texts:
There are limits to how much you can use a the DRBG before you have to reseed
it, but are there any limits to how much you must use it before reseeding?

Take the following scenarios as an example…

Usually you seed the DRBG once, then you use that instance until you reach the
reseed limit. Like so:

seed     = seedFromUrandom    // Reads entropy from /dev/urandom
genStart = drbgFromSeed seed
(v1, gen1) = genBytes genStart // Generates random data and the next state
                               // of the DRBG as a tuple
/*
    Code using the random data in v1
*/
(v2, gen2) = genBytes gen1 // Generates more random data and the next state
                           // of the DRBG as a tuple. Note that gen1 is
                           // used here and not genStart.
/*
    Code using the random data in v2
*/

What if you created a newly seeded instance each time you want to generate
random data? Like so:

seed     = seedFromUrandom    // Reads entropy from /dev/urandom
genStart = drbgFromSeed seed
(v1, _)  = genBytes genStart // Generates random data and ignores the
                             // next instance of the DRBG.
/*
    Code using the random data in v1
*/
seed     = seedFromUrandom    // Reads entropy from /dev/urandom
genStart = drbgFromSeed seed
(v2, _)  = genBytes genStart // Generates random data and ignores the
                             // next instance of the DRBG.
/*
    Code using the random data in v2
*/

Please note:

When I say “DRBG”, I mean the NIST standardized number-theoretically secure
random number generator. Either HMAC (SHA512), Hash (SHA512), or counter
(AES 128).
Like stated in the pseudo-code, entropy is read from /dev/urandom.


texts: AES CBC mode or AES CTR mode recommended?

texts: What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?


texts: SHA-1 hash where each of the first 16 bytes is even

texts:
Is it possible for a SHA-1 hash to have the first 16 characters with a character code $c$ where $c \bmod 2 = 0$?

So given the hash, hash[i] % 2 must be 0 for all 16 characters.


texts: Relationship between $N$ and $\phi(N)$ in the RSA algorithm

texts:
Recently I started learning how the RSA algorithm works and there is one single part of the computation which really confuses me and can't get over it.

Let's say I chose 2 prime numbers,

namely

$P = 3$ and $Q = 11$

$N = 3 \times 11 = 33$

$\phi(N) = (P-1)\times(Q-1) = 20$

Now, I have to chose e based on some criteria (as per RSA), let $e = 7$
Now, I have to determine $d$ by using, $e^{-1} \equiv1 (\bmod \phi(N))$
When I encrypt and decrypt,

a) cipher = $m ^ e \bmod N$

b) message = $c ^ d \bmod N$

In the above case, instead of $\bmod N$, for the same example, I tried different $N$ than the actual $N$ ($33$), it didn't work for any other number other than $33$. Why is it so? I can feel since finding $d$ is based on inverse under $\bmod \phi(N)$, there is some relation between $N$ and $\phi(N)$, but couldn't get my head on it.

Is there some relation between $N$ and $\phi(N)$, if so, how can I learn about it in detail?


texts:
I just saw a video at CNN in which it is claimed that, if the server isn't generating a random public key, the server can be hacked.

First how HTTPS works… to be sure I’m on the same page:

Server has a public key and a private key. Client uses the public key to encrypt data before sending it to the server. Then the server uses its private key to decrypt that data… which is the only way to decrypt it.
Client makes sure – using an SSL service provider – that the public key the server is offering is indeed genuine and belongs to that server. Otherwise, if someone “in-the-middle” would change the key, then that someone (via a fake server) would be able to read the data instead of the actual server.

Questions:

Does a server that offers HTTPS have to update its public key for every request it gets? Or is it true that – usually – it doesn't and therefore the claimed flaw exists?
How is the man in the video able to get the password? How is he able decrypt without using the private key?

If my understanding of SSL is bad, so it would be nice if you could explain this flaw to me.


texts: Method and explanation for calculating difference in speed between DES and RSA

texts:
Our assignment asks us to convert an RSA speed in bytes per second to a DES speed in bytes per second. Our professor's treatment of this ("RSA is 100 times slower than DES") seems insufficient. Could anyone explain how this conversion is calculated?

Thanks.


texts: Synthetic Jitter to Combat Timing Attacks

texts:
We are working on some tooling. It has a networking kernel.
We would like to think that jitter built into the kernel would help with timing attacks?

Is this true?


texts: Why use a 1-2 Oblivious Transfer instead of a 1 out of n Oblivious Transfer?

texts: When initiating an oblivious transfer, why would someone use a 1-2 oblivious transfer rather than going for an 1 out of n oblivious transfer? Perhaps a slight time overhead for the extra message encrypts, but with everything as fast as it is these days is that a concern?


texts: RSA - What's to stop someone from using the same ciphertext to mimic private key holder?

texts:
I've recently looked into fundamentals of RSA and think I understand how it works. However, there's one basic problem I can't seem to figure out. If someone received ciphertext for a given message, what is to stop them from sending the same message/ciphertext to other nodes in a network and pretending to be the private key holder?

For example, suppose Alice is a general and commands soldiers Bob, Sue, and Jerry. Alice generates private key (n, d) and public key (n, e) and sends (n, e) to all soldiers. The soldiers wait for Alice's instructions every day, which is either "attack" or "don't attack". Alice sends encrypted message "attack" to the soldiers via RSA as ciphertext to all soldiers. Now suppose one of the soldiers is malicious and has hacked Alice's delivery method (e.g. email), but not her private key. And on a separate day sends the same "attack" encrypted cypher text to all other soldiers. What's to prevent this from happening (even if you use padding which will always result in decrypted message "attack")?

I suppose one way is to add a timestamp to all messages and soldiers must make sure the date matches with current day. But it still doesn't seem right that someone can send the same exact message to others by just having the cyphertext... Or am I missing something?


texts:
When it comes to exchanging secure information over an insecure channel, this approach is considered. It all depends on the nature of photons in which the third polarization is focused. It can easily be trusted when it comes to exchanging the Secret keys without facing any issue.

What is Quantum Cryptography?
What are the differences between modern cryptography and quantum cryptography?


texts: EdDSA Verification vs. Cofactorless Verification

texts:
In the EdDSA for more curve paper the authors defines:

Keys

  An EdDSA secret key is a $b$-bit string $k$. The hash $H(k) = (h_0, h_1, ... , h_{2b−1})$ determines an integer $s = 2^n+\sum_{c≤i<n} 2^ih_i$ , which in turn determines the multiple $A = sB$. The corresponding EdDSA public key is $A$.

Note that $B$ is defined to be a point of order $l$ where the cardinality of the curve is $\#E(p)=2^cl$

Signature

The signature of a message $M$ under key $k$ is created as:

Define $r = H(h_b, ...., h_{2b-1},M) \in \{0,1,...,2^{2b}-1\}$.
Define $R = rB$.
Define $S = (r + H(\underline{R},\underline{A},M)s) \mod l$

Output: $(\underline{R},\underline{S})$
(note that underline is a byte encoding of points or integers which doesn't matter for this question)

Verification

Verification of a signature  $(\underline{R},\underline{S})$ of a message $M$ is defined as:

$2^cSB = 2^cR+2^cH(\underline{R},\underline{A},M)A$

Cofactorless Verification

Cofactorless verification of a signature  $(\underline{R},\underline{S})$ of a message $M$ is defined as:
$SB = R+H(\underline{R},\underline{A},M)A$

They comment that:

  Any alleged signature that passes cofactorless verification will also pass verification. The signature of a message will pass cofactorless verification, so it will also pass verification. However, a signer using a secret key outside the above signing procedure can create strings that pass verification without passing cofactorless verification.

I can't really understand the above comment and I have a few questions.

What does it mean "secret key outside the above signing procedure" ? Does it  mean that $s$ is a string without a leading nth-bit set and not multiple of $2^c$ ?
How does the $2^c$ factor affects the verification compared to cofactorless verification?
Can you provide me an example/way of generating a secret key "outside the above signing procedure" that generates a signature that pass verification without passing cofactorless verification ?


texts: What format should a salt be when it is concatenated with the password?

texts:
Assume that, in the available environment, it is not possible to use modern password hashing functions (bcrypt, scrypt, Argon2, PBKDF2, etc.), so it is necessary to roll my own stand-in, until they become available. (Or call it a theoretical question, because either way I'll learn something from your answers.)

With a simple (uniterated) SHA256 of the password and a random 256-bit salt, when concatenating the salt and password, is it better to use the binary form of the salt, or is a base64 representation just as secure?

For example, with the salt, hard-wired to 256 bits, it will always end in a '=' in base64 (if the extra character isn't dropped). That seems like it's not ideal.

(Assume the salt is stored with the hashed password, both as base64, so concatenation is easy with that form.)

I Googled and searched here, without much that seemed related to the specific format of the salt when it's being concatenated. This question mentions a length extension attack, which I would think might be easier with the textual base64 salt. (Oh, and this question talks about nested hashes to address the length extension attack as well, but that doesn't seem to apply? and doesn't address the salt format.)

Is the salt format moot because the entropy of 32 binary bytes is the same as 42.7 base64 characters, or is one format really a better choice?


texts: ECC keys vulnerable to brute force attack?

texts:
I have started learning about Elliptic Curve Cryptography (ECC). Since the key size required in ECC is relatively smaller than the key size in RSA (to provide the same encryption strength), I wonder whether the smaller key size of ECC makes it vulnerable to brute force attack.  Does it?

I'm not very knowledgeable about the ways in which a key can be cracked.  But, basically, fewer bits means the number of possibilities can be more quickly guessed or tried!


texts: Why does lattice KEX not require sampling with high precision?

texts: I was reading the NewHope paper, and I see that they are using Binomial distribution and not a discrete Gaussian distribution as was used by BCNS. I also remember hearing somewhere that lattice key exchange does not require a very high precision sampling, whereas signature schemes need high precision sampling. Why is this distinction? How does the sampling algorithm used affect the security in these schemes?


texts: I just came across this term “forward search attack” while reading about Interchange key and Session key. The book mentioned that using session key helps to prevent attacks such as forward search attack.


texts: DSA: How to calculate 224-bit $q$ for 2048-bit $p$

texts:
$p$ is a 2048 bit prime number

$q$ is a 224 bit prime number

I know that $q$ is a prime divisor of $p-1$, thus $p=1 \bmod q$ but I couldn't write efficient code to calculate this.

I can calculate 2048 bit prime $p$, but how to find $q$ efficiently?

Currently what I am doing is generating 224-bit primes and checking whether they are dividing $p-1$ or not but it takes forever...


texts: Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

texts:
It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software without being vulnerable to timing attacks (other than by linear search through a large array, which is much, much slower).  Since these algorithms are also ill-suited to hardware implementation (since the S-box must be stored in RAM), this seems to make the algorithms suboptimal for all purposes.

Is this assessment correct?  It seems strange to me that I can come to such a strong conclusion.  Yet I cannot think of any way to (reasonably) implement key-dependent S-boxes in constant time, so my point seems to still stand.


texts: Enhance security by combining bits of 4 different hashes

texts:
Assuming that performances do not matter, is there any real benefit in terms of security (in general) in combine hashes in this way:

hash functions:

Blake512 (b)
Groestl512 (g)
Kekkack512 (k)
Skein512 (s)

Output:

## imagine the outputs of each function as 512 single bit:
b1b2b3b4......b512
g1g2g3g4......g512
k1k2k3k4......k512
s1s2s3s4......s512

Mix:

## combine the top 128bits of each output into a 512-bit hash
b1g1k1s1 + b2g2k2s2 + ....... + b128g128k128s128

Does this make sense?
If yes, do I loose security (in general) by truncating each hash to 128 bit?

ps. it's not meant to store passwords


texts: HMAC for provable server distributed randomness

texts:
I have an application in which a user must use a high-entropy salt to salt a message. Due to the fact that I can not rely on the user to actually provide a strong salt, the server must provide this salt instead.

The server needs to keep track of this salt so that it can later verify that a valid salt was used. This adds unfortunate statefulness.

However I was wondering if a stateless solution exists.

For example: Using an HMAC where the HMAC key is a server secret and the HMAC message is not a reliable secret at all (a username, for instance). The benefit of this would be that the server can statelessly verify valid server-generated salts. However, this seems like a dangerously "clever" solution that probably has a huge lurking flaw I'm unaware of.

Is this reasonable, or is there some other solution to this problem that is well vetted?


texts:
How are IVs used in association with RSA Encryption?

Can someone explain why we use them in this RSA context?


texts: I was looking at how SHA-512 works, and I have a question. Imagine I want an input $N$ of 512 bits whose hash in hexadecimal starts with the digits 12345678. How could I determine an input $N$ to get that hash output?


texts: Are SSL/TLS used for maintaining data confidentiality?

texts:
In SSL/TLS, we use symmetric and asymmetric keys to encrypt the data. Does that mean that the keys are used to encrypt the data (preserve the integrity) or provide a secure channel for the data to be sent?

And as far as I know, hashing algorithms – inside of the SSL handshake protocol – are used to provide data integrity. So when data is encrypted via SSL/TLS, do they:

Encrypt the data like hash algorithm, or
Encrypt the data so that there is no eavesdropping of data? Meaning: they provide a secure channel which means they make use of symmetric, asymmetric key to preserve data confidentiality (no eavesdropping) and hashing to preserve integrity?


texts: RSA Accumulators with auxiliary information or known trapdoor information

texts:
In "Universal Accumulators with Efficient Nonmembership Proofs" by
Jiangtao Li1, Ninghui Li2, and Rui Xue3 section "How to compute witness with the auxiliary information" the authors write:

"The membership witness and nonmembership witness can be computed efficiently given the auxiliary information $aux_f$. Suppose there is a trusted group manager who knows $aux_f$, maintains the set $X$, and has already computed the accumulator $c = f(g, X)$, the group manager can compute (non)membership witness for any $x \in X_k$ with one short modular exponentiation.

For $x \in X$, the group manager first checks whether $x \in X$, then computes
$a = x^{−1} \bmod \phi(n)$, and finally computes $c_x = c^{a} \bmod n$. The membership witness for $x$ is $c_x$. It is easy to verify the correctness of the witness as $(c_x)^x = (c^a)^x = c^{x^{−1}·x \bmod \phi(n)} = c \bmod n$."

When I try to apply this I always get membership in the accumulator as true, even when the tested number is not in the accumulator.

Example:

$$
c = g^{x_1 x_2 \cdots x_k} \bmod n
$$

According to the authors I should calculate the witness of $p$ (a prime number) as:

$$
c_p=c^{p^{−1}mod \phi(n)} \bmod n
$$

Then check if $(c_p)^{p} = c$.  This is always true if $p^{-1}$ exists. As per the proof presented by the authors, even when $p \notin X$.

On the other hand if I store the full exponent of accumulator $c$ as $e = \prod_{i=1}^k x_i $ I can test if an element is a member of the accumulator or not by calculating:

$$
w_p = g^{e / p \mod \phi(n)} \bmod n
$$
$$
c' = (w_p)^p \mod n
$$

$$
  isMember(p) = \left \{
  \begin{aligned}
    &\text{true}, && \text{if}\ c'=c \\
    &\text{false}, && \text{otherwise}
  \end{aligned} \right.
$$

This works but I have to store the full exponent $e$ instead of just storing accumulator $c$ and using trapdoor $\phi(n)$ to calculate witnesses on the fly.

What am I doing wrong? How can I use the knowledge of the accumulator's trapdoor to calculate valid membership, or non-membership, on the fly just by knowing the accumulator's value $c$?


texts: Does adding complexity mean a more secure cipher?

texts:
I have a cryptography workshop question I'm having trouble with as follows;

Person A creates a cipher $E_k(m)$ which produces a ciphertext from message $m$ using key $k$. The function inside $E$ is kept secret but the length of $E_k(m)$ is known.

Person B recommends "increasing" security of the cipher by instead doing :

$(E_k(m) \oplus m)\ ||\ (E_k(m) \oplus 1111...11)$

Does this in fact increase security of the cipher or increase new problems.

My thinking is, depending on the function within $E$, xoring the output of the cipher with the plaintext message $m$ could expose the key $k$, meaning the extra complexity is for nothing. Am I on the right track, or am I missing something?

I have tried searching for examples of similar schemes and found nothing (which probably means it's not a good scheme) but I need to justify my answer.

Any steers in the right direction would be greatly appreciated, I'm more than happy to do the research myself just unsure what specifically to look for.

Unfortunately the above context is all I have been provided for this question.


texts:
I am wondering whether an attacker can gain any useful information from having several hashes of an unknown plaintext that differs in relatively few bits. For example, if provided with:

H1 = SHA-256(TXT | 1)
H2 = SHA-256(TXT | 2)
...
HN = SHA-256(TXT | N)

Can an attacker recover TXT more easily?


texts: Modulo settings for successful encryption?

texts:
I saw this awesome video which shows how encryption works using "discrete logarithm".

The example says: $3^x\mod17$. I understood that $3$ is called “generator”, because it has no "straight" root and when used with any exponents it walks through entire clock (till $17$ in that case).

Would saying $3^x \mod 449825$ make it any weaker, easier to crack, or anything alike? Is there anything I should watch out for when choosing that number?
If it's a logarithm, why is it the function having $\mod x$ in it? I have $\log(x)$ on my calculator, not $\mod x$. Is it correct that $\mod x$ stands for modulo?


texts: is it possible to extract a "hint hash" of some kind from another hash?

texts:
I'm a web developer starting to dip into cryptography so please bare with me on this...

Let's say I have a collection of hashes that were generated from some common data i.e. changes to multiple records. Is there a way that I could generate a secondary hash from the main hash and compare it to the other hashes based on how the main hash was generated. For example...

plain text             | hash      | hint hash
----------------------------------------------
"USER:123:fName:Alice" | 92eb5ff.. | 3cd24
"USER:123:fName:alice!"| 1c77753.. | 3cd24
"USER:456:fName:Bob"   | fee6ae2.. | 7d28e
"USER:456:fName:bob!"  | 7775315.. | 7d28e
"USER:789:fName:Carl"  | fec3ad7.. | 75315

Notice how all hashes are unique but the hint hashes match up to the record IDs they are hashed from. So if I generated these hashes based on the plain text and some key i.e. genHash(plainText, keyText). If you only had the hashes, you could associate which hashes are related to each other by their hint hashes only. So if I only had the hashes, I could still find their associations with a couple getHintHash(hash) calls...

Table of hashes:

hash
---------
92eb5ff..
1c77753..
fee6ae2..
7775315..
fec3ad7..

Table of hashes with hint hashes:

hash      | hint hash
----------------------
92eb5ff.. | 3cd24
1c77753.. | 3cd24
fee6ae2.. | 7d28e
7775315.. | 7d28e
fec3ad7.. | 75315

Now I have the relationships between the unique hashes without exposing the plain text that generated them. Is this possible? Remember, the hashing function got the plaintext and a key that the "hint hash" could be based off of...

genHash("USER:123:fName:Alice", "USER:123") -> 92eb5ff..


texts: Equal length of primes in paillier cryptosystem

texts:
In the key generation step of paillier cryptosystem ,

In order to satisfy  $\gcd(pq,(p-1)(q-1))=1$ , we can take equal length primes.

Instead of taking(length as parameter to generate $p,q$) equal length primes , is there any time efficient method to generate $p,q$ that assures
$pq,(p-1)(q-1)$ are relatively prime ? Or is it mandatory to take equal length primes for efficient implementation .

Just out of curiosity I want to know whether there are any public-key cryptosystems in which primes of equal length are mandatory. If there is , please list names of few of them.

Some work :

Let $p,q$ be the primes such that $p<q$.

Then $p\not|(p-1)$ and $q\not|(q-1)$

Since $p<q$ , $q\not|(p-1)$

So , the only chance to violate the condition $\gcd(pq,(p-1)(q-1))=1$ is $p|(q-1)$

More generally largest prime number minus one does not consists of smallest prime number as a prime factor .

How to ensure this without taking equal length primes ?


texts: The SHA spec states - eg, in the case of SHA-224 and SHA-256 - that the constants "represent the first 32-bits of the fractional parts of the cube roots of the first 64 primes". How are these values "represented"?  Beginning with a prime number, and ending with the hex constant, what is the correct sequence of steps to generate all of the constants as provided in the spec?


texts: What is the fundamental difference between image and text encryption schemes?

texts:
I don't know where to ask this question, I hope I am in the right place to ask about this.
So, what exactly is the fundamental difference between image and text encryption techniques?
link 1
link 2
link 3
I mean there are a lot of researchers (for example on the above links) that said AES, DES, RSA, etc. are not suitable for encrypting images because of image characteristics (high redundancy, high correlation, and large volume). Some of them imply that it will have a long encryption time because of the size and the low security it provides since the data originally has a high correlation. Hence they develop image encryption schemes using chaos theory, optical transform, random grids, DNA coding, compressive sensing, and so on.
Is the diffusion or confusion technique fundamentally different? If it is, how exactly does it differ from text encryption's confusion and diffusion? If it is not, why not just use text encryption by modifying AES or DES so that it takes an input of an image and output it as an image? I haven't found any articles that literally describe what differs between image encryption and text encryption techniques/methods.


texts:
I'm thinking about the evaluation of a cipher or separate cipher round as a PRNG. In general, we can encrypt consecutive natural numbers and check them with some randomness test. But PRNGs don't work like this. They use their output like a new input.
Shouldn't it be like that the ciphers should have long periods in such a test? Do they have long periods? If not, they should not be considered good PRNGs, correct?  And is it possible that a cryptographically secure PRNG will have a short period for some inputs?


texts: I was trying to work out the security of an system that used the polarized LCD panel over an OLED display (the point being that you can only block certain pixels) and the pixels are either on or off (white or bleck). When the device is enabled someone a random key (lets aim for the best, one time pad quality) is generated that will block a random set of pixels and allow others to pass through unaffected. What is shown is the original display with some pixels blocked off. The blocked off pixels are known only by the content generator and the filter (not the device containing the OLED display). My question is how do I model this system in order to determine what sort its cryptographic quality.


texts:
I was asked to encrypt a message by applying backward-compatible triple encryption using the 8-bit key $k = (k_1, k_2)$ where $k_1≠k_2$.

I'm a little confused because I thought all 3 keys had to be independent for it to be backward-compatible with DES, unless by backward-compatible they were referring to something else? Thanks.


texts: Size of group for Elliptic curves vs RSA for equal security

texts:
For my research, I would like to compare the efficiency of a scheme when instantiated with Elliptic curves and RSA. So, I would like to know a "latest" comparison (as of 2018) on what group sizes of ECC and RSA provide equal amount of security. I found some references online, but they are really outdated and I would like to have a latest comparison on their security.

For example, I would like to have a table of the form for each of the 15 NIST curves.

2048 bit RSA - 224 bit ECC curve - xx bit security.

1024 bit RSA - 160 bit ECC curve - xx bit security.

What are the time complexities of best attacks in each case? Does the comparison matter whether the group is being used for encryption or signatures? It would be helpful to provide an explanation on why those groups provide the corresponding amount of security.


texts: Determination of the key rate of BBM92 Quantum Key Distribution (numerically)

texts:
I'm currently working on a Python Program which aim to return the secret key rate of a specific
Quantum Key Distribution protocol (Brassard, Benett and Mermin 1992 i.e. BBM92). A colleague will provide me with the result of this protocol.
However, I am still looking for the right formalism to express this secure key rate.
So, are there existing formalism(s) to to express the secure key rate?

And optionally: Do they have public software support?


texts: Does the SHA-256 sum of a 256-bit key help you crack it?

texts: If I have the SHA-256 sum of a 256-bit AES key, can I determine the key any faster than if I merely had a ciphertext and the corresponding plaintext?


texts: Cryptanalysis of a feedback shift reigister with an S-box

texts:
I’m just getting started on learning cryptography and here is a problem from exercises about which I'm totally confused:

This is a 32-bit feedback shift register to encrypt some message. The register shifts circularly by 4 bits. Before each shift the S-box takes the last 4 bits and feeds the 4-bit output back into the four bits just next to them (as shown above). This cryptosystem is keyed by the contents of the S-box. The questions are:

  If the S-box is not invertible, how many bits of information does it contain? And what if the S-box is invertible but entries selected randomly without replacement?

So what I'm confused about is: why is this cryptosystem "keyed by the contents of the S-box"? How to decrypt the ciphertext if we know the S-box (and times the register shifted if necessary)? And what does "information contained by the S-box" mean? How does the invertibility of the S-box affect the bits of information it contains?

I know that the initial value of an FSR is called the "seed" and from that the register can generate some pseudorandom keys to be used in some cryptosystems. But in this problem it seems that the seed itself is the plaintext to be encrypted and the ciphertext is one of its successors. Also, I know an S-box is used to perform substitution but I've never heard something about "the information it contains".

Hope that I've described this problem clearly.
Thank you guys in advance :)


texts: Pseudonymous publication of a series of texts online when a bad guy is expected to join in with fakes: will this approach to PGP verifiability work?

texts:
Alice wishes to publish under a pseudonym a series of texts online. She expects the texts to circulate, and she will not include any way of contacting her. Bob will not know the identity of the pseudonymous author but he will seek to confuse the author's audience by publishing texts that he falsely attributes to the same pseudonymous person. For verification of the authenticity of her writings Alice wishes to use PGP but she does not wish to use a key server. She can only operate online.

Is the following approach sensible?

STAGE A

1) Publish several fairly anodyne initial texts in places that are sufficiently obscure for Bob not to notice for a while, and which are also places of record that date-stamp texts. I'm thinking Usenet here.

2) In each of those texts, include her PGP public key, its 40 hex-digit fingerprint, and a signature made using her PGP private key.

STAGE B

3) Start publishing the texts that Bob will find annoying on open-access websites. In each one, include the said fingerprint, the advice that readers may find her PGP public key in posts that were made to named Usenet groups between two stated dates, and a signature made using her PGP private key.

Bob will now start publishing fake texts. These may state that the author has changed their key and that the new public key is as follows. Or they may state that they have been signed using a key from a pair for which the public key can be found in Usenet articles posted between a different pair of dates.

Alice's idea is that although Bob's actions may be a minor annoyance, she can safely continue publishing texts in the knowledge that the more net-savvy of her readers will be able to verify their authenticity. And as readers start adding to their collection of texts published in Stage 2 who have already saved the public key from Usenet, all they need do to validate authentic texts and invalidate fake ones is to check the signature.

Is she thinking along the right lines? Or is there a gaping hole in the idea which her opponent will be able to drive a tractor through?


texts: Discrete logarithm key sizes for very short term usage

texts:
We have this special use case that our session typically only last for less than 30 minutes, no more than 1 hour at most, after the session finished, the information protected does not matter. Each time a new session start, a new group (p, q, g, k) choose randomly, where p=k*q + 1, g is the generator of subgroup q, p, q are both large prime, k and q coprime; I known if sizeof p = 1024, sizeof q = 160 is good enough, but it's a bit slow and consume too much power on smartphone, since our session only live very short term, I'd like to known if its safe to choose shorter group size, say p=512, q=160, or even shorter p=256, q=112?

any comments would be appreciated


texts: Should a certificate be validated every time it is used?

texts:
In contrast to private keys, public keys don't need to be stored on a secure place. But what if somebody changes a certificate with a public key to just another one? To ensure certificate authenticity, its validation chain can be verified up to the root CA certificate, which could be an unchangeable part of the software.

When a partner system updates my system with a new certificate (for whatever reason), I would, of course,  check the chain validity before storing it on a proper place in the system. Now, should this kind of validation be carried out

everytime I use the certificate or
just before it is accepted as a new certificate?

I feel, that the first option would be the answer, but I want to avoid the overhead of validation against CA every time the certificate is used.

How would it be to store a validated certificate together with its hash (SHA-256) based on an individual system key, and to check only the hash when using the certificate?


texts: I am trying to do a project on RSAES-OAEP cryptography.Can anyone advice me any good applications where this can be used where there will be a lot to learn about in a programming and application perspective?


texts: How to effectively apply combination of Block and Stream Cipher?

texts:
I have used TrueCrypt but it uses a cascaded encryption. I want to know about encrypting a file using two ciphers with each cipher having different key.

Cipher A (Block Cipher) - with Key KA

Cipher B (Stream Cipher) - with Key KB

First I am encrypting a file with Cipher A (KA). Again I am encrypting a file using Cipher B (KB).

Does this, in any way, make the final encrypted file vulnerable? Or, rather, leave some loopholes.

One other approach I thought is to compress a file before applying second cipher so as to make it more random.

Cipher A -> ZIP -> Cipher B

How secure is this and in which mode the two ciphers be operated to achieve high security?

** Edited **

Both the keys are different. Encrypted file also does not contain any key.


texts: Does a 128bit 3DES need billions of years to decrypt using brute force attack?

texts: a) I did some research and there are two opinions.. some say it cracks in several years and others say it doesn't crack for billions of years USING BRUTE FORCE ATTACK...


texts:
Alice and Bob share a secret key K. Suppose that someone suggests the following methods to allow Alice to securely authenticate to Bob.

Bob generates a random message r, enciphers it using K under a secure block cipher scheme and sends the encrypted message to Alice. Alice decrypts it, adds 1 to it and sends the result encrypted with K under the same block cipher to Bob. Bob decrypts the message and compares it with r. If the difference is 1, then he is sure he is communicating with Alice; or else, as no one else knows the secret K, he is talking to an impersonator. Is this protocol secure?

Is this secure based on the difference of 1 or is that still prone to attack?


texts: Elliptic Curve Verifiable Secret Sharing

texts:
I'm reading this paper, which on page 3(Section IV.C) presents a Jointly Random Verifiable Secret Sharing Scheme for Elliptic curves. The algorithm makes sense to me save for this part:

"Each $P_{i\neq j}$ verifies that his share is consistent with other shares i.e. $a_0^{(i)}G = \sum_{j \in B}b_j f_i(j)G$"

Just to explain the terms for those that haven't read the whole paper:$E$ is an elliptic curve, the base point is $G \in E(Z_p)$ of order $r$.

Player $P_i$ shares secret $a_0^{(i)}$ via $f_i(x)$, a random polynomial of degree $t$. $P_i$ then sends other players their share, i.e. sends $f_i(j)$ to player $P_j  \hspace{3pt}\forall j \in \{1,\cdots,n\}$. $P_i$ also broadcasts $f_i(j)G \hspace{3pt}\forall j \in \{1,\cdots,n\}$.

So, can someone please explain to me why this equation holds:$$a_0^{(i)}G = \sum_{j \in B}b_j f_i(j)G$$

The authors do not seem to define $B$ or $b_i$. However, later in the same paper,in a related context,  they define $b_i = \prod\limits_{j \in B, j \neq i}\frac{j}{(j-i)}$. I'm not sure if that definition applies here too.


texts: What Is The Number of Active S-boxes over 5 Rounds of Fides AE cipher?

texts:
It is mention in the paper "
Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware" , the number of active S-boxes of Fides cipher is 22 over 5 rounds but my result shows it is 25((9-3-1-3-9))using the same concept used in midori (same almost MDS matrix) to construct MILP model.

Q. Is anyone else got same results as mine? if not , is there any steps should i take to find the correct answer other than exhaustive search?


texts: Finding out the greater number under zero-knowledge conditions?

texts: Is it possible to construct a zero knowledge proof that one encrypted number is larger (or not) than another encrypted number without releasing the values of either numbers?


texts: Is there a way to bound linear complexity of a sequence less than its period

texts:
Linear complexity of a sequence $s_0,s_1,\ldots$ over a finite field is the shortest length $n$ of linear recurrence of the sequence such that
$s_{n+j}=\sum_{i=0}^{n-1}a_is_{i+j}$ for $j=0,1,2,\ldots$
for constants $a_i$ in the field. My question is at which $n$ should we stop computing $a_i$? Assuming the sequence is periodic with period $N$ at which $n$ should we stop the search for the coefficients in the recurrence relation above so that the relation will be valid for all subsequent longer sequences until the full period?
The definition doesn't seem to give any clear idea of the computation of linear complexity. Even the Berlekamp Massey algorithm doesn't say at what $n$ less than $N$ to stop.


texts: Can two files/strings have the same SHA-256 value?

texts:
I was wondering whether, theoretically, 2 files can have the same SHA-256 value.

Since there are only $16^{256}$ or $2^{1024}$ SHA256 sums, all 1024-bit files (with $2^{1024}$ different combinations) will have to have different SHA256 sums (if I'm not mistaken).
Additionally, for files with larger file sizes (such as, let's say, 2048-byte files, where there are $8^{2048}$ = $2^{6144}$ different combinations), there will have to have 2 files with the same SHA256 sums.

And, once there are two files with the same SHA256 sums, what then? Will that mean that SHA256 sums are broken?

Thanks for feeding my curiosity.


texts:
I need to compute a function $h^l$, where h is an element of G2 and l is a rational number. How can this be done using the PBC library?

I have converted the h to an element in G2

As far as I have seen, for exponentiation, PBC has two functions :

element_pow_zn, and
element_pow_mpz

The first function is used when both the operands are of type element_t. The second function will be used when the power is of type mpz_t.

I read in the pbc manual that the mpz_t type is for integers in GMP, while mpq_t is for rationals. Can I use any of the functions in PBC to acquire the required exponentiation? If yes, how will I have to declare the elements?

UPDATE

Will such an initialization work :

mpz_t a, b, l;
element_t ea, eb, el, bi, t1, res;
....after computing a , b, I can use
element_set_mpz(ea, a);
.
.

element_invert(bi, b);
element_pow_zn(t1, h, a);
element_pow_zn(res, t1, bi);


texts:
I am new to crypto.

I have a password for my user, e.g. &&38:while:HAVE:havana:60&&
I want to encrypt several documents with 10 pages each with AES.

Now when do I run my salt, KDF and init vector functions?

As often as possible, e.g. for every page? (This is what I do now, but it gets too slow. I store salt and initialization vector with the encrypted page.).

Or KDF once at login (so I use the same derived key for all encrypted documents) and a different salt and initialization vector for every page?


texts: How to generate own secure elliptic curves?

texts:
I know that the algorithm used to generate the Brainpool curves and the NIST curves is published. The algorithm should be this one (RFC5639 Appendix A). From what it looks like it's rather slow to find secure parameters.

After some research I've also found "Efficient Algorithms for Generating Elliptic Curves over Finite Fields Suitable for Use in Cryptography" by Harald Baier (in fact it's a PhD thesis I think) on the generation of secure elliptic curves. I've also googled around and found a tool that actually generates such curves (using this algorithm I think). From an efficiency point of view this algorithm looks faster than the NIST's one.

Now my question:
Are the above two algorithms the only ones (published) for generating safe elliptic curves or are there other ones?


texts: Difference between a Polynomial Opening & a Polynomial Commitment

texts:
Going through the literature led me to think I understood the difference between these two things, but thinking about I am not actually certain. Could you help me correct my definitions of these two things (or provide some more detail that aids understanding)?
Polynomial Commitment: This is an object created by evaluating the polynomial at a specific point. We are in a sense committed to the polynomial because the object was created using the structure of the polynomial.
Polynomial Opening: Revealing what a polynomial is, we open up the polynomial to be seen. We can for example use this to check a commitment.
For some context, taking the KZG polynomial commitment scheme, a polynomial commitment to $f(X)$ is $C = g^{f(\alpha)}$, where $\alpha$ is random and $g$ is the generator of some group. A polynomial opening is then just a presentation of $f(X)$?


texts: Why a key pair is used in OpenSSL ECDSA_sign or ECDSA_do_sign instead of only private key ?

texts: If the digital signature in ECC (ECDSA) is made using a private key, why is the OpenSSL library using ECKEY pair as an input parameter instead of the private key only ?


texts: What do the signature security abbreviations like EUF-CMA mean?

texts:
From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes.

The most common ones are the *UF-* ones, advertising security against specific classes of attackers.
Now these notions may not be that well-understood by many people so I ask hereby for a canonical answer, that explains what the following security notions mean. A (simple) description of the formal attack scenario is preferred.

Please don't restrict the answer to "you can chose this and if you can break it with this it isn't EUF-CMA". Please at least outline the formal attack (like f.ex. generate a new signature).

The following list is in order of strength for the same suffix (x)or prefix:

UUF-KMA
SUF-KMA
EUF-KMA
UUF-CMA
SUF-CMA
EUF-CMA


texts: Regarding matsui's Paper on Linear Cryptanalysis of DES

texts:
I am going through the the Paper by Matsui on Linear Cryptanalysis of DES. In that, he says

$NS_{5}(16,15)=12$

And then in the next paragraph he says considering the expansion and permutation phases the following equation holds good:

$X(15)\bigoplus F(X,K)[7,18,24,29]=k[22]$

Can somebody help me understand this, because I can't find a relation between the first equation and the second one?


texts: Decrypt AES-128 with key file but missing IV?

texts:
I want to decrypt a file that has been encrypted using AES-128 in CBC mode using OpenSSL. I got the “.key” file – which is 32 digits – but when I try to decrypt with OpenSSL, the program asks me for “-iv” and I don't know the IV of that file so it won't decrypt. Is there is any other way to decrypt the file without knowing the IV?

I tried with another file of which I have the correspondent IV and it works, and when I don't supply that IV, the decryption fails too.

By the way: is there anyway to know what type of encryption was used to encrypt a file?


texts: What is the parameter for? I read that in XMSS it is a member of the set {4, 16} but what does it exactly mean? I also read that the bigger the w parameter, the shorter the signatures but the keygen, sign and vrfy become slower. How do I pick an optimal w parameter? Is it the height of merkle tree?


texts: How do decryption algorithms determine whether your attempted passphrase is correct?

texts: Judging by the algorithm on the Blowfish Wikipedia article, there is no way for the process to fail with an error. How then does GnuPG know when to tell you your password is correct when decrypting a file, rather than proceeding to decrypt meaningless data?


texts: Do parts of a hash carry the properties of the entire hash?

texts:
When I need to generate unique id's based on some information hashing is typical choice. However, sometimes that id needs to be of a particular size.  I've seen a lot of schemes (HMAC-MD5-96 in SSH, CGA in SeND for IPv6) that use a portion of a hash, so I'm thinking it might be alright to use it that way.

Which properties of a hash are preserved and which do not apply anymore?

Obviously, with less bits, the chance of collision goes up, but can I still rely on the partial hash for uniform character distribution?  What about the avalanche property?  I'm guessing that if a hash modifies the entire hash upon the smallest change to the input, that would imply that a portion of that hash would be equally well changed.  Am I thinking about this correctly?

Also, would these behaviors be different for different hashing algorithms?


texts: How fast compute high degree power in finite field?

texts:
We need find y for some x on elliptical curve in cases:

decompressing public key
restoring public key from signature for given message hash, r and s.

This algorithm uses power twice: first it is y1 = $x^3$ modulo p, and next is very high degree y = $y1^{(p + 1) / 4}$ modulo p.
I know way to compute it on logarithmic time, similar to adding-doubling method, where instead adding is multiplying , instead doubling is compute square.
I wonder, if is faster method for special exponent, here exponent is not arbitrary but (p + 1) / 4.
I'm afraid that restoring public key from signature takes much more time than verify signature.


texts: I am using AES encryption in my application. I used 3 types of encryption AES-128,AES-192, AES-256 keysize. When I encrypt with different keysize(128 or 192 or 256) with the same text, the encrypted string length is same for all keysize(128 and 192 and 256) whereas encrypted characters only differs. Is this correct? Is the length of the encrypted string length always same for every keysize?


texts: Which version(s) of SRP are in ISO/IEC 11770-4:2006?

texts:
I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password.

This states that SRP is part of IEC 11770-4, among other protocols. But no version is specified, and I've seen there's SRP-1, SRP-2, SRP-3, SRP-6, and the current SRP-6a.

Hence my first question: which version(s) of SRP are in ISO/IEC 11770-4:2006? (link is to a free preview; drafts are available here to those willing to subscribe to a mailing list, and I have yet to spot a meaningful technical difference between the October 31, 2005 draft and the real thing)

Which list of parameters and options to SRP or/and ISO/IEC 11770-4:2006 would be necessary to define implementations to the point of being secure and inter-operable?

Also: ISO/IEC 11770-4:2006 can use an Elliptic Curve setting, with (I guess) shorter cryptograms; is that the case for SRP?

Update: the motivation of the question is that ISO/IEC 11770-4 is an international standard, approved by a committee, which is more reassuring to a decision-maker than SRP-6a as defined by a web page than can disappear or change any second.

In a comment, Smit Johnth suggested TLS-SRP/RFC 5054, which has some traction. That could be a possible choice. I'm reading it as implementing SRP-6a, despite claiming to implement SRP-6 with reference to documents predating SRP-6a. My main reservations are that TLS is a bit heavy for my application; and RFC 5054 is stuck to SHA-1, which is bad from a certification standpoint: in France, any hash less than 200 bits, or 256 bits for use after year 2020, does not match rules in section 2.3 of these official recommendations, which at least can make a prescriber less comfortable.


texts: I mistakenly thought that RSA keys could only be powers of two(1024, 2048, 4096 etc.) but a few days ago read about a 1536-bit and 1160-bit RSA key. I am wondering is it possible to have an RSA key of any bit length?(e.g 1025-bit RSA key, 1234-bit RSA key etc.) thank you.


texts: How to show CPA attacker does not need access to encryption oracle after receiving cyphertext

texts:
In the private key CPA game, the attacker has access to an encryption oracle anytime during the attack.

However, I have seen this statement in lecture notes I downloaded "You can prove that for every polynomial time attacker that uses the encryption oracle after receiving the challenge cyphertext, you can construct another polynomial attacker that also breaks the encryption scheme only querying the oracle before receiving the challenge cyphertext."

I have tried to do reductions but I don't see how I could use the first type of attacker to build the second type, since the first requires oracle queries after knowing the challenge cyphertext.

I have also tried to search this but was unable to find.


texts: How many possible input files are there who's length can be stored in 63-bits?

texts:
I'm trying to calculate how many possible combinations of files there can be using a signed 64-bit file length, but can't seem to find a formula (or I'm using the wrong keywords). For example, the number of unique files that have a length of 256 bytes is $2^{256*8}$ = $2^{2048}$. I assume the total number of combinations across all file lengths will be some kind of geometric sequence?

The reason I want to calculate it is because I'm curious how it relates to the number of possible SHA-256 hashes ($2^{256}$). Also, if I calculate the SHA-256 hash of the SHA-256 hash of a file's contents, how much have I reduced the entropy (if that's the correct term)?


texts:
I was wondering if we could construct a symmetric encryption scheme by assuming that the secret key itself in GGH is public and the shared "key" is the error vector $e$.

To encrypt we would take the lattice basis $B$ and our shared secret $e \in \mathbb{R}^n$ and do:

$c = m*B + e$

and to decrypt:

$m = (c-e) * B^{-1}$

Without the correct $e$ this should not decrypt correctly. But how could I attack such an encryption?


texts:
I'm working through the matasano crypto challenges, and I'm onto set 7, where they describe an attack on encryption/compression oracles. I am having trouble understanding the attacks, more so the logic behind the attack and am having difficulty finding any papers on it. If anyone knows about this type of attack and how it works, it would be much appreciated if someone could explain it.

For reference, here is the link to the challenge: http://www.cryptopals.com/sets/7/challenges/51

  Compression Ratio Side-Channel Attacks

  Internet traffic is often compressed to save bandwidth. Until recently, this included HTTPS headers, and it still includes the contents of responses.

  Why does that matter?

  Well, if you're an attacker with:

  Partial plaintext knowledge and
  Partial plaintext control and
  Access to a compression oracle

  You've got a pretty good chance to recover any additional unknown plaintext.

  What's a compression oracle? You give it some input and it tells you how well the full message compresses, i.e. the length of the resultant output.

  This is somewhat similar to the timing attacks we did way back in set 4 in that we're taking advantage of incidental side channels rather than attacking the cryptographic mechanisms themselves.

  Scenario: you are running a MITM attack with an eye towards stealing secure session cookies. You've injected malicious content allowing you to spawn arbitrary requests and observe them in flight. (The particulars aren't terribly important, just roll with it.)

  So! Write this oracle:

oracle(P) -> length(encrypt(compress(format_request(P))))

  Format the request like this:

POST / HTTP/1.1
Host: hapless.com
Cookie: sessionid=TmV2ZXIgcmV2ZWFsIHRoZSBXdS1UYW5nIFNlY3JldCE=
Content-Length: ((len(P)))
((P))

  (Pretend you can't see that session id. You're the attacker.)

  Compress using zlib or whatever.

  Encryption... is actually kind of irrelevant for our purposes, but be a sport. Just use some stream cipher. Dealer's choice. Random key/IV on every call to the oracle.

  And then just return the length in bytes.

  Now, the idea here is to leak information using the compression library. A payload of "sessionid=T" should compress just a little bit better than, say, "sessionid=S".

  There is one complicating factor. The DEFLATE algorithm operates in terms of individual bits, but the final message length will be in bytes. Even if you do find a better compression, the difference may not cross a byte boundary. So that's a problem.

  You may also get some incidental false positives.

  But don't worry! I have full confidence in you.

  Use the compression oracle to recover the session id.

  I'll wait.

  Got it? Great.

  Now swap out your stream cipher for CBC and do it again.


texts: Yarrow and weak cryptographic keys on macOS

texts:
Given that macOS uses Yarrow as a PRNG, and Yarrow is only capable of 160 bit outputs (/dev/random on macOS is actually Yarrow) are keys generated on macOS weaker than Linux?

Even BSD has switched to Fortuna.

Is this is big gaping hole in Modern macOS security?

https://en.m.wikipedia.org/wiki/Yarrow_algorithm

EDIT:

I have looked through the source and it seems as if they switched to a DRBG NIST generator?

https://opensource.apple.com/source/xnu/xnu-4903.221.2/osfmk/corecrypto/ccdbrg/src/ccdrbg_nisthmac.c.auto.html

There are very few references to Yarrow in the 10.14 XNU code compared with older versions of the Kernel, but 10.14 still contains this string in key.c :

/* Our PRNG is based on Yarrow and doesn't need to be seeded */
That said if you looked at older XNU Yarrow is littered everywhere.

Source code for XNU:

Lots of Yarrow references in XNU 2782 - macOS 10.11

Very few Yarrow references in XNU 4903 - macOS 10.14

So, are Apple still using Yarrow?

Update: Apple are using Fortuna.


texts: How is multiplication inverted in IDEA's decryption round?

texts:
As we can see in the picture we have a multiplication in this algorithm,
we know that two 16 bit inputs should have a 32 bit output, but here we just use 16 bits of the 32 bit output.

For decryption we can reverse the algorithm from bottom of the algorithm to top, but how can we invert the multiplication that produced value of $a$ to recover $I$?


texts: I'm going paperless, and I want to encrypt the documents that I scan. I'd like to use CommonCrypto to perform AES-XTS encryption on each file. I'm a software engineer, and I like the idea of being able to write my own wrapper around the library. However, I am not a crypto expert by any means. If I understand IVs and salting correctly, is it possible to use one long passphrase to generate a unique encryption key for each file? Also, is this general approach a good idea, or should I go in a different direction?


texts: Encrypt a file for multiple persons with different keys?

texts:
I thought a problem and want to ask if there's a more elegant solution.

The scenario:
A company with a fileserver, which hosts encrypted documents.
The files need to be accessible by about a dozen employees.
Now the condition is, that each employee has different key material but all the employees can still access the file (even though they have different materials).

The most naive approach would be to give everyone the symmetric key that's it. This violates the condition.
The next way would be to store the file's key in a header, which is encrypted with each employee's symmetric key. The problem with this is, that everyone none can create new files without knowing the keys of the others.

The most optimal solution I'm aware of is to use asymmetric encryption to encrypt the file's key in a header for each employee using his corresponding key. This would enable everyone to create new files for the group and it would let everyone have different keying material (which can even be stored on a smartcard).

Now my question:
Is there a way to solve the above problem, without the overhead for the additional headers (maybe using some more esoteric protocol or algorithm)?

I'd prefer an answer which doesn't only give a name for the class of algorithms, but also instantiations, which are considered secure (based on blockciphers, asymmetric encryption schemes, ...)


texts: Are there any signature algorithms with pseudorandom signatures?

texts: As the title says.  My reference point for the "pseudorandom ciphertext" concept is this paper by Möller, which introduces a public-key encryption algorithm with this property.  I want to know the analogue for cryptographic signatures; forgive me if this is discoverable somehow via Google, since it is quite hard to get the search engine to understand that "pseudorandom signature" doesn't refer to the random value used in many signature algorithms.


texts:
When I am studying about linear cryptanalysis, I have a question about correlation of linear trail.

Let $U=(u_0, u_1 , ...,u_n)$ be a linear trail

Then we can compute a correlaton of linear trail $U$ such that $C_{U}=\prod_{i}C^{r_i}_{u_{i}u_{i-1}} $

where $C^{r_i}_{u_{i}u_{i-1}}$ is a correlation of $r_i $th round.

My question is why we compute correlation of linear trail by producting round correlation?

Is there any mathematical proof of this point?

Thank you.


texts:
Server A produces signed messages on request.  You can tell server A what type of RSA padding to use in the signature (either RSASSA-PKCS1v1_5 or RSASSA-PSS).  Either way, the message will be signed using the same private key.  The signed message is a JSON object where you can supply some of the fields, but the server supplies the others.

Server B accepts these signed messages and verifies the signature using server A's public key.  You have the ability to select which padding scheme that server B should use to perform the verification (again, either RSASSA-PKCS1v1_5 or RSASSA-PSS).

Is it possible to abuse the ability to switch between padding schemes in order to tamper with the message?  Is it possible to cause server B to misread fields in the JSON object that were supposed to be supplied by server A?


texts: Proof of work for determining whether a number is prime?

texts:
I have an idea for a system that would be outsourcing some brute force calculations to many users in hopes of finding divisors of a number. However, there is a possibility that a given number would be prime, or that it would not have a divisor in a given range.

For example, a computer might be tasked to look for a divisor of a number 2^n-1 (which would be a very large number) and whether there is a divisor in range x*10^10 to (x+1)*10^10.

Proving that one has found a divisor is easy - they just need to submit that divisor and the number can be checked against it. However, how should the users go about proving that there is no divisor to be found in a given range? Obviously one couldn't just trust a user in their claims - this would open a possibility for malicious reports messing with the system.

So far I was pondering a few options - submitting overlapping regions to various users for checking and comparing their results, challenging the users to find the smallest / biggest remainder of a check they would be performing in the range and so forth. Are there any approaches to the presented problem that are more vetted in the crypto world than "an idea that sounds okay"?


texts: How to know if an ElGamal ciphertext is well-formed?

texts:
Is there a way to prove/verify that an exponential ElGamal ciphertext of a message representative $\widetilde{m}=mG$ is well-formed, meaning that $r_1 = r_2$ in:

$$C = (R, S) = (r_1G, \widetilde m + r_2Y)$$

with $Y = xG$.


texts: SHA-256 private/public coordinates to the PEM format

texts:
I feel that my question might display a bit of ignorance. I have been searching for answers, but have had no luck--perhaps my assumptions are wrong. I apologize if that is the case.
Context:
I have a microcontroller communicating with a server.  Every frame is signed using a private key from an RSA/SHA-256 public/private key pair. The pair is generated externally with OpenSSL, and the public key is in the PEM format, which is something like this (it is a not a used key):
-----BEGIN PUBLIC KEY-----
MIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgHR/kzljDkbuyOWGzfxSgfrJ3xZd
GZspxrVU+2ZbkDej5KNzGXu5lJdBzATU/h/S4Y2DgwaaN0tRMxX4QeN7x90qmdkO
oUQggpbv7rvju3idBp0fDcV6M56mnkw+EeyeNjDsRqoUVD/zlQdEUUcC00iItu8N
0GH08Ex8ubBhXQ7XAgMBAAE=
-----END PUBLIC KEY-----

My issue:
Due to performance problems on the microcontroller, we had to use an external chip (for instance, ATECC608A) for all of these cryptographic processes. Also, it will be useful for production because this chip can generate its own private/public keys SHA-256 keys. When generating the SHA-256 private key, the chip returns me the public key. However, it does not return me a public key in the .pem format, but, according to the datasheet, it returns me the coordinates X and Y of the public key, which are 64 bytes.
My questions:

My first assumption that might be mistaken is this: I assume that a SHA256 pair is the same thing as RSA-SHA256. I know that there are many variants of the SHA256 algorithm, but based on what I've read, the RSA is the standard variant. So I am assuming that RSA-SHA256 is the same thing as SHA256. Am I right?

Assuming I have RSA-SHA-256, how can I convert these coordinates to .pem? On the server-side, I was using the .pem public key of the device to verify the signature. Now I am only able to share some coordinates of the public key. Is it possible to convert from coordinates to .pem? Or am I just misunderstanding a bunch of different concepts?


texts: How can I get issuerNameHash and issuerKeyHash from PEM or DER certificates?

texts:
I need to get these values from pem and der files. Is there Python and C code or openssl command for these results?
Example cert in PEM format:
   -----BEGIN CERTIFICATE-----
    MIIDTTCCAjWgAwIBAgIBATANBgkqhkiG9w0BAQsFADBHMRQwEgYDVQQDDAtSb290
    IENBIFJTQTEMMAoGA1UECgwDT0NBMQswCQYDVQQGEwJOTDEUMBIGCgmSJomT8ixk
    ARkWBE9DVFQwIBcNMjAwMjEyMTgxMDI3WhgPMjA2MDAyMDIxODEwMjdaMEcxFDAS
    BgNVBAMMC1Jvb3QgQ0EgUlNBMQwwCgYDVQQKDANPQ0ExCzAJBgNVBAYTAk5MMRQw
    EgYKCZImiZPyLGQBGRYET0NUVDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
    ggEBAJ0gKwiY8Yj5T+SwZCQB3evp2y65BoVdBlnL91FzpuZ1LP9i0C4dQVcjN59W
    d3lDskb9njjm41ds57zAUEesMwomFy+DfXd2zDSoBpmFCJuoW3bD+8xN1ISfrEI0
    vQPTMRtyfaue1CYo55+4Fkv0zLEbjSOx3Sl+9ciwQ4i/x6hDjclu5JXx9Bom/oR2
    +xlHZEfpGogyDvQB3al+GsOCOk9Y7kA8EaVDPLeeI+CJdOS4syoZdyEiA6cO+kAH
    0tE+Rl5Pqf3wabuO1ebTLenswa7xLrUGQ9rURmXTJQ2+23c3YsXOGgMZ5M7H2R2i
    sOt2S62t28aVs62+PwQrqh/X4vkCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAO
    BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFNSqKyVEMyNJoqivS0wO565HVoOiMA0G
    CSqGSIb3DQEBCwUAA4IBAQAtxUSnf+pb+dgLPAtLgoMLsc+CgvoeEpHF1aLWNgcc
    VSC2L0frxtpERl3xjxE9ttc+3mE6KA2UQFhf4Md4vCPf60GZw44rFl1Rj9PwrLA9
    c2AtLjcDkthhmZylgEjorzyox3wVW5pbOWRP38lDz9gpqJCzTYmmm+9skNS09/gq
    M5lYhAqBjKjLiyKylwKWdw9EOkUxnSlg4aicn83+1cdD0iNM+z6lIP5cxvQu2/f6
    8KJ9JkTofQzdyPH4l/JvuSwmXnfWR3O8JTJjAq8Z5XoqduJXhEB73Xvamdah1PB0
    BJHAh45odouHCmtG6TqRUgoFVNZDLdNurVXXzn5cnL+t
    -----END CERTIFICATE-----

Example output:
  "certificateHashData": {
    "hashAlgorithm": "SHA256",
    "issuerNameHash": "f405cb5ba4efe79d4863495e186413c551f7d98dd021030573e169146a763056",
    "issuerKeyHash": "3e1518dc6e867ea55d699922be7be6898fb5abf459709c086e17ac4760682da9",
    "serialNumber": "1"
    ]}


texts: In PKCS#1 V2.2, should MGF be based on the same hash function that RSA-OAEP-ENCRYPT uses?

texts:
In Section 7.1.1 of PKCS#1 v2.2 there are two options for RSAES-OAEP-Encrypt given:

Hash
MGF

Appendix B.2.1 of the same document states that MGF1 is based on a hash function.

Is MGF1 based on the same hash function that is chosen as an option for RSAES-OAEP-Encrypt, or is it a different hash function?

If they can be different, in what common implementations do they differ?


texts: One-time pad encryption - how does the receiving side decrypt the message?

texts:
If a message is sent using one-time pad scheme, which generates random bits in order to, for example, XOR them with the message's bits - how does the receiving side generate the exact series of bits ?

If the receiving side is able to generate the same series then how is it still random ?


texts: RSA decrypt message with low public exponent (n = 187, e = 3 and C = 185)

texts:
n = 187
e = 3
C = 185

How to decrypt message? I know there is some way using cryptogram exponentiation. Can you give me a hint?


texts: number theory question in a group with unknown order

texts:
I was reading a paper and I am struggling understanding one part of it.
Lets say we have a group $G$ of an unknown order $n$. we know that $B<n<B+C$. both B and C are large values).

we choose a random element $z \in G$. and let's say we have some prime values $B+C<e_1,e_2,...,e_l$. We Calculate $h=z^ {\prod_i e_i}$.

The claim is as $\gcd(n,\prod e_i)=1$ (which is true as each prime is greater than $n$) we can say that $h$ is uniformly distributed in $G$. How can we prove this statement?


texts:
I have a question about this attack: Oded Yacobi and Yacov Yacobi, A New Related Message Attack on RSA (in proceedings of PKCS2005).

Given $e$ linear related messages encrypted with RSA:
$c_i = ({x_i}^e \bmod N)$

where, $x_i = a_i*x + b_i$,

the author claims that given the $a_i$'s and $b_i$'s values, it is possible to obtain the original message $m$. He shows that for the case of $x_i = x + b$, but I can't see how is the general form to apply this attack for messages $x_i = a_i*x + b_i$.

More specifically, I'm having difficulties in calculating the $p_k$ values presented in section 2.2.

Thanks!


texts: Standard for asymmetric encryption based on elliptic curves

texts:
Most parts of public key cryptography has established standards which are in turn used in a large amount of real world applications. There is PKCS#1 for RSA based encryption and signatures and there is DSS for ECC based signatures.

But for some reason, I never came across a proper standardised form of a ECC based encryption scheme. Whenever I look at software trying to use, it usually is some homebrewed El-Gamal variant.

Am I missing something? Or is there a reason for that gap?


texts: I'm working on a file encryption system where multiple versions of the same file might exist. The filenames are encrypted using AES in CBC mode with a random IV and stored in metadata. Since versions of the same file share the same filename, this information may be used by an adversary. Is there any additional information to be derived from multiple ciphertexts which are known to share the same plaintext, just with a different IV?


texts: Are cryptographic hash functions perfect hash functions?

texts:
For a cryptographic hash function and input values of shorter length than the hash function output, it's pretty obvious that there should be as few collisions as possible. But are there guaranteed to be none?

In other words, for a cryptographic hash function $H: x\to y, x \in \mathbb{N}, y \in [0,y_{max}]$, are there any $x_i \ne x_j$ with $x_i,x_j \le y_{max}$ so that $H(x_i) = H(x_j)$?

This seems to be a special case of Is every output of a hash function possible?, with the additional limitation of inputs to the space of possible outputs.

If there are any such collisions, wouldn't that mean that, due to the pigeonhole principle, there exists some possible output of the hash function that can never be reached by hashing another output, i.e.

$\exists y:H(x) \ne y$ for all $x, y \in [0,y_{max}]$?

Are common cryptographic hashes bijective when hashing a single block of the same size as the output? even mentions that some hash values are expected to be unreachable by all possible inputs, which would of course also imply the limited input range given above.

Are there any practical consequences of that property of hash functions? I'm thinking about things like the Bitcoin proof-of-work system that require collisions (or "close collisions", differing only by some amount from the target hash value) to be found. Any chance that finding such a collision (range) would be not only practically, but theoretically impossible?


texts: AES and GOST 28147-89 "Magma" Comparison

texts:
I am trying to understand how AES is comparable to GOST 28147-89 "Magma". Like for parameters such as bit shifting and addition of the subkey to the input, which are a part of Magma, what is their replacement in AES? Also, how is S-box application in AES different from that of Magma?

Why is swapping of halves not required in AES?


texts: What are the extended homogeneous coordinates in the EdDSA specification?

texts:
According to the EdDSA specification from the IETF:

For point addition, the following method is recommended.  A point (x,y) is represented in extended homogeneous coordinates (X, Y, Z, T), with x = X/Z, y = Y/Z, x * y = T/Z

I'm unfamilar with extended homogeneous coordinates, and I'm used to seeing points as simply (x, y).   Can anyone explain where the T and Z variables come from in the specification document?
UPDATE:
I found this answer on Stack Overflow that has some great detail:


texts: Why do we use one transformation to hide the structure in UOV?

texts: Why do we use just one affine transformation in Oil and Vinegar (UOV) scheme to hide the structure of the map? Doesn't it cause any security problems, and isn't it better to use two transformations?


texts: Robust cryptosystem for files/chunks protection?

texts:
I'm not a cryptographic expert by far but I do understand that when it comes to cryptography it's best to stick with established standards.

I have to ensure confidentiality and integrity of a bunch of files (chunks of these files actually).

Getting inspiration from "serious" people, AES-GCM with distinct IVs and keys for each chunk seems the way to go since it provides both confidentiality and integrity, and is good performance-wise.
It also seems a good practice to encrypt each chunk key with a Key Encryption Key that has to be renewed on a regular basis.

Here are my questions:

Did I get it right up to this point?
Are there specific ciphers for encrypting each chunk key with the KEK? Does it require to use an IV since there shouldn't be two identical chunk keys?
What are the good practice/standards to protect the KEK on a server without dedicated hardware such as an HSM?

PS: I'd be glad to take a look at any ressource available and accessible to non-experts on that topic.


texts:
I am new to cryptography, I have used OpenSSL and its aes-256-cfb cipher before to do stream encryption, which works great. Now I am going to try libsodium, since it's light and its APIs look concise, but I can't get it working.

I tried its XChaCha20 stream cipher, but it only has the crypto_stream_xchacha20_xor and crypto_stream_xchacha20_xor_ic functions, I can easily encrypt and decrypt messages when the message lengths appear in pairs, like encrypting 20 bytes, then decrypting 20 bytes, this works fine. but it will fail if encrypting 20 bytes, then decrypting 10 bytes and decrypting 10 more bytes. The latter case is what I want, I am implementing a proxy, I would like to read random length (i.e. not in blocks and no boundaries) of data from one TCP connection, encrypt and stream the data through another TCP connection, the other end of the connection reads random length of the encrypted data and decrypts it.

For what I want, xoring my data wouldn't work, since there's no context object like OpenSSL's EVP_CIPHER_CTX and no information like how many bytes have been encrypted/decrypted is kept, this looks weird to me, if it doesn't support this kind of stream mode, why is it called a stream cipher?

My question: Is it possible to do what I want using libsodium, if so, how?


texts: If the S-Box is given. How to calculate the affine transformation matrix?


texts: Understanding Baby-Step Giant-Step Algorithm and discrete logarithm

texts:
Studying the Baby-Step/Giant-Step Algorithm, I have some questions:

In the algorithm, $p$ is the order of group, $x$ is solution. We rewrite $x = i * m + k $, but why do we make $m =\lfloor\sqrt{p}\rfloor$, rather than something else like $\lfloor {p/2}\rfloor$?
(a) The time complexity is $O(\sqrt{p})$. If we make sufficient large $p$, then why is it difficult for compute the discrete logarithm computation in group $G$ of such order $p$?
(b) It is said that the discrete logarithm computation is hard in group of prime order, particularly in subgroup (order $q$) of group of strong prime order (like order $p = 2*q + 1$, $q$ and $p$ is prime); why is that?


texts: TOTP intermittently does not return the same code when generated within the same time step

texts:
So we have the need for using a TOTP to generate a code on the server to send to a mobile client, I have been testing code generation with the following 3 java repos:

https://github.com/jchambers/java-otp
https://github.com/andOTP/andOTP
https://github.com/freeotp/freeotp-android

I've taken the core TOTP generating code and I've been testing them. My issue is that I will run the arbitrary mvn unit test where using the default time step of 30 secs, I will generate a token (t0), wait 2 seconds, and generate another token (t1) and sometimes (like 1 of every 10 tries) t0 != t1. I can't figure out why this is and my math-fu is not at the level to fully grasp whether this is expected or whether I am doing something wrong.

Note that this happens for all the 3 code sources (i haven't changed the code except for providing the secret key) I mentioned above - clearly either i'm doing something wrong or this behavior is possibly expected?!


texts: Zero-knowledge proofs vs. "Identification schemes"? (as in Katz--Lindell)

texts:
Most modern papers on zero-knowledge proofs (for example, BBB+16) recycle essentially the same list of boilerplate definitions, concerning soundness (formulated using extraction or some form of "emulation") and zero-knowledge (involving simulation).

Yet Katz and Lindell's incredible book does not use these definitions—instead speaks only of an Identification scheme (see [KL15, p. 452]), which is either secure (against a passive attack), or isn't (i.e., see Def. 12.8). For example, the Schnorr protocol is formulated only as an identification scheme (Fig. 12.2). Moreover, both its perfect zero knowledge and 2-soundness are implicitly contained in its proof of security (Thm. 12.11).

My question is: should I view this simpler Identification scheme-based definition as "the future"? Can we get by with definitions of this sort, i.e., can this definition capture everything we "care about" in zero-knowledge proofs? What are the reasons for keeping the more traditional definitions around, if any?

Moreover, has an Identification scheme-based definition been formulated for more general settings, where the "statement" of the relevant NP language has a complicated structure (is no longer uniformly random, maybe selected by the adversary, etc.)? Where can I find these more general formulations?


texts: RSA: If the least significant bits of the factors are leaked, what advantage is there in factoring N?

texts:
For $N=pq$, if the first $x$ least significant bits of both $p$ and $q$ are leaked.

what is the advantage in factoring $N$?
Does this give an advantage beyond simply lowering the number of bits we have to guess for the smaller factor?


texts: using random encrypted RSA challenge as key material

texts:
Assume a simple protocol for authentication - one side sends a randomly generated challenge string and encrypts it with RSA.

The receiver decrypts it and replies with a hash of the challenge, proving that he owns the private key (and nothing more).

My question: is it safe to also use parts of the same random challenge to derive encryption keys, e.g. for a symmetric cipher or a HMAC?

If not, is it safe to hash only part of the challenge as proof, and use another part of the challenge as key material?

As concrete example: send e.g. a 2600 bit random challenge, encrypted via 3072 bit RSA-OAEP. Is it safe to hash the 2600 bits (and return the hash to the sender in cleartext) as proof, and use hkdf on the first 128 bits to derive a shared AES key?


texts: Is Wikipedia's table about SHA-2 collisions correct?

texts:
I was looking a Wikipedia article on SHA-2, and the "Comparison of SHA functions" table seems to indicate that SHA-2 is less secure than SHA-1.

Is this true, or is the table wrong / misleading?

What does $2^{28.5}$ mean for SHA-256 compared to $2^{60}$ for SHA-1 (table in SHA-1 article says $2^{53}$)? How does it relate to MD5 article, which says:

  The security of the MD5 hash function is severely compromised. A
  collision attack exists that can find collisions within seconds on a
  computer with a 2.6 GHz Pentium 4 processor (complexity of $2^{24.1}$)

Assuming that no collisions have been found for the SHA-2 family, does that still mean it takes less work to find a collision than SHA-1? Or do these numbers ($2^{28.5}$, $2^{60}$, $2^{53}$, $2^{24.1}$) mean different things?

If the table is wrong, how should it be corrected?


texts: Is there any public-key cryptosystem that is (possibly) secure against $NP\cap coNP$ adversary?


texts:
As we are all aware that HASHing is user to verify integrity in cryptography. I have a query about hashing.

Suppose a man in the middle attacker manipulates the data and creates new HASH (by running algorithm on manipulated data) using the same hashing algorithm (becausehashing algorithms are universal algorithms) and send it along with the manipulated data to the receiver.when receiver runs the algorithm on manipulated data, it gets the same HASH ( HASH created by the attacker) and though integrity will be verified. But actual data has been manipulated/modified and integrity is compromised.

Is it possible? and if it is possible how can we eliminate this problem (solution for the same)?


texts: How can I remove my personal data from my PGP public key?

texts:
According to this Q&A-discussion it is possible to remove all personal data (name and mail address) that is attached to a public key.

What steps do I have to follow in order to remove all personal data?
Will that modified public key still allow me to decrypt data with my regular passphrase?


texts: Am I applying Hybrid lemma and proof by contradiction correctly?

texts:
In the following scenario, I am trying to apply proof by contradiction. My idea is to use a Hybrid lemma. So if I am able to distinguish $G'$, this implies we are able to distinguish $G$. But we already know that $G$ is a PRG. Therefore $G'$ should be a PRG. Is my notion correct?

Let $G: \{0,1\}^n\to\{0,1\}^{n+1}$ be a PRG.
Let $G: \{0,1\}^{nt}\to\{0,1\}^{(n+1)t}$ for some $t=\text{poly}(n)$ be defined as follows:
$$G'(s_1s_2\dots s_t)=G(s_1)G(s_2)\dots G(s_t)$$
Using Hybrid argument, prove that $G'$ is also a PRG.


texts: Which concrete applications benefit from Oblivious RAM constructions?

texts:
The main motivation for Oblivious RAM (ORAM) is that, for instance, in the "cloud" setting a client outsources his data to a server in the form of encrypted blocks. Later on, he wants to perform read and write operation on these encrypted blocks, which apparently may leak information about what data is stored. ORAM now ensures that the server cannot tell which blocks the client is interested in and whether he is reading or writing.

My question is: Are there any concrete examples/attacks, where the access pattern on encrypted data leaks sensitive data?


texts: Keyed digest function with odds of collision below the birthday bound?

texts:
I wonder if it is possible to devise a function $F(K,S,R_S)\mapsto D$ where:

$K$ is some key (I have freedom on $K$, it could even be generated by a trusted party);
$S$ is in $\{0,1\}^s$, say $s=32$; $S$ is a serial number;
$R_S$ is a random value associated to $S$, in $\{0,1\}^r$, say $16\le r\le48$; $R_S$ is produced from $S$ once for all by a random-like function unknown to adversaries;
$D$ is a short digest in $\{0,1\}^d$, say $48\le d\le64$.

such that:

$D=F(K,S,R_S)$ can be computed knowing $K$, $S$, $R_S$, say in at most $2^{28}$ instructions of a typical 32-bit CPU;
an adversary not knowing $K$, knowing $S$, $R_S$, $S'\ne S$, $R_{S'}$, has no advantage in trying to tell whether some $D$ is $F(K,S,R_S)$ or $F(K,S',R_{S'})$; Update: or better, an adversary with black box access to $(S,R_S)\mapsto F(K,S,R_S)$ for some fixed unknown $K$ can not distinguish that from a random oracle with the property laid below in (4);
an adversary knowing $K$, and given $D$ known to be $F(K,S,R_S)$ for $S$ chosen at random, with $S$ and the corresponding $R_S$ unknown, has no method much better than brute force to guess $S$ [where brute force enumerates possible ($S$, $R_S$) pairs, computes $F(K,S,R_S)$, and makes a decision based on matches of that with $D$];
odds that there exists distinct $S$, $S'$ with $F(K,S,R_S)=F(K,S',R_{S'})$ should be as low as possible, and much lower than the birthday bound (about $0.39$ when $7\le d=2s$).

The application is transforming the serial number $S$, and some auxiliary data which limited entropy after hashing is modeled by $R_S$, into a digest that is meaningless to a party not knowing $K$ (property 2), does not directly leak the serial number $S$ to a party knowing $K$ (property 3), and can reliably be used to recognize an object for a given $K$ (property 4). The computation of $F$ will be made as slow as bearable, which will correspondingly increase the cost of brute force in (3).

Things I considered but do not fit:

If $F$ is $H(K||S||R_S)$ with $H$ a random function with $d$-bit output, (4) is not met.

If $F$ is $\operatorname{ENC}_K(S||H(K||R_S))$ with $\operatorname{ENC}_K$ a $d$-bit block cipher with key $K$, and $H$ a random function with $d-s$-bit output, (4) is met with zero odds of collision, but (3) is not met, for an adversary can invert the cipher and find $S$.

If $D$ was wide enough (say $d=2048$), then instead of $\operatorname{ENC}_K$ in the above we could use a deterministic RSA encryption with public keys $K$ generated by a trusted party, and meet both (3) and (4); but I'm considering much smaller $d$.


texts: What are the practical problems of using zero knowledge proofs, for instance in the field of authentication?


texts: Jumblar: Using map locations as passwords

texts:
I had the idea of converting map locations into passwords. Basically Jumblar (github.com/micheal-swiggs/jumblar) takes a hash of the user's location and stores this as a comment on the PGP network. The 'stored-hash'(Vague-Hash) currently is only 2-bytes long. Each time the user wishes to use that location to generate passwords, they will first attempt supply a guess location. Jumblar then spirals around this guess location until it finds the point with the same hash.

Jumblar then uses this location as the basis for password generation. The user will add a 'spice' e.g username@email.com that Jumblar will use to generate a password. So rather than the user remembering a map location for each password, they only need to remember one location and a list of spices. Currently I'm assuming that is fine to store the spice(s) in open storage. So long as the map location remains a secret, the passwords derived from the spice(s) are 'safe'.

When Jumblar (github.com/micheal-swiggs/jumblar) generates a password there is a guarantee that it will contain atleast - one lowercase, one uppercase and one numeric - character.

Vague Hash

Jumblar only does a vague-hash of the secret location. Rather than storing the entire location hash on the PGP network, Jumblar only stores between 2-3 bytes of hash material. So a potential cracker could only discover a set of possible points that correspond to the vague-hash. The vague-hash is only used to distinguish the secret location from immediately surrounding locations. If the user guesses a location far away from the actual location, then Jumblar is likely to match an incorrect location.

A review and/or comments of the 'idea' and even the project would be greatly appreciated.

Salt & Master Password

The user must also remember a 'master' password and a salt accompanies each vague-hash. So the vague-hash is a result of hashing upon the secret location, password and salt.


texts: Could RSA keypairs be used for cryptocurrency addresses?

texts:
A bitcoin address is created from an ECDSA keypair. It is common to use use a hashed version of the public key as the shared address, but the original bitcoin implementation also allowed for using the unaltered key directly. (which anyway is revealed when the coins in the address is spent) The purpose of public key cryptography here is that the owner can prove ownership of the address by a digital signature, which is required by the blockchain before accepting spending of the coins in an address.

The ECDSA algorithm is not suited for encrypting messages. If an RSA keypair was used it would allow the sender of money to encrypt and convey some personal information to the receiver (eg. by a public message server), which obviously could be a useful feature. Is there any reason why an RSA keypair should or could not be used for cryptocurrency addresses?


texts: Why is $h(H, m) = E(m, H) \oplus m$ insecure?

texts:
I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies-Meyer or Miyaguchi-Preneel are secure).  Why is this compression function insecure?   What is the attack?

(See also Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure? for a related question.)


texts: Key derivation: Does it make sense to use KDF and PRF consecutively?

texts:
I'm in a project, where the output of a Key Agreement algorithm (uses ECC) is used as input for a KDF, and the output of the KDF (X9.63 KDF) is consecutively used as input for a PRF (CMAC) to calculate AES session keys.

Summary: ECC-PAKE->KDF->PRF->AES_keys.

My question: Is there any major advantage of using both KDF and PRF? Wouldn't the KDF good enough in this scencario?


texts: 2 Round Secure Multiparty Computation with BGW

texts:
The BGW protocol gives us security aginst a dishonest minority of parties, with round complexity linear in the function's circuit depth.
Several works (like ABT18 or LLW20) use the BGW protocol to get 2-round MPC by reducing the functions degree to 2.
However, I don't see how BGW gives us a 2-round protocol. You need one round to share the inputs, one round for the multiplications and one final round to reconstruct the result, resulting in a 3-round protocol. What am I missing here? How can the multiplication round be merged into the input sharing or the reconstruction round?


texts: Relationship between special RSA modulus and quadratic residue in CL (Camenisch-Lysyanskaya) signature

texts:
I'm studying the CL(Camenisch-Lysyanskaya) signature (A signature scheme with efficient protocol proposed by Camenisch-Lysyanskaya).

However, I cannot understand the relationship between special RSA modulus and quadratic residue.

What is the relationship between Special RSA modulus and quadratic residue?

and please recommend the references for special RSA modulus.


texts: which exponent to be used for RSA e =3 or 65537 for RSASSAPSS signature verification

texts:
I have the public key and I dont know how to obtain Modulus and exponent. After referring stack overflow, I have used below command line to obtain e and M finally as mentioned below.

openssl.exe rsa -pubin -inform PEM -text -modulus < key1024_pub.pem

Public-Key: (1024 bit)

Modulus:
    00:c4:bd:2a:41:92:5a:a1:0b:98:07:81:96:4f:9b:
    bc:ae:15:f9:01:b3:1c:37:df:9f:a0:a2:ab:0f:96:
    8f:cb:79:1a:21:31:49:ce:17:30:63:8f:7b:d5:24:
    96:e2:03:11:f8:fd:c2:20:62:13:e1:a1:b6:cd:73:
    58:c1:f0:67:56:57:d7:e2:88:ce:94:0d:8f:aa:ee:
    49:ac:cd:f7:37:57:47:1d:e6:00:76:c7:c9:1a:bb:
    46:29:31:6e:79:97:6e:c1:46:ef:38:b7:c2:ac:13:
    d5:ec:e1:98:94:ce:59:6e:a8:30:fd:25:26:69:f8:
    12:17:6b:9a:68:41:f0:cb:c5

Exponent: 3 (0x3)

Modulus=C4BD2A41925AA10B980781964F9B
BCAE15F901B31C37DF9FA0A2AB0F968FCB79
1A213149CE1730638F7BD52496E20311F8FD
C2206213E1A1B6CD7358C1F0675657D7E288
CE940D8FAAEE49ACCDF73757471DE60076C7
C91ABB4629316E79976EC146EF38B7C2AC13
D5ECE19894CE596EA830FD252669F812176B
9A6841F0CBC5

But now I am confused now which exponent to use either e=3 or 65537 Since i read Public exponent e - 65537 is default for 1024 bits of RSA. Could someone help me which value to use?


texts: Is it acceptable to use a HMAC-SHA256 hash as a secp256k1 private key?

texts:
Say I want to generate a deterministic private key related to some data, for instance to a domain name. The easiest way I can think of is:

take a secret material which will work as "generator".
take a domain name and HMAC-SHA256(my secret, domain name).
take resulting hash and use it directly as secp256k1 private key.

Question is if that last step is an OK move or are there issues with directly using hash as private key?


texts: A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem

texts:
In this paper (A simple provably secure key exchange by Ding et al.)  At page number 8, the author gives correctness of the technique as follows

then SK A  = SKB with overwhelming probability i.e. if Alice and Bob run the protocol honestly, then they will share an identical key.

The above equation uses Lemma 1 which is as follows

How does the author deduce the above equation using Lemma 1. This equation gives correctness of the technique. Can anyone please help.


texts: How is EdDSA different from ECDSA with a custom curve?

texts:
I just found this draft/informal IETF specification: Alternative Elliptic Curve Representation:

This document specifies how to represent Montgomery curves and (twisted) Edwards curves as curves in short-Weierstrass form and illustrates how this can be used to implement elliptic curve computations using existing implementations that already implement, e.g., ECDSA and ECDH using NIST prime curves.

This triggered my curiosity as I thought that ECDSA and EdDSA had many more differences than just different curves.
From what I understand, Edwards curves can be expressed in the Weierstrass form.
How is EdDSA different from using ECDSA with an Edwards curve (e.g., Curve25519) converted to a Weierstrass curve? I am mostly interested in functional aspects rather than possible optimization(s) due to curve parameters.
Related questions: #1, #2


texts: How does the CBC Padding Oracle Attack work in General?

texts:
Right now we don't have a single generalized question asking how the CBC padding oracle attack works. We have e.g. this one and this one but the former is distracted by the concrete values being thrown around and the specific problem the poster has and the latter is distracted by the complications introduced by ASP.NET.

So (representatively) my question is:
How does the standard CBC padding oracle attack work?

Optional extensions which may be interesting here: What if the padding oracle checks the (untamperable) ciphertext length before checking padding?


texts:
Previoulsy I had asked this question at https://stackoverflow.com/questions/18235983/can-s-mime-be-still-considered-secure but I feel this forum is topic-wise the right place.

Recently there has been a discussion whether secret service agencies have access to certification authorities. Also before that several CAs were facing security problems being attacked by hackers.

Given this, I am wondering whether S/MIME can be still considered secure. Some time ago I had generated a free email certificate from one CA. To my surprise the key had not been generated with a tool on my own computer; instead it was generated by the CA and emailed to me. I am wondering:

If this CA is infiltrated by a secret service agency, will they have access to my private key and can use it to decrypt emails encrypted by my public key?
Are there tools to generate S/MIME keys on an own computer? If so, is it possible to send only public keys to a CA to get them signed?


texts: Why weak modes of operations are not banned?

texts:
If some modes of operations of AES are not secure (like ECB or CBC), which are prone to bit flipping / manipulation attacks, and why they haven't they been banned or advised against by NIST for other bodies and are still recommended?

The last publication that I am aware of is: Recommendation for Block Cipher Modes of Operation.

From the document:

  "This recommendation specifies five confidentiality modes of operation
  for symmetric key block cipher algorithms, such as the algorithm
  specified in FIPS Pub. 197, the Advanced Encryption Standard (AES)
  [2]. The modes may be used in conjunction with any symmetric key block
  cipher algorithm that is approved by a Federal Information Processing
  Standard (FIPS). The five modes—the Electronic Codebook (ECB), Cipher
  Block Chaining (CBC), Cipher Feedback (CFB), Output Feedback (OFB),
  and Counter (CTR) modes—can provide data confidentiality."


texts: Is it possible to derive the encryption method from encrypted text?

texts:
Is it possible to identify the encryption method, or at least rule out some of them, by looking at the encrypted text?

For example, if you have 3 encrypted strings where the first 10 characters are the same on each of the strings.


texts: stream cipher and block one, which one is faster to encrypt/decrypt?

texts:
As the title says, I would like to know which one is faster.  I read in some book it indicates the stream is faster since it encrypts one bit at a time; the others show block is faster since it is using "block".

Thanks


texts: Need 32-bit mixing function that has perfect avalanche between octets

texts:
for my hobby tinkering project, I need a mixing function that takes 32-bit input and has 32-bit output (and will, most likely, run in a 32-bit C environment) and the following property (independent of endianness, i.e. it’s enough to only look at either big endian or little endian (or pdp endian) systems):

union u {
    uint32_t u32;
    uint8_t u8[4];
} ival, oval, ival2, oval2;
int x;

ival.u32 = /* some unsigned 32-bit value */;
oval.u32 = ƒ(ival.u32);

x = /* some value ∈ { 0, 1, 2, 3 } */;
ival2.u32 = ival.u32;
ival2.u8[x] ^= /* some nonzero octet */;
/* ival2 = ival where exactly one input octet differs */
oval2.u32 = ƒ(ival2.u32);
assert(oval2.u8[0] ≠ oval.u8[0]); /* first output octet differs */
assert(oval2.u8[1] ≠ oval.u8[1]); /* second output octet differs */
assert(oval2.u8[2] ≠ oval.u8[2]); /* third output octet differs */
assert(oval2.u8[3] ≠ oval.u8[3]); /* fourth output octet differs */

That is, I need a function where, when you change one of the octets in the input, all four octets of the output differ.

Since this is a 32-bit to 32-bit mapping, it can be a perfect mixing function (bijective, not one-way); this would be extremely beneficial because I could then replace the Final function of a 32-bit (nōn-cryptographic) hash (based on Jenkins’ one-at-a-time but tweaked) I’m using in the same context with it, too, and it would not lose any fractional bits of entropy from the input.

Of course I could do this “the simple way” with lookup tables, but the idea is to have this in only a few lines of code (that is, few machine instructions), either completely algorithmic, or with only, say, up to 256 bytes of read-only data. I bet there’s something like this already around. (My target CPUs are, for now, i486, sparc v8, 32-bit MIPS, but I’d want it in portable code, not assembly; C is just fine as long as it uses only unsigned integers, since I’ll most likely need to implement it in C.)

Please only include code snippets if they are true Public Domain (e.g. government work) or I can reuse them under the MIT Licence, the MirOS Licence, or the BSD Licence, or in a language not C with a permission for me to “rewrite the same algorithm” in C (while not copying a line of code); otherwise, please only include algorithmic descriptions that are enough for me to write C code from it. And nothing that’s legally dangerous or questionable of course ☺

My strength is coding, not mathematics (I already had to prove the bijectivity of the Finish function of my modified Jenkins-OAAT empirically, i.e. by trying all possible 2³² combinations), that’s why I thought to ask here. (No homework or commercial stuff, just trying to improve the world, in the context of the BSD Unix operating systems, and Open Source.)


texts: Weak and Strong Collision Resistance, again

texts:
Weak collision resistance (CR), or second-preimage resistance, is the property that given $x$ and $h(x)$ ($h$ a hash function) it's difficult to find $x' \neq x$ such that $h(x') = h(x)$.
Strong CR, or just collision resistance, is the property that it's difficult to find any two $x,x'$ with the same hash value.

The latter is easier than the former; the former is the "hash function analogue" of "same birthday as me" and the latter the analogue of "any two persons sharing a birthday".

Now then, what would a collision attack look like? I don't understand when it would be of relevance that it's relatively easy to find a pair $x,x'$ with the same hash value; isn't an adversary typically confronted with a given hash value that he has to "work with"? I.e., $x$ and $h(x)$ are given, if he can find a collision pair $(y,y')$, well, what does that help him?

Also, how does one actually find "any two" inputs with the same hash value? Seems to me that you must always first choose one input $x$, and then compare against that, at which point we're back to finding second preimages, right?