRF, Password and Salt, we can calculate DK exactly.

My question is actually very simple:

When given PRF and DK, is it possible for an adversary to learn anything about Salt?

Here are some trivial examples that may help you understand the question better:

If we define function1(PRF, Password, Salt) = Password, then obviously the adversary won't learn anything about Salt because it's not being used.
If we define function2(PRF, Password, Salt) = Salt, then obviously the adversary will learn something (everything, in fact) about Salt.

The parameter name Salt may be confusing because we are not using it as a salt here. Instead, it's some information that we want to keep a secret. This may or may not be its original design goal. But I'd simply like to know whether it's safe to use PBKDF2 in this way.


texts: Authentication impossible without pre-shared public key

texts:
Correct me if I am wrong, digital certificates require the user to have the public key for the certificate in their web browser, right?

Which means it has to be pre-shared.

(Say I am designing a cryptosystem which is an application for encrypted chat that uses TLS. However, I want the cryptosystem to be end-to-end, meaning, the client must directly connect to a server of their choice.

How can I make this cryptosystem's authentication work if I allow my clients to create their own servers for direct end-to-end encryption?
In other words, the application does NOT contain a pre-shared public key for the digital certificate.

In this scenario, is my application doomed without a pre-shared public key?


texts:
In class, we learned the Kocher Timing Attacke on modular exponentiation. For determining whether the (e.g., LSB) is 0 or 1, we specified two values:

$T_1 = T_M - (TMult(1, y) + (\omega -1)ExpTMult)$

$T_0 = T_M - \omega ExpTMult$

where $T_M$ is the timing for $y^x\ mod\ m$, $TMult$ the timing for the multiplication, $\omega$ the Hamming weight of the exponent and $ExpTMult$ the expected timing value for a  multiplication. We calculated these values for every sample. Then, if $\Sigma_{sample} T_1\ <\ \Sigma_{sample} T_0$  the LSB is likely 1. Similar for the following bits.

Question: What happens after a incorrect guess?

The linked paper says (Sec. 3):

  after an incorrect exponent bit guess, no more meaningful correlations are observed.

So, it is $\Sigma T_1 \approx \Sigma T_0 $ for the following bits?


texts: ECC Complexity order of point addition, scalar point multiplication and selecting random point

texts:
I am facing this problem in calculating the order of a process which involves ECC point addition: $P+Q$ , scalar multiplication: $aP$, and selecting random points in the group. The group is of prime order say $q$.

What is the time complexity order of these operations? Is it $O(n)$, $O(log(n))$ or something different?


texts: During the encryption process in NTRU, a random polynomial $r$ of small coefficients is generated to bind to the message to obscure it, and this polynomial must be kept secret. Does this polynomial have to be unique per message?


texts: Understanding the Pohlig-Hellman algorithm

texts:
The paper has the following relation:
$$y^{(p-1)/p_i} \equiv \alpha^{x(p-1)/p_i} \equiv \gamma_i^x \equiv \gamma_i^{b_0} \pmod p$$

where $\gamma_i = \alpha^{(p-1)/p_i}$. I understand this relation and can show how each step is derived. However I'm stuck at the next step. From the paper:

  $\gamma_i$ is primitive $p_i$th root of unity. There are therefore only $p_i$ possible values for $y^{(p-1)/p_i} \pmod p$, and the resultant value uniquely determines $b_0$

What exactly does this mean and how do I get $b_0$ from $\gamma_i$?


texts: AES vs RSA - Which is stronger given two scenarios?

texts:
Let's say we have some plaintext.
Let's say that we encrypt this plaintext with a random 32 byte key using AES-256.
Let's say that we also encrypt this plaintext with an RSA 2048 public key.

If only the cipher text was known, which of these would be harder to identify the plaintext from?

My thoughts are that it would be the RSA ciphertext since the assumption is that the attacker has no access to either the public key or the private key, just the ciphertext. This is because the attacker has nothing to base any assumptions on and would still have to figure out what the private key is.


texts: Constructing RSA private key, given public key

texts:
As part of a puzzle I was given an RSA 256-bit public key and an encrypted message.

The key itself is very weak, having exponent e = 65537 and modulus N = 00:c0:fb:55:b3:ed:f5:19:bf:8d:3a:2a:60:e8:bc:6e:1c:94:f0:5c:17:19:f8:38:ff:45:0b:01:0f:47:96:27:fb

I can determine p and q by using an arbitrary precision library and iterating through until I find something that satisfies N mod p = 0, and then get q = N/p

From there it's straightforward to get phi = (p-1)(q-1) and to calculate d = e^-1 mod phi

My question is this:  Given d and N, how do I actually construct the private key as binary data suitable for use with e.g. openSSL?


texts: I need some suggestions about the use of the CRC in my application. I need to be sure about the BIOS run by the CPU. I have a FPGA between the BIOS flash and the CPU that sniff every read performed by the CPU on the BIOS memory. The initial idea was to compute the SHA1 of the data stream to authenticate and to be sure about the correctness of the BIOS. The resulting digest is stored inside the bitstream of the FPGA. Is it enough safe to use the CRC in this application ?


texts: Is there a technical difference between tag such as tag generated by authenticated encryption, and signature such as the signature generated by a functional signature scheme or homomorphic signature scheme.


texts: Rationale behind IETF-ChaChaPoly's padding during MAC computation

texts:
RFC 7539 (Section 2.8) specifies a ChaCha20/Poly1305 based AEAD cipher scheme; pseudocode:

pad16(x):
     if (len(x) % 16)==0
        then return NULL
        else return copies(0, 16-(len(x)%16))
     end

chacha20_aead_encrypt(aad, key, iv, constant, plaintext):
     nonce = constant | iv
     otk = poly1305_key_gen(key, nonce)
     ciphertext = chacha20_encrypt(key, 1, nonce, plaintext)
     mac_data = aad | pad16(aad)                // <- Here
     mac_data |= ciphertext | pad16(ciphertext) // <- Here
     mac_data |= num_to_4_le_bytes(aad.length)
     mac_data |= num_to_4_le_bytes(ciphertext.length)
     tag = poly1305_mac(mac_data, otk)
     return (ciphertext, tag)

Why do they require to pad the ciphertext/additional data during MAC-computation? Are there any cryptographical advantages over a similar algorithm without padding (as used by libsodium)?


texts: Is it possible to build an unfair noisy channel from 1 out of 2 oblivious transfer

texts:
For a fair channel, sender sends a bit b and receiver gets it with probability 1/2 and gets b's flipped value with probability 1/2. It is trivial to build a fair noisy channel from 1 out of 2 oblivious transfer since sender only needs to input b and b's flipped value and receiver randomly choose one.

Now I wonder if we can achieve that we can use 1 out of 2 oblivious transfer to implement an unfair noisy channel where receiver gets b with probability p and b's flipped value with probability 1-p and p is not equal to 1/2. Thanks in advance!


texts: Secure communication protocol for equality test

texts:
I'm solving a theoretical problem with two entities, each having one secret number. They need to find out whether these number equal without disclosing their number when they differ.

Easy solution is to encrypt/hash both numbers and compare these encrypted messages/hashes. In this case, it is still, in theory, possible to compute/to guess the other secret number (even if is very improbable). For example when there is very limited number of possible secret numbers.

Is there any protocol that is 'totally safe' - meaning that an entity cannot guess the other secret number regardless of its computation power?


texts: Why does Carter-Wegman (and AES-GCM) use different keys for PRF and keyed-hash

texts:
So. As I understand, Carter-Wegman transforms a one-time MAC (which must be a difference unpredictable function (DUF)) by encrypting it with a PRF.

The DUF and the PRF use two different keys, which can be understandable if:

you're just being precautious and not mixing keys
the PRF and the DUF might take keys of different sizes/format

Now, AES-GCM uses AES and GHASH which both take keys of size 128-bit. So why don't they use the same key?


texts: How to generate a list of unique random strings?

texts: How would you generate a list of distinct random strings, where all strings are alphanumeric and have a fixed length?


texts: Design flaws when designing a MAC-function

texts:
Suppose we want to build a very basic hash function like this:
$$c_i = h(c_{i-1},x_i) = c_{i-1}\oplus x_i \quad\quad mit \;\; i\geq1, c_0 = \operatorname{IV}$$
Now suppose we'd use this hash-function to construct a custom-MAC-function in this fashion:
$$\operatorname{MAC}_k(c) \equiv c_n +k_1 + k_2 + \cdots + k_{16} \bmod 256$$
The function uses two operations, namely $\left(\left[\oplus, 2^{8}\right] \text { and }\left[+, 2^{8}\right]\right)$ and we use a 128-bit key, where $k_1 , k_2 $ etc. represent the corresponding bytes of said key
Needless to say, this MAC-function has some horrible design flaws and I've spent some thoughts on what these are specifically
My question is which design flaws, apart from the following, could be pointed out. I am particularly interested in which design flaws this function has, which also apply to other cryptographic functions, such as block-ciphers and hash-functions In other words: Which properties do we generally aim for when designing cryptographic functions, and which of these does our custom MAC-function violate?
These are my points:

$+$ Addition does not actually increase the key, because of mod 256
very small modulo
low collision resistance, for example by flipping two bits in any $x_i$ we get the same MAC.

Question: Collision resistance is usually a property of hash-functions, would that also be a proper term to describe block-ciphers? E. g. Is this a proper statement: "AES was designed to have low collision resistance"

No diffusion effect: Making small changes in the plaintext or key result in roughly the same output

Have I missed something or misunderstand something?


texts: How to use "mod" related words in technical paper？

texts:
Modular reduction is a widely used arithmetic operation. I found many "mod" related words such as

modulo
modulus
modular

Can anyone explains the difference among these words?  Please give examples or idioms.


texts: Can a "pattern" in a series of passwords be detected from their hashes (and maybe a single raw password)?

texts:
Let's say I'm a lazy user of a system with annoyingly frequent password change policies. I may have a "good" password I used initially that is only used for this system but since I have to change it every week I'm just going to increment or decrement a number. E.g.

Week 1: 545h9yEQ8k37t!VW53d7g6263!&D4grz
Week 2: 645h9yEQ8k37t!VW53d7g6263!&D4grz
Week 3: 745h9yEQ8k37t!VW53d7g6263!&D4grz
Week 4: 845h9yEQ8k37t!VW53d7g6263!&D4grz
...

And so forth...

Suppose a hacker obtains the hashed password history (i.e. the hash of each password). Are there any statistical approaches they could use to detect the (very simple) pattern being used?

I would assume the hashing algorithm used will have a lot to do with it, as well as other factors like the use of a salt, possibly the length of the password and if maybe the attacker also has access to at least one cleartext password. So I guess another way to phrase the question would be: In what sort of circumstances would an attacker potentially be able to detect a pattern from a series of hashed passwords?


texts: Why doesn't WhatsApp encryption multiply file size

texts:
WhatsApp uses and end-to-end encryption, on both personal and group chats.
According to my understanding, that means every message I send to a group  is encrypted on my Device for every group member separately and is sent separately to everyone

If I understood properly, this is why WhatsApp group chats are limited to 256 members.

And here comes my question:

Why doesn't sending large files on WhatsApp groups require much data and takes much time?

If a group contains hundreds of people, sending a small movie has to cost hundreds of megabytes, but actually it doesn't!


texts: Entity authentication protocol by encryption

texts:
I'm not a cryptography expert, so excuse me if the question seems very trivial.

I need to know if this protocol is secure against a MiTM attacks and ensure a safe entity authentication method.

We have Alice and Bob that share the same key $K$.
Alice needs to be sure that Bob is really Bob.
In order to achive this Alice generates a random number $N$ and sends it to Bob.
Bob receives this message from Alice, computes $C=ENC_K(N,ID_{B})$ and then sends to Alice $C$.
Upon that Alice received $C$ performs $DEC_K(C)$ extracts the nonce, named $N'$ and checks if $N'$ = $N$.

Is it correct?

UPDATE:
I've found this paper:

  M. Bellare, R. Canetti, and H. Krawczyk, “A modular approach to the
  design and analysis of authentication and key exchange protocols”,
  Proceedings of the 30th Annual Symposium on the Theory of Computing,
  ACM, 1998.

Where in section 3.2 is described an authentication technique using encryption and MAC algorithms. Now, I need to know, since the paper is quite old, if this scheme could be considered secure yet. Furthermore, how can I make it secure against a Reset Attack (if it is possible) ?


texts: Is authenticated encryption basically a lockable box?

texts:
I recently used a custom construction as a commitment scheme, which was taken from the standard picture you give people while explaining commitment schemes.

Basically commitment schemes can be described in terms of physical objects, as "put the information to commit to in a lockable box, give the other person the box and keep the key. As soon as you want to prove that you had the information at the previous time, give him the key to verify".

Now Schneier (in Applied Cryptography 2nd edition p. 86) describes a block cipher based commitment following the exact same principle (with block ciphers). Choose some random value (B does) and let A encrypt it using the key to which A wants to commit, basically exchanging "key" and "content".

Now for the custom scheme:

Suppose you are using an authenticated encryption scheme (e.g. AES-GCM) and you want to commit to a value $R$.

Encrypt $R$ using a randomly chosen $k$ and choose a random IV and append the tag. ($=IV||C||tag$)
Send $k$ to the verifier at the point of verification.

So the question:
Is authenticated encryption the computer equivalent to a lockable box (in this context)? or equivalently: Can the above commitment scheme be broken (and if yes, how?)

For me it looks like the above question is equivalent to:
Given a ciphertext with tag, there's only one key that will produce the correct tag with the given ciphertext, meaning the corresponding plaintext can't be altered.


texts:
Building off of Relationship between AES GCM and AES CTR... if your GCM nonce is "aaaa aaaa aaaa" (no spaces) then the CTR IV is that with (0,0,0,2) appending to it.

My question is...  what happens when the counter gets to (255, 255, 255, 255)? Would the last five bytes be (98, 0, 0, 0, 0) (where 98 = b) or would they be (97, 0, 0, 0, 0) (where 97 = a)?

I'm guessing the latter but idk.

Thanks!


texts: Does a "commutative" asymmetric system exist?

texts:
Completely crypto noob here.

I'm looking for a cryptosystem made of a func f + key1 + key2 such that they satisfy:

g(f(msg, key1),key2)=msg
g(f(msg, key2),key1)=msg
key1 != key2

Does such a cryptosystem exist?

Ideally I'd like f and g, to be the same function, but I'm ok if they are different.

It is ok if it's not Fort Knox secure, I want it to play with my nephews but I don't mind going hardcore :)


texts: Perfect Secrecy with 1 Time Complex Secret Cypher

texts:
Is it possible to achieve perfect secrecy, unbreakable, unguessable, uncrackable by using a totally secret cypher?

The following conditions must apply:

Using the secret cypher only 1 time, so that no correlation between outputs can be achieved
The cypher itself has to be selected from a big pool of possibilities and having a high complexity so that an attacker would not have the option to just run through all combinations of cryptological operations (XOR, NOR, ShiftRows, Shiftcolumns, etc..)
So the attacker only knows the OUTPUT, and doesn't know the private key, doesn't know the cypher, and doesn't know the input. The attacker also doesn't know the size of the input in relation to the output, other than the input being < or = to the output, but not the precise size. Also the cypher would not be shared, so 1 time use by 1 person, and no other user.

Now using the cypher only 1 time is self explanatory. If you use it multiple times, and the cypher turns out to be weak, then probaly some kind of correlation attack between multiple outputs could be mounted to recover the input.
Now the complexity of the cypher should also be obvious. Like if you just pick a simple cypher like one of those old cyphers from the cold war, or one of a similar structure, then the adversary can just run through the possible combinations of all cryptological operations and then brute force each. It would slow him down, but not stop him.

Then some people might say that this would violate Kerckhoffs's principle, but I disagree.

Because if the cypher is secret, then obtaining the cypher is equivalent to obtaining the private key. If the attacker can obtain the cypher through some side channel attack, then with the same effort he can just obtain the key altogether and decrypt the message.

So a secret cypher that nobody knows, and it's complex enough, would be like Navajo code that was used during WW2.

Furthermore of the input itself is unknown, like the attacker doesn't even know what to look for, then even if he break N rounds of the cypher, he has absolutely no clue what to look for, and doesn't know how many rounds are there left. It doesn't even know if the algorithm he used is correct at all.

So it's not even like searching for a needle in a haystack. It's like having a haystack and no needle, the attacker doesn't even know what to look for.


texts: How much entropy is generated by 'random' human keystrokes?

texts:
I'm wondering about using human input as an entropy generator. We all know humans are terrible at making up random numbers or keys or passwords. But what if we let a user 'randomly' type in some garbage. Just smashing the keyboard, so to speak.

How much randomness does that give, or rather, how much bits of entropy would it generate?

Obviously, way less than 2log(number of keys on keyboard), but I'd say 'a few' bits per keystroke feels about right? After one keypress, the next will be either a key close by (with another finger of the same hand) or one on the opposite side of the keyboard (with the other hand). So I would roughly guesstimate that at somewhere between 2 and 3 bits per stroke.

Any insights?


texts:
Is it OK to use a secret IV as key when creating keyed MD5 checksum for fixed-size data?

Because data size is known, attacker cannot append anything. And I think it's hard to raise chosen-plaintext attack if the secret is well kept, but I’ld like to be sure.


texts: Using 32 hexadecimal digits vs ASCII equivalent 16-character password

texts:
Assume I'm using a cryptographic algorithm to pseudo-randomly generate a string that is specified to be 16 characters long.  The string will be used as a passphrase when encrypting a file.

So, for instance the string is:

Z±¨Û‹'bó£´µ¼

The hexadecimal equivalent of that string is:

0x5AB1A81CDB8B279D62F3A3B405B51DBC

Is either variant "stronger", cryptographically speaking?  In other words, if I use the string as the passphase, or if I convert the hexadecimal numbers into a string and use that as the passphrase, is either one better?


texts: Single-block hash construction based on a block cipher with two fixed keys

texts:
Let k1, k2 be two arbitrary fixed keys (nothing-up-my-sleeve values like "foo" and "bar") and E_k1 and E_k2 be the corresponding encryption functions of a block cipher. x is a single input value (same value is fed to both E_k1 and E_k2).
Define a hash as follows:
H(x) = E_k1(x) xor E_k2(x)
This hash is meant to be used exclusively for proof-of-work purposes. The input size is assumed to exactly match the block size. There is no significant issue with the risk non-trivial collisions. The construction was intentionally designed to include only encryption operations, not key-scheduling (for optimization reasons). This makes it different than common constructions like Davies–Meyer, Matyas–Meyer–Oseas or Miyaguchi–Preneel.
Wikipedia says:

Black, Cochran and Shrimpton have shown that it is impossible to construct a one-way compression function that makes only one call to a block cipher with a fixed key.

This one uses two fixed keys, so it leaves the option it is good enough.
The underlying cipher is intended to be AES-128 or AES-256.
The question is: do you know of papers that have tried to analyze this type of construction? Can you give some of your own insights?
Edit: The intention was to define a hash. I misunderstood the idea of "compression function". I have changed the title now.


texts: Relation between $N = P \times Q$, and $\Phi(N)$

texts:
When studying RSA, and proving simple concepts to myself, I went and understood groups and rings, but I failed to understand Lagrange's theorem.

I did understand how from invertible finite groups I could derive Euler's theorem and Fermat's little theorem, etc. But one point remained...

When extracting the invertibles from $N \rightarrow U(N)$, we get the elements which form a group. I also saw that the order of any element in that belongs to $U(N)$, which is the order of $U(N)$. For example, if the number $10$ is $N$, $1,3,7,9$, it forms a group under multiplication $\bmod 10$. Now any element $a$, let it be $7$, the order of $7$, is $4$, which is also the sum total of the co-primes or the order of $U(N)$. This proves Euler's theorem, and thus, Fermat's as well. But when doing RSA, we do the same thing; however,  during key generation, we choose a number that is a co-prime to the order of $U(N)$, which also does from an invertible group $1$ and $4$.

Therein lies the rub, which I don't understand at this moment. What does the order of $U(N)$ have to do with key generation?

I have been unable to find a direct visual link. Ultimately, we are not choosing an element $E$ that belongs to $U(N)$, but an element that forms a group under $U|U(N)|$. And again, when encrypting, we are doing $M^{ed} \bmod N$.

I am not getting the relation between $U(N)$ and the number of elements in $U(N)$ when we are not using the order as an exponent to any element within $U(N)$ to get $1$ or something like that. Why are we generating the key from the number of elements in $U(N)$, and why does it work? What's the relation?


texts: Vulnerability of low value generated key

texts:
I have read here that Elgamal is resistant to brute-force attack, because the group to where the key is selected is very large. But since the key generation is random, (i assume)there is a chance that the key generated is lower than the recommended.

example, the recommended keylength is 1024 bits, but the key generated ($x$) was really small, way under 512 bits. The adversary can see that the $g^x$
is indeed small (smaller than $g^{2^{1024}}$ and $g^{2^{512}}$), limiting his/her search.

My question is, would a public key encryption be vulnerable to brute-force attack the moment it generated a low value key ?
If it is, what are the countermeasures ?


texts:
I am interested in what conditions are necessary and sufficient to define a cryptographically secure pseudo-random number generator (CSPRNG).

Wikipedia lists two defining characteristics:

It satisfies the next-bit test.
It withstands 'state compromise extensions' - part of all of the state being compromised does not allow for reconstruction of the prior stream of random numbers.

I understand that condition 1 is equivalent to saying there does not exist a polynomial-time algorithm which can distinguish the output stream from random (with success probability 1/2 + $\epsilon$), due to Yao (1982). I cannot, however, find any formal justification for the second criteria, which Wikipedia surmises as 'they hold up well under serious attack, even when part of their initial or running state becomes available to an attacker.' Does anyone have a reliable source for this?

Moreover, is this condition even sensible? If you consider something like RC4 (okay, not the best example of a CSPRNG I know), if you know the whole state at any point then it is possible to step the PRGA forward or backwards completely deterministically and independent of knowledge of the key, right? So, this means that RC4 does not satisfy Wikipedia's second condition for being a CSPRNG?


texts: Is it safe to encrypt a public key alongside a message with AES?

texts:
If I have a message M and a public key P, and I encrypt them alongside one another:

CIPHER = AES(M + P, aes_key)

Is CIPHER now weakened if someone knows what P is? It seems like if I encrypted only P:

CIPHER = AES(P, aes_key)

that it should be possible to recover aes_key from CIPHER. I realize that this is different than encrypting M + P, but is a weakness introduced?

My goal is to be able to send a signed encrypted message without revealing the originator publicly.


texts: Why is there an enormous difference between SAT solvers?

texts:
SAT solvers are very important in algebraic attacks, for example walksat and minisat.

However, when solving the benchmark problems available here there is an enormous performance difference between the two - Walksat is much faster than minisat for these problems. Why is this?

This implementation of walksat appears to have some performance improvements - is there any reason it wasn't included in the international SAT Competitions?


texts:
Is it possible using RC4 that for e.g. a 17-bit long plaintext i can get a 17-bit long ciphertext?

From my understanding, for this example i need a 17-bit long key to do the XOR operation for encryption. However in the normal algorithm of the RC4 only keylengths of 1 to 256 bytes are permitted.

Can i use 3 bytes = 24 bits as keylength and discard 7 bits in the generation of the random bytes K which i use for encryption?

Or is there another workaround which i am missing?


texts: What are the correct order of operations for One Time Pad Cipher?

texts:
According to Wikipedia the One Time Pad Cipher is unbreakable.  On the Wikipedia page it explains how to perform this simple encryption process by hand.  For the encryption it adds (+) the message and the key and then modulo by 26.
For the decryption it subtracts (-) the key and the ciphertext and then modulo by 26 again.

In another source it explains that for the encryption process one should subtract (-) and for the decryption process one should add (+).

Which one of these sources are correct and what will the security difference be between the two order of operations?


texts:
Right now chacha20 and blake use constants in order to eliminate fixpoints. As far as I know however inserting a bitwise not every $n$ rounds should eliminate this issue without using constants (and as a bonus chacha20 would be a $\{0, 1\}^{512} \to \{0, 1\}^{512}$ function rather than a $\{0, 1\}^{384} \to \{0, 1\}^{512}$ as it currently is).

My questions are:

Why did Bernstein went with constants rather than bitwise not?
Would use bitwise not once every two rounds, for example, cause some kind of issue that I am not aware of?


texts:
If an encryption algorithm is meant to convert a string to another string which can then be decrypted back to the original, how could this process involve any randomness?

Surely it has to be deterministic, otherwise how could the decryption function know what factors were involved in creating the encrypted string?


texts: Are there any known collisions for the SHA (1 & 2) family of hash functions?

texts:
Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512?

By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?


texts: Should I PGP encrypt using a publickey intended only for Certify?

texts:
I'm working with a publickey that does not include EncryptStorage or EncryptCommunication flags (see RFC4880 for flag reference).

My question is, is it safe/appropriate to encrypt using this key?

$ curl https://members.exacttarget.com/Content/Subscribers/SubsLists/publickey.txt > salesforce_publickey.txt
$ pgpdump salesforce_publickey.txt | grep Flag
 # Notice: The encrypt message and encrypt storage flags are not set

GPG has no problem encrypting with this key, I'm forced to use PGPy a pure-python implementation that is apparently more circumspect and fails to encrypt using the root and any subkeys:

import pgpy
publickey = pgpy.PGPKey.from_blob(bytearray(open('salesforce_publickey.txt').read(), 'utf-8'))[0]

publickey.encrypt('secret message', user=publickey.userids[0].email)
>>> PGPError: Key 64C4D5362A88CF19 does not have the required usage flag EncryptStorage, EncryptCommunications

since the root is only able to Certify and no flags are set on the subkeys AFAICT.

The full pgpdump output is as follows:

$ pgpdump salesforce_publickey.txt
Old: Public Key Packet(tag 6)(418 bytes)
    Ver 4 - new
    Public key creation time - Tue Jul 22 08:08:31 MST 2003
    Pub alg - DSA Digital Signature Algorithm(pub 17)
    DSA p(1024 bits) - ...
    DSA q(160 bits) - ...
    DSA g(1022 bits) - ...
    DSA y(1023 bits) - ...
Old: User ID Packet(tag 13)(54 bytes)
    User ID - ExactTarget, LLC. (We mail it.) <info@exacttarget.com>
Old: Signature Packet(tag 2)(91 bytes)
    Ver 4 - new
    Sig type - Positive certification of a User ID and Public Key packet(0x13).
    Pub alg - DSA Digital Signature Algorithm(pub 17)
    Hash alg - SHA1(hash 2)
    Hashed Sub: signature creation time(sub 2)(4 bytes)
        Time - Tue Jul 22 08:08:31 MST 2003
    Hashed Sub: preferred symmetric algorithms(sub 11)(5 bytes)
        Sym alg - AES with 256-bit key(sym 9)
        Sym alg - AES with 192-bit key(sym 8)
        Sym alg - AES with 128-bit key(sym 7)
        Sym alg - CAST5(sym 3)
        Sym alg - Triple-DES(sym 2)
    Hashed Sub: preferred hash algorithms(sub 21)(2 bytes)
        Hash alg - SHA1(hash 2)
        Hash alg - RIPEMD160(hash 3)
    Hashed Sub: preferred compression algorithms(sub 22)(2 bytes)
        Comp alg - ZLIB <RFC1950>(comp 2)
        Comp alg - ZIP <RFC1951>(comp 1)
    Hashed Sub: features(sub 30)(1 bytes)
        Flag - Modification detection (packets 18 and 19)
    Hashed Sub: key server preferences(sub 23)(1 bytes)
        Flag - No-modify
    Sub: issuer key ID(sub 16)(8 bytes)
        Key ID - 0x64C4D5362A88CF19
    Hash left 2 bytes - c6 d4
    DSA r(159 bits) - ...
    DSA s(159 bits) - ...
        -> hash(DSA q bits)
Old: Public Subkey Packet(tag 14)(525 bytes)
    Ver 4 - new
    Public key creation time - Tue Jul 22 08:08:42 MST 2003
    Pub alg - ElGamal Encrypt-Only(pub 16)
    ElGamal p(2048 bits) - ...
    ElGamal g(3 bits) - ...
    ElGamal y(2047 bits) - ...
Old: Signature Packet(tag 2)(70 bytes)
    Ver 4 - new
    Sig type - Subkey Binding Signature(0x18).
    Pub alg - DSA Digital Signature Algorithm(pub 17)
    Hash alg - SHA1(hash 2)
    Hashed Sub: signature creation time(sub 2)(4 bytes)
        Time - Tue Jul 22 08:08:42 MST 2003
    Sub: issuer key ID(sub 16)(8 bytes)
        Key ID - 0x64C4D5362A88CF19
    Hash left 2 bytes - e4 a9
    DSA r(157 bits) - ...
    DSA s(159 bits) - ...
        -> hash(DSA q bits)


texts: Do 2DES and 3DES2 have the same effective key length?

texts:
I am following the notes "Introduction to Modern Cryptography" by Bellare and Rogaway, and on the chapter about blockciphers there is the following claim (page 11 of https://cseweb.ucsd.edu/~mihir/cse207/w-bc.pdf):

  2DES, although having the same effective key length as 3DES2 and offering what appears to be the same or at least adequate security, is not popular in practice.

However, from what I understood, the effective length of 2DES is 57 bits, since it can be attacked by the meet-in-the-middle attack (this is stated on the end of page 10). On the other hand, the text says that 3DES2 does not appear to be target of meet-in-the-middle attacks, so its (effective) key length is 112 bits.

So I was wondering if I am missing something about these statements or if there might have been a mistake in the text (I did not find any errata).


texts: Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?

texts:
I am trying to solve the question whether
"IPsec is IND-CCA secure provided the used block cipher is a pseudorandom function" (with IPsec using a variant of Encrypt-then-MAC)

As a resource I am given the paper
Mihir Bellare & Chanathip Namprempre (2000). Authenticate
andd Encryption: Relations among notions and analysis of the generic composition paradigm

where I should focus on Theorem 3.2, which is the following implication:
INT-CTXT $\wedge$ IND-CPA $\rightarrow$ IND-CCA

Accordingly, I am trying to verify that the antecedent of the implication holds when using a pseudorandom function as a block cipher. I am currently stuck with the part whether the property of IND-CPA security holds. If I understood it correctly, the IND-CPA security depends on the mode of operation in which the pseudorandom function is used.
In our lecture it was mentioned that an encryption scheme using a pseudorandom function as block cipher is indeed CPA-secure if the CTR mode (with a randomly chosen initial ctr) or the CBC mode is used. However, as far as I know it does not hold for other modes.

Therefore, I would like to know which mode of operation is used by IPsec and whether my approach makes sense.


texts:
Let
$$d_p = d~\mathrm{mod}~(p−1)$$
and
$$d_q = d~\mathrm{mod}~(q−1).$$

Given $d_p$, $d_q$, $p$ and $q$, how can I reconstruct $d$?


texts: Is this SHA256 hash implementation secure from rainbow table, brute forcing attacks?

texts:
So I have an implementation where by we have an $8$-byte random input (entirely random, not user defined) which we hash with $\text{SHA256}$. The hash is shared with many parties to the point that we consider it is effectively public, so we are concerned with potential attacks to reverse the hash.

With this input, there are $1.8 \times 10^{19}$ hashes.

So my calculations for brute-force feasibility are done taking into account reported hash rates of bitcoin mining rigs and ASICs from:

https://en.bitcoin.it/wiki/Mining_hardware_comparison
Current best $7,722,000$ MHash/s would take 27 days ($\frac{1.8 \times 10^{19}}{7722000000000  \times 60 \times 60 \times 24}$).

https://en.bitcoin.it/wiki/Non-specialized_hardware_comparison
Current best $2,568$ MHash/s would take 227 years ($\frac{1.8 \times 10^{19}}{2568000000 \times 60 \times 60 \times 24 \times 365}$).

Also, I'm assuming that since bitcoin mining is $\text{SHA256}(\text{SHA256}(x))$, that either the times above could be roughly halved, or in the case of an ASIC which may not be flexible enough to do single hashing, a brute force attempt would simply target $\text{SHA256}(target_{hash})$ instead?

As for calculating the rainbow tables, I'm guessing at the basic level, each record would be $40$ bytes ($8$ byte input + $32$ byte hash), leading to $1.8 \times 10^{19} \times (8 + 32) = 7.2 \times 10^{20}$ bytes $= 720,000,000$ terabytes

I've made a number of brain farts in getting to these numbers, so I'm not entirely confident in their accuracy, and whilst I've read many articles on the related topics, my concern is that they all seem to target password cracking, and therefore don't assume that $8$ bytes input is actually $8$ bytes of entropy, especially since they often promote dictionary attacks.

Please can anybody confirm the accuracy of the above numbers and whether my methods are sound?


texts: When making public key fingerprints - is a sha1 hash still a good idea?

texts:
I'm thinking about trying to save some space (and readability) when referencing 2k and 4k public keys (millions of them) by storing the fingerprint in some places instead of the full public key.

  The primary threat to the security of a fingerprint is a preimage attack, where an attacker constructs a key pair whose public key hashes to a fingerprint which matches the victim's fingerprint. The attacker could then present his public key in place of the victim's public key to masquerade as the victim.

  A secondary threat to some systems is a collision attack, where an attacker constructs multiple key pairs which hash to his own fingerprint. This may allow an attacker to repudiate signatures he has created, or cause other confusion.
  - Wikipedia

With this in mind, I was wondering about using a larger hashing algorithm like SHA-256 to help prevent collisions or collision attacks.

SHA1 seems to be the existing standard, but is it still the way to go?


texts: What does (06) in "CRL Signing (06)" mean?

texts: In "Certificate details -> key usage -> CRL Signing (06)", what does "(06)" in "CRL Signing (06)" mean?


texts: How to break CBC cipher with partly known plaintext?

texts:
I'm learning some IT security and during practice I found an exercise I couldn't solve.

I have an encrypted message with block cipher in CBC mode.
The blocks are one byte long and the first block is an IV. I know 80% of the plaintext which is a form but there are missing parts. I don't know anything about the encryption function.

Which attack method should I use, and where to start?
I know, that $C_1=Enc_k (M_1\oplus C_0)$. I know $C_1$, $M_1$ and $C_0$, the IV.


texts: Reveal all information up to n-th message

texts:
Is there a way to generate a sequence of keys that have the property that exposing any of those keys will reveal all previous keys, but no future key?

I'm thinking about an application that sends an encrypted message every day, and sometimes I want to disclose to some other party the content of all past messages at any point in time, but without revealing any future message.

A possible way would be to hash some data x times, and than use the final hash for the first message, the x-1th hash as key for the second message, x-2th hash as key for the second message and so on. Revealing to any party the x-n key allows them to just hash it many times to obtain all the keys between x and x-n with no access to any later keys. But that limits the application in the total number of messages and requires a lot of work to be done beforehand. Maybe there is a much better way?


texts: How does the DH algorithm deal with enormous powers?


texts: Using error-correcting codes for the bootstrapping procedure of Fully Homomorphic Schemes

texts:
In the context of Fully Homomorphic Schemes, we use a technique called "bootstrapping" to refresh the ciphertext, by evaluating homomorphically the decryption circuit with an encrypted version of the private key.

I was wondering if it was possible to consider this approach, of reducing the error size, by using an error-control code instead (eventually designed for our FHE scheme).

I am not concerned about the efficiency of such a scheme right now, but would it be feasible to design a scheme such that we can apply an "error-reducing code" reducing errors instead of correcting all of them. I don't think there have been researches to this idea so far so it is maybe completely unthinkable but I wanted to discuss it with other people..


texts: How is the second digram a legal mapping? (Playfair Cipher)

texts:
So this is a partly completed key I have:
_ R _ _ _
_ T _ _ _
_ _ H _ _
_ _ L _ _
_ P _ _ W

And this is my plaintext/ciphertext:
Plain: INALLCIPHERSYSTEMS
Cipher: HORMKRDXIGCTCBELKU

The resultant digraphs:
IN AL LC IP HE RS YS TE MS
HO RM KR DX IG CT CB EL KU

I'm tasked with completing the key, but I'm stumped on the second digraph pairing of AL and RM. Given that L and R are in different rows/cols, isn't it impossible to fill in the key s.t. A maps to R? We can't map it to R via shifting to the next row/col entry, and we can't use the rectangle method thing either because if we draw a rectangle from L to R, the opposite adjacent corner that would map to R is directly above L...
Am I missing something? Do you know a possible way of mapping A to R from those two digraphs?


texts: How to use HMAC-SHA1, HMAC-SHA2 in conjunction with AES

texts:
I understand how to compute HMAC-SHA1, HMAC-SHA2 etcetera.

Please explain why/how is the resulting HMAC value is used in conjunction with AES for encryption/decryption and signing/verifying.

In particular:

How does HMAC interact with AES for key sizes (AES-128, AES-196 and AES-256)?
Is the calculated MAC encrypted using AES? And if so, why?
How about signing and verifying? How does the AES cipher play a role here?
Is it correct that the AES ciphertext is HMAC-ed for signing and the HMAC is verified?


texts: Are there maximal rsa modulus keysize above which security start decreasing?

texts: Is there a rsa modulus size where security starts to decrease or is a larger rsa keysize always better? (of course I’m considering things like performance penalty)


texts: Is Joux's multicollision attack applicable for truncated SHA256?

texts:
Joux presents an elegant way to generate k-way multi-collisions with about as much effort as generating a single collision: https://www.iacr.org/archive/crypto2004/31520306/multicollisions.pdf

However, so far I have only found applications of this attack on full-length hash functions like SHA-256 or MD-5. Therefore, consider this following scenario:

An attacker wants to find a 2^70-way multicollision of the first 70 bits of a SHA-256 output. In essence, the output of SHA-256 is truncated to 70 bits (let's call this function SHA-70). Can Joux's multicollision attack be applicable in this scenario? If so, how much effort would be required?


texts: Security of a cryptosystem where the encryption is swapped with decryption

texts:
For any given one-key cipher $(M,C,K,E_k,D_k)$, we may modify it into $(M,C,K,D_k,E_k)$. In other words, we swap the encryption function with the decryption in the modified cipher.

Are the two ciphers have the same level of security with respect to known- plaintext attacks?


texts: What is the impact of the Goppa code distinguisher on the CFS and McEliece?

texts:
What is the impact of the distinguisher for the high-rate Goppa codes (as published in "A Distinguisher for High Rate McEliece Cryptosystems") on the CFS signature scheme and the McEliece/Niederreiter cryptosystems?

It seems that the distinguisher strongly affects the CFS scheme, forcing its parameters to increase (if one hopes for a provably secure signature) to such an extent that the CFS scheme becomes totally impractical.

On the other hand, the distinguisher does not seem to affect the security of the McEliece cryptosystem at all. Why is that?


texts: Cryptanalysis of XOR cipher with repeated key phrase

texts: My assignment is to cryptanalyze cipher text that we know was encrypted with a stream cipher (bitwise XOR of plain text and key stream), and decrypt to plain text. We know the key stream is a repeated English phrase. I have tried a variety of methods without success. They include applying the Kasiski examination to determine the length of the key stream, and analyzing where in the cipher text 0's appear, because x ^ x = 0, and so it might be possible to perform frequency analysis and determine what x is in this case. However, I have not had much success with these methods. Any help or hints would be greatly appreciated.


texts:
The main problem is to use a block cipher to generate a random key.

I would like to generate 256-bits key which can be as random as possible. I generate it in the following way:

Pick a plaintext $p_0$ of 64 bits and a 256-bit key $k_0$. ( can be given from keyboard as seed)
Implement a cipher which goes from 64-bits to 64-bits.
Encrypt $p_0$ with this cipher using $k_0$ to get $c_0$. (Assuming that the cipher is a pseudo-random permutation then $c_0$ is pretty random)
Set $p_0 = c_0$ and repeat the process say for 1000 times.
At the end use the last 4 encrypted messages of the loop to fill the key $k_0$ and take this as the new key.

Is this method random enough? Maybe there is a problem as I'm using all time to encrypt $k_0$? Which is the best implementation to get a really random key?


texts: Why is a-symmetric so much harder to compute and why does it need such big keys?

texts: I read that a symmetric encryption requires a way bigger key size to have the same security as symmetric encryption with smaller keys. But why is this, and why is it so much harder to compute?


texts: It seems that this is pretty difficult to find large (above 1024 bits) strong primes, or at least such primes $p$ where $(p-1)$ has a very large prime factor. Is there any information regarding the distribution of strong primes vs. other primes? The GNU library generates strong primes for RSA?


texts: Signing a message using SPHINCS Hash-based Signature scheme

texts:
I have questions on “SPHINCS: practical stateless has-based signature” by Bernstein et al. And I really hope that someone can help me with it.
To help me understand it, I read the https://cryptoservices.github.io/quantum/2015/12/08/XMSS-and-SPHINCS.html blog.

SPHINCS is really composed of WOTS+, XMSS, and HORST building blocks. I understand each one of these alone, but I am still having a problem figuring out how to sign a message in SPHNICS. I understand the hyper-tree structure of layers of L-Trees (WOTS+ trees) where the final layer is the HORST tree. Here are my questions:

Q1. If I have to sign a message, M, do I randomly pick any of the HORST trees and sign my message? The signature is going to be pretty huge to reach all the way up to the PK. i.e. the signature must contain the authentication path of all roots to reach the PK. Is this correct?

Q2. According to the example parameters mentioned in https://cryptoservices.github.io/quantum/2015/12/08/XMSS-and-SPHINCS.html of h=3 and d=3 which yields three layers of height 1 each. In layer 2, each node in the two WOTS+ trees can sign k roots of layer 1 WOTS+ trees? So when I reach layer 0, the total number of messages I can sign is (2*k)^3. Is this correct?

Thank you very much for your help


texts: One Time Pads and reuse of the decrypted message?

texts:
How is it insecure when Alice encrypts a message with a One-Time-Pad to Bob, and Bob then uses the decrypted message from Alice as the next One-Time-Pad?

For example: Alice sends Bob a message Hello World with the Key of Orange Fish which they both shared earlier. Vvlyu Atzdk (Hello World). Then Bob uses Hello Word (which he decrypted with Orange Fish) as the key for the next message.

If Bob’s message back to Alice Hello Alice encrypted with Hello World to Oiwwc Wzznh (Hello Alice). I’m sure this is detectable, but I’m curious how it could be broken.


texts: Why don't I see the IV in the FINISHED fragment in TLS_RSA_WITH_AES_256_CBC_SHA communication with OpenSSL?

texts:
I'm implementing a TLS 1.2 server, comparing against OpenSSL to ensure I'm getting things right, and I've noticed that when the cipher is TLS_RSA_WITH_AES_256_CBC_SHA the IV isn't in the FINISH message.  OpenSSL is taking it from the keyblock data, derived via PRF from the master secret.

My understanding of the RFC (https://tools.ietf.org/html/rfc5246#appendix-A.1) is that GenericBlockCipher types have the IV as part of the fragment data.  So, AES_256_CBC is apparently a GenericStreamCipher, not a GenericBlockCipher.  But that's not what appendix C says.  Can anyone explain why OpenSSL isn't putting the IV in a FINISHED, v 1.2 message?

=====
(To confirm that I'm doing things right)

My SERVER_HELLO looks like this:

00000000: 16 03 03 00 31 02 00 00  2D 03 03 6E 97 FF 27 00  ....1...-..n..'.
00000010: 01 02 03 04 05 06 07 08  09 0A 0B 0C 0D 0E 0F 10  ................
00000020: 11 12 13 14 15 16 17 18  19 1A 1B 00 00 35 00 00  .............5..
00000030: 05 FF 01 00 01 00

type = 'HANDSHAKE'
tls_plaintext_maj = 3
tls_plaintext_min = 3
fragment =
    msg_type = 'SERVER_HELLO'
    body =
        server_version_major = 3
        server_version_minor = 3
        gmt_unix_time = 1855455015
        random_bytes = b'\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b'
        session_id = b''
        cipher_suite = 'TLS_RSA_WITH_AES_256_CBC_SHA'
        compression_method = 0
        extensions = [Container({'extention_type': 'RENEGOTIATION_INFO', 'extension_data': b'\x00'})]

And OpenSSL seems fine with it, sending me CLIENT_KEY_EXCHANGE, CHANGE_CIPHER_SPEC and then this HANDSHAKE:

type = 'HANDSHAKE'
tls_ciphertext_maj = 3
tls_ciphertext_min = 3
fragment = b"\x87E\x08\xf4\xc9A\xadw\xe8i\xdb\xd6\xcb\x9d\x82\xa9\xdd\xa9\xee\x8d\xaa\x94\xfd\xc3\xc9\xf5\x94\xb4\x1d\xb4@\xd6\xc1\x8d\x16\xf0\x05\xbb!\xeb\x14HY\xe0\xb9\xa9i0+\xda\n\xe1\x87'V\x16\x1b\xce\xc41\xe6\x81\xe5\xb3"

That fragment can be decrypted with AES256, using:

client_iv = faaa0de35870f9041e40471b02d5dfd5
client_write_key = 702ca8bd8cc39a707b297f3ef164cb5c7a0f90f39a20fd86e3dfcdd2e01eeb62

Those keys are generated on my side via PRF and the shared master secret, and after decrypting it looks valid (there are 11 \0x0b bytes at the end, which is the expected padding).

In [8]: AES.new(bytes.fromhex('702ca8bd8cc39a707b297f3ef164cb5c7a0f90f39a20f
   ...: d86e3dfcdd2e01eeb62'), AES.MODE_CBC, bytes.fromhex('faaa0de35870f904
   ...: 1e40471b02d5dfd5')
   ...: )
Out[8]: <Crypto.Cipher.AES.AESCipher at 0x99fada7208>

In [9]: _.decrypt(b"\x87E\x08\xf4\xc9A\xadw\xe8i\xdb\xd6\xcb\x9d\x82\xa9\xdd
   ...: \xa9\xee\x8d\xaa\x94\xfd\xc3\xc9\xf5\x94\xb4\x1d\xb4@\xd6\xc1\x8d\x1
   ...: 6\xf0\x05\xbb!\xeb\x14HY\xe0\xb9\xa9i0+\xda\n\xe1\x87'V\x16\x1b\xce\
   ...: xc41\xe6\x81\xe5\xb3")
Out[9]: b'\x1c\xe3<\x88\xf4\xc0\x98\xe3\x8f\xbf\xc9\xa9"\'\x1bq\x14\x00\x00\x0c]\x95\xb8+l\x10 \xad\x99\xd8\xe2\x16=\xbf\x9e{\xc7\xd5\xbdLm\x04n\xa6/\xfb
\xfd\x8f\x96\x92\xe5\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b'

So, I'm pretty sure I'm doing it right.

Thanks...


texts: Discrete logarithms: large prime modulus vs. large semi prime modulus

texts:
I have a cryptography homework question, in the question it says a cryptographic hash function in the form of $f(x) = g^x \bmod n$ ,  where $n$ is a very large prime (1024bits and more), $g$ is a generator for $\{1, 2, . . . , n − 1\}$, and $x$ is
possibly much more than 1024 bits in length. Comment on how well the function satisfies pre-image resistance and second pre-image resistance properties.

The second part of the question asks what would happen to the properties if $n$ is changed to $n = pq$ where $p$ and $q$ are very large primes (512 bits and more).

I know that the discrete log problem is very hard to solve for when $n$ is a very large prime, but what if $n$ is a large semi-prime number? Would the hash function still be pre-image and second-pre-image resistant?


texts: Is there a definition of the pseudo-random sequences like PRG or PRF in cryptography?

texts:
I have learned the definition of PRGs and PRFs. As I know the meaning of pseudoreandomness. I think that the pseudo-random sequence and the truly random sequence are indistinguishable.

I did not find a definition of the pseudo-random sequences. And I think the definition should describe some possible collections of "pseudo-random sequences" (e.g. M-sequence).
Follows are my approaches which may be helpful.

Let a sequence $\alpha = (a_{1}, a_{2}, \ldots, a_{n}, \ldots)$ is a sequence over a finite set $\Sigma$ ($|\Sigma| > 1$), where $a_{i} \in \Sigma$. It is truly random if $a_{i}$ is chosen uniformly in $\Sigma$.

Let $\beta= (b_{1}, b_{2}, \ldots, b_{n}, \ldots)$ be a sequence over $\Sigma$. It is pseudo-random sequence if for every PPT algorithm $A$, there is a negligible function $\varepsilon$ such that

$$\left\vert \Pr \left[ A(b_{1} \Vert b_{2} \Vert \cdots \Vert b_{n}) = 1 \right] - \Pr\left[ A(a_{1} \Vert a_{2} \Vert \cdots \Vert a_{n}) = 1 \right] \right\vert \leq \varepsilon(n)$$

Or can we consider that it is unpredictable? Let $\beta= (b_{1}, b_{2}, \ldots, b_{n}, \ldots)$ be a sequence over $\Sigma$. It is pseudo-random sequence if for every PPT algorithm $A$, there is a negligible function $\varepsilon$ such that

$$\left\vert \Pr \left[ A(b_{1} \Vert b_{2} \Vert \cdots \Vert b_{n}) = b_{n+1} \right] - \frac{1}{|\Sigma|} \right\vert \leq \varepsilon(n)$$


texts: How to deterministically generate a 256 bit ECC key from 128 bits of entropy without a CSPRNG

texts:
A safe way to generate a 256 bit ECC key from 128 bits of entropy is to use a CSPRNG, according to this answer: https://crypto.stackexchange.com/a/56551/43864

However, it's difficult to find a cross language, cross platform CSPRNG that guarantees to produce the same result across all implementations.

What would be a safe alternative to using a CSPRNG? Ideally the answer would involve just the use of SHA3-256, for which implementations are widely available.


texts: Transforming simplest protocol into a Sigma-protocol

texts:
I have some questions from previous years exams, I hope you could help me with them. :)

  Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) honest-verifier zero-knowledge. Show how to transform this protocol into a $\Sigma$-protocol for the same relation by assuming that the verifier generates $c \in C$ at random (with uniform distribution), where $(C,+)$ is an additive finite group.


texts: What is the role of steganography in network security?

texts:
Quick definition:

  Hiding secret messages inside what seem to be harmless messages is nothing new. The word steganography itself originated in Greece and means “covered writing”. During important historic events of our past, steganography was often used to trade personal secrets, plan covert operations and send political espionage information.

source: steganography

What is role of steganography in network security?


texts: Is timing analysis attack the same as cache timing attack?

texts: I am working on an essay on timing attacks on DES but then i have seen resources mostly about cache timing attacks. so is timing analysis attack the same as cache timing?


texts: Elliptic curve point addition clarification

texts:
In a book I am reading currently, it asks to perform the addition of $(2,7)$ and $(5,2)$ in the elliptic curve defined as $y^2=x^3+2x+2 \mod 17$.

Now, I believe this is impossible, as these points are not part of the group, hence it is not possible to compute the third point. Is that correct?

Pretty sure I am correct, but just would like clarification that i'm not making a huge mistake, as this book has not had any errors so far so I'm suprised to see one.


texts: How to break AES/CBC/PKCS5 when key and IV are reused?

texts:
I'm doing a code review for a crypto solution that reuses the same key with a constant IV.  I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all of their test data.

I have access to lots of ciphertext.
I know the same key is used.
I know the same IV is used.
Cipher is AES/CBC/PKCS5
Plaintext is 16 bytes.
Ciphertext is 32 bytes (PKCS5 padding?)
I can put whatever plaintext I want through the system and then get that ciphertext.

What's the high-level pseudo code or process to break this system?


texts: How can I decrypt this kind of variation of block cipher?

texts:
I have a block cipher $E$ that is a permutation of $\{0,1\}^\ell$ for key $K\in\{0,1\}^\ell$.

$c = E_{K_1}(m \oplus K_1 \oplus K_2)$ for unknown keys $K_1, K_2$ is given. I need to figure out the strategy to find the message $m$ and its complexity.

However, before choosing which attack to find the message, I have no idea how to break this block cipher. I'm new to block cipher and it's hard to break a new kind of cipher I haven't seen. I need some help.

If we have some (m, c), and permutation is usually known, then I guess we can figure out $K_1 \oplus K_2$. Is this right? And then, how can we find $K_1$ and $K_2$ respectively? Or $K_1 \oplus K_2$ is sufficient to find the original message?


texts: Identifying the type of algorithm for a PRNG that uses modular multiplication and addition

texts:
GNU libc uses the following pseudo-random number generator: $$(\mathit{state} \times 1,103,515,245) + 12,345 \pmod {2^{31}}$$ where state is the result of the previous call to the generator.

My questions are:

What are PRNGs using this algorithm - possibly using different numerical
constants - called?
Assume that this generator has the maximum possible period. What is its
period?
Given the result of a call to this PRNG, show how to obtain the result of
the previous call symbolically?

For the last question it is not required to perform any numerical
calculation.

This question was in my cryptology final-exam and I could not solve it and could not find the answer in internet, slides or books. I am really curious about the answers. I would appreciate if someone explain it to me.


texts: Looking for cipher that uses one ciphertext

texts:
I'm new to Cryptography so please free to edit my question for clarity and add the appropriate tag.

I'm trying to research if the following is possible. Suppose

John has a message that he encrypts to share with more than one
recipients.
The message is different, i.e. it's unique to the recipients
(though the recipients don't know that).
The recipients must each be given a unique password so as not be
able to decrypt each others message.

Questions (sorry for more than one question, but they're related):

What approach should I take? Links to references or further reading
will be appreciated
Is the one encryption with different decryption the wrong approach to
achieve goal 3? What approaches would you suggest?

The objective are two fold:

allow a teacher to easily (hence 1 ciphertext) encrypt "answers to exam questions" (text and
binary data e.g. images) to distribute to selected students. Reason
for not allowing anyone outside of the selected students is to
prevent students who haven't taken the exam to know the answer thus
allowing reuse of the exam questions.
allow students to see teacher's comments and feedback specific to that students' attempted answers. Since students answered differently, the students need not share the same password and are discouraged from using the same password. This also helps teacher track which students leaked answers to future students.

Thanks

Update: I've bought Bruce Schneier's book to learn up on terminology and concepts so I won't be at a loss with terms like ciphertext.


texts:
What I want to know is how to perform symbolic finite field computations in SAGE math? Such computations are required in building algebraic models for cryptanalysis. To explain this mathematically consider the finite field GF($2^n$). If I am given the irreducible polynomial of degree $n$ and $a$ its root which generates the extension field, then any indeterminate $x$ in this field is represented in polynomial basis
$x=x_0+x_1a+x_2a^2+...+x_{(n-1)}a^{(n-1)}$
where $x_i$ are indeterminate co-ordinates. How do I declare such an indeterminates $x, y$ and find the co-ordinates in the basis of functions such as $x^2$,$xy$ etc. in terms of their symbolic co-ordinates in SAGE?


texts: How well is it understood mathematically why encryption schemes are hard to crack?

texts:
I have read some intro material into cryptography. It mainly goes into the current encryption schemes like AES, but not very deeply into the mathematics of why they are secure.

I know that encryption is all based on two principles of "confusion" and "diffusion", but these are very general, handwavey principles. I have not read anything like a formal definition of these two principles, and some kind of proof that if an algorithm satisfies them, it is secure by some formally defined metric.

Moreover, I know that it is currently an open problem whether one-way functions exist or not.

I therefore get the impression that there is not really a very formal mathematical underpinning for our trust in the security of encryption schemes, but that may be taking it too far.

So that's why I'm wondering: what is our current formal mathematical understanding of what makes encryption schemes secure?

Is there a mathematical theory of "hardness of cracking encryption", with something like a formal definition of hardness and proofs that xertain encryption schemes are hard to crack?

Are ther partial theories, that formally capture aspects of encryption security but not others?


texts:
I know that IKEv1 Aggressive mode is not secure as ID payload is sent out in plain text. Even though it is insecure, it still exists! Can someone tell why exactly do we need Aggressive mode? What is it that Main mode cannot do and Aggressive mode can (other than speed)
From what I know Aggressive mode is to be used for Remote Access VPNs but I am not able to understand the requirement behind this.


texts: Block size of BKZ algorithm and related security of CRYSTALS-Kyber

texts:
Security of lattice-based schemes in the NIST Posto-Quantum Project often relies on the complexity of dual attack. Complexity of this attack depends on the running time of lattice basis reduction algorithm like BKZ$-\beta$, where $\beta$ is block dimension of BKZ-like algorithm.

I am looking at candidate CRYSTALS-Kyber. The dual attack works in lattice of dimension 795 and the best corresponding $\beta$ was chosen 870. I thought that $\beta$ must be smaller than the lattice dimension. That is not right?


texts: AES-128 + HMAC-SHA-256 but HMAC truncated

texts:
I implemented AES-128 in CBC mode + HMAC-SHA-256 but it seems to me that 256 bit HMAC is more than necessary.
Can I truncate the output of HMAC-SHA-256 to a desired bit length?
And what is the minimum required length of it to match the security level of AES-128?


texts: On the hardness of addition when the elements of a field is represented by the powers of generator and possible any existant scheme

texts:
We can represent elements of a finite field $F$ in various ways polynomial basis and normal basis. There is one other; generator-based representation and this is based on the fact that the multiplicative group of a finite field ($F^*$) is cyclic so there is a generator of this cyclic group, call $g$ and we write $\langle g \rangle = F^*$. Now every element of $F^*$ can be written as powers of the generator as $x = g^i \in F$ for some positive integer $i$. The identity is $g^0$. In this way, the multiplication is easy
$$\text{let } a,b\in F, \text{ and } a = g^x, b = g^y \text{ then } a\cdot b = g^{x+y}.$$ The bonus is the fact that the discrete log is easy since we tack the elements by the generator's power but the addition seems hard. $$a +b = g^x + g^y = g^z, \quad z =?$$ Questions;

How hard the addition?
Are there any cryptographic scheme that uses this hardness?


texts:
I am a bit of a newbie to RSA encryption, so please be patient.

I understand that for a 4096 bit RSA, the numbers p and q should be prime. And to have the best security, the p and q should both be about 2048 bits long.

However, we don't have a way of generating and verifying a 2048 bit prime number with 100% accuracy. The implementation for prime generation that gpg uses goes through 64 rounds of miller-rabin which is enough to give a prime probability of $1 - 2^{-128}$.

Given that these primes are only probabalistically prime, what happens if we selected composite values for p or q?

Does the RSA algo run into any sort of problem?

My guess is that there will be no problem and RSA continues to function normally (encryption and decryption both) because, if there was a problem, we could use that problem as a way to detect that the numbers are not prime. This would give us a really fast way to verify extremely large prime numbers. I am guessing this is not the case.

So, my conclusion is that RSA works with prime or composite p, q... but using composite p, q makes it easy to break the encryption (because its easier to derive p, q from n).

Is this conclusion correct?


texts:
I am designing a user registration protocol for a system where I control both clients and servers.  The aim is to establish a symmetric key for subsequent authentication, while minimizing the work load on the server side.  The security concerns are less about privacy than about integrity of the system and resistance to DoS attacks.  I thought about doing something like this:

Client generates an RSA public-private key pair
Client sends public key to server
Server returns randomly generated key, encrypted in the public key

Is there any risk that malicious clients may choose public keys that cause undue work load on the server?  Or, other problems?  Is there a better way to minimize load on the server in the face of malicious clients, while still insuring the security of the key exchange for cooperative clients?


texts: State level "Weak Diffie-Hellman" working for SRP too?

texts:
I've read about the "Weak Diffie-Hellman" attack (paper, website), where a resourceful entity like a state can pre-compute values for known primes to aid solving the discrete logarithm problem for that particular prime.

I've also read that SRP is very similar to Diffie-Hellman, and has common groups (see RFC 5054). Can the attack be mounted on SRP as well?


texts: Create a MD5 collision on two given files with an identical prefix

texts:
I'm stuck on an assignment of mine and maybe someone has some advice for me. I have the following task: I have to modify two files, which differ in exactly one byte, so that they have the same MD5 hash. The files are structured as follows, it starts with a X byte long prefix, which I can vary in length, but must be constructed according to a certain structure. Then follows the byte in which both files differ. For example file 1 should have 0x01 and file 2 0x05. After that two fixed bytes follow. Another specification is that the calculation time of the tool/alogrithm should be in the range of minutes.
I have already looked at the repo of Korkami about MD5 collisions and in this context I have already experimented with Hashclash. With the chosen prefix collision from Hashclash I manage to solve the task, but this takes several hours. I have also tried the identical prefix attack with my prefix, which is much faster and in the range of minutes. But there I don't know how to keep the last two bytes fixed and still set the differing byte in the collision. Maybe someone could give me a hint how to solve this.
Thanks in advance for your advices


texts: Help me understand how to do a crypto assignment about AES/CBC

texts:
I'm doing the Coursera cryptography I course from Dan Boneh. I am attempting to do week 2's programming assignment, but I think I am having some sort of misunderstanding of either the theory, the actual implementation, or both. I am neither a crypto or python expert so I'm sure I'm messing up both.
Essentially, I am trying to decrypt some ciphertext given the key. Sounds simple. We are given:
In this project you will implement two encryption/decryption systems, one using AES in CBC mode and another using AES in counter mode (CTR).  In both cases the 16-byte encryption IV is chosen at random and is prepended to the ciphertext. (I'm just doing CBC first)
CBC key: 140b41b22a29beb4061bda66b6747e14
CBC Ciphertext: 4ca00ff4c898d61e1edbf1800618fb2828a226d160dad07883d04e008a7897ee2e4b7465d5290d0c0e6c6822236e1daafb94ffe0c5da05d9476be028ad7c1d81
We're also told: the 16-byte encryption IV is chosen at random and is prepended to the ciphertext.
So I'll go through an example of what I did for the first two blocks. The IV is 16 bit and pre-pended, so it's the first 16 characters of the ciphertext:
IV  = 4ca00ff4c898d61e
Next, I tried to decrypt the next block, which is positions 16-31 (0 indexed) of the cipher text:
c[0] = 1edbf1800618fb28
I believe how this should work is the plaintext for m[0] should be:
$$ m[0] = (c[0] \oplus k) \oplus IV $$
Actually, what my lecture slide says is:
$$ m[0] = D(k, c[0]) \oplus IV $$
And then for the following blocks, just increment the indices by 1: $$ m[i] = D(k, c[i]) \oplus c[i-1] $$
But I'm not 100% sure what "D" actually is (yes, decrypt... but is it xoring? Something else?). When I calculated each one in turns, I just got gibberish. If my understanding is correct (the decryption of the current layer being just xoring c[i] with the key), then it could be an implementation problem?
I'm also a bit unsure about xoring the key with the blocks. I know that IV is supposed to be the same length as the blocks (16) but the key is 32 bits. Do I pad or repeat the blocks so they are 32 bits? Do I use the first 16 bits of the key? etc. I have been using this function given by the prof in a previous assignment:
def strxor(a, b):     # xor two strings of different lengths
    if len(a) > len(b):
       return "".join([chr(ord(x) ^ ord(y)) for (x, y) in zip(a[:len(b)], b)])
    else:
       return "".join([chr(ord(x) ^ ord(y)) for (x, y) in zip(a, b[:len(a)])])

But I don't know if that's still the right way to do it. I know I need to string.decode('hex') before I feed things into the above function and then string.encode('hex') them back into hex afterwards.


texts: Are there actual consequences of padding oracle attacks?

texts:
I am writing a program that encrypts data in Python and heard about padding oracle attacks, but I think they are overrated (I mean, what are the real-world uses?) even for the old implementations that are vulnerable (the ones that tell if padding is right or wrong like SSLv3).
Because:

If all I need are two ciphertexts $c(n-1)$, $c(n)$ which are the last two encrypted messages blocks, and a server to tell me if the padding of decrypted $c(n)$is correct or whatever, doesn't that mean that the server just decrypts whatever you send to it (I mean, just send the whole encrypted message as you received it and read the output). I mean, this is the server bug that it doesn't take a key in the first place and check if it's correct.
Let's assume that all we have to do is send those two cipher messages to know and decrypt the last block (the padding block). This only works since the padding plaintext is known or at least not random or whatever reason.

But what about, say, c2 and c3 which are in the middle of the whole message? We know c3 and c2, but we don't know and we will never know either p3 or p2 (plaintext), nor the intermediate state IS3; i.e. we can't XOR c2 with is3 to obtain p3, so this attack I think only allow us to decrypt the padding block with the only new thing we actually knew is an intermediate state of padding block.
I am asking to know if this attack is just a one with no real-world implications and no real data decryption capabilities (actual data).


texts: How to calculate number of possible key pairs in RSA

texts:
What determines the number of possible RSA key pairs for a given $n$?
Is it because $\varphi(n)$ produces the number of values that are less than $n$ and coprime with $n$?
Is it as simple as $\varphi(n)$?


texts: Notion of Security in case of Covert Adversaries

texts:
On the page 31 of the Book "Efficient Secure Two-Party Protocols by Y. Lindell and C. Hazay", while defining the notion of security in case of covert adversaries, it is mentioned:

  Define an adversary to be covert if the distribution over the messages that it sends during an execution is computationally indistinguishable from the distribution over the messages that an honest party would send. Then, quantify over all covert adversaries A for the real world (rather than all adversaries).

What do we mean exactly by quantifying covert adversaries?
Moreover, it says:

  Another problem is that adversaries may be willing to risk being caught with more than negligible probability, say $10^{-6}$. With such an adver- sary, the proposed definition would provide no security guarantee.

While quantifying the covert adversaries, how did we make it so that the probability of catching the "non-covert" adversaries is equal to statistical distance from the honest party's distribution?

Moreover, on page 32, why did we decide to quantify over all adversaries (including malicious), and how did that fix the problem we were dealing with?