texts: Does an adversary require the public key to perform operations when RSA or ECC is broken?

texts:
If we had a way to break signature or encryption schemes (e.g. recover the key, recover plaintexts from ciphertexts, forge signatures), e.g. a quantum computer that was powerful enough to  break discrete log, would the attacker still need to know the public key used to make the encryption or verify the signature in order to decrypt or forge a signature?

That is, given merely the ciphertext or a signature without the public key, could such an attacker decrypt the ciphertext or forge other signatures?

I'm mostly interested in RSA and ECDSA, but if the situation is different for other schemes, I'd love to hear that.


texts: How does IBM's 53-bit quantum computer compare to classical ones for cryptanalytic tasks?

texts:
IBM just announced "a new 53-qubit quantum computer".

How does it compare to classical computers, performance-wise, for cryptanalytic tasks? E.g. finding a 48- or 64-bit value whose SHA-256 has a certain value (edit: or factoring the product of two distinct primes, or computing some discrete logarithm).


texts:
First, I want to know what is the logarithm used in the following system of equations (from the paper Flexible and Robust Privacy-Preserving Implicit
Authentication - Domingo-Ferrer, Wu, Blanco-Justicia):

Second I want to understand how one can obtain integer values $r^\prime_1, r^\prime_2, ..., r^\prime_s$ after using logarithm.
Note: All the other values ($R^\prime,r^\prime_0, a_i;\forall i$) in the system are integers.


texts: Privacy-Preserving Protocols and Proofs of Security

texts:
While dabbling in privacy-preserving protocols (mainly using Semi-Homomorphic Encryption) and coming up with miscellaneous ideas for comparison tests or other similar primitives, based on obfuscation and a small number of rounds between two parties, I have been consistently opposed the argument that such protocols did not provide an "adequate" level of security.

For example, in this particular protocol, the use of random values ($b \in {-1,1}$, $r, r'$) to obfuscate the encrypted value of $(y-x)$ in order to have the other party perform a test on it:

  $Enc(c) = (Enc(y) Enc(-x))^{b*r} Enc(-r') = Enc(b*r*(y-x)-r')$ (I)

Or in a simpler example, assuming we want another party to (obliviously) compute the value of $log(x)$, sending the obfuscated value:

  $Enc(c) = Enc(x)Enc(r) = Enc(r+x)$ (II)

(where $r$ is a random integer $\in [0, n-x[$)

In both those cases, the argument seems to be that, because $c$ does not follow a perfect uniform distribution (assuming $x$ and $y$ do), the protocol is not secure.

However, this seems like an unrealistically high bar to define "security" (especially given the arbitrary strength of the encryption scheme itself).

In both cases, even with full knowledge of the obfuscation scheme and an infinitely large number of exchanges, a malicious party would have no way to guess the exact value of the unobfuscated values with any degree of accuracy (at best, getting a distribution that is somewhat skewed), whereas typical random share protocols will tend to have a non-zero possibility of failure (due to modulo error and such) that is deemed acceptable.

As a non-cryptographer (math/CS background), I have a hard time understanding this approach to defining "security" and was hoping someone could give me a more formal and/or flexible definition of adequate security through obfuscation than "all obfuscated values exchanged must follow a strict uniform distribution".

Edit: I should add that I am clearly not the only one with trouble with this definition, since peer-reviewed papers like this one or this one clearly present schemes that fail the "uniform distribution of obfuscated value" condition.


texts:
Can we build two messages with same MD5 but different size?
I researched MD5 collisions, but everything I found targets messages of the same size.


texts: Can a TLS client perform any DH regeneration?

texts: I have only the barest understanding of cryptography, but I've been following the Logjam issue; some posts and articles (elsewhere) imply that a client can regenerate DH keys. Is Logjam solely a server issue? Is there a way for the client to perform DH regeneration on a regular basis; if so, how? Is there any way the client can circumvent the Diffie-Hellman Logjam issue?


texts:
For a one-time pad to be truly secure, do I need to use XOR? In other words, is a numerical OTP as secure as a XORed one?

I'm new to cryptography, so this might not even make sense.


texts: How can I use an XML detached signature when the file may be stored anywhere?

texts:
How can I use an XML detached digital signature in Java when the URI where the file is being signed will not be the same as when the file is being validated? Specifically, the file to be signed is created and signed on one server, then shipped to another server where it should be verified. The URI is file:///....
Similar to RFC 5485, the need is for the file to be signed "to be stored anywhere without hindering signature validation". Unlike RFC 5485, the need is for an XML formatted detached signature. The Java implementation seems to require the full URI to be the same at the signing time and at the validation time.


texts: Is there a signature scheme in which private keys can't be linked to their signatures?

texts:
Normally in a signature system, the private key can be used to derive the public key, and therefore verify any given signature signed by that private key. Can we create a system without this property?

Namely, I'm looking for a signature scheme in which given a signed message and a private key, you can't tell whether the private key was used to sign the message; only the public key (or rather verifier key) can.

A corollary is that public/verifier key is not derivable from the private key. In addition, the signing process must be stochastic, as otherwise you could sign the message and see if it produces the same signature.

The use case I have in mind is that Alice would have 100 private keys, with one key be the distinguished "true" key, and then send these 100 public/verifier keys to Bob (and then Alice would delete the 100 private public keys from her computer). She would always sign messages with "true" key. Then, if Alice is captured, the adversary can not know which private key is the "true" key even after applying Rubber-hose cryptanalysis (since they can't tell whether Alice is lying or not). If one of the bad keys is used, Bob will know that either Alice's computer was compromised, or she signed it under duress.


texts:
Some time ago I read an explanation of the key generation process of NTRUEncrypt, where it was stated that a polynomial $f$ should have "small" coefficients. It defined the number $df$, which configured the space of this polynomial to have coefficients in the set $\{-1,0,1\}$ such that $df$ is the number of 1s and $(df-1)$ is the number of -1s.
However, checking the submitted code in the third round of NIST competition, the sampling of $f$ seems to return coefficients in the set $\{0,1,2\}$. Is it because they are equivalent representations for the coefficients, being this one the best for making computations?
Also, the sampling function for $f$ needs a seed as a parameter called "uniformbytes". Based on the comments, I filled it with uniform random bytes from 0 to 255, but the number of 1s and -1s (suposing 2s are -1s) are really different from the $df$ and $(df-1)$ thing I read in the other work. Looking at how this sampling function is called in other parts of the code, I see that the seed is generated using some AES functions, which seemed pretty weird to me.
What is the correct way of sampling $f$, and what is that $df$ parameter that seems to be missing in the submitted code?


texts: How are objects sold as NFT's ("non-fungible tokens")?

texts:
I'm familiar with "blockchain" and the theory and technology behind cryptocurrencies, tokens, and the economics behind why such things are capable of having monetary value, however I've never been able to wrap my head around "non-fungible tokens" (NFTs).
As I understand it, NFTs and, say, Bitcoin are in principle one and the same. Both are units of data stored on a tamper-resistant public ledger, NFTs being special in that each "token" is "unique" in a way that Bitcoin/etc. are not. That these things can hold value makes some sense. What I don't understand is how NFTs are used to sell "physical" objects (digital art, music files, etc).
Access to the original object or file is not restricted to the owner of the token. As I understand it, the only relationship between the token and the object is that the seller decided to represent the object by the token. And then people are willing to pay absurd amounts of money to "purchase" these objects, in effect receiving only some string of numbers that the seller decided would signify ownership of the object. How is this any different from, say, purchasing some work of art at auction and being handed an ID number, never actually taking possession of the artwork.
How are objects "associated" with these tokens, outside of someone more-or-less deciding that some token will serve as an "identification number" for the object?  I admittedly don't know much about the topic, however I suspect there must be more to it than what I understand.


texts:
I have a big problem to figure how the security model in papers about side-channel are relevant (briefly the attacker has a partial access to the hardware).

Why these breaches are so seriously considered?

Is there any known and famous story of a system attacked with these techniques?


texts: Using quadratic residue to learn the sign of a field element

texts:
Given $x' \in \{-x, x\} \bmod q$ (where $q$ could be any prime of my choice), $s$ is a random element in the field, $y = x'\cdot s$ and $y' = \pm\sqrt{(x\cdot s)^2}\bmod q$ (i.e., both solutions to the quadratic residue), is there a way to tell whether $x'= x\bmod q$ or $x' = -x \bmod q$?

If not, is there some other known result about quadratic residues I can utilize, assuming I can choose $q$ to be whatever prime (or composite) I'd like and can compute multiple QRs of the form $y_i = (x\cdot s_i)^2 \bmod q$?


texts: Is there a formal definition of what a distinguisher is?

texts: I've often been reading about (polynomially bounded) distinguishers in books or papers. Although by name and intuition it is somewhat clear what a distinguisher is and does, but i am asking myself whether there is a concrete formal definition. Despite the concept being used frequently, i wasn't able to find one.


texts: Understanding the big picture with regard to how anonymous credentials work

texts:
I'm trying to learn about anonymous credential systems. I started with Lysyanskaya's thesis, which gives an outline of how to build an AC system given some particular primitives (signature scheme, commitment, etc.), and then looked at some papers building those particular primitives. I have also come across some papers (one using RSA assumptions and one using bilinear pairings) which don't follow Lysyanskaya's "formula" but still manage to form a valid AC system.

I can follow along in each of the papers from one line to the next, but I still don't exactly understand what makes it "tick". Can someone suggest a way to better understand this? Of course, the various assumptions (pairings, discrete log, RSA, etc.) offer some way of "hiding" information to achieve anonymity. But I don't really see what property exactly is necessary to make the system work.

Apologies if this question is vague. Can someone suggest what to do to better understand what makes these systems work? I fail to see the commonalities between the schemes.


texts: How did the cryptographers of Bletchley Park figure out the chi stream of the Lorenz cipher?

texts:
How did the Bletchley Park code breakers figure out the chi stream of the Lorenz cipher, that was obscured in the ciphertext, which British code breakers eventually decoded? It's written in The Rutherford Journal that John Tiltman deduced the key using a depth found on 30 August 1941. Since he couldn't figure how the key was generated, it was given to W.T. Tutte, who figured out how the key was generated without ever looking at the Lorenz cipher machine.
Jack Copeland writes in Colossus: The Secrets of Bletchley Park's Codebreaking Computers (p.364)

Here was a method of wheel setting! Δ(χ1+χ2) was a periodic sequence, supposed known, with a period of 41×31=1271. Lay it against Δ(C1+C2) in each of the 1271 possible relative positions and count the number of agreements for each one.

It's obvious that the British code breakers had the ciphertexts in hand, from which they could obtain the delta-ed version of the sum of the first and second impulse of an intercepted ciphertext, i.e., Δ(C1+C2). I would like to know how the code breakers figured out the delta-ed version of the chi stream of the Lorenz cipher machine, i.e., Δ(χ1+χ2).


texts: Encryption algorithm which produces comparable results for substrings

texts:
I am wondering is there any encryption algorithm available which produces comparable string.

I am expecting the output as shown below.

Data        |       output
---------------------------------------------
testData    |  uTrildHcKpM
testData_1  |  uTrildHcKpMiopu

Please let me know if you happen to know such algorithms.


texts: Significance of y-coordinates in ECDH public key exchange

texts:
In the research paper Breaking the Bluetooth Pairing – The Fixed Coordinate Invalid Curve Attack? by Biham and Neumann, 2019,
they talk about attacks in Bluetooth pairing, they state that in the pairing process which involves ECDH key exchange- "sending both the x-coordinate and the y-coordinate during the public key exchange is a design flaw as it is unnecessary and highly inadvisable, and it greatly increases the attack surface"
I'm aware that in other implementations only $x$-coordinate is sent in compressed form. I'm curious to know how sending both coordinates increases the attack surface, how important it is to know the information about the $y$-coordinate and what are the possible attacks related to this.


texts: RTL solutions to Post quantum candidates

texts:
I am looking for RTL implementations of the PQC finalists for KEM (McEliece, Kyber, Saber and NTRU)
Saber provides the following repository
McEliece provides some code from their website, but as far as Ive been able to see there is no mention from Kyber and NTRU.
Does anyone have any information on hardware implementations for these two? (VHDL/Verilog).
As a side question; I new into this world of hardware crypto, are there normally standards when it comes to implementation or are they implemented how the user see's fit?
Any information is great, thanks!


texts: Will the non-colluding servers communicate in IT-PIR schemes ?

texts:
The current literature around Information Theoretic Private Information Retrieval (IT-PIR) schemes assume the existence of multiple copies of the database distributed across non-colluding servers. Much of the research seems to be around the servers not communicating with each other but only with the client.

Can the results be improved (or are there known results) ? when the the multiple servers communicate among themselves without breaking the security assumptions (say using multiparty computation) ?


texts: Are EC public key values evenly distributed?

texts:
At my Day Job(tm) we've encountered a bug wherein if the leading digit of the X or Y value of a public key are zero, "shit happens" (this bug is in our code - I'm not suggesting there's some problem with EC itself. It's just an encoding thing and it's not particularly interesting for this question).

Naively, this suggests that we should expect 1 out of 128 keys to trigger the bug, but that assumes that the X and Y values are evenly distributed. Are they?

If it matters, the curve is secp256r1.


texts: Determine the Key given ciphertexts and plaintexts?

texts:
Given two sets of plaintexts and their corresponding ciphertexts, how does one determine the key $K$?

The ciphertexts are:

$$C_1= (P_1 \oplus K_0) + K_1$$

and

$$C_2= (P_2 \oplus K_0) + K_1$$

$K = K_0 || K_1$ (string of bits).

where $+$ means addition mod $2^n$.

How do we find the unknowns (eg, $K_1$)?


texts: How to find the interpolation polynomial of the DES S-boxes

texts: The Lagrange interpolation polynomial of the AES S-box has degree 254 and 9 terms in it. How about the DES S-boxes? How can we calculate the interpolation polynomial for S-boxes having a different number of input and output bits?


texts: LSB of the Exponent in the DL Problem Can Be Efficiently Computed for Groups of Even Order

texts:
I am studying a script on the mathematical foundations of cryptography as part of which I am currently trying to wrap my head around some basic cryptographic reductions. I am stuck on one problem that I would like to request some help / advice on how to proceed:

Consider the (D)iscrete (L)ogarithm problem for a group $H = \, < \negmedspace h \negmedspace >$ of even cardinality $\lvert H \rvert = 2 n$. Show that there exists an efficient algorithm that computes the LSB of $x$ in the DL problem $y = h^x$.

So far the only thing I managed to come up with is the following: We can determine the order of $y$ and find $c$ s.t. $y^c = h^{x c}= 1$. Since the group caridnality is even we conclude that $x c = m 2 n$. If $c$ is odd we can therefore conclude that $x$ must be even and hence the LSB of $x$ is zero. How can I proceed from here? The only additional insight I can present is, that due to Lagrange, we know that $c$ divides $2 n$.


texts: Proving that a plaintext is the Paillier decryption of a certain ciphertext

texts:
Assume that Alice received 100 ciphertexts encrypted with additive homomorphic encryption, say Paillier, using the same public key that belongs to Bob.
Alice added all of them, and wants to know the final sum, so she sends the final result (which is still encrypted of course) to Bob so that he can decrypt it with his private key, and return the result of the sum in clear text to Alice.

How can Alice be sure that Bob didn't give her a number that doesn't match her encrypted sum?

Should I use another additively homomorphic encryption if I want ZKP?


texts: How the coin flipping protocol prevent Alice from generating $ n $ from many primes?

texts:
This is a question from reading the paper 'Coin Flipping by Telephone - a protocol for solving impossible problems'.
The fact that the coin is unbiased is based on the fact that if n is a product of two primes, then there should be exactly four solutions to the congruence $ x^2 = f^2 \pmod n $.
What if Alice is malicious and intentionally want to bias the result towards $ n $ is factorizable. In that case, she could make $ n $ a composite out of a few primes (let's say, 5), then there will be $ 2^5 = 32 $ solutions and it will be highly likely that picking a solution will lead to $ n $ turns out to factorizable?


texts: Unforgeable CPA-secure private-key encryption scheme that is not CCA-secure

texts:
This is exercise with 4.26 in Katz and Lindell's introduction to cryptography 2nd ed.

The question is: Show a CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure.

This is what I've come up with.

Let $F$ be a pseudorandom function.

$Gen(1^n): k \leftarrow \{0,1\}^n$.

$Enc_k(m): r_1\leftarrow \{0, 1\}^n, r_2 \leftarrow \{0,1\}^n\setminus \{r_1\}$,
    output $c = (r_1, r_2, F_k(r_1) \oplus m, F_{k}(r_2) \oplus m)$.

$Dec_k(r_1,r_2,c_1,c_2): \perp$ if $r_1 = r_2$ or $F_k(r_1)\oplus c_1 \neq F_k(r_2) \oplus c_2$, else output $m = F_k(r_1)\oplus c_1$.

I have somehow proved that this is unforgeable and CPA secure.
I wonder if there is an easier way to go about it or if this scheme indeed has the required properties.

The notation $\perp$ means decryption fails. To summarize, unforgeability means that an adversary with encryption oracle can't come up with a valid ciphertext whose underlying message wasn't queried to the oracle before except with negligible probability.

Thank you.

EDIT: This scheme doesn't work. Flipping the last bit of the 3rd and 4th components of the ciphertext yields a valid encryption of $m$ with last bit flipped.

EDIT: To provide the formal definition of unforgeability.

Define the unforgeable encryption experiment $EncForge_{A, \Pi}(n)$:

Run $Gen(1^n)$ to obtain a key k.
The adversary $A$ is given input $1^n$ and access to an encryption oracle $Enc_k(\cdot)$. The adversary outputs a ciphertext $c$.
Let $m = Dec_k(c)$, and let $Q$ denote the set of all queries that $A$ asked its encryption oracle. The output of the experiment is 1 if and only if $m \neq \perp$ and $m \notin Q$.

An encryption scheme $\Pi = (Gen,Enc,Dec)$ if for any PPT adversary $A$,
$$
  P[EncForge_{A,\Pi}(n) = 1] \le negl(n)
$$
for some negligible function $negl$.


texts: When I calculate two RSA keys, what if anything, would make any difference which I call the public vs which I call the private key?


texts: Combining md5 collisions to create more collisions

texts:
Given X1 and X2 such that md5(X1) = md5(X2) and Y1 and Y2 such that md5(Y1) = md5(Y2), and knowing the following property of md5:

  if md5(a) = md5(b), md5(a|s) = md5(b|s)

is there a way to find Z1, Z2, Z3, and Z4 such that md5(Z1) = md5(Z2) = md5(Z3) = md5(Z4)?


texts: Explanation and proof of a well-know probabilistic lemma

texts:
Pointcheval and Stern in their paper on "Security proofs for Signature Schemes" state the following "well-known" probabilistic lemma:

  Let $A \subset X \times Y$, such that $\mathrm{Pr}[A(x, y)] \geq \epsilon$, then there exists $\Omega \subset X$ such that

  $\mathrm{Pr}[x \in \Omega] \geq \epsilon/2$
  whenever $a \in \Omega$, $\mathrm{Pr}[A(a, y)] \geq \epsilon /2$

I am not familiar with the notation used and I also can't find this result in my literature.

Questions:

Can $A$ be any set or it must be an event (measurable set)?
Does the notation $\mathrm{Pr}[A(x, y)]$ mean $\mathrm{P}\left(\{(x, y) \in A\}\right)$? Notation $A(x, y)$ could also imply that $A$ depends on $x$ and $y$, but I don't believe this is the case.
Does the notation $\mathrm{Pr}[x \in \Omega]$ mean $\mathrm{P}\left(\{(x, y) \in \Omega\times Y\}\right)$ or does it mean $\mathrm{P}\left(\{(x, y) \in (\Omega\times Y)\cap A\}\right)$
How can I prove this? Where can I find the proof?

In my definitions I assume that $A$ is an event and a subset of the sample space $X \times Y$ and that $P$ is a probability measure.

Thanks.


texts: What does ChopMD refer to in the default Go ECDSA package?

texts:
If one navigates to the ECDSA Go package page, he can observe that:

  This implementation derives the nonce from an AES-CTR CSPRNG keyed by ChopMD(256, SHA2-512(priv.D || entropy || hash))

While I am familiar with AES in CTR mode and SHA2-512, I am not familiar with what ChopMD refers to and I haven't been able to find any definite answer.

The only reference to ChopMD I have found is this PDF, showcasing how to improve ChopMD but never really going into detail as to who conceived it, why etc. MD commonly stands for Message Digest in the hashing functions but within the paper, MD refers to the Merkle-Damgaard construct, which is internally used by MD-5, SHA-2 and SHA-1.

If someone could clear up what ChopMD refers to I would appreciate it.


texts: How does the Chop Chop attack effect TKIP?

texts: I know that chop chop attack is because of WEP's insecure checksum mechanism that is CRC32. As TKIP uses MIC along with CRC32 which just makes an attacker to wait for 60 sec upon two mismatch MIC codes. But how does an attacker guess the data by using ARP and Deauth Packets?


texts: How to split up $GF(2^{128})$ into smaller fields?

texts:
I've heard that it's possible to split up $GF(2^{128})$ into copies of several smaller fields like $GF(4)$ so as to make the math easier in some cases.  How do you do that?

I know how it works for groups modulo a composite number using regular arithmetic instead of carryless, such as when using the Chinese Remainder Theorem to speed up RSA.

I believe that this is called "field extension".


texts: Is it possible to derive an Ed25519-public-key from an Ed25519-signature?

texts: If you have an Ed25519-signature and the signed message, can you derive the corresponding public-key or is the signature anonymous (except if you already know the public-key of course)?


texts: Password protection in ARJ: 3 characters of password are retrievable

texts:
On this site there is information that one can know first 3 characters (bytes) of the password without brute force. I know that ARJ in older versions has very simple encryption, i.e. XOR with passwords.

I can't understand how it is possible to retrieve those 3 characters. Is compression or realization of these archives is weak?


texts: How should short term keys (keys stored in RAM or volatile memory) be described by PKCS#11?

texts:
How are short term keys usually implemented by PKCS#11?

Is the proper way to distinguish between keys that are more temporary/stored in volatile memory and those stored in non-volatile memory to label them "session objects" or "token objects" using the CKA_TOKEN attribute?  Or is there another attribute or property in the spec that I am missing?

If a power-off event occurs for a device, is it valid to consider that to be an event which closes the session and allows session objects to be destroyed?


texts: Do I understand HMAC-SHA-xxx and HMAC-SHA-xxx-yyy correctly?

texts:
I've recently started looking at HMAC, and there a few things that I'm not 100% sure that I'm understanding correctly.  Am I right about these three things?

HMAC-SHA-xxx has an output length of xxx bits
HMAC-SHA-xxx-yyy has an output length of yyy bits
If I have a function that generates HMAC-SHA-xxx output, then I can create a function that generates HMAC-SHA-xxx-yyy output simply by returning the first yyy bits of HMAC-SHA-xxx output.

If I am misunderstanding any of them, how so?


texts:
Break the RSA code whose key is $(n, e) = (8369428283, 1234567)$.

Find the deciphering key and then decipher the message under the assumption that the plaintext consists of 7-letter blocks in the alphabet, converted to an integer between 0 and 26^(7) −1 in the usual way, and the ciphertext consists of 8-letter blocks in the same alphabet.

The given answer was CLAIMYOURPRIZE, but this doesn't match the one I got.

I converted the first 7-Letter block in CLAIMYOURPRIZE and I also got the first 8-letter block of the encrypted message. Then in order for them to match the value of the private key (d) must be 2 and that is not possible


texts: I was going through a presentation titled "SIKE in Hardware" by professor Reza Azarderakhsh. On the page $10$ of the presentation he introduces a variable $w$. Could you please explain what the variable is in layman's terms? I am a master student with a background in software engineering and little to none background in algebra.


texts: Is flipping the bit belonging to encryption?

texts:
Just a simple question about encryption.

If we have an image, we transform into a bits and we get 1001001...
Then, I flip the bits into 0110110... manually.

Can I said that I have done an image encryption?

Thanks.


texts: Why does the key for a one-time pad have to be uniformly distributed?

texts: I would like an intuitive argument for what goes wrong in the proof that that a one-time pad provides perfect secrecy, if the key $K$ is not chosen uniformly at random from the entire key space.


texts: Is the crypto riot.im claims to use safe?

texts:
My friends want to communicate with me using “about.riot.im”, I tried to research them and the protocols they claim to use and I only found their own websites promoting it, so the whole thing seems sketchy to me.

  Matrix provides state-of-the-art end-to-end encryption as a
  first-class citizen using the Olm and Megolm cryptographic ratchets.

I tried googling for that Olm and Megolm encryption and the whole thing seems sketchy to me.

Can anyone here confirm that the cryptography and implementation they use are sound and safe? And that you can trust riot.im?


texts: Small generator for classical Schnorr signatures?

texts:
I'm implementing classical Schnorr signatures for real-world use. By "classical," I mean that the operations occur in a finite group, with no elliptic curves.
I'm following Schnorr signature and Schnorr group at Wikipedia, and some academic papers.
After choosing $p=qr+1$ with $p$ and $q$ prime I need to calculate a suitable "generator" $g$.
As explained on the Wikipedia page, I set $h=2$ and try to see if $h^r \textrm{mod } p$ is different from 1 (it always has been so far) and that value becomes $g$.
The trouble is, $g$ is (logarithmically) about as large a number as $p$ when chosen this way.
Is there a way to choose a smaller $g$ so that less parameter data needs to be passed around?
If I understand correctly, any $g$ s.t. $g^q=1 \textrm{ mod }p$ ought to work (provided, of course, $g \ne 1$). It's easy to see why $2^r$ works; it's because $(2^r)^q=2^{rq}=2^{p-1}$ which is 1 by Fermat's little theorem.
But can a smaller $g$ be derived somehow?


texts:
I am studying Merkle tree signature. Let $\sigma=(s,Y_s,\sigma_{\text{OTS}},As)$ be a signature of certain document. Here $s$ is the index of leaf, $Y_s$ is the respectively OTS public key and $A_s$ is the authentication path. My questions are:

1) Is there any attack where an adversary changes part of the signature $\sigma$? (For example suppose the adversary changes $\sigma_{\text{OTS}}$ to $\sigma^{*}_{\text{OTS}}$ for her or his convenience).

2) If that attack exist what is the name of that attack?


texts: Why in Android kernel CSPRNG state is saved?

texts:
I am reading about the security internals of Android. In the book Android Security Internals, in chapter on Cryptographic Providers, there is a para stating:

  On Android, CSPRNG implementations are seeded by reading seed
  bytes from the standard Linux /dev/urandom device file, which is an inter-
  face to the kernel CSPRNG. As the kernel CSPRNG itself may be in a
  fairly predictable state right after starting, Android periodically saves the
  state (which is 4096 bytes as of Android 4.4) of the kernel CSPRNG to
  the /data/system/entropy.dat file. The contents of that file are written back
  to /dev/urandom on boot in order to carry over the previous CSPRNG
  state. This is performed by the EntropyMixer system service.

Can someone help me to understand why is it important to save the state of kernel CSPRNG and load it on boot? If we not save the state, is it insecure? Isn't this saving the state making it predictable. Also, why the kernel CSPRNG will be in a predictable state after starting?


texts: Period, correlation and auto-correlation of non-linear feedback shift registers based sequences

texts:
Use of Linear Feedback Shift Registers(LFSR) is discouraged due to complexity of order of it's length.

Recently Non-Linear LFSR has been talked about.

I am curious how the properties of LFSR based m-sequence generators hold in this case:

Auto-Correlation- low
Cross-Correlation- Very low
Periodicity $~ 2^n-1$

How NLFSR performs on these metrics? Are they suitable to be used for multiple access systems or say in spreading sequences.

How difficult is it to hack into these systems compared to Berkelamp-Massey algorithm?


texts: What are the differences Between “White-Box Cryptography” and “Code Obfuscation”?

texts:
I have been reading the question "What is a white-box implementation of a cryptographic algorithm?" and it led to this short article / Q&A which states in question 2:

Q2: What is the difference with code obfuscation?
Related and
complementary techniques for protecting software implementations but
with different security goals include code obfuscation and software
tamper- resistance. Code obfuscation is aimed at protecting against
the reverse engineering of a (cryptographic) algorithm while
software tamper-resistance is aimed at protecting against modifications
of the code. All these techniques have however in common that the
resulting implementation must remain directly executable.

Now, it shows the differences between obfuscation and temper-resistance, but it says nothing about the difference between white-box cryptography and code obfuscation.
So I guess my question is: are those two completely different things? Or is code obfuscation a way to achieve white-box cryptography? If the second is true, are there other ways to achieve it?


texts:
Does there exist any hashing function that has a different output for all of the messages?

For example, let's say we have the function $H_{256}(x)$

Where $H$ is a 256 bit digest. Is it possible to construct $H$ so that it has a different output for every combination from $0$ to $(2^{256}-1)$?

EDIT: what I mean is, if you have a hash function which produces a fixed length 256 bit digest, is it possible to make such function so that every permutation of 1's and 0's of length 256 have a different output? I hope I'm clear now


texts: rotational cryptanalysis on modulo multiplication?

texts:
I saw the paper 'Rotational Cryptanalysis of ARX', it is effective against design primitives using XOR, addition, and rotation.

http://www.iacr.org/archive/fse2010/61470339/61470339.pdf

However about those that use modulo multiplication (e.g. Multiplication modulo $2^{16}+1$, where the all-zero word (0x0000) is
interpreted as $2^{16}$ (denoted by a circled dot ⊙))?


texts: DES key expansion: why are these two descriptions different?

texts:
I would like someone to explain me how to generate DES subkeys, because in the documentation that I saw, sometimes they say:

  "We rotate the initial key according to the number of iterations given by this sequence:
  1, 2, 4, 6, 8, 10, 12, 14, 15, 17, 19, 21, 23, 25, 27, 28."

and sometimes they say:

  "The two halves are each rotated to the left by an amount depending on the iteration stage, in the following order: 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1."

Do you have any idea why these descriptions are different?


texts: One time pad - how is the difference in length between the plain text & the OTP handled?

texts:
Since OTP have to be agreed upon in advance, they may be longer than the plaintext. So in this case, how is the encryption done? Is the OTP truncated to the same length of the plaintext before encrypting or is some kind of padding used - how does it work?
I am talking about the case where Alice & Bob exchange a book of One Time Pads. Each page of the Pad is used for one plaintext encryption. So each page is of a fixed length & is always longer than the plaintext which it encrypts. So how is the difference in length handled?
As per Dan Boneh's book, a scheme which leaks the length of the plaintext cannot satisfy the definition of perfect security. If we only use that much part of the OTP same as the length of the plaintext, then we are essentially leaking the length of the plaintext because then ciphertext is same length of the plaintext. So how is this handled? I am looking for an authoritative source on how this is handled? Is it via padding? If so, how is the padding done?


texts: In bilinear pairings, is it possible to let someone be only able to decrypt ciphertexts in $G_1$ but not able to decrypt the ciphertexts in $G$?

texts: For example, in Don Boneh et al.'s paper "Evaluating 2-DNF Formulas on Ciphertexts", they gave an encryption system that the cihpertext can be in either $G$ (when only additional homomorphic operations are evaluated on the ciphertext) or $G_1$ (when one multiplication applies). In such a setting, is it possible to let someone be only able to decrypt ciphertexts in $G_1$ (the target group in bilinear map) but not able to decrypt the ciphertexts in $G$?


texts: The DES (Data Encryption Standard) takes 64 bit key as input but how is the plain text of length say n is getting converted into 64 bit binary format?


texts: Key generation algorithm based on bytes in a drive

texts:
I am a novice cyber security student and thought of a way to generate a random cryptographic key.

The algorithm works as follows:

Get the size (in bytes) of every file in a directory (drills down into each folder to only get files)
Concatenate each byte sizes together, EX: A file length of 2 bytes and a file length of 4 bytes would would make "24"
This creates a string thousands of digits (I've done up to 10,000,000 digits long)
If the user needs an extra long key, hash each individual character using SHA-256
Take the final string (millions of bytes) hash it down to two 64 byte hashes and combine them to make a 128 byte or 256 byte based on user selection.

Some reasons I chose this method include the randomization of the string created since it's very unlikely that two people would have the exact same drive structure, and the size of the bytes hashed to make the key grows very rapidly since most files are several hundred bytes or more.

I guess this isn't a very direct question, but does this algorithm sound useful/secure? What are some ways I could improve on this algorithm?


texts: What is the difference in exchanging the Enigma rotors in their slots?

texts:
I have a question regarding the exchange of the rotors in a enigma machine.

I know that there are 3 slots and that up to 8 rotors can be used in those slots. What I don't understand is, as all the rotors have 26 letters each (they are  equal), what is the difference in exchanging the rotors in the slots?


texts: Is frequency analysis the only attack on a simple substitution cipher?

texts: I understand that "anagramming" is often used after frequency analysis of a traditional substitution cipher, but anagramming requires prior frequency analysis to provide a starting point. Is there any technique other than frequency analysis for a cipher-text only attack on a traditional substitution cipher?


texts: Is $H(x) = x^2 \bmod p$ pre-image resistant, second pre-image resistant and/or collision resistant

texts:
I have the function $H(x) = x^2\bmod p$ , where $p$ is a prime of length n bits and this function maps to the message $x$ to a n-bit hash value $H(x)$.

I need to find out if it is pre-image resistant, second pre-image resistant and/or collision resistant; and if it isn't collision resistant, what are some simple colliding messages.

I think the hash function is pre-image resistant, because for a given $x^2\bmod p$ in the output space of the hash function, it is hard to find any message $x$ with $H(x) = x^2\bmod p$. Is this correct?


texts: Zero-knowledge proof or zero-knowledge proof of knowledge?

texts:
It has always been a question surrounding in my mind whether a zero-knowledge proof ($\mathrm{ZKP}$) is the same as zero-knowledge proof of knowledge ($\mathrm{ZKPoK}$), but it was not since today that these concepts are creating problems in my understanding of cryptography.
So, what is the real difference (if there is one) between $\mathrm{ZKP}$ and a $\mathrm{ZKPoK}$? Is people using both concepts indistinguishable?
Here is an answer difference that answers my question partially, but I am lookin forward a direct answer to mine.


texts: Can I find the IV of a single block of SHA256, given the plaintext and digest?

texts:
Each 512-bit block of SHA256 takes an initialization vector (IV) and message schedule and returns a digest. Knowing the message schedule and resulting digest, is it feasible to reverse the algorithm to find the IV?

My intuition tells me no because the IV is added to the working variables immediately before returning the digest, causing a dependency on the IV at both the beginning and end of the algorithm. Is this correct?


texts: Difference between statistical PRNG and cryptographic PRNG?

texts:
What's the difference between a statistical pseudorandom number generator (PRNG) and a cryptographic-strength PRNG?

I've seen a lot of PRNGs that are proposed for statistical uses -- e.g., statistical simulation, games, that sort of thing.  These statistical PRNGs include schemes like linear congruential generators, linear feedback shift registers (LFSR), Mersenne twister, and many others.

I've also seen many proposals for cryptographic-strength PRNGs: PRNGs designed for cryptographic uses.  These include constructions such as AES-CTR DRBG, HMAC_DRBG, ANSI X9.17, and many others.

What's the difference between these two kinds of PRNGs?  Is there any difference?

Can I take a PRNG that was designed for statistical use, and use it for cryptographic purposes?  Would that be safe?  If I find some statistical PRNG that looks nifty but wasn't designed specifically for cryptographic use, would it be reasonable to use it for cryptographic uses?  What if I start with a statistical PRNG and then tweak it a little bit -- would it be OK then?

This is intended as a general reference question that we can point others to, when they ask about specific instances of this sort situation.


texts: RSA Key Differences (OpenSSL CLI vs. OpenSSL/ssl.h C function)

texts:
So, I am sitting here trying to figure out what is happening and why two keys are different in such a vast manner. I've created two key pairs, one key pair with the OpenSSL CLI commands on an Ubuntu 16.04 machine and the other keypair with a C program using the RSA_generate_key functions resident within the  library. However, even though both keys are made with identical parameters, the differnce is farily large within the public and Private key. The difference in Public Keys are 25 bytes and it seems it's not formatted the same either.

OpenSSL CLI:

 openssl genrsa -des3 -out private.pem 4096
 openssl rsa -in private.pem -outform PEM -pubout -out public.pem

OpenSSL CLI Key:

OpenSSL CLI ASN1Parse:

OpenSSL CLI Key Dump (Base64 -d):

------------------------------------------------------------------------------------------------------

C Program:

C Program Key:

C Program ASN1Parse:

C Program Key Dump (Base64 -d):

Attempting to dig into what the RSA_generate_key function does I found this: but, that does not tell me if it is in an ASN1 (Which it looks to be from the header). Or if there a a different formatting applied that I need to duplicate in order to create a key similar to that created from teh C Program. Essentially, I have to duplicatie the extact functionality of the C key generation with the CLI tools.


texts: Is this protocol for masking DB ids sound?

texts:
Problem Statement

I don't want to expose my internal database ids (or other internal private ids) so to make it harder to abuse them, by e.g. guessing the next id of a sequence or similar. It is not feasible for me to add a new field with a public, non-guessable UUID for every entry in my DB. I therefore require a protocol that can mask my ids (reversibly).

Desired Properties

Ids in a sequence should be hard to guess and recognize when masked
Ids should be very hard to forge when masked
compromise of a single masked id should not make it significantly easier to comprise other masked ids
Masking the same Id should generate different outputs decided by chance
Masked Ids should not be too long
Masking should be reasonably fast

Current State-of-the-Art

There is a popular library that tries to tackle this issue: https://hashids.org/ with a e.g. Java implementation here. HashIds basically encodes the id with an specific alphabet which is dependent on a "salt" that is provided by the caller. Additionally they try to omit certain letters so the chance of generating an id with an english curse word is minimized. Ids are fully deterministic ie. the same number with the same salt creates the same output.

New Cryptographic Approach

I found the described issue interesting but was disappointed by the miserable security properties actually masking the id (to be fair HashId never claims to be more than obfuscation). My idea is probably similar a specialized version of key wrapping.

So my approach would be:

id         .... 8 byte number
entropy    .... 4, 8, 12, 16 byte random value
secret-key .... 16 byte high quality random key assumed to be stored in a safe manner

Primitives:
AES-CTR(iv, key)
HMAC_SHA256(key, data)
HKDF-Expand(PRK, info, L) -> OKM

For every id create a random byte array entropy between 4 to 16 bytes long.
Derive 64 byte key material km with HKDF-Expand(secret-key, entropy, 64)
Split the 64 bytes into:

roundSecretKey = km[0-16]
iv = km[16-32]
macKey = km[32-64]

Encrypt the id with AES-CTR(iv, roundSecretKey) -> encryptedId
Create mac with HMAC_SHA256(macKey, encryptedId | iv ) -> hmac
Truncate mac to 4-16 bytes -> truncated_hmac
Create output message with:
masked_id = entropy | encryptedId | truncated_hmac

Discussion

AES-CTR as encryption primitive was chosen because:

Basically every programming language has standard implementations for it
Is a stream cipher and can efficiently encrypt data smaller than 16 byte
AES can be reasonably fast (and is often hardware accelerated)

The big drawback is however that AES-CTR with key k1 must never be used with iv1 more than once.

HMAC is used to add integrity and authenticity for the generated id to prevent forging.

The random entropy part ensures that id1 masked multiple times will most probably create different masked ids.

Compromises

To keep the masked id short, entropy and the hmac is kept short (or very short depeding on configuration). Assuming the worst case: 4 byte entropy. The chance of a repeated iv is realistic, however seldom. The attacker should not be able to decrypt since the iv and the roundSecretKey is dependent on the secret secret-key which would requireing brute forcing it first. An option would be to switch to AES-CBC, but that would make the minimum output length 16 byte (most ids are either 8 or 16 byte).

Keeping the hmac small makes it easier to forge messages, however it should make it easier to get macKey.

Both of these issue can be solved by increasing the length of entropy and hmac to 16 byte. This would increase the output length to 40 byte however.

So the question to the community: Does this protocol make sense in accordance with the desired properties? Are the compromises reasonable? Is this basically a sound protocol. I am looking for general feedback, security issues, possible improvements - currently I am not looking for different ways to solve the public id issue.

Update for the interested reader: Here is the reference implementation of the id encryption schema on Github and here is a article about it.


texts: Can a SHA3 engine be used to construct a Keccak implementation?

texts:
I am working on a cSHAKE-128 & cSHAKE-256 implementation that takes advantage of a number of hardware accelerators I have at my disposal, specifically for SHA-3 256/384/512 and SHAKE 128/256.
cSHAKE 128 is defined as follows:
1. If N = "" and S = "":
return SHAKE128(X, L);
2. Else:
return KECCAK[256](bytepad(encode_string(N) || encode_string(S), 168) || X || 00, L).

If condition 1 is met, the solution is trivial, since I do have a SHAKE128 engine available.
However, in the case of condition 2, I don't have a Keccak engine readily available. I'm wondering if SHA3 can be used as primitive to construct Keccak 256.
I have read that SHA3 is directly derived from Keccak (was a result of a contest which Keccak won), but I've also read they're not exactly the same. This very useful on-line hasher does not produce the same hash values for SHA3 256 and Keccak 256.


texts: NTRU crypto from unseen.is; myth busting help

texts:
I am always on the look out for privacy enhancing technologies. I stumbled upon the service from unseen.is. I had a look at their site (specifically here) and even though I lack knowledge there are a few early warning signs:

  a former security contractor told us "if it's publicly available, it's cracked"

I think this is untrue?

  extremely strong but not widely available encryption

I thought extremely strong = widely used/available?

  We've use only super strong NTRU encryption for public key exchange that is believed to be resistant to even quantum computing attacks

Quantum computing doesn't even exist in any (realistically) applicable way, so I think this a bold statement?

I contacted the service asking about their encryption algorithm, how they exchange keys, if they have cryptographers on their team and got this response:

  For the chat we use NTRU for the key and xAES for the message, 4096 bit key.  For email we are using PGP at the moment 2048 bit or 4096 bit.  The email will get upgraded to the same encryption as the chat at some point.  Probably this summer.

I also found out that NTRU is in fact a known standard and has a wikipedia article although I am suspicious of the concept.

Simply put my question is this: would this service and their claims fall under "have no clue" or is it my lack of knowledge and could this be a very decent, functional service?

Update: the website's FAQ (or this recent archive) states about xAES (an AES replacement with 4096-bit key) something that seems falsifiable:

  we add an advanced symmetrical encryption which is very easy to use with keys 16x longer than those found in AEA256, an industry standard. According to our engineers, this will take 23840 times longer to crack than aes256, which is commonly known as "military grade" encryption.


texts: Give a CPA-attack on Elgamal when used with $\mathbb{Z}_p^*$

texts:
We know that if the decisional Diffie-Hellmann problem is hard then the Elgamal encryption is CPA-secure. One show that if the chosen group is $\mathbb{Z}_p^*$ then the decisional Diffie-Hellman problem is not hard. For instance, one realizes that $g^{ab}$ is a square with probability $3/4$ with an argument based on the parity of $a,b$. Therefore, it makes self to ask the following question:

  Is there a CPA-attack on Elgamal when used with $\mathbb{Z}_p^*$?

I need some help on the way to go here. Should I try to build a distinguisher using the above fact about the Diffie-Hellman problem? Or does is just come from the algebraic structure of the group?


texts: Do any bits from the standard Mersenne Twister repeat more often than the total period?

texts: While the total period of MT19937 is $2^{19937}-1$ by design, is the period of the sequence of any of the individual bits from the output less than this? I'll admit I'm far too unfamiliar with group theory to understand Matsumoto and Nishimura's original proof for the period of the untruncated output, so I apologize if the answer follows trivially from it.


texts: What are the ways to generate Beaver triples for multiplication gate?

texts: So to speed up the function evaluation we use beaver trick, to generate raw data in the offline phase and use them in the online phase to get the output share for the multiplication gate. So what are the methods to generate these raw data i.e. multiplication triples ?


texts: Is there any good reason to chain HMACs in this manner?

texts:
I am looking at some decompiled Java code from an Android app. As a security measure, a signature is passed as a parameter to a number of JSON requests.

The method that generates the signature is as so:

private String getSignature(String s, String s1)
{
    try
    {
        Charset charset = Charset.forName("US-ASCII");
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(master_key, "HmacSHA256"));
        mac.init(new SecretKeySpec(mac.doFinal(charset.encode(s).array()), "HmacSHA256"));
        mac.init(new SecretKeySpec(mac.doFinal(charset.encode(s1).array()), "HmacSHA256"));
        s = Hex.toHexString(mac.doFinal(charset.encode(serialNumber).array()));
    }
    // Misplaced declaration of an exception variable
    catch (String s)
    {
        s.printStackTrace();
        return null;
    }
    return s;
}

As you can see, the key of the HMAC is set to the master_key (a preset byte array). A piece of data is then passed through the hash and used as the key for the HMAC on the next step.

The function is called like so:

s2 = getDateString();
s3 = getSignature(s2, "/xquery/1.0/relay.json");

Is there any reason to chain together the HMAC like this? Is it anymore secure than simply performing HMAC(master_key,s|s1|serialNumber)?


texts:
I am unable to account for an extra 0x00 byte in an EC SubjectPublicKeyInfo structure.

> openssl asn1parse -i -in ecpub.pem -dump
0:d=0  hl=2 l=  89 cons: SEQUENCE
2:d=1  hl=2 l=  19 cons:  SEQUENCE
4:d=2  hl=2 l=   7 prim:   OBJECT            :id-ecPublicKey
13:d=2  hl=2 l=   8 prim:   OBJECT            :prime256v1
23:d=1  hl=2 l=  66 prim:  BIT STRING
  0000 - 00 04 d0 ee 64 61 7b 90-48 a2 a9 5f b5 a3 da 67   ....da{.H.._...g
  0010 - 53 56 91 e0 cf 5b b8 85-3e 05 0c b9 e6 95 c3 8d   SV...[..>.......
  0020 - 26 ab d7 ee 47 94 38 61-1e cd 07 e6 90 0b 3d 4a   &...G.8a......=J
  0030 - 6a df c5 d5 9f f3 11 91-53 00 ff 0e 91 93 49 44   j.......S.....ID
  0040 - 4c 58                                             LX

In the BIT STRING representing the public key in octet form, what is the 0x00 byte that precedes the 0x04 byte (which I was expecting to be the first byte)? Without the mysterious 0x00 byte, the public key comes out to 65 bytes and the entire structure lines up with the SEC1 specification.


texts: What's the internal state size and output range of mrg32k3a?

texts: This is Pierre L'Ecuyer's PRNG.  I know its period is $2^{191}$, but I don't know what is its internal state size.  What is it?


texts:
Is there a way to commit to a degree of a polynomial without committing to every single one of its coefficients?

The problem I am trying to solve is to prove that two polynomials are the same in a more efficient way than to prove that every coefficient of the two polynomials is the same.

My idea is that if you can prove that:
1) the sum of the coefficients of both polynomials are the same
2) the degree of both polynomials is the same

You can prove that the two polynomials are equal. Is this possible?


texts: What size should the HMAC key be with SHA-256?

texts:
I'm trying to generate a secret key to be used for HMAC SHA-256 signature processing. I've seen many sample of keys with variable length from 32 characters to 96 characters.

What is the ironclad rule for this key size?


texts: 'random' function $r_{n+1} = f(r_n)$, $|\{r_i,\forall i\}|=N$, $r_N = r_1$ where a function $g(r_k)=k$ is harder than in ECC?

texts:
Is there a deterministic pseudo random function $f$ with $r_{n+1} = f(r_n)$, $|\{r_i,\forall i\}|=N$, $r_N = r_0$, (for given random initial value $r_0$) where a function which derives the index of a given value $g(r_k)=k$ is harder than deriving the index of a given value at elliptic curve cryptography?

For ECC e.g. Babystep-Giantstep-Algorithmus or Pollard-Rho-Methode can be used with about $\mathcal{O}(\sqrt{N})$.

Getting the index of the random function value $r_k$ can't be harder than $\mathcal{O}({N})$ because that would be the computation of it.

So I'm looking for a complexity harder than $\mathcal{O}(\sqrt{N})$, in best case $\mathcal{O}({N})$.

Further nodes:

-set $R=\{r_i\forall i, \text{ given one } r_0 = r_N\}$ don't need to pass any tests for randomness

-$(\max(R)-\min(R)) <= b\cdot N$ with $b<=\sqrt[3]{N}$ and $b<=32$, $|R|=N$

-computation time of $f$ should not increase with higher index or $r$


texts: Can the subgroup membership problem still be hard in known order subgroup?

texts:
For example: Given an elliptic curve $E$ over $\mathbb{Z}_q$, and $\#E(\mathbb{F}_q) = p^2$, where $p$ is a prime. Now given a subgroup $\langle G \rangle$ of $E$, and the order of the subgroup $\langle G \rangle$ is $p$. If we randomly sample group element $P$ on $E(\mathbb{F}_q)$ and find that $[p]P=\mathcal{O}$. Can I conclude that $P\in \langle G \rangle$? I want to stress that there may be two subgroups whose orders are both $p$.
Generally, is the subgroup membership problem possible to be hard even the orders of its subgroups are all known?


texts: Possibility of factorisation of rsa modulus due to vulnerability in java implementation code

texts:
Below is my implementation of the RSA algorithm. Actually I'm choosing the private key (d) instead of public key (e) and computing the public key.It is working fine but

I want to know if this is a safe implementation? and also Is any part in the code could lead to factorization of the modulus (n), thereby breaking the key?

As I did some work on it, I think the way I'm calculating (e and d) that could leads to factorization of the modulus(n) but I'm not sure. I read some research work on vulnerable class of exponents in RSA and from there I got public exponent satisfying an equation:

eX - NY = (ap + bq)Z with q>a>0, b=[ap/q]

Using the continued fraction algorithm and the Elliptic Curve Method of factorization, we can show that such exponents yield the factorization of the RSA modulus.

So question is that IS any part in code could lead to factorization of the modulus(n), thereby breaking the key? If yes then which part?

import java.math.*;
import java.security.*;
import java.util.*;

public class RSAKeyGenerator
{
        public static int KEY_SIZE = 2048;

        public static void main(String [] args)
        {
    try
    {
    //select size of each prime factor whose product will be atleast the given keysize.
    int factor_size = KEY_SIZE/2;
    Random rnd = new SecureRandom();
    BigInteger p = BigInteger.probablePrime(factor_size, rnd);
    BigInteger q = BigInteger.probablePrime(factor_size, rnd);
    //compute N = p * q
    BigInteger N = p.multiply(q);

    //compute euler phi = (p-1) * (q-1)
    BigInteger phi = p.subtract(BigInteger.ONE).multiply(q.subtract(BigInteger.ONE));

    //select d size
    int d_size = KEY_SIZE / 5;

    //compute d
    BigInteger d = BigInteger.probablePrime(d_size, rnd);

    //make sure d is a coprime to euler phi.
    while (phi.gcd(d).compareTo(BigInteger.ONE) > 0)
    {
        //select another d

        d = BigInteger.probablePrime(d_size, rnd);
    }

    // compute e = d^-1 mod phi
    BigInteger e = d.modInverse(phi);
    BigInteger plaintext = BigInteger.probablePrime(d_size, rnd);
    BigInteger ciphertext = plaintext.modPow(e, N);
    BigInteger decryptedvalue = ciphertext.modPow(d, N);
    if(decryptedvalue.compareTo(plaintext) == 0)
    {
        System.out.println("decrypted values matches original plain text. these are proper RSA keys");
    }
    else
    {
        System.out.println("something wrong... decrypted value does not match. try again!");
        return;
    }

catch (Throwable th)
{
}

}


texts: Can two different pairs of RSA key have the same modulus?

texts:
Can $n=pq$ be part of two different pairs of RSA keys?

If such keys exist, say $(e_1,n)$ and $(e_2,n)$, how are they related?
What will be the security concerns for the two users?


texts: Purpose of expanding then shrinking in SHA-1

texts: What is the purpose of expanding then shrinking in SHA-1? Does it serves any security purposes?


texts: Performance comparison of SPHINCS+ and XMSS or LMS

texts:
Is there a comparison of the performance between SPHINCS+ and XMSS(MT) or LMS? I am aware of this paper that compares LMS and XMSS but nothing that compares either of them to SPHINCS+. I ask because I am interested in batch-signing and since SPHINCS+ is slow (and has big signatures) I plan on generating a temporary XMSS/LMS keypair (that will sign the actual data) and sign it with SPHINCS+.
In addition to that where could I find implementations for XMSS and/or LMS?


texts: Using salted hash as password for easy memorization without reuse?

texts:
I had an idea earlier:
Secure passwords are a) long, and b) unpredictable. A hash is both of these. Would it be safe to reuse a key between sites, and include the site's name as a salt? For example:

SHA256("kFnU7Ra%P1_stackexchange")
SHA256("kFnU7Ra%P1_google")

And so on. As long as nobody discovers your key, it seems better than password reuse.


texts: Non-iterative cryptographic hash functions

texts:
Consider the following cryptographic hash function $H$ which maps a message $m$ of variable size to $b$ bits:

$$H:\{0,1\}^{*} \mapsto \{0,1\}^b$$
$$y = H(m) = SPRP(IV||m||padding)\mid_{b}$$

, where: $$SPRP:\{0,1\}^n \mapsto \{0,1\}^n,\\
|m|+|IV|+|padding|=n,\\
|IV| = b.$$

Such a hash function could be considered non-iterative since, unlikely an iterative hash function, no entropy is discarded until truncation in the last step. While such a function has the disadvantage of not being streaming, it does have the nice property that finding a multicollision[0] is much harder than in iterative hash functions.

What other non-iterative hash function have been developed?
Is there another name for this as non-iterative doesn't seem to be a
good search term?

Edited to add a more formal definition: An iterative hash function is any hash function in which some the message can be compressed independent of the entire message.

A hash function $G$ is iterative iff:
$$\exists\ f\ h\ \pi, \forall m:\\
\pi(m_1||\ m_2)=m\ \ \ \wedge\\
|f(m_1)|<|m_1|<|m|\ \ \ \wedge\\
h(f(m_1),f(m_2)) = G(m)$$

A non-iterative hash function is any hash function for which it is impossible to compress any bits of the message without access to the entire message.

A hash function $H$ is non-iterative iff:

$$\not \exists\ f\ h\ \pi, \forall m:\\
\pi(m_1||m_2)=m\ \ \ \wedge\\
|f(m_1)|<|m_1|<|m|\ \ \ \wedge\\
h(f(m_1),f(m_2)) = H(m)$$

YMMV, the above definition is not a standard definition and exists to explain what I mean by non-iterative.

[0]: Antoine Joux, Multicollisions in iterated hash functions, 2004


texts: What are the specifics behind MD5 being weak against collisions?

texts:
One thing I see a lot on InfoSec Exchange is this phrase -

MD5 is weak against collisions

but what I am failing to understand is why.
Why specifically is MD5 weak to collisions? I understand the concept of a collision attack (at least I think I do) so perhaps this question appears stupid in that case, but what is it specifically which makes MD5 so prone to collisions? Are there any other "common" hashing functions which suffer from the same issue? And to what extent do they suffer this issue?
Would I be correct in assuming speed has something to do with this?

TL;DR: On an overview / high-level, how do the collision attacks against MD5 work and why don't they apply to other algorithms?


texts: How long does it take to decrypt an RSA/ECB encrypted message?

texts:
I am working on assignment where I have specific scenarios and I am little bit struggling with this one.

Alice sends and email to Bob.For this e-mail, she uses the following method of encryption: each single word of the text is viewed as an integer number in binary, obtained by concatenating the 8-bit binary values of the ASCII code of each letter. The number thus obtained for each word is then encrypted using the RSA algorithm and the resulting list of numbers is sent. Words that are too long to fit into this scheme are split into syllables, and each syllable is treated as a word.

I need to discuss whether eve can find efficient method to decrypt messages. My answer is:

I know if the plain text has two or more blocks of plaintext in common then we get same result for each of these blocks.  This is the bit of information that leaks even if this does not give immediate information what the original plain text might be, Eve can see the relationship between plaintext and cipher text.

Eve can also measure how much power /time it takes to decrypt cipher text. Eve can observe this power and time consumption and she might be able to get some information about how many “1” there are in d. If Eve manages to determine d she can decrypt entire cipher text as c^d mod n =m.

I also need to provide rough estimation about the time it would take to decrypt the message and this is the part I am struggling with.  The estimates of the time could be of the type: a few seconds, a few minutes, 1 hour, a few hours, one day, one week or longer. You may make assumptions about the speed of her computer: for example you could assume it would take 1 millisecond to perform RSA to encrypt or to decrypt one integer (of any size commonly used in RSA), if the encryption, respectively decryption key is given.

Any suggestions?


texts: I recently saw a claim that BearSSL has a bignum-free implementation of RSA. What does this mean? I don't see how one could implement RSA without bignum arithmetic.


texts: I have function with input 128 bit and output 64 bit that hash the header and hash the payload then  concatenating them after that hash the result so my question is does this pass the collision security requirement? or it fail because the attacker can find the hash 2^32?


texts: Elliptic Curve SSL performance: ECDHE and/or ECDSA?

texts:
I have a question about the performance benefits (in terms of server-side CPU load) of ECC (Elliptic Curve cryptography) cipher suites in SSL/TLS.

It is a known fact that ECC is very good for performance, it offers a good "security / key length" ratio.

But ECC kan be used for 2 things in SSL/TLS sessions:

ECC key establishment: ECDHE algorithm.
ECC authentication: ECDSA algorithm with ECC server certificate.

So I am wondering: do you need the 'full' ECC package (ECDHE + ECDSA = ECC key establishment + ECC server certificate) to get a substantial performance gain with SSL, or does ECDHE (ECC key establishment) already provide the largest portion of the possible performance gain?

Or, to make this question less abstract, let's consider 3 SSL cipher suites:

a) Non-ECC cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (DHE-RSA-AES256-SHA256).
Here ECC is not used at all.

b) Partial ECC cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ECDHE-RSA-AES256-SHA384).
Here ECC is used for DH key establishment, while RSA is used for server authentication (RSA server certificate).

c) Full ECC cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (ECDHE-ECDSA-AES256-SHA384).
Here ECC is used both for DH key establishment and for server authentication (ECC server certificate).

I assume that scenario C is better (performance wise) than scenario B, which in turn is better than scenario A.
But: where exactly would scenario B be positioned?

If scenario A = 1% (bad performance: high server CPU load) and scenario C = 100% (good performance: low server CPU load), then how far can you get with scenario B: 10%, 50%, 90% ...?

I hope the question is clear and that someone knows the answer or can point me to some documentation about this subject.

Thanks in advance!

Bert


texts:
What would be a good way to go about attacking a Quagmire 3 cipher?

I understand that it is polyalphabetic with a key and an indicator. I have started by taking the cipher text, taking every n-th letter and putting that in a string, computing the index of coincidence for the n strings I get and then averaging that. I would assume that whatever n value corresponds with the closest average index of coincident to English (0.066) would be the number of alphabets, i.e. the length of the indicator.

Where do I go from there? Or is my approach incorrect?


texts: What does variable-base point/scalar multiplication mean in ECC?

texts:
I am a bit confuse about the term, variable-base point/scalar multiplication, in Elliptic Curve Cryptography. What I have understood so far. It means that the base or point on EC is variable/unknown.

Am I right?


texts: Why does AES_GCM sometimes has a SHA for integrity?

texts:
For example the following suite:
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode GCM already creates a MAC, then why is the cipher suite followed by SHA384?


texts: Can you still decrypt XTS if half of the cipher text is deleted?

texts:
If a part of my data is damaged, corrupted, or deleted, is it then still possible to decrypt the rest of the data if you still have the key?

The situation: a piece of data (something like a document for example) encrypted with AES with a 256-bit key with XTS as the mode of operation.


texts: Encryting data with password for local storage using libsodium

texts:
I want to encrypt data that is stored on the hard disk using a user-entered password. For this I look into the sodium docs and all I can find for symmetric encryption is authenticated encryption.

This method requires a "nonce" which is needed again in decryption. If I understand correctly, nonces are important for communication, but for my case they are not needed. Correct?

Also to generate a key from the user entered password requires salt, which must be the same every time.

Is authenticated encryption really the correct choice for my task? If yes, how should I handle the nonce?
How should I handle the salt for generating the key? Should I always use the same? Or where should I store it?


texts:
From what I understand, the steps of a key exchange protocol are

Alice and Bob each encrypt something using their public key and private key and send the result to each other
Alice and Bob each do some mechanism with their private key and the result sent by the other
They should agree on the secret.

Key encapsulation is

Alice generates a secret key and public key and sends the public key to Bob.
Bob generates his own secret key and encrypts it using Alice's public key. He sends the result to Alice.
Alice decrypts the result using her private key and ends up with Bob's key.

Is this correct and if not, could someone clarify which parts I am misunderstanding or missing?

Looking at the Known Answer Tests for NIST PQC KEM Submissions, when a seed is provided, each algorithm returns the secret key, public key, cipher text, and shared secret.

Is the shared secret Bob's private key and the cipher text what Bob sent to Alice? If not, how does the terminology work? How can the seed guarantee the correct public/secret key generation?


texts: Is the BFV homomorphic encryption scheme a commitment scheme?

texts:
The BFV scheme can be described as:
Public Key: $(p_0, p_1)$
To encrypt a plaintext $m$, the ciphertext is : $(c_0, c_1) , c_0= up_0+\Delta m + e_0, c_1=up_1 + e_1$


texts:
So I am looking for the most secure method of symmetric key cryptography for long term messaging use between two users. I have heard that most symmetric key algorithms are not absolutely compromised by quantum computers, but rather weakened.

I have read that AES 256 is in fact the weakest, followed by AES 128, and AES 192 being the strongest.

Let us imagine that today quantum computers exist with "good" capacity to break cryptography.

Is AES still the best symmetric key solution as of right now? If not which is? If so then which AES key space is the strongest?

These are many questions which remain unanswered or lack good discussion as there isn't much in regards to post quantum security concerns.


texts:
Wikipedia on its page for Shamir's secret sharing scheme provides a python implementation that applies the idea. This algorithm will generate a (k, n) threshold scheme so for example we could split a secret in 6 parts and we would need only 3 of them to recreate it.

But isn't the idea of this scheme to be used by a number of various agents that each one will generate only a part of the key and share it? This way each agent can then create the secret key by combining the parts he will receive.

What would be the proper way to make this algorithm distributed and not generating everything in one computer?


texts: Best practice to create certificate by CA

texts:
I suppose that I have this scenario:

Root CA
Intermediate CA

Practice 1:

The Root CA generates her own $PK_r$ and $PB_r$ key, and after it makes her certificate $Cert_r$.
The Intermediate CA generates her own $PK_i$ and $PB_i$ key, and after it generates a Certificate Signed Request (CSR), and send it to the Root CA to obtain a Certificate $Cert_i$.

Practice 2:

The Root CA generates her own $PK_r$ and $PB_r$ key, and after it makes her certificate $Cert_r$.
The Intermediate CA makes a request of a certificate $Cert_i$ to the Root CA, and this last creates a key pair ($PK_r$ and $PB_r$ key) and send to Intermediate CA the certificate requested. In a second moment, the Root CA send (i.e. with an email) the key pair to Intermediate CA.

I'm using xca to test and understand what is the best practice.


texts: Are these hash function compositions collision resistant?

texts:
If a hash function $H$ is collision resistant, are the following two hash functions collision resistant or not?  ($||$ is concatenation)

$H'(m) = H(H(m)) || H(m)$

$H''(m) = H(m) || H(m)$

My first approach to the problem for the first function is this: by proof of contradiction, I find that there aren't $m_1 \ne m_2$ so that $H'(m_1) = H'(m_2)$, because:

$H'(m_1) = H'(m_2) \iff H(H(m_1))||H(m_1) = H(H(m_2))||H(m_2)$

If we suppose that $m'_1 = H(m_1)$ and $m'_2 = H(m_2)$ then:

$H(m'_1)||m'_1 = H(m'_2)||m'_2$  which is false because $H$ is collision resistant.

Is my solution correct or am I missing something?

I can apply the same technique to the second function, but what confuses me is that first half bits are always the same as the last half bits, and this definitely doesn't look secure. But collision resistance is all I need.


texts: Is it worth hiding an AES encrypted text string in a PNG image for better security?

texts: I need advice as to whether it is worth the extra "security" and processing of an AES encrypted text string to be hidden in a PNG image as opposed to an AES encrypted text string to be saved in a read-only text file. Both the PNG image and Text file would serve as publicly available AES placeholders that would be decoded via password in a web application. I gather that any hex editor or similar software could access the AES string anyhow, so, would there be any practical benefit security-wise in hiding the AES string in a PNG?


texts: I'm having some hard time understanding why the size of the share must be at least as large as the secret itself, why is this restriction imposed? What would happen if the share is smaller?


texts:
i have a question about CBC operating mode.
what problem happen if we always use IV Zero in CBC Mode?


texts:
Recently, I've been wondering what happens when I combine two stream ciphers $f_1$ and $f_2$ by xoring the keystream, so the final cipher would be:

$C = P \oplus f_1(K_1) \oplus f_2(K_2)$

$P = C \oplus f_1(K_1) \oplus f_2(K_2)$

Obviously, the keystreams shouldn't be the same because they would negotiate each other, so a few scenarios shouldn't apply:

$f_1 = f_2$ and $K_1 = K_2$ because they obviosly would create the same keystream.
$f_1 = f_2$ and $K_1 \neq K_2$ but there $f$ is insecure and $K_1$ and $K_2$ are part of a related-key attack so $f$ produces the same keystream.
Really bad luck?

Another thought was that the combination could be used to double the key length, as long as there are not related keys. Also given that $f_1 \neq f_2$ and an attacker is able to compute the keystream of only one of both,  he would be left with $C \oplus f_\mathit{other}(K)$ making the combination as secure as the most secure cipher used.

Finally, one last thought I had is that such patterns are already used in stream ciphers (e.g. A5/1) when LFSRs are combined so they might be secure?


texts:
In symmetric cryptography, a scheme is not considered secure if the data transmitted is only encrypted. The adversary will be able to modify messages to generate encrypted messages of his choice without having the key.

Is this applicable to asymmetric crypto such as RSA?


texts:
I would like to use the NaCl cryptography library (or TweetNaCl), but I would very much like to have perfect forward secrecy for my application.

From what I understand, all Bob needs to to decrypt a message from Alice with NaCl's crypto_box_open is the public key of Alice and his private key. Thus, if an eavesdropping adversary stored all messages and later gains access to Bob's private key, he can decrypt all previously stored communication.

Am I correct in this matter?
How would one best work around this problem? (preferably only using algorithms implemented in NaCl)


texts: Cryptosystems used to generate public key certificate

texts:
Where can we find the cryptosystems used to generate public key certificate? Are the cryptosystems under the signature algorithm and signature hash algorithm? Do I need to analyze the packets trasmitted between my computer and the server? For example, ciphersuite.

Suppose the following ciphersuites are transmitted from ClientHello to the server.

- TLS_RSA_WITH_AES_128_CBC_SHA256           (0x003c)
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256     (0xc027)
- TLS_ECDHE_ECDSA _WITH_AES_128_GCM_SHA256  (0xc02b)
- TLS_DHE_DSS_WITH_AES_128_CBC_SHA256       (0xc040)
- TLS_RSA_ WITH_RC4_128_MD5                 (0xc004)

Can I say that the cryptosystems used to protect the communication between my computer and the server are RSA, ECDHE_RSA, ECDHE_ECDSA and DHE_DSS?


texts: Is there a practical security difference between XXX-bit encryption?

texts:
I know I'm treading in dangerous waters asking this - my comprehension of cryptography math is sorely lacking. On the flip side it gives me massive admiration for what many of you are able to do.

From my understanding of crypto functions, a password is typically used to create a xxx-bit secret key. This could be 128-bit, 256 bit... 2048-bit (aka xxx-bit encryption) etc. This key is then used to encrypt the data via whatever algorithm is chosen (AES, etc). As I understand it (I could be wrong) you can either decode the information by supplying the correct secret key, or by supplying the correct password which produces the correct secret key.

Given that typically something like an 8 digit alpha numeric case sensitive password would supply 30 bits of entropy, my assumption is that in almost all cases the password would have significantly less entropy than the cryptographic secret key, hence the logical target for brute force attacks. Because of this weak point, which is independent of the encryption key length, is the target of the attack, is there any practical advantage of going for longer bit encryption schemes in keeping data safe?

Caveats

Being very new to cryptography, I probably have gotten terminology wrong. Feel free to correct me but don't get hung up on strict interpretation of what I've said, more the 'theme' of the question.
If I've gotten anything wrong about how the encryption process works please let me know.
This question is targeted towards encryption / decryption with human interaction rather than say SSL certificates. Let's assume a password exists and is used.
I'll try and follow any math you give, but you might lose me!

Thanks so much crypto. First question here, sorry if I've missed anything.

Edit: As an obvious follow up after two answers have been provided showing I'm largely on the right track with my thinking - What's the virtue of choosing longer keyspace algorithm? Again basic understanding is it would give "more" security at the cost of computational intensity in calculating the key. Why do we worry about 1024-bit and 2048-bit encryption? Aren't they both essentially unbreakable anyway?


texts: Security of RSA public key depending on how it's computed

texts:
I understand that the public key in RSA encryption may be computed using Euler's totient function or Carmichael's totient function.

I'm now trying to figure out how the choice of totient function affects the security of the public key, if any. Are there any ways in which a chosen totient function may make it easier or harder to compute the private key from the public key?

Edit for clarification: Are there any direct ways in which the choice of totient functions may affect the 'backtracking' process of figuring out the private key (d) from the public key (e)?


texts: Key storage management of session keys and long term keys

texts:
In key management, one of the topics is key storage, I want to know where and how these keys(long-term and short-term) are stored?
For example I read that android password apps use KeyStore api to encrypt the the user passwords. I found the following steps for these kinds of apps:
    1.Generate a random key when the app runs the first time;
    2.When you want to store a secret, retrieve the key from KeyStore, encrypt the data with it, and then store the encrypted data in Preferences.
    When you want to read a secret, read the encrypted data from Preferences, get the key from KeyStore and then use the key to decrypt the data.

Now the question is how does this randomly generated key gets stored in a safe way and then retrieved?(more common question is how apps store secrets used for encryption either in windows or android or other OSs)
About short term keys like session key for example TLS protocol for this website, I found out that they are stored in memory but again how? I mean can we access that part of memory?


texts: SIV - Synthetic IV - S2V Construction? Benefits over a MAC or Hash?

texts:
Looking at the SIV construction in rfc-5297 - https://tools.ietf.org/html/rfc5297

With regards to the generation of the SIV, using S2V construction, I am struggling to find the benefits of the chosen method of combining MAC codes together and has some questions I am struggling with:

What benefits does the doubling and xor provide over say a modern MAC and/or Hash function?
For example, if you used the following, how does the security differ?

$MAC( MAC($x$0), ... MAC($X$i)) $
instead of

dbl_Xor( MAC($x$0), ... MAC($X$i))
Where xi represents of your header inputs for 0 < i < blocksize-1.
Looking at the choice of a MAC, the proof works if its a secure-PRF. The authors choose CMAC and list that alternative could be used under different circumstances. There are many discussions on this forum on cipher versus non cipher based MACs and the differences mostly come down reducing the number of components you need to trust. Given this, for a SIV construction could you use a modern hash for the MAC instead of CMAC? say SHA3 or Skein-MAC (which is based off a tweakable cipher as well). ?

Thanks and regards


texts: How to calculate elliptic curve parameters?

texts:
I'm having a rough time understanding the math behind elliptic curves.
I want to implement ECDH where user can define a, b, and p parameters of elliptic curve.

How can I calculate generator base point G? Is it any point that satisfies elliptic curve equation $ y^2 \equiv x^3 + ax + b \pmod p$?

Also, how can I calculate order n and cofactor h given the base point?


texts:
The reference uses treeHash algorithm everytime a signature is generated, thus generating authentication path AND the root, which is not necessary, as the root has only to be generated once. Generating root with every new signature is not efficient, but are there more efficient ways to generate the authentication path without recomputing the xmss root?
My first approach is to save all the xmss leaves during root computation, then create authentication path out of them if needed, but this requires a lot of memory for bigger tree heights.


texts: 3DES over Galois Counter Mode (GCM) for authenticated encryption

texts:
Is it possible to use DES or 3DES over Galois Counter Mode (GCM) to provide authenticated encryption?

I haven't seen any implementation yet.


texts: Blum Blum Shub vs. AES-CTR or other CSPRNGs

texts: Following on from D.W.'s comments on a previous question, what properties does Blum Blum Shub have that make it better / worse than other PRNGs? Are there significant implementation difficulties or security issues with BBS?


texts: Does Runge phenomenon affect Shamir's secret sharing scheme?

texts:
Lagrange interpolation seems to be affected by the so-called Runge phenomenon when one tries to interpolate polynomials of high degree from a set of equidistant points.

Lagrange interpolation is used in some secret sharing schemes like Shamir's secret sharing, in which the polynomial being interpolated is not continuous but defined over a finite field.

Does any of you know whether this Runge phenomenon also exists or could also affect the accuracy of the interpolation done in Shamir's secret sharing scheme?


texts: Using ECB as RSA encryption mode when encrypted messages are unique?

texts:
As I understand, ECB should not be used as encryption mode unless you are encrypting single blocks of data which are always unique and only are encrypted once.

I have a collection of ids represented by integers that I encrypt and transmit (individually) with the same public key using RSA/ECB/PKCS1PADDING. Sometimes the same ids are encrypted and transmitted multiple times but as far as I can tell the ciphertext is never the same.

Can anyone tell me how this is possible? As far as I understand, this would not be an acceptable scenario to use ECB, but why are the encrypted messages never the same even though the key and plaintext messages are?


texts: Given a message and signature, find a public key that makes the signature valid (ECDSA)

texts:
This question is a variant on Given a message and signature, find a public key that makes the signature valid, which discusses the analogous question for RSA.  It was suggested to me by this post over on Bitcoin.SE.

Suppose we are given an ECDSA signature $S$, a message $M_1$, and a public key $P_1$, such that $S$ is a valid signature of $M_1$ with $P_1$.    Let $M_2$ be another message.  Is it known whether we can feasibly find another public key $P_2$ such that the same $S$ is also a valid signature of $M_2$ with $P_2$?

Is there a general name for this kind of an attack (on a general signature algorithm)?

What would be the practical implications of such an attack?  I can't think of any obvious way to use it to cause mischief, but I may just not be creative enough.

(Apologies if this is well-known or if my terminology or notation is bad.  I am a mathematician but not a cryptographer.)

Edit: Thanks to Ricky Demer for the link to the paper by Pornin and Stern (see comment below).  In their terminology, if I have it right, this attack is called a second key construction, and a vulnerable signature algorithm is said to lack destructive exclusive ownership.  They also describe a way that an attacker could use this to produce a fake revocation of a victim's X.509 certificate.


texts:
I am by no means an expert in the PQC field and am just trying to self teach myself about it. I was hoping to look into error correcting in lattice. I want learn about error or fault detection as it applies to lattice, but I am unable to find many resources.
Does something like CRC apply to a lattice? Or are there lattice specific mechanisms?
I know this is a little broad, just looking for some insights.


texts: Another cut-and-paste attack on CBC mode

texts:
I am trying to see specific cases of attacks in the CBC mode, in particular, I am investigating some attacks such as Example of a cut-and-paste attack on CBC. Here I have posted something similar and I have received great answers that are also very clear. But I have tried to look for more examples cut-and-paste attack and I have come across the following that I would like to solve and understand as well as possible:

An attacker intercepts the following encrypted text (encoded in hexadecimal):

74620075616f0ef33e9d10b5780639a4 dc8c17e186380f131a2c5916ea2144be

He knows that plain text is the ASCII coding of the message  "A Alice 10,000" (excluding quotes).
The attacker also knows that CBC mode encryption was used with a random IV that uses AES as the cipher of underlying block.
Show that the attacker can change the encrypted text to decrypt "A Alice  90,000"
.What is the resulting encrypted text (encoded in hexadecimal)?
This shows that CBC does not provide integrity.

We have to modify the encrypted text so that it decrypts what the exercise asks for, I suppose we have to change, in the plain text that is encoded using ASCII the character or characters that correspond to the number 1 by the number 9, to do this I don't need to know the initialization vector and the key? How could I solve this exercise easily?


texts: Give a simple hash chain example in Java

texts:
I am looking for a very simple example of cryptography hash chain source code. Could you forward me some examples or link, guys?
For example, https://en.wikipedia.org/wiki/Hash_chain [1].
h(h(h(h(x)))) gives a hash chain of length 4. h=hash, x=password


texts: How can I validate my implementation of Ansi 9.19?

texts: I implemented an Ansi 9.19 mac generator in java, but now I don't know how to validate its functionality. I couldn't find any sample of a {plain text,key,mac} on the internet, and I want to know if there is a good way to test my implementation.


texts:
I'm a big fan of Colin Percival's "Cryptographic Right Answers" post.

This was written in 2009, which is a long time ago in Internet years.

Is the advice still valid or, if not, can someone point me to more up-to-date information?


texts: ZK proof of "element in subgroup" protocol

texts:
Consider the following protocol for $P$ and $V$ :

Note: The multiplicative group is $Z_p^*$ and $p$ is prime.

Note: The protocol is for proving that $x \in \langle \alpha \rangle$.

Input to $P$ and $V$ : a prime $p$ and $\alpha, x \in Z_p^∗, k = \log_2(p)$.

Input to $P$ : $y$, so that $\alpha^y = x \bmod p$.

Protocol:

$V$ checks that $\gcd(x, p) = \gcd(\alpha, p) = 1$ and rejects if this is not the case.

$P$ chooses $r$ at random in $[0, p - 2]$, and sends $a = \alpha^r \bmod p$ to $V$.

$V$ chooses $b$ at random in $\{0, 1\}$ and sends $b$ to $P$.

$P$ sends $z = (r + by) \bmod (p-1)$ to $V$.

$V$ checks that $\alpha^z = ax^b \bmod p$. If OK, then accept, otherwise reject.

Problem:

I've already proven completeness and soundness of the protocol. However, I need to prove that it is zero-knowledge.

To do this, I consider a simulator playing the role of $P$.

I know, I could use the Rewinding Lemma, so I consider a perfect honest-verifier simulator.

I try to follow the ZK proof of the graph isomorphism protocol, however, I'm stuck.

I don't know how to respond if $b=1$, since I cannot assume the simulator knows $y$. The $b=0$ case is easy.

Can someone help me out?


texts: KDFs for symmetric encryption master key & serial number

texts:
Let's assume that I generate a high entropy AES master key (through /dev/random for example) and I want to derive it with a fixed-length serial number (12345 for instance).
The derived key is used to encrypt and authenticate files that can be read by a specific device only (with said serial number). Therefore, to create files for that device, only the master key and the serial number would be required.
Which KDFs would you recommend for that scenario?
Thanks!


texts: Given two commitments on different values, Can a third party compare those two commitments to know which one is the higher value?


texts: Encrypting and Authenticating The Simplex Communication Between Embedded Devices

texts:
I am planning to build temperature sensor nodes for my home heater control. Central device will control the heater using temperature data read by nodes. These nodes will send temperature data to central device over RF communication periodically. There will be no acknowledge from central device to nodes. I want to learn something about encrypted communication at the same time. I have little general knowledge and no experience about encryption.

It is common that today microcontrollers have built-in cryptographic engine supporting AES with ECB, CBC, OFB, CTR and CFB128 modes with true random number generator. (ref)

I have two goals:

Communication should be encrypted. Attacker can't read the temperature value by sniffing.
Once a node sends a encrypted message, this messages should become invalid for retransmission. For example, each message should be different even if a node transmits the same temperature value. Attacker can't act as a true sensor node by transmiting false temperature values to my heater.

My questions are: (Please consider that I have no background in cryptography.)

Encryption is not so hard. For example, I may use AES-128. But simple ECB mode doesn't satisfy my goal #2. If temperature doesn't change, AES-128 output will also be the same. AFAIU I should use encryption + authentication. I have to ensure that encrypted message is sent from a valid node not from an attacker. Is authentication term is the correct one for this case? For example, does AES-CCM overcome this problem? I read several sources about AES-CCM and other encryption + authentication methods and I couldn't correlate my problem with the authentication term used in cryptography.
Let's say that node increments a counter by one at each transmission. Plain data is now value of counter + temperature. Plain data is encrypted and sent. Counter ensures that data changes even if temperature is the same. Receiver now tracks value of the counter and ignores the message if it is not incremented by one (or within a range). It should help me to satisfy goal #2. I think this approach is similar to Keeloq algorithm. Attacker shouldn't guess the next encrypted text easily. Does it make sense?
Hardware has true random number generator. Can it be used somehow to make communication more "secure"? For example plain text =  value of counter + data + some random bits. Does random bit stuffing make any improvement?
Probably my ideas are the worst ones. What would you suggest for data validation? How can a node "sign" its data?


texts: How to verify if g is a generator for p?

texts: For learning purpose, supposed I have a 16-digit prime which is 2685735182215187, how do I verify if g is a generator? (p is supposedly a special kind of prime)


texts:
I need some guidance here:

assuming I have the following:

(PreSharedKey of 32 bytes) XOR (one time Random Buffer of 32 bytes)

The only way to crack this should be brute forcing, correct? One of the issue in sending out the XORed value is to disclose the PSK length. At this point I could add some random bytes at the end of the XORed value to avoid this (the two ends knows the real PSK len). But does it make sense? Or it would be better to just  increase the PSK (and the random buffer) length of the same number of bytes to get more security?

Sorry for the newbie question...

Thanks,


texts: Is it safe to use ChaCha20Poly1305 with empty AAD? I tried to implement E2E encryption between two clients in network.


texts:
I'm trying to crack a cypher that I believe is Vigenère encrypted and I'm currently stuck.

I calculated the key length by finding repeated sequences in the cypher and calculating the the common factors.

Word    distance factors
agzd    16       2,4,8,16
zna     92       2,4,23,46,92
zdc     54       2,3,6,9,18,27,54
csio    44       2,4,11,22,44
omy     46       2,23,46
zab     5        5

I assume the key-length is 4 as these are the once that are common factors, but from here on trying to map the correct caesar shiffre for each position I'm stuck.

Can somebody confirm that my key-length calculation has no errors which would explain why I can't solve the cypher.

Here is the cypher:

jD 2GSA 7HNA ZNA w.m. V7KXA 36HBM MKE5 /H SGP9 +R GKKJ 2I A4OTC KDBCUR. 19+R 8Y TKJ JG4 IGO6 6U4T OJ hH/BIK. 196 qFKT+9 BNJK ZD6+Q AGZD. kJ'R EaOP6 4NCR ZK 36 / AGZD6C/HOIE2D. x0ZNAC2S8IO8DI HB xX8D4D 0XK O66M 0Y MN62S 8TZABBD2Za8BI. lBJ HA+DF 6UU/ 2J /FOZDC6S8I OJ kDC8G OO 2BLCYZ O66M 0Y G 925F4 UL J2JHCTGH FHH3K


texts: Using a PRNG for a stream cipher instead of a dedicated algorithm

texts:
I am aware, that it is possible to build a stream cipher using some deterministic PRNG (like HASH_DRBG or CTR_DRBG) with good key material as the seed.

What are the advantages of using a purpose built stream cipher algorithm (like Salsa20 or RC4 before it became obsolete) over a generic PRNG?


texts: how many pairs of plaintext-ciphertext are needed before we break AES?

texts:
Imagine a set of words ($plaintext$) each are encrypted using AES-ECB mode and due to some leakage in the system an attacker could gain access to some pairs of $plaintext$ and $ciphertext$. But once the attacker got bunch of such pairs he cannot further ask the oracle for any other pairs. So in reality how many such pairs of $plaintext$ and $ciphertext$ are needed to crack the $key$.

Here each input $|plaintext| < 128$ bits.


texts:
I'm writing a tool to do security posture assessments of SSL/TLS services, and ran into an interesting result. I ran through all defined cipher suites to test which could be negotiated (like sslscan does) and found that an unusual PCT-related cipher suite, PCT_SSL_CIPHER_TYPE_1ST_HALF (0x830004) appeared to be accepted by a number of sites.

I'm aware of PCT as a precursor-of-sorts to TLS, alongside early SSL implementations, but I can't find any information as to what PCT_SSL_CIPHER_TYPE_1ST_HALF is, or why modern SSL/TLS stacks would ever negotiate it successfully.

What is this suite? Why can I negotiate it?


texts:
Here author seems to give overview of merkle trees.

However, I have one problem.

As in the article author claims you can use merkle trees to verify authenticity of data, e.g. if piece of data is authentic.

But I could use a simple hash of the file (signed), for authenticating/checking integrity of file too, right?

Why employ merkle trees for this purpose?
So it seems I am clearly missing something. Can someone enlighten me on this?


texts: What operations provide perfect secrecy other than modulo addition

texts: As far as I know OTP is the only algorithm proven to provide perfect secrecy. It can work with XOR which is addition modulo 2 and obviously it can work with additions modulo N. What other operations enable perfect secrecy? Can we for example have randomized tables to define the mixing of data and key and still prove the perfect secrecy property of OTP?


texts:
This is a homework assignment, so I'm not expecting full solutions, just general guidance.

  Let a PRG $G:\left\{ 0,1\right\} ^{n}\to\left\{ 0,1\right\} ^{l\left(n\right)}$ (where $l\left(n\right)$ is a polynomial and
  $l\left(n\right)>n$).

  Is $G':x\mapsto G\left(x\|x\right)$ a PRG? (where $\|$ is the concatenation operator).

My intuition (that is probably wrong) says it is not, since $\left|Im\left(G'\right)\right|\leq2^{n}$ whereas $\left|Im\left(U_{l\left(2n\right)}\right)\right|=2^{l\left(2n\right)}>2^{2n}$.

I'm not sure however how to show this.

I want to show a distinguisher between $U_{l\left(2n\right)}$ and $G'\left(U_{n}\right)$ with a non-negligible advantage, so I get input $z\in\left\{ 0,1\right\} ^{2n}$ and need to decide from which distribution it came from.

I thought about just checking whether $z\in Im\left(G'\right)$, but that can take $2^{n}$ to compute.

I would love some direction. Thanks!