texts: How to calculate how many trials I need to guess the plain text if a simple P-Box is used to make the cipher text

texts: If I have 64 bit as input for a straight box that use a transposition process to encipher the plain text and the given 64 bits contains 60 bits as (1s), then how many trial I should do?


texts: why is index "a non-negative integer less than $2^{64}$" in the KDF for UMACs?

texts:
https://tools.ietf.org/html/rfc4418#section-3.2.1 describes the parameters for KDF as follows:

   Input:
     K, string of length KEYLEN bytes.
     index, a non-negative integer less than 2^64.
     numbytes, a non-negative integer less than 2^64.

My question is...  why is index defined as "a non-negative integer less than $2^{64}$ when the largest value that's ever passed to it is $4$?

It's called in the PDF function with a parameter of $0$:

  K' = KDF(K, 0, KEYLEN)

...and in the UHASH function the highest parameter that it ever goes to is $4$:

 //
 // Define total key needed for all iterations using KDF.
 // L1Key reuses most key material between iterations.
 //
 L1Key  = KDF(K, 1, 1024 + (iters - 1) * 16)
 L2Key  = KDF(K, 2, iters * 24)
 L3Key1 = KDF(K, 3, iters * 64)
 L3Key2 = KDF(K, 4, iters * 4)

So why not say that it's an integer that can have a range between $0$ and $4$?


texts: Why don't we use an Extendable Output Function to efficiently store the public key of Regev's LWE-based encryption scheme over standard lattices?

texts:
In LWE-based schemes the public key is generated by choosing a random matrix (or polynomial) $A$, and outputting the pair $(A, b = A\cdot s + e)$, where $s$ and $e$ are vectors/polynomials with coefficients taken from some error distribution.

In the Kyber encryption scheme the first part (the matrix/polynomial $A$) is not a part of the public key. Instead they save the seed to the (publicly known) extendable output function (EOF) that was used to generate $A$. If someone wants to know the public key, then he can just ask for the seed and generate $A$ himself. This saves a lot of space.

Why is this not proposed for schemes based on general lattices (standard LWE)? The big problem of these standard LWE schemes is the huge public key size, but this EOF solution would resolve that. However, it is not mentioned in any of the implementations that I found, like this one.


texts: Is nonce-less Encrypt-then-HMAC as secure as poly1305

texts:
While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not make use of nonces and in the poly1305 paper DJB says:

There are several reasons that Poly1305-AES uses nonces. First, comparable protocols without nonces have security bounds that look like $C(C+D)L/2^{106}$ rather than $DL/2^{106}$ -- here $C$ is the number of messages authenticated by  the sender, $D$ is the number of forgery attempts, and $L$ is the maximum message length -- and thus cannot be used with confidence for large $C$. Second, nonces allow the invocation of AES to be carried out in parallel with most of the other operations in Poly1305-AES, reducing latency in many contexts. Third, most protocols have nonces anyway, for a variety of reasons: nonces are required for secure encryption, for example, and nonces allow trivial rejection of replayed messages.

Doesn't that mean that HMAC is an inferior choice compared to poly1305 if we consider all threats except partition attacks?


texts:
Alright this is a question I found on one of my books:

  Given is a stream cipher which uses a single LFSR as key stream
  generator. The LFSR has a degree of 256.

How many plaintext/ciphertext bit pairs are needed to launch a successful attack?
Describe all steps of the attack in detail and develop the formulae that need to be solved.

What I don't understand is how the author came with the answers.

First it seems that one would need 512 consecutive pairs of plaintext/ciphertext to launch an attack, which consists of creating a system of 256 linear equations and solving them, that much I understand.

My question is: why do we need 512 consecutive plaintext/ciphertext pairs if we are going to construct a system of only 256 equations? Shouldn't it be 256 pairs?


texts: Why the definition in $\epsilon$-differential privacy is multiplicative rather than additive？

texts:
According to its mathematical definition, a random algorithm $M: D\rightarrow R$ satisfies $\epsilon$-differential privacy if the adjacent datasets $x, y \in D$ where $D$ is a whole dataset and datasets $x$ and $y$ differs by only one record, and any set of $S \in Range(M)$,
$Pr(M(x) \in S) \leq Pr(M(y) \in S) * e^{\epsilon}$.

The additive one is shown in this question: Differential privacy definition.

Dr. Dwork explains the advantage of using the multiplicative definition over the additive one in the Microsoft Research Lecture 2 (at about 2'50''). In short, with this multiplicative definition, it could be ruled out the possibility that an individual's record would be randomly selected and published.
However, I struggle to understand her meaning. I would appreciate any help in understanding this definition!


texts: How does Google's “authenticator number generator” work?

texts:
I have two-factor authentication enabled on my Google account, and I have this app on my phone which generates a number I have to type when I'm logging in to Google-Mail.

But I don't understand how this number is validated on Google's side. My bank has a similar approach: they gave me this little gadget which also generates numbers.

How do such “authenticator number generators” work?


texts: How can a non-crypto-expert implement crypto libraries in a programming language?

texts:
I'm a regular developer and thus not a crypto expert. I'd like to use ECDSA as a library in a programming language, Idris, which still doesn't have one. I could, obviously, try and port a particular implementation of my choice, run some tests, and call it a day. But that sounds unprincipled for something that needs strong security.

Is there any standard procedure or best practices to guide a normal developer to implement such a thing properly, without falling on the "don't roll your own crypto" trap?


texts: Why is HMAC-SHA1 still considered secure?

texts:
This Q & A https://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family

says that the security of HMAC-SHA1 does not depend on resistance to collisions? Are they are saying specifically with respect to HOTP or for HMAC-SHA1 for any use?

If HMAC-SHA1 is used for verifying the integrity of a document and you can find a collision, you can make changes in the document, right?

http://tools.ietf.org/html/rfc2104#section-6

Even the RFC says that resistance to collisions is relevant

  The security of the message authentication mechanism presented here depends on cryptographic properties of the hash function H: the resistance to collision finding (limited to the case where the initial value is secret and random, and where the output of the function is not explicitly available to the attacker), and the message authentication property of the compression function of H when applied to single blocks

What am I missing here?


texts: Feasibility of using a base 26 LFSR for cryptography by hand

texts:
I have been playing with base 26 LFSRs (i.e. using the alphabet) and noticed that the XOR operation for base 26 is just the tabula recta and so can be done very quickly. This made me wonder whether a base 26 LFSR (combined with a technique such as self shrinking) could be used as a PRNG that could be performed by hand and then XORed with the plaintext.

A base 26 LFSR would have to be of length 27 to have $\approx2^{128}$ possible states (giving 128 bit encryption?) but depending on the number of taps this could still be performed relatively quickly on paper.

I am not sure about my understanding of non-binary LFSRs so some of my assumptions may be incorrect but any help would be appreciated.


texts:
I'm reading Bernstein's RSA signatures and Rabin–Williams signatures: the state of the art. In section 6, Bernstein states:

  Recall that Rabin’s system needed to try several values of r, on
  average about 4 values, before finding a square H(r,m) modulo pq. The
  Rabin–Williams system eliminates this problem by using tweaked square
  roots in place of square roots. A tweaked square root of h modulo pq
  is a vector (e, f, s) such that e ∈ {−1, 1}, f ∈ {1,2}, and efs2 −h ∈
  pqZ; the signer’s secret primes p and q are chosen from 3 + 8Z and 7 +
  8Z respectively. Each h has exactly four tweaked square roots, so each
  choice of r works, speeding up signatures.

If I control key generation, then I can ensure p and q are chosen from 3 + 8Z and 7 + 8Z respectively, and I can possibly use the tweaked roots. Do tweaked roots violate P1363? What I might be really asking is, does an exponent of 2 run afoul of P1363, but I'm not sure at the moment.

If I cannot use tweaked square roots and/or an exponent of 2, then what are the remaining options? Is it principal roots and Jacobi?

If I load a private key generated by another library and it does not satisfy the conditions on p and q, then what are the remaining options? Is it principal roots and Jacobi?

My apologies for asking. I don't have a copy of the P1363 standard, so I'm not sure what the potential pain points are in using the algorithm described by  Bernstein.

The ultimate goal of the exercise is to remediate CVE-2015-2141 (Evgeny Sidorov paper here). I'm trying to observe P1363 but avoid Jacobi.


texts: Time efficiency of Bitcoin Multi-signature Vs. threshold signature

texts:
I read this paper (Securing Bitcoin wallets via a new DSA/ECDSA threshold signature scheme) that illustrated that threshold signature is the best solution to avoid single point of failure

but I think multi-sig is better than threshold signature in term of time  efficiency because it is non-interactive algorithm and each party can sign separately not like threshold

I am wondering if that correct inference or not ?


texts: Why the differential cryptanalysis complexity is linear with inverse of the probability while linear cryptanalysis is quadratic with the bias inverse?

texts:
I am trying to understand the analysis of the complexity of Differential Cryptanalysis versus the complexity of linear cryptanalysis.

In differential cryptanalysis the number of required texts is $\mathcal{O} {\left( \frac{1}{p} \right)}$ where $p := Pr(\alpha \to \beta)$ for some differences $\alpha$ and $\beta$

In linear cryptanalysis the number of required texts is $\mathcal{O} {\left( \frac{1}{\epsilon ^ 2} \right)}$ where $\epsilon$ is the bias of some masks, i.e. $\epsilon = | Pr(\lambda \to \gamma) - 1/2|$

What I don’t get is why the complexity became quadratic in linear case? e.g. what if we used the probabilities in linear cryptanalysis instead of biases, why the complexity is not proportional to  $\frac{1}{Pr(\lambda \to \gamma)}$.
I tried to read Ali Aydın Selçuk’s paper On Probability of Success in Linear and Differential Cryptanalysis but I still don’t have an intuition why.


texts: SNFS: Quantifying the "small" parameters?

texts:
The special number field sieve (SNFS) is an algorithm to calculate discrete logarithms and to factor numbers, given that the target has a special structure.

Now, all ressources always say something like

  The special number field sieve is efficient for integers of the form
  $r^e \pm s$, where $r$ and $s$ are small

So my question is:
How can "small" be quantified in this context?

Is an integer small if it is small than $2^{10}$ or rather $2^{40}$? Is there even a hard boundary or a heuristic boundary? Is there a way to estimate the (asymptotic) running-time which also uses these "small" values?


texts:
I want to construct a seeder for a big state PRNG (xorshift1024 based) and have been thinking about using Aes Ctr using multiple 256 bit keys, where the counter is simply encrypted multiple times (similar to 3DES).

Would this in any way reduce the statistical qualities of Aes Ctr? Security isn't a concern, but uniqueness of the generated random number sequences is. The reason I'm considering Aes is because it's built into .net and mono.


texts:
I want a code 'black box' that receives data inputs, processes those inputs, then sends out the outputs.

I want the code to be encrypted, or somehow obfuscated.

Is there any known way to do achieve this outcome?


texts: Decrypt an tex file encrypted with rand()

texts:
Link to encrypted tex file: https://drive.google.com/open?id=1gZCujDYmEL-FZ5o_xBUS-Ng5979HSsZ7

This is my attempt at solving the problem:

/* The ISO/IEC 9899:1990 edition of the C standard */

#include <stdio.h>
#include <time.h>
#include <iostream>

//#define RAND_MAX 32767
static unsigned long int next = 1;
int rand(void) // RAND_MAX assumed to be 32767
{
    next = next * 1103515245 + 12345;
    return (unsigned int)(next/65536) % 32768;
}
void srand(unsigned int seed)
{
    next = seed;
}

using namespace std;

//Return a byte at a time of the rand() keystream
 char randchar() {
  static int key;
  static int i = 0;

  i = i % 4;
  if (i == 0) key = rand();
  return ((char *)(&key))[i++];
}

int main(int argc, const char* argv[]) {

  for (unsigned int i = time(NULL); i >= 0; i--) //Try all possible return values of time(NULL) since today
  {

      srand(i);

      cout << "Trying with time(NULL) = " << i << endl;

      FILE *input, *output;
      input = fopen("Homework1b-Windows.tex.enc", "r");
      output = fopen("Homework1b.tex", "w");

      int c,rc, test;
      int pos;
      pos = 0;
      bool pos0, pos1, pos2, pos3, pos4, pos5;
      pos0 = pos1 = pos2 = pos3 = pos4 = pos5 = false;
      char temp1, temp2;

      while ((c = fgetc(input)) != EOF) {
        rc=randchar();
        fputc(c^rc,output);

        test = c^rc;

        temp1 = (char)test;

        temp2 = '\\';

        if ((pos == 0) && (temp1 == temp2))
        {
                 pos0 = true;
        }

        temp2 = 'd';

        if ((pos == 1) && (temp1 == temp2))
        {
                 pos1 = true;
        }

        /*

        temp2 = 'o';

        if ((pos == 2) && (temp1 == temp2))
        {
                 pos2 = true;
        }

        temp2 = 'c';

        if ((pos == 3) && (temp1 == temp2))
        {
                 pos3 = true;
        }

        */

        temp2 = 'u';

        if ((pos == 4) && (temp1 == temp2))
        {
                 pos4 = true;
        }

        temp2 = 'm';
        if ((pos == 5) && (temp1 == temp2))
        {
                 pos5 = true;
        }

        pos++;

      }
      fclose(input);
      fclose(output);

      if (pos0 && pos1 && pos4 && pos5)
      {
         cout << endl << "Cracked. The seed is time(NULL) = " << i << endl;
         break;
      }
  }

  system("pause");

}

I know that the decrypted tex file starts with "\document".

The problem I'm facing is that the code never terminates. It never finds the right key (seed).

Any help?

Thank you.


texts:
What is the exact difference between the key update and re-keying? Following the discussions here, I understood that the key update is the process of deriving the new session key from old key. In the case of re-keying, the new key is independent of old key. My questions are as follows:

Can key-update protect future messages from a compromise of an old key in any way? Is the re-keying only solution to achieve this?
In the case of re-keying, is it always necessary to perform the authentication process between communicating entities prior to every re-keying, especially when sensing devices are deployed in a hostile environment? If not, how communicating devices will trust each other?
If I am using ECC based key establishment protocol with a pre-shared master key for resisting the meet-in-the-middle attack, what are the possible options for the key update on resource constrained devices?


texts: RSALib prime generation - derive number of primes

texts:
I'm working on factorizing a ~450 bit key that I know has been generated with RSALib and thus is vulnerable to ROCA. Now reading the original paper, I can see that the primes are generated in the following form:

$$p = k \cdot M + (65537^{\,\large{a}} \bmod M)$$

where $k$ and $a$ are unknown value to us but where $M$ is known and is in fact the product of the first $j$ primes. Now in the original paper I was able to find that we know $j$ for some intervals but I'm not quite sure how to derive it for key length that are below 512 bits. Is there a way to do it?


texts: Does subsampling amplify privacy budget of differentially private median function

texts: I was reading that subsampling amplifies the privacy budget. I understand that it reduces the contribution of data to the aggregation function. I am wondering how sub-sampling impacts the median function. Does it amplify the privacy budget while the median is calculated using smooth sensitivity?


texts:
Following situation. We got a Feistel network. And in each round we get following outcome on the left side:

$$L^\prime = L_1 \oplus F(K_1, R_1)$$

Is there a possible key to get an unchanged outcome if $F(K_1,R_1)=K_1\oplus R_1$?


texts: Different patterns of different paterns, wildcard

texts:
I'm not realy experienced with programming and such but I am wondering if the following could be implemented in, lets say, python

we have the following ciphertext sequence

AO AP AL EE IL OP QR IV OD DD GH DK OL FK PO AD GG PO FK OL DK GH OL OT RI DH SK

and I know part of the plaintext says:

risetovotesir

Than for sure, I know that of the chipher text the following part:

[GH DK OL FK PO AD GG PO FK OL DK GH] = risetovotesir

which means GH = 'r' , DK = i

Now, lets say the ciphertext would be 400 times longer but does not have such pattern in it again, is there a way to "search" for such thing ?

I'm sorry if I explained this too vaguely, but I'd be happy if anyone could tell me how this would be possible.


texts:
It seems to me that cryptanalysis of the autokey cipher relies on patterns being found in key attempts, easy when it's English you're looking for, but how can you do this if you're just getting further cipher texts?

How would someone decrypt a plaintext enciphered with an ordinary vignere followed by an autokey cipher, where the two keys are 10-20 characters long and random?

Presumably any solution would rely on a computer, but I'd also be interested if there was a method that could be done by hand.

Thanks


texts: Detecting the amount of entropy used for random number generation

texts:
I am majoring in computer science but I have recently become obsessively interested in information theory and cryptography. I have read some articles about entropy and random number generators.

I find few algorithms online to generate 128-bit entropy supported random number generator. As I can tell from other discussion in this website that random number generator does not change the entropy.

It seems that N-bit-entropy-support random number generator only depends on how many bit of initial state supported by the algorithm. If my understanding is correct, I wonder if it is possible to figure out the how many bit of entropy supported by any given random number generator if we don't know the algorithm (like testing it in a black box)?


texts: Are there any authoritative definitions of "key stretching"?

texts:
This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the term "key stretching" and would like to know if there is any consensus in the research literature about how the term is to be used, or, perhaps, that it should be avoided exactly because there is no consensus.

Some of the meanings:

Key stretching is the method of applying a KDF or PRF to some input, as to produce output of arbitrary length. Some uses RFC 5931, gnu.org. The same feature is called key expansion in e.g. RFC 5869.
Stretching the entropy of the input by increasing the complexity of the derivation process. Found this on Wikipedia and in this paper by the reputable authors Bruce Schneier, David Wagner et.al. However, it seems these authors intended this feature should be used in particular when there is a need for the first feature (key expansion).
Increase the length of the input, e.g. by concatenating it with a public salt, before applying the KDF to it. Both this feature and the second is allegedly sometimes called Key Strengthening.

Are there any better terms that are more likely to be understood correctly without having to repeat the definition each time they are used? Key Expansion for the first, Key Hardening for the second, and Salting for the third?

On the other hand, the term key expansion seems to also often be used to describe the feature of cipher algorithm key schedules, when the input key is expanded into the round keys. It would be better to have a term that distinguishes between the output of a KDF and the intermediary output of a key schedule.


texts: Iterated AES encryption under a fixed key

texts:
Is it right that repeated AES encryption under the same key will eventually lead back to the original plaintext?

The reasoning is that AES acts like a reversible permutation of the blocks, the composition of several permutations is yet another permutation (closure), and because the number of permutations is finite, it must eventually get back to where it started.

If I write $E \circ E = E^2$ to mean "double AES" and $E^N$ to mean $N$ applications of AES (under the same key), then I can state the hypothesis symbolically as $E^N = I$ for some $N$, where $I$ is the identity permutation.

If this is correct, then it seems that $N-1$ applications of AES behaves identically to the inverse/decryption function, $D$, because

$$E^N = E \circ E^{N-1} = E \circ D = I$$

Is this statement correct?


texts: Can Montgomery ladder multiplication be used with secp256k1?

texts:
While reading about Elliptical Curves and ECDSA, I found a paper ECDSA Security in Bitcoin and Ethereum: a Research Survey by Hartwig Mayer. On page 6, the authors say:

  The curve secp256k1 does not allow the Montgomery ladder
  implementation.

Is this true? And if so, why? I don't see why Montgomery methods wouldn't be usable with secp256k1.


texts:
I'm looking for a way of one way hash data for multiple records. We have a privacy requirement to anonymise information "after it's used for its intended purpose" which is a little wooly at best.

I'd therefore like to delete everything once a project is finished, but this has been met with pushback internally "in case clients as follow up questions", so I figure the next best way is to hash the data with a one way system, so, it's effectively anonymized, not even we'd know what it was, but, if supplied with an email address (for instance) to lookup, we could hash it and search for a match in our database.

I'd need something that non-technical users could use and wouldn't be overly onerous in time, as it's an uphill battle to get people compliant already.

Hoping for an excel solution, or something that could load an excel/csv in and spit out the hashed version, however everything I look at for PBKDF2 is for implementing in websites or similar, singular password use.

I managed to get SHA256 working in excel, but as there's no salt they can be reversed with some work, meaning our effort to make the data anonymised is disingenuous, which is where i came across PBKDF2.

As you can tell be reading this far, I'm a bit out of my depth and would like to appeal to those who know more than I for any help!


texts: Why does the NIST Runs Test include a Frequency Test?

texts:
In the NIST suite of RNG tests (https://csrc.nist.gov/publications/detail/sp/800-22/rev-1a/final), one  of the tests is the Runs Test, which tests counts of runs of 1's and 0's. According to the documentation, you need to first carry out a Frequency Test, which essentially confirms if the number of 1's within the sequence is within $\pm$4 standard deviations (where $\sigma=1/{\sqrt{2n}}$) for $n$ total bits.
There is already a Frequency Monobit Test elsewhere in the test suite, and the test statistic is very similar in each. One calculates $count_{1}/n - 0.5$, and the other calculates $|{count_{1}-count_{0}}|/\sqrt{n}$. Why do we need this second Frequency Test as part of the Runs Test? Why not just let the Runs Test test the Runs, and the Frequency Monobit Test test the frequencies of each bit?


texts: NIST test vectors for RSASSA-PKCS1-V1_5-SIGN with the SHA-256 hash function?

texts: I haven't been able to find it on the web anywhere, and I need to check if my implementation of the algorithm is correct. Does NIST provide such a file?


texts: Do per connection random keys solve the stream cipher key repetition issue?

texts:
Edits: added then removed additional cases that on reflection seem like a bad idea.  In fact, this whole line of thought seems like a complicated way to get a bigger nonce, which might be better accomplished with something like XSalsa20 which was designed for that.  I will accept the "just use the right tool" answer, but if anyone has anything further to contribute please do.

To prevent possible stream cipher key repetition given unreliable storage, provided only that your RNG works and at the cost of some bytes per connection, start the connection with a random cipher key that is not stored on disk and is used to encrypt the rest of the stream (i.e. as the key for your stream cipher, which might be AES-256-CTR, ChaCha20, or a Keccak based stream cipher).

Questions (assume we have a MAC and any reply will encrypt with that random key and a different, previously agreed, nonce):

Suppose you use a simple shared secret XORed with this random key to encrypt it and have a reliable random number generator.  An attacker can then easily get random key 1 XOR random key 2 and encrypted streams 1 and 2, but it seems like this shouldn't help.  Are there any specific properties that a stream cipher would need to have or not have for this to be exploitable?
If that doesn't work or you don't trust that your RNG doesn't have some characteristic that might be exploitable with that system, add a random nonce sent before the key and use the shared secret to encrypt the random key (via the stream cipher) with that nonce.  Now are there any considerations that would make this system exploitable beyond the need for your RNG to generate a good key each connection?


texts: Is Dropbox's hashing method cryptographically secure?

texts:
Dropbox uses CRC32 and md5 to create a checksum of each 4 mb "block" as part of the their compression/file system.

I suspect that Dropbox uses an additional cryptographic hash to check if there's a collision, but let's assume that doesn't happen.

Is using CRC32 and md5 in combination cryptographically secure?


texts:
I have some embedded device for which I want to sign and encrypt firmware files. Firmware updates are generated by me and may be installed by the customer. The encryption is supposed to protect the intellectual property contained in the firmware and the signature prevents unauthorized modifications.

For the signature there are tons of resources, but I’m having problems with the encryption part. The simplest solution would be a shared symmetric encryption key. In case the encryption key gets extracted from the device one could not only decrypt the firmware, but also create your own encrypted firmware (without a valid signature). Are there a better alternatives using asymmetric encryption, so that less information is available when the device keys are extracted?


texts: Using platform-level RNGs for key derivation with hash functions like BLAKE3?

texts: So I've read stack overflow questions like this one. What I'm wondering is a bit more specific though: I'm really liking what I'm seeing with BLAKE3. (I suspect that this hash function is relatively unknown, though that's not surprising given its newness.) This would, however, also apply to BLAKE2 (and maybe BLAKE, I'm not sure). BLAKE3 defines a third mode of operation, derive_key. As the paper indicates, it takes a hardcoded context string and key material and derives a key using that information. My question, to be precise, is this: assume that I am in an embedded system with a BLAKE3 implementation available, and I want to derive a key for encryption/decryption purposes. Would it be safe to use an architecture-level instruction like RDRAND or RDSEED (x86) or RNDR (ARM) to generate this key material, and then derive a key that way?


texts: Verifiable delay functions vs Proof of Sequential Work

texts:
I've read recent papers about verifiable delay functions (Boneh et al 2018) and proof of sequential works (Cohen et al. 2018). I understand that the core difference between the definitions is that a VDF output is required to be unique (while in PoSW constructions - many commitments can prove knowledge of the same x w.h.p.).

But... why does it matter? Namely, what are the applications that use VDF, and that rely heavily on this uniqueness property such that replacing the VDF with the PoSW won't suffice?

For example, the Randomness Beacon - one of the basic motivations for VDF, can use PoSW as well, no?


texts: Half of any bitcoin (crypto) public key - (public key half) is possible

texts:
I found a topic on bitcointalk

Public key x and y == Double(Half of the Public key x and y)

half any public key is possible how that possible , in crypto there is subtraction and multiplication only then how divition

one post Sure, just multiply the point by 2^-1 (mod n).

can some one explain more which point to multiply and what is 2^-1 (mod n)

Half of any bitcoin (crypto) public key - (public key half)


texts: Use of the info parameter in Hybrid Public Key Encryption

texts:
I dont understand the use of the info parameter, what does "to fold in identity information" mean? What is the security benefit?

All the algorithms also take an info parameter that can be used to influence the generation of keys (e.g., to fold in identity information) [...]

https://www.ietf.org/archive/id/draft-irtf-cfrg-hpke-07.html#name-hybrid-public-key-encryptio


texts:
Is $\frac{1}{n!}$ a negligible function where $n$ is a security parameter?

Application: I have a vector of n>100 elements. I permute it and give it to an adversary. The adversary can break it if it can find the original oder of vector. Its probability to succeed is: $\frac{1}{n!}$. Thus, I need to know whether this probability is negligible.


texts: Why we use a fixed inverse Multiplication Matrix in AES

texts:
I just want to  know that in AES we use following multiplication matrix for encryption.

2 3 1 1
1 2 3 1
1 1 2 3
3 1 1 2

and for decryption it use's following matrix.

0E 0B 0D 09
09 0E 0B 0D
0D 09 0E 0B
0B 0D 09 0E

So my question is that can i change these matrices? and what is the process of doing that.


texts: Are there signatures that don't have subliminal channels?

texts:
Are there signatures that don't have subliminal channels and also don't require commitments or zero-knowledge proofs?

DSA or Schnorr signatures need a nonce which can leak valuable information. There are derandomization schemes, but the verifier can't check that the signer used them without extra steps.

Is there a signature that avoids these problems?


texts: What is the sponge construction in simple terms?

texts:
I suggested to my client to use SHA3 instead of SHA2. I know that SHA3 is based on Keccak algorithm which won the NIST's competition.
I want to explain the structure of sponge functions in very simple terms; does anybody have a simple explanation of cryptographic sponges?


texts: Small solutions to modular arithmetic linear congruence

texts:
Let $p$ be a prime number with $N$ bits, let $a,b,c$ be constants. The problem is to find solutions to the equivalent $a x + b y \equiv c \pmod p$ with both having at most $N/2$ bits.

What algorithmic approaches can solve this problem? Does it have any known hardness reduction?


texts: In constraint systems for ZK proofs, why are multiplications counted but are additions not?

texts:
For example, If I wanted to prove that:

$$x^2 + x^3 = 45$$

This cost of this would be calculated by counting the number of multiplications that need to be done, and not the addition of $x$ squared and $x$ cubed.


texts: How do you find a cheater in Shamir Secret Sharing?

texts: If there are 4 people involved, and every two of them should be able to know the secret (the polynomial is just a line) and you are given $f(x)$ and $x$ for each of those people, and you know one of them is a cheater, how do you find the cheater?


texts: RSA decryption with small exponent - no "public keys"

texts:
I have an unusual scenario where an RSA key pair is being used to protect the confidentiality of data in transit. The encryption exponent, the decryption exponent and the modulus are all kept secret between the two systems (i.e. there is no "public key").  The decryption exponent is 65537. Appropriate padding for RSA encryption is being used when encrypting.

Does the small decryption exponent create a vulnerability in this case?


texts: What are the smallest possible RSA private and public keys?

texts:
I'm trying to understand what the smallest possible RSA public and private keys are.
When using $p = 2, q = 3$, the encryption function doesn't encrypt. So I have to shift one prime to get $p = 3, q = 3$ and then the private key is $(9, 3)$ and the public key is also $(9, 3)$. I know that it is trivial to factor the product of two equal primes and it is bad to have the identical private and public key. However is it the lowest (feasible) RSA key pair or am I missing something here?


texts: Has it become easier to pre-compute tables after MD5 collisions?

texts:
Apparently it is not possible to compute all MD5 values from 0x00000000000000000000000000000000 to 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF.

As far as I understand this operation is hard because cryptographic hash functions make it difficult to calculate a message for a given digest (Pre-image resistance).

Storing all MD5 hashes requires $16 * 2^{128}$ Bytes, or $5.44 * 10^{39}$ Bytes, or billions of Yottabytes (1 Yottabyte = $10^{24}$ Bytes). This doesn't yet count the message(s) for each digest. To put this in context: 2011 it was estimated that the world wide storage capacity is "only" 295 Exabytes, ca. 0.0003 Yottabytes.

But MD5's collision resistance is broken. It doesn't take much time to create two different messages with the same hash.

Has the capability to provoke collision attacks in MD5 made it easier to create tables of pre-computed hashvalues?


texts: Diffie-Hellman computing public key with a large private key

texts:
Given is Generator $g = 5$, Multiplicative group $F_{10007}^*$, Private key = 7347.
Then public key is $5^{7347} \bmod 10007$ right?
On a calculator this gives an overflow error, how am I supposed to calculate the public key when a private key is a large number?


texts: Multiple users getting access to same (secret) encryption key on a single computer?

texts:
I am developing an application for Desktop PCs (Mac primarily, Windows later) that uses an encrypted SQLite database. I want to give multiple authenticated users access to this "main" database. I like to make this as secure as possible.
My constraints are:

Everything happens on a single computer. No server involved (I plan to change that, as well as introduce the use of SmartCards, but that's quite the challenge on OS X).
I roll my own user authentication (I don't want to use something complex like Kerberos or whatever else is out there as I don't have the time to dig into and manage that all as well. I'm a single fighter and need this all as simple as possible).
I understand the risk that a hacker will be able to infiltrate the system and then grab the encryption key as soon as a user logs in. I also understand the risk that a running computer may still have the encryption key lingering in memory, so a system memory dump may be a viable attack. I have to live with that for now.
My main goal is to protect the database against someone simply breaking in and stealing the computer, or copying files off it, then trying to gain access to the database.

Currently, I envision this to work as follows:

The DB encryption key is stored with another ("secondary") password using symmetric encryption (not sure what to use here, I've used Blowfish before, is that good?). That lets me change the DB encryption key centrally if needed.

That secondary password is stored in a separate "users" database, protected by the user's password, e.g. using a cypher or whatever is appropriate (I need help here).
So, when a user logs in, I simply look up the value from the users database, decrypt it using the entered password, and then use that to decrypt the DB key, and use that DB key to open the main SQLite database. If that opens the database, the user's entered password was valid.

Is that reasonable and sound, or am I missing something? Can it be improved to make it more secure or is that the best I can do under the mentioned constraints?


texts: Which algorithm has better performance (HMAC, UMAC, and Poly1305)?

texts: I want to implement a protocol which requires Integrity and Authentication for its messages. I found a lot of algorithms such as HMAC, UMAC, and Poly1305 which provide Integrity and Authentication. So I get confused for which one must I use. Please, could I know which one is better?


texts: What are the separate single DES keys from a triple DES key?

texts:
Suppose my 192 bit triple DES key (in hex) is

0123456789ABCDEFFEDCBA987654321089ABCDEF01234567

What are the keys for the separate single DES operations? In this case the 168 bits triple DES key includes the parity bits to make the key size ($64 \times 3 = 192$ bits).


texts: Is ECC multiplication over real number also one-way?

texts:
ECC multiplication over GF(p) is clearly one-way.

How about ECC over real number?

Is ECC division over real number also practically impossible?


texts: Is it OK to just hash a symmetric key to derive an authentication key?

texts:
I'm using xsalsa20poly1305 for encryption in my program from libsodium. The recommended size for chunks is 4 kB. In that case, poly1305 will have authentication only for the the individual 4k chunks. Not the whole message.

I would like to authenticate the whole message again with poly1305 or HMAC-SHA256 or whatever. It's well known that reusing the same key for encryption and authentication is a bad idea. Please correct me if I'm wrong there.

My question is: Is it OK to calculate SHA-256 or SHA-512 of my current key and use it as the key for authentication (in an open-source project where everyone will know the algorithm I'm using)?

Please note that in my application, it's absolutely not possible to have more than one symmetric key, because that key is derived from ECDH.


texts:
Please, I would like to find some hints or solution to my following problem, I would appreciate your assistance to walk with me throughout the solution

Given fully homomorphic encryption (FHE) scheme(gen, enc, dec, eval), design
a secure computation protocol so that two players, Alice and Bob, can jointly and securely
evaluate a function $g : \{0, 1\}^ k \times \{0, 1\}^k \rightarrow \{0, 1\}^k$
Here, both Alice and Bob provide inputs
but only Bob learns the output


texts: Importance of salt when deriving an encryption key

texts:
I'm very curious to know this and a bit confuses too:

Suppose, I have two files encrypted using AES-128bit with keys PBKDF2-derived from the same password and the same salt. If an attacker does brute force attack (imagining that he finishes this)
to crack the keys, I'm guessing he needs to run the attack once to get those 2 keys.
Now, if I encrypt the files using AES-128bit with keys PBKDF2-derived from the same password and a different salt, will it make the attacker run brute force twice? If the answer is yes, then why? Changing the salt doesn't change the number of possible keys $2^{128}$.

If the answer is no then, in both cases the number of possible keys are $2^{128}$. So, what difference does it make if the salt is different?


texts: How to increment the counter value for CTR mode?

texts: I am testing CTR mode on STM32 board. I want to know how the auto increment of counter happens and what is the method to follow if I have to increment the counter manually.


texts: Non-trivial examples of a system being a zero-knowledge proof system but not zero-knowledge proof of knowledge

texts:
It got me confused these days when I encountered the notions of zero-knowledge proofs (ZKP) and zero-knowledge proofs of knowledge (ZKPoK). As far as I know, the two terms are not the same, but all the ZKP systems I know so far also happen to be ZKPoK systems.

Can anyone tell me if there is any non-trivial example of a system being a zero-knowledge proof system but not zero-knowledge proof of knowledge, and vice versa?


texts:
Let R be a ring.

Is there a known/standard way for N parties to perform some exchanges, such that at the end each party holds an element $r_i\in R^\ast$ and $r_1r_2\dots r_N=1$ (and each party $i$ does not know $r_j$ for each $j\neq i$)?

(Or equivalently, share 0 additively?)


texts: Meaning of entropy of a bitstring in NIST SP 800 - 90A

texts:
From NIST SP 800 - 90A from January 2012 (see http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf), page 6:

  For the purposes of this Recommendation, an n-bit string is said to have
  full entropy if that bit string is estimated to contain at least
  $(1-\epsilon) n$ bits of entropy, where $0 <= \epsilon <= 2^{-64}$.

My understanding of entropy is that entropy is a property of the probability distribution of a source of bit strings, and not a property of a single bit string.

So what is NIST specifying here? Is there a way to estimate the entropy of the underlying source, given a bit string produced by that source? Maybe statistical tests, like Maurer's universal test? This could only be probabilistic since in principle, a true source of randomness can create any bit string...


texts: What are the differences between proofs based on simulation and proofs based on games?

texts: what are the main pros and cons of proving the "security" of a crypto scheme under simulation proofs instead of game based proofs?


texts:
I stumbled upon the Q&A “Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?” which mentions “HChaCha20” in the question.

Trying to look it up via the usual research sources, I failed to find an according paper handling HChaCha20. The only places where it seems to be mentioned and implemented are some github projects (like libsodium – but the libsodium docs likewise fail mentioning a paper of alike reference) and some back-and-forth discussions at twitter (which also fail to point to any paper).

Since even some well-known and respected security libs like libsodium know about HChaCha20 and implemented it, I just have to ask: Where is HChaCha20 formally defined?

Note that I'm asking if any paper exist which formally handles the definition, description, and security analysis of HChaCha20 and where I might find it. I'm not interested in related implementations and/or explanations describing how it practically works. I can read the sourcecode, but I'ld like to check the according paper that should exist as a base for those HChaCha20 implementations. After all, verification and validation requires a formal basis.

If such a paper does not exist, can we even assume HChaCha20 and related implementations to be cryptographically secure? If, on what basis? How and where has that basis' cryptographic security formally been analyzed and verified? Or is HChaCha20 bluntly relying on the ChaCha20 core to be secure, without taking another look at the HChaCha20 specifics that differ from ChaCha20's security assumptions? If the later is the case, can we really assume HChaCha20 to be secure? After all, that would mean there isn't a formal analysis & verification of such claims.


texts:
I have read the post Why should I use Authenticated Encryption instead of just encryption? When is it safe to not use authenticated encryption?

I assumed hard drive volume encryption or per file encryption that is not transmitted over an insecure network should be considered safe to do without a MAC. Is that right?

The advantage might be that if you do not provide a MAC, an attacker that has gained access to the physical storage and performing a brute force search does not know if they have successfully decrypted the volume/file as they do not have the MAC to verify that the key is correct. Perhaps an attacker could try decrypting and testing if decryption matches English phrases, however there could be multiple keys that produce valid plaintexts.

What is done in practice, do programs like TrueCrypt or Keepass perform authenticated encryption?


texts: Does encrypting data multiple times using different passwords increase security?

texts:
Does encrypting plain-text data multiple times using different passwords provide a greater level of security?

If so, what encryption algorithm would be best for such a use? Would it be beneficial to use different algorithms for each iteration?

I also had an idea to use 1 algorithm if the password starts with A-N and another if the password starts with O-Z. Is something like this beneficial?


texts: Could we break MD5 entirely in the future?

texts:
Even of today MD5 is (sadly) still heavily used in some applications. Even big tools like ApacheMD5. But even today there are more then enough MD5 hashes which are still not cracked.
According to Wikipedia, the strongest attack at time of writing this seems to be a preimage attack against MD5 which was published in April 2009, was published that breaks MD5's preimage resistance. This attack is only theoretical, with a computational complexity of $2^{123.4}$ for full preimage.
But in the future with Quantum computers, could we get all known plaintext for MD5 (or make them collide)? And would anyone who has a quantum computer even take the effort to do so ?


texts: AES encryption using a Diffie-Hellman key exchange

texts:
I have two systems which need to encrypt their communication by AES-128. The key for the AES encryption should be exchanged with the Diffie-Hellman (DH) algorithm.

Now, I've read about DH and got a lot of question marks over my head. These are my questions:

Typically with AES-128, you need a password and a key which will be generated from the password. What exactly will be exchanged with DH, is it the password or the key? In other words, what is the secret that Alice and Bob will calculate?
If I use a 1024 bit prime and a 256 bit private secret for DH, the calculated secret will consist of a lot more than the required 128 bit for AES-128. How can I transform the secret to match the required 128 bit? Is there a standard to do it, because the two systems use different programming languages?

You see, there is a lot of confusion. Maybe you could help me and shed some light on it.


texts: HMAC Key Sizes for MD5, SHA1, SHA224|256|384|512

texts:
I'm trying to find an authoritative source for the HMAC Key sizes for each of the hashing algorithms below. Specifically for TLS implementations of HMAC.

I found this table in RFC5246:

MAC       Algorithm    mac_length  mac_key_length
--------  -----------  ----------  --------------
NULL      N/A              0             0
MD5       HMAC-MD5        16            16
SHA       HMAC-SHA1       20            20
SHA256    HMAC-SHA256     32            32

Which lets me populate this information:

MD5 HMAC uses a 128 bit Key and produces 128 bit digest
SHA1 HMAC uses a 160 bit key and produces 160 bit digest
SHA224 HMAC uses a ____ bit key and produces a 256 bit digest, truncated to 224 bits
SHA256 HMAC uses a 256 bit key and produces a 256 bit digest
SHA384 HMAC uses a ____ bit key and produces a 512 bit digest, truncated to 384 bits
SHA512 HMAC uses a ____ bit key and produces a 512 bit digest

But I am unable to find definitive key sizes for SHA224, SHA384, and SHA512.

The HMAC RFC (2104) lists this:

  We denote by B the byte-length of such
  blocks (B=64 for all the above mentioned examples of hash functions),
  and by L the byte-length of hash outputs (L=16 for MD5, L=20 for
  SHA-1).  The authentication key K can be of any length up to B ... the
  minimal recommended length for K is L bytes (as the hash output
  length). See section 3 for more information on keys.

Which implies the Key Size must be at least the hashing algorithm's digest size, and confirms what I've "filled in" above.

I presume, given the above that in all cases the HMAC key size should be at least the length of the digest, which would make the SHA384 HMAC key size a minimum of 384 bits, but I can not seem to find definitive confirmation of the fact.


texts: Yao's Garbled Circuit with different outputs

texts:
In a lecture I was told of a a possibility to modify Yao's Garbled Circuit Protocol so that both parties in the end get each a part of the output but not the other part.
This may be achieved by manipulating the Circuit.

Does anybody have some hints how this can be done?

Thanks in advance.


texts: Implementing AES MixColumns with fewest XOR gates

texts:
I'm playing with Contiki (O.S. for constrained devices such as sensors and micro-controllers) and particularly with the AES encryption in software (the one available in Contiki source code).

I'm trying to  complete the code by adding the decryption operation, but   I'm confused with the inverse MixColumns operation.   They are using the paper Lightweight MixColumns for it (because it can reduce the number of XOR gates in hardware).   On the page  257 they state that:

QUESTION: Would be correct to say that the first line is  equivalent to the following  code? (inspired by a similar question) :

 //buf1 * 9 =  ((( buf1 x2) x2) x2)+ buf1
 buf1  =  state[buf4] ^ state[buf4 + 1] ^ state[buf4 + 2] ^ state[buf4 + 3];
 buf2 = galois_mul2(buf1);
 buf2 = galois_mul2(buf2);
 buf1 = galois_mul2(buf2) ^ buf1;

Currently, my decryption function is not working, but not sure if it's because I'm screwing up in another part of the code or at this point.


texts: What does the probability subscript mean in Shannon's secrecy definition?

texts:
Shannon's secrecy can be defined as:

$$P_M (M=m) = P_{SK,M}(M=m|E(SK,m)=c)$$

What does $P_M$ means? (same question for $P_{SK,M}$)

I know that is the probability space M, M being the messages; I do not really understand why that has to be specified - or in general I don't understand what this means.


texts: Do ECDH and ECDSA combined solution provide an authenticated protocol exchange solution in MCU environment?

texts:
I'm working on a project in MCU (micro controller) environment with GPRS connection to exchange data securely with the cloud. The encryption algorithm has been selected to use AES.

I did some search on internet and figured out that ECDH key agreement protocol quite fits the requirements. The good news is that there are some security ICs that have built-in support of ECDH/ECDSA algorithms including secure hardware-based key storage. After digging into this further I learn that ECDH does not do authentication and thus is prone to MITM attacks. This is a very important issue that the system should address.

Can ECDSA be used to do the authentication? Will my system be secure enough with regard to e.g. MITM attacks using a combined ECDH and ECDSA solution?


texts: How Mac-then-encrypt provide security in nonce-misuse setting?

texts:
From this, it is clear that Encrypt-then-Mac provides more complete  security than Mac-then-Encrypt but some schemes use Mac-then-encrypt to provide nonce-misuse resistance such as SIV (AES-GCM-SIV, AES-CCM-SIV) or DEOXY II, ESTATE  by generating a tag and use it as IV for the encryption part.
Q. How is the use of Mac-then-encrypt provide nonce-misuse security?


texts: Possible to use an accumulator to "license" or restrict the qty of certificates being used?

texts:
Suppose in a future version of x509 PKI, it is possible to limit the quantity of certificates being used, what would that look like?

Here is a concept that won't work in the real world, but illustrates what I'm trying to do:

The child CA sends a list of primes to the parent CA (the prime is the public key of an issued certificate and therefore unique)
The parent CA checks the quantity of primes, and if it's less than the license threshold, it creates the product of those primes. (quasi-commutative hash)
The parent CA signs the result of #2
Each validator (web client) gets the signed result of #2, and ensures membership of the public key in the accumulator

The reason I ask is because I'm working with a different crypto system developed by a 3rd party, and  was told I need to constrain its usage somehow.  The design of the 3rd party system is similar to PKI, and therefore many of the thoughts are transferrable.


texts: Correctness Proof in "A tree-based CP-ABE scheme with hidden policy ... "

texts:
I could not understand one step in correctness proof of paper titled "A  tree-based CP-ABE scheme with hidden policy supporting secure data sharing in cloud computing" authored by Runhua Xu, Yang Wang, Bo Lang.

Link to paper: https://www.researchgate.net/publication/271482056_A_Tree-Based_CP-ABE_Scheme_with_Hidden_Policy_Supporting_Secure_Data_Sharing_in_Cloud_Computing

Please refer the screenshot attached. Specifically, I could not understand the move from step 3 to step 4 in which they replaced one of the denominator (highlighted in screenshot).

I will be very grateful if someone can help me understand this move. Many thanks in advance.


texts: How do two parties put together the AUTH data in the SKEME protocol?

texts:
SKEME is a Key Exchange protocol used in the Internet Key Exchange (IKE).  It contains three phases:  SHARE, EXCH, and AUTH -- these are defined in Section 3.2 of the linked SKEME document.

I am trying to understand a confusing part (to me at least) about the AUTH phase of SKEME. There is a bit of background to cover before I can get to my actual question, please bear with me...

SHARE

  Phase SHARE is intended to establish a key $K_0$
  between $A$ and $B$

  In SHARE the parties exchange "half-keys" encrypted
  under each other's public key and then combine
  the half-keys via a hash function to produce $K_0$

But this whole phase is skipped if the two parties instead use a Pre-Shared-Key instead of Public Keys. This is defined here:

  3.3.2 Pre-shared key and PFS

  In this mode, the protocol assumes that the parties already share a
  secret key, and that they use this key in order to derive a new and
  fresh key

  In this mode of SKEME the SHARE phase can be skipped and the
  pre-shared key used as $K_0$

This is the mode of SKEME that I am concerned with, so we take it at face value that $A$ and $B$ have Pre-Shared-Key $K_0$

EXCH

  The next phase, EXCH, is used to exchange Diffie-Hellman exponents.
  Notice that this phase is independent of SHARE.

  EXCH:
  $A$ --> $B$: $g^x$ $mod$ $p$
  $B$ --> $A$: $g^y$ $mod$ $p$

Standard Diffie-Hellman exchange, nothing too complicated here. Both parties now have the DH shared secret.

AUTH

  The authentication of this Diffie-Hellman exchange is accomplished in
  the following phase, AUTH, which uses the shared key $K_0$ from SHARE to
  authenticate the Diffie-Hellman exponents.

  AUTH:
  $A$ --> $B$: $F_{K_0}$ ($g^y$; $g^x$; $id_A$; $id_B$)
  $B$ --> $A$: $F_{K_0}$ ($g^x$; $g^y$; $id_B$; $id_A$)

  Notice that the key $K_0$ shared in the SHARE phase can be known only to
  A and B ...
  The inclusion of $g^x$ in the first message serves to authenticate (to $B$)
  that $g^x$ came from $A$; the value $g^y$ in the same message is used to prove
  to $B$ the freshness of this message (assuming $g^y$ was freshly chosen by
  $B$);

And this is where I get confused.

I know $A$ put calculated $g^x$, and can understand how $A$ knows this value. But from what I understand, $B$ calculated $g^y$, and only shared $g^y$ $mod$ $p$.

Therefore, how does $A$ know $g^y$ to include in the formula above? Similarly, how does $B$ know $g^x$ to calculate the same $F_{K_0}$ to validate the value provided by $A$?


texts: Real world use cases of Multi-Party Computation

texts:
Most of the research papers give imaginary applications of multi-party computation.

Either they talk about Yao's millionares' problem or two or more corporates willing to compute some intrustion detection stuff collectively on their private data without revealing their network logs or similar.

In reality, what are the practical use cases for multi-party computation?

Sharemind is trying to achieve cloud privacy of data computations (of single party) by distributing to multiple cloud servers but here there are no multiple parties as such.

While Homomorphic encryption is touted as special case of SMC, but its still single party outsourcing computations.


texts:
I am mainly looking for security on 2-key $\operatorname{3DES}$ implementation where $K_1=K_3$.
How hard or easy is it to crack $\operatorname{3DES}$ when $K_1=K_3$?


texts: Is secure communication without public-key crytography feasible?

texts:
We all know about public-key cryptosystems, and we know some of these are computationally secure (for the time being, of course).

Are there any algorithms out there which allow safe communication between peers in a non “public/private” key fashion? If so, I would like to know some of these. If not, does any kind of formal demonstration of the infeasibility of such algorithms exist?


texts: Get IV from Key, Clear and Cipher text in AES-256 CBC

texts:
Newbie question here but can I get the IV if I know the Key, plain text and chiper text ?

(I thought that if I encrypt 16 first bytes of clear with the key and 16 first bytes of cipher text as IV it would work to get original IV but it seems that it doesn't)

Thanks.


texts: Can a 1 byte difference in AES 128 bit keys make huge difference in output?

texts:
If we take some randomly generated key of AES-128 and we change any random 1 byte of that 16 byte key, will this make huge difference in the AES cipher text generated over same input string?

Does this 1 byte change makes output look like uniformly random? Does it have an effect on security?


texts: Encrypt a single file, chunk-by-chunk, each chunk using different key (AES)

texts:
Encrypt a single file, chunk-by-chunk, each chunk using different key.
I am a security newbie (only took 2 security courses before)
But currently I am using this encryption method for my Android application, which perform client-side encryption and upload each encrypted chunk into different cloud storage (Dropbox, Box, Google Drive, SkyDrive) {The app is not yet published in google market, and is planned for publish after it is stable}
But somehow I think it seems like it is doing extra works without adding extra level of security.

Steps as below:

Using PBKDF2, I derive 1 master key (Km) and 1 database key (Kd) from two passwords provided by user
Then I further derive multiple partial keys (Ki...Kn) from (Km) using PBKDF2 with random salts. The salts (Si...Sn) are stored in a database encrypted with (Kd)
Then I split a file into multiple chunks (4MB), and encrypt each chunk with different partial key (Ki...Kn)
The information of which salt is associated with which chunk is stored as file metadata in database. (the database is stored in cloud storage too)
The same steps goes for decryption, in reverse way (take 2 passwords from user, derive Km and Kd, decrypt database, retrieve salts from database, derive Ki...Kn from Km + salts, decrypt each file chunk, merge each chunk back to original file.

Initialization vector (iv) is also used when initialize the cipher, but I don't mess anything with it. I follow the original method and I just append it infront of my file chunk as plain text.

As far as I understand the usage of Salt is we don't need to keep it secret. As it simply makes brute force attack slower.
But in my case, I am keeping the salt secret (some people call it pepper, or shared secret)

My main questions are:
1) Is my design flawed?
2) If it is not flawed, does it provide extra security? instead of just slowing down brute force. Or is my design totally pointless and extra?
3) Any else comments are welcomed.


texts: Safety of a private key when knowing the full content of an encrypted message in case of fixed initialization vector

texts:
When knowing the full content of the original message, will I be able to derive the private key from the encrypted message when the underlying encryption uses a fixed initialization vector?
Meaning if we encrypt by Text UNENCRYPTED x Private Key =[fixed IV]=> Text ENCRYPTED, can we somehow calculate the key backwards by Text ENCRYPTED % Text UNENCRYPTED =[fixed IV]=> Private Key, considering a fixed IV is used?
If the answer is no, please explain why this is not possible. If the answer is yes, will the calculated key really be the private key or just a local solution to this particular message, not suitable to decrypt other texts encrypted with the same unknown private key? (The latter would mean something like:  Text ENCRYPTED % Text UNENCRYPTED =[fixed IV]= Pseudo Private Key != Private Key)
(You might also note differently: fx(Text UNENCRYPTED, Private Key) = Text ENCRYPTED, so if fy(Text ENCRYPTED, Text UNENCRYPTED) = Private Key, how to get from the function fx to fy? If a fixed IV would not allow this, please mention some other encryption methods with which this backwards calculation would be possible)


texts: What are the pros and cons of deterministic site-specific password generation from a master pass?

texts:
I've been reading up a bit on deterministic password generators. All the ones I can find basically do something like this:

Pick a master username and a master passphrase. The username could be your email, or a PIN, or something else. The master passphrase can be subject to stringent requirements to ensure sufficient entropy. The combination of these two factors needs to be ultra-secure and something you're reasonably certain that nobody's ever used before.
Enter the site name that you want a password for.
Generate the string $H^n\text{(passphrase||username||sitename})$, where $H^n(\cdots)$ is an n-fold iteration of SHA256 or some other sufficiently secure hashing algorithm and $||$ is string concatenation.
Make sure that n is sufficiently large such that n iterations of the hash generates a substantial amount of work and protects against brute-forcing.
Do a final deterministic mapping from this last string down to an n-character string where the individual chars of the string are in some set of "valid" characters (alphanumeric, alphanumeric+symbols, etc).

There are variations on the above, but that seems to be the basic idea.

Now, I'm curious how secure and trustworthy an algorithm like this really is compared to existing password managers.

For existing password managers, you have the same basic weakness - if your user+master pass is compromised, all of your passwords are also compromised. But does this system have any additional weakness on top of that?

It seems as though it'd be fairly resistant to the obvious things:
- If your plaintext pass for one site is compromised, it'd be very difficult to work out your pass for another site.

Furthermore, due to the fact that the hash function is iterated a sufficient number of times, it'd be difficult to brute force.
The best way to attack this seems to be a rainbow table approach with a bunch of common master usernames, master passphrases, and site names, but so long as your username+passphrase is of sufficient entropy, that'd be difficult to pull off.
Furthermore, if you want extra security for a certain site, you can increase the entropy of the sitename field a bit (example: eBay becomes 3b4Y@!#$% or something).

Seems reasonably secure, but I don't know if I'm missing something. Is there some well-known weakness with this system?


texts: Implementing forward secrecy in OpenPGP with public key authentication

texts:
I am trying to consider the feasibility of implementing an encrypted file sharing system, which both provides forward secrecy but also allows public key verification. I am stuck on the marriage between these two requirements that hopefully someone can help me out with.

In order to provide forward secrecy, I think a new random keypair should be generated for every file transfer request rather than two users sharing long-term public keys in advance. That way, if a private key for a particular file share is somehow compromised, it would only compromise that one file and not all of the files ever sent from that user.

However, the creation of a new keypair for every file share introduces a problem with public key verification. Traditionally speaking, the fingerprint of a public key should be verified in person and would remain verified for the lifetime of the keypair. If a new keypair is generated for every file share, then that means each new public key needs to be verified in person, which is infeasible.

Is it possible to utilize unique keypairs for every file share for forward secrecy while also securely verifying a public key is sent from the correct user only once?

Note that the system is meant for asynchronous file transfer, meaning the encrypted data would be uploaded to the cloud temporarily until downloaded by the recipient. However, file share requests would include a mandatory expiration date.


texts: How convert Point on Curve into AES key?

texts:
I'm playing around with ECC, trying to encrypt traffic between my webapp and backend (its not a product, im trying to learn and understand more about ECC)
I managed to generate keys, successful run key exchange and got same point on both ends.
Now I wonder how I should convert my point which has 2 coordinates into AES key.


texts: Verification of homomorphically encrypted computations

texts: Is there a way to prove the accuracy of computations performed on homomorphically encrypted cypher text?


texts: How does chosen ciphertext attack on Elgamal work?

texts: Can it be proven that attacker can obtain the full message if he knows some plain-ciphertext pairs?


texts: Symmetric property of DDT of inverse function

texts:
Given a bijective function $F: \mathbb{F}_2^n \rightarrow \mathbb{F}_2^n$.

The entry of the Difference Distribution Table (DDT) at row $\alpha$ and column $\beta$ is defined as

$$DDT_{F}(\alpha,\beta) = \delta_F(\alpha, \beta) = |\{ x \in \mathbb{F}_2^n | F(x) + F(x+\alpha) = \beta  \}|$$

I need to show that

$$DDT_{F}(\alpha,\beta) = DDT_{F^{-1}}(\beta, \alpha)$$

with

$$DDT_{F^{-1}}(\beta, \alpha) = \delta_{F^{-1}}(\beta, \alpha) = |\{ x \in \mathbb{F}_2^n | F^{-1}(x) + F^{-1}(x+\beta) = \alpha  \}|$$

Unfortunately, I do not know how to start to show the equality, but I assume substitution is the way to go. Can you please give me a hint?

I tried the same approach I used to show that this symmetric property does also hold for the Linear Approximation Table (LAT), i.e.

$$LAT_{F}(\alpha,\beta) = LAT_{F^{-1}}(\beta, \alpha)$$

with

$$LAT_F(\alpha,\beta) = \widehat{F}(\alpha,\beta) = \sum_{x \in \mathbb{F}_2^n} (-1)^{<\alpha,x> + <\beta,F(x)>}$$

$$LAT_{F^{-1}}(\beta,\alpha) = \widehat{F^{-1}}(\beta,\alpha) = \sum_{x \in \mathbb{F}_2^n} (-1)^{<\beta,x> + <\alpha,F^{-1}(x)>}$$

For the LAT, the trick was to substitute. Since $F$ is a permutation and the sum goes over all elements in $\mathbb{F}_2^n$, substitution only changes the order in which the elements in $\mathbb{F}_2^n$ are processed.

$$x = F(y)$$

This leads to:

$$\widehat{F^{-1}}(\beta,\alpha) = \sum_{x \in \mathbb{F}_2^n} (-1)^{<\beta,x> + <\alpha,F^{-1}(x)>} = \sum_{y \in \mathbb{F}_2^n} (-1)^{<\beta,F(y)> + <\alpha,y>} = \widehat{F}(\alpha,\beta)$$

Unfortunately, substituting $x = F(y)$ did not solve my issue with the DDT.


texts: How can a derived key be verified to be the right key?

texts:
Assuming I am using some derivation function to generate encryption key from the string to encrypt a file. How that string is later verified during decryption?

If user enters wrong password/string, why system / app doesn't decrypt entire file resulting in incorrect clear text? What mechanism is behind the scene?


texts: Security aspects of using a global values as nonce and additional data for AES?

texts:
is it a good idea to use global values as nonce / additional data? What problems
can occur?
What should be take in account when we deal with such parameters for encryption.

Thanks


texts: Why is it bad to encrypt the same message M with the same key K in both CTR and CBC modes of operation?

texts:
It is apparently not good - more precisely it is not secure - to encrypt the same data message M using the same cryptographic K with a block cipher (e.g. AES, but this is not relevant) in both CTR and CBC modes of operation.

One example of this statement can be found in ref. [1] below.

We can assume a context where the attacker has full control on both decryption mechanisms (both the CTR one and the CBC one). Of course, he cannot read or change the key K, but he can inject chosen inputs in both mechanisms and recuperate the outputs. As many as he wants. Secondly, I also assume the attacker know the IV used for CBC, and the [nounce||ctr] in CTR, as these parameters are not secret. Also, to be clear, the IV in CBC mode is not related to the [nounce||ctr] in CTR; it is not the same.

I can imagine that the weakness resides in the capability to decrypt with CTR what was encrypted in CBC (or vice-versa), and somehow gain information from here... But this is too advanced for me.

I am interested in understanding this. How having both encrypted forms bring risks, exposes, the value of K? Or give information that can lead to the clear message?

[1] https://docs.microsoft.com/en-us/playready/packaging/content-encryption-modes#limitations


texts: Understanding math behind RSA key derivation

texts:
I was reading through the key derivation for RSA. Here are the steps per wiki -

Select strong primes $p$ and $q$ such that $pq = n$
$\phi(n)$ = $(p-1)(q-1)$
select $e$ such that $e$ and $\phi(n)$ are coprime.
Select $d$ such that $ed mod(\phi(n)) = 1$

I do not understand why the $\phi(n)$ is even needed. Why can't we just skip the step and say -- select $e$ such that $e$ and $n$ are coprime.

Would it not work? Is the math somehow dependent on that? If so what is it?

Also why should $e$ be coprime to $\phi(n)$?

To clarify my main question was about why e needs to be relatively prime to phi(n). Would it not work if its relatively prime to n?

After following poncho's answer -- Lets say I want to pick e relatively prime to n. In his example N = 77. Lets say e = 4 then d = 19. So $edmod(N) = 1$. Of course e is not a prime number here, but the spec does not say e should be prime.

It would appear that the $\phi(n)$ is chosen so that its smaller than N giving an opportunity to find the $e$ and $d$. So why choose $(p-1)(q-1)$? Why can't it be some other operation to make the result smaller than n?

I know I am missing something here and its not clicking. Hope some one explains it.


texts: Why does a non-prime DH modulus creates a "NOBUS" backdoor

texts:
can't we do a nobus backdoor with DH modulus prime? Some have argued that with a prime modulus you can just get the order by doing p-1 and then factor it, thus it is easy to reverse. I argue that this is not true.

The prime case

Our modulus is a prime $p$ such that the order of the group is $p-1 = p_1^{k_1} \times \cdots \times p_n^{k_n}$

For the backdoor to work, the discrete log should be do-able in groups of order $p_i^{k_i}$

For the NOBUS to work, you shouldn't be able to find the factors $p_i^{k_i}$

The non-prime case

Our modulus is now a composite $n = p_1^{k_1} \times \cdots \times p_n^{k_n}$ such that the order of the group is $p_1^{k_1-1}(p_1-1) \times \cdots \times p_n^{k_n-1}(p_n -1)$

For the backdoor to work, the discrete log should be do-able in groups of order $p_i^{k_i-1}(p_i-1)$

For the NOBUS to work, you shouldn't be able to find the factors $p_i^{k_i}$

The difference?

I see almost no difference between these two problems. It seems like a NOBUS backdoor could as easily be created with a prime modulus as with non-prime one.

Thoughts?


texts: RSA encryption/decryption process is not working correctly

texts:
I'm trying to apply the RSA cryptosystem to encrypt a byte M=72, using predefined modulus n, public key exponent e and private key d.

(n, e, d, p, q) = (4802, 5, 59, 43, 8)

In order to accomplish that, I used the following code on Python console:

C=(M**e)%n
M=(C**d)%n
print M

the first instruction encrypts the byte as C: using the RSA encryption mathematical expression (** stands for exponentional, and % for modulus in Python programming language)
the second decrypts C to get M back: using the RSA decryption mathematical expression.

However, the output shows:

  2816

which means that M was incorrectly computed as '2816', although I'm pretty sure that all the values of n, e, d, p and q respect the RSA public key algorithm specification.

Does anyone have any idea?


texts: Suppose $N=3953$, Alice encryption key is $e_A = 337$ and bobs is $e_B=23$. Eve happens to know the corresponding decryption keys, $d_A=3385$ and $d_B=2663$. Can I use this information to find the prime factorization of $N$?


texts:
I want to compute an HMAC value of a data set using CKM_SHA256_HMAC mechanism with AES key. I have the error code CKR_KEY_TYPE_INCONSISTENT because it seems that I need to use a key of key_type GENERIC_SECRET instead.
Is it possible to use AES key_type with this mechanism? If yes, how can I do it? Can you provide an example?


texts: Is this ECC based messaging method secure?

texts:
I developing an encrypted messaging for ZeroNet (aP2P file-based network, website: zeronet.io) and would like to have some guidelines if any of this could work.

My first idea:

In ZeroNet every user has his/her own files signed by ECC this ensures the messages authenticity.
When Bob visits the site first time then a new (Bitcoin BIP32 based) public key will be generated, written to his file, signed and published to the network.
If Alice want to message to Bob then reads the Bob's public key, creates a new message using ecc_encrypt_using_bob_pubkey("ZNE1" + generated_aes256key + generated_aes256iv + aesencrypted_text), puts it to her file, sign and publish to network.
If a new file is published to the network then Bob checks the added messages in it and try to decode them using his ECC privatekey.

To make privacy better the sender does not specify the messages recipient, so have to check every messages added to the network.
The messages are signed with one ECC private key and encrypted with an another one.

My other idea:

If Alice wants to send a message to Bob, then she puts ecc_encrypt_using_bob_pubkey("ZNE1" + generated_aes256key + generated_aes256iv) encrypted shared secret to her file. (or better to use per-message, unencrypted IV?)
Then from now Alice will use this shared secret to encrypt messages to Bob (random prefix + protocol id + message)
If a new file is published then Bob checks encrypted shared secrets in it and see if he able to decrypt any of them.
If he successfully decrypt a shared AES secret from Alice file then he checks Alice's encrypted messages and decrypt the messages in Alice file.

The pros of second idea:
 - Shorter messages
 - Don't have to store the messages twice (one for other user, one for our sent folder)
 - AES provides 100x faster message checking.

The cons of second idea:
 - If the AES key is broken then all messages can be decrypted (applies both if privkey broken).
 - Anyone able to see if you added a new shared secret (start messaging with new people)

Thanks for any suggestions!


texts: Public signature of challenges as authentication

texts:
Assuming you trust a client's public signature keys, a simple authentication protocol would be to send a long random string challenge, and get the client to sign it
Since most of authentication still relies on more sophisticated protocols like sending some form of secret over the tubes and verifying it in the server, there must be some weaknesses in the above protocol that I am ignoring.
What issues is there with this approach? If you rely on HTTPS to send the challenge, most MitM attack surface is removed, am I correct?


texts: Key derivation design to avoid key leaks

texts:
I have the first function that generates keys from AES decryption (128-bit key). It takes seed as input:

derived_key_1 = AES-DEC(key, seed)

seed and key are both fixed values that the attacker cannot changed. Attacker knows the value of seed. His first goal is to get derived_key_1.

He dooes have an extra capability. He has access to another function defined as follows:

temp_key = AES-DEC(key, chosen_seed)
derived_key_2 = AES-DEC(temp_key, seed)

where chosen_seed is controlled by the attacker. He can observed derived_key_2.

Assume the AES is implemented in hardware and AES primitive itself does not have timing side channel. Also attacker does not have other physical side channel (e.g., power, EM, fault, etc.) to observe other than timing of the two functions.

Are there any potential security concerns in this construction?

If there are problems, do the problems go away if I change the seed in the second function to seed_new which is still visible to the attacker, but not changeable by him.


texts: how to use AES block cypher when there are only 47 byte space?

texts: If I have only 47 byte for encrypted data, and want to use AES block cypher, is there a method that I could make full use of them, or if I could only use 32 bytes of them, since the block should be multiple of 16 byte?


texts: Are partial hashes used in cryptographic protocols?

texts:
In my question (and answer) about a partial hash code used within a signature application I found out that partial hash codes are sometimes used within protocols with a relatively restricted security tokens such as smart cards.

In the comments below the answer I mused that the partial hash makes sense over a full hash. If a octet string representing a full hash is send then the octet string can contain any data, which would then be used in the signature scheme instead of the hash. This way it could be possible to create a covert channel.

Two related questions:

Are covert channels considered a significant threat in signature schemes?
Are partial hashes used in other protocols than the one described above?


texts:
It has been said that RSA uses a modulus product of two prime numbers for security reasons. But does RSA even work correctly if we allow composite integers instead?

I think that the answer is "NO".

Define “work correctly” as:

allows encryption and decryption to be carried out as in normal RSA, yielding the original message (message padding and unpadding can remain unspecified, or absent as in texbook RSA);
a security level can be given in terms of the key generation process (which may have alternate requirements to testing that $p$ and $q$ are prime).


texts: Is EKE attackable by a brute-force password search?

texts:
So I'm trying to properly implement the EKE protocol and I'm using C# with the Windows CNG and ECDH key exchange. I need to use this because it's FIPS certified and all that jazz.

So what I'm understanding about EKE is the fact that it depends on the fact that the public keys are completely randomized, therefore not verifiable plaintext. Otherwise it would be easy to run a dictionary attack against the protocol because the public keys are encrypted using the pre-known password.

Here's my problem: I noticed that in the CNG algorithm, the public key is a large byte array and it is completely randomized except for the first 6 bytes are always the same. From there on its completely randomized. This leads me to believe that if I wanted to run a dictionary attack against that, all I would need to know is what the first 6 bytes were and I could validate that I was able to decrypt that public key or maybe even brute force it.

To protect against this, I could easily truncate off the first 6 bytes and encrypt the rest of the completely randomized byte array with the password and then just add those 6 bytes back on either endpoint to calculate the secret key.

I'm pretty sure that's right but I'm discovering that cryptographic systems are fiendishly tricky and I wanted to run it past you guys to make sure I'm thinking about this correctly.


texts: How SPHINCS+ Hash Signature ADRS structure define

texts: can anyone help me to elaborate the structure of ADRS with example ( tree ADRS, layer ADRS, keypair ADRS etc)used to generate root SPHINCS+ signature. Also can some one help me to describe tree hash process used in SPHINCS+ with example.


texts: Confusion regarding computing Multiplicative Inverse Modulo P?

texts:
May be a silly doubt, please rectify my confusion regarding below problem:

For concreteness assume $g=2, p=11, a=6$ and $x=9$

$$A = g^a \bmod p = 2^6 \bmod 11 = 9$$

$$X = g^x \bmod p = 2^9 \bmod 11 = 6$$

$$C = A^x \bmod p = 9^9 \bmod 11 = 5$$

To find $X$ (i.e. $g^x$) using $C$ and $a$ only is:
$X' = C^{a^{-1}} \bmod p = 5^{6^{-1}} \bmod 11 = 5^2 \bmod 11 = 3$

The answer should be $X = X'$ but it is $X \neq X'$
Why this problem, where is my mistake?


texts: Standard lightweight one-way hash functions for IoT devices

texts:
What are the standard lightweight one-way hash functions used in current Internet of Things devices?

I could find some proposal of hash functions in conference papers but I want to know the ones which are being currently used. I found no concrete answer while searching on internet.


texts: Quadratic Sieve: what's the next step after it fails?

texts:
Factoring some 20-45 digit values n with a (simple) quadratic sieve, the quadratic sieve may end up with pairs of x and y s.t. $x^2 \equiv y^2 \pmod n$, but neither x+y nor x-y has a nontrivial gcd with n for any of the pairs.
The contini pdf (www.crypto-world.com/documents/contini_siqs.pdf) is an excellent resource for this and related questions.

To factor these numbers, I've been trying a couple of things:

2) Add more tb-smooth squares' factorizations to the matrix in order to increase the dimension of the nullspace.

What is the best way to handle this?

explanation:
For every Linearly Independent vector in the matrix's nullspace, there's a ½ chance of finding a good pair.  If the nullspace has dimension around 10, that's a very high chance of success.

Update: Post above heavily edited to make it informative.  Having too few vectors could potentially happen (e.g. if fewer than recommended smooth squares are found), but the problem I was having came from my own error.


texts:
I cannot quite grasp my head around this

Basically, RSA encrypts by having public key (e, n) and private key (d, p, q) Where n = pq

Signatures are done by: Signed = Message^d mod n Hence, to verify you would do Signed^e mod n = Message

You would get the Message. How do you encrypt the message and have a signature at the same time? What am I missing..? I know you would hash the message, but then again. How would you hash the message?

I want to encrypt the message, but if I send over the Signature, the attacker can simply reverse the signature to find out what the message is.... no?


texts: How to recognize Authenticated Encryption with Associated Data ciphersuites

texts:
I have some doubts regarding AEAD ciphersuites and I need some clarification. In the following ciphersuites list:

dhe_rsa_aes_128_sha
dhe_rsa_aes_256_sha
ecdhe_ecdsa_aes_128_gcm_sha256
ecdhe_ecdsa_aes_128_sha
ecdhe_ecdsa_aes_256_gcm_sha384
ecdhe_ecdsa_aes_256_sha
ecdhe_ecdsa_chacha20_poly1305_sha256
ecdhe_rsa_aes_128_gcm_sha256
ecdhe_rsa_aes_128_sha
ecdhe_rsa_aes_256_gcm_sha384
ecdhe_rsa_aes_256_sha
ecdhe_rsa_chacha20_poly1305_sha256
rsa_aes_128_sha
rsa_aes_256_sha
rsa_des_ede3_sha

I have some questions:

Can you help me identify the ciphersuites that provide Authenticate Encryption with Associated Data (AEAD) from those that do not?
Are GCM and Poly1305 ciphers indicates AEAD and the rest of ciphers do not provide it? Can you list all the AEAD algorithms?
Is it always the case that AE ciphersuites must be also Forward Secrecy ciphersuites? or there is no relation that binds the two?
Is Authenticated Encryption (AE) is the same AEAD? or they are different terms?


texts: Is it accurate to say that SHA-3 (keccak) is based on Merkle-Damgård?

texts:
I know that sponge functions are different in many ways. Yet I'd like to know if SHA-3 can nonetheless be said to be "based", if not simply "inspired", by the Merkle-Damgård construction. To be more precise it seems to be a wide-pipe construction followed by an entropy collection procedure.

Is it accurate to say that SHA-3 (keccak) is based on Merkle-Damgard?


texts: What does it mean if second half of 8-char string encrypted in 3DES is always identical?

texts:
In the recent Adobe passwords leak, presumably encrypted in 3DES ECB, second half of all 8-character passwords is identical: ioxG6CatHBw==

Source: http://pastebin.com/iDTFARwq (guesses based on obvious password hints)

L8qbAD3jl3jioxG6CatHBw== password
BB4e6X+b2xLioxG6CatHBw== adobe123
j9p+HwtWWT/ioxG6CatHBw== 12345678
rpkvF+oZzQvioxG6CatHBw== iloveyou
2dJY5hIJ4FHioxG6CatHBw== sunshine
Ttgs5+ZAZM7ioxG6CatHBw== princess
Dts8klglTQDioxG6CatHBw== computer
y7F6CyUyVM/ioxG6CatHBw== superman
2hD1nmJUmh3ioxG6CatHBw== asdfasdf
cSZM/nlchzzioxG6CatHBw== 1q2w3e4r
e+4n2zDarnvioxG6CatHBw== 1qaz2wsx
ueE89xIj8RTioxG6CatHBw== internet
ietF94QrMIbioxG6CatHBw== michelle
ecW6IyEemknioxG6CatHBw== football
lVwka/Mn8TPioxG6CatHBw== baseball
ghrvkwCcX4bioxG6CatHBw== jennifer
eOsrbcW/PeTioxG6CatHBw== abcd1234
Nz4/TI6o5RrioxG6CatHBw== trustno1
iMhaearHXjPioxG6CatHBw== whatever
OPQxDLW2L+DioxG6CatHBw== 11111111

Does it allow for guessing the keying option used or other 3DES encryption properties?


texts: What properties should an ideal straight P-Box exhibit?


texts: Prove that for key with $n$ dimensions, the order of the key is $k!$

texts:
I need to prove, that for a key with $n$ dimensions, they order of the key would be $n!$ and to prove that, I need to use mathematical induction:

$$\text{Let n = 1} \Rightarrow {1} \text{ if there are only one element in the key, there is one way to order it. } \\ \text{Suppose that n = k  }\Rightarrow \text{ the order of the key is } k! \\ \text{ Then it must be proved that for } n = k+1 \Rightarrow \text{ the order of the key is } (k+1)! \\ \text{ Is it true that } k!  +1 \stackrel{?}{=} (k+1)! \\ \frac{(k+1)!}{k+1} +1 \stackrel{?}{=} (k+1)! \\ (k+1)! + k +1 \stackrel{?}{=} (k+1)(k+1)!  \\ 1  \stackrel{?}{=} (k+1) -\frac{(k+1)}{(k+1)!} \\ (k+1)((k+1)!-(k+1) = (k+1)! \\ (k+1)(k+1)!(k!-1) = (k+1)! \\ (k+1)(k!-1) \stackrel{?}{=} 1 $$
And this one is not true even for $k=1 $, so I must have made some error.


texts: Trustless, Two-Party Random Number Generation

texts:
I've been having trouble with coming up with a random number generator that produces a random number between two parties. My current scheme is this:

User 1 gives user 2 the hash of their randomly generated seed, user 2 responds with their unhashed seed. User 1 generates the random number by feeding his own unhashed seed and user 2's seed into a seeded RNG. User 1 discloses the resulting random number and discloses his own seed. User 2 accepts the outcome if the seed matches the hash and seeded RNG produces the same.

I'm not too good with the cryptography behind this but is this safe? Is it okay to just make the RNG seed by just appending one seed to the other? Is there any specific RNG I should use?


texts: Is Commitment Scheme with hash function is a perfectly hiding scheme?

texts:
If I use a hash function to construct the commitment scheme, can I say it is perfectly hiding?

$m$ is the message
$r$ is a random value

In commit stage,
$$ c = C(m, r)$$

In reveal stage, by revealing $r$ and verify
$$c = C(m, r)$$

Because there is $m'$ and $r'$ exist for $$C(m, r) = C(m', r')$$
So it is perfectly hiding, and it can open it both ways, so it is computationally binding.

Am I correct?


texts: How are the IVs of SHA-512/256 and SHA-512/224 calculated?

texts:
This seems odd to me, because there are a lot of resources out there saying that the initializer values of SHA-512 and SHA-384 are the first 64 bits of the fractional parts of the square roots of prime numbers. For SHA-256 and SHA-224, the 32 LSBs or MSBs of those values are used.
But this question came into my mind that what about SHA-512/224? How on earth are 0x8C3D37C819544DA2 and others calculated? And I have searched a lot and ironically, had no luck.
So, how are those calculated?


texts: Can an AES-256 key be generated for a large number of cribs?

texts:
I have a question in regards to Ransomware type viruses. I know that a number of these viruses use the AES-256 algorithm to encrypt user's files using a randomly generated key. I work in IT support and I had one client the other week who had lost a large number of important files this way but one thing which struck me was that we were able to recover a large number of files via DropBox - about 500 files (~2gb worth of data) and because the virus only changed the extension it was clear which unencrypted file corresponded to which encrypted file.

What I was wondering is; with a large dataset like this where you have both the encrypted and unencrypted data would it be possible to calculate the encryption key for an AES-256 algorithm in a reasonable time? I don't know how these algorithms work but presumably you would have so much data available to compare that it should at least make the task considerably easier should it not?

I'm not intending to rid the world of ransomware but it just interested me!

Cheers,

Olly


texts: Why RSA2048 sign of Intel accelerate card is fast?

texts:
Intel accelerate card

This card executes rsa2048 sign 35K ops(operation/second). My fast version is only 100 ops.

I can't find any HSM paper that has same performance level.

I am interested in this problem. I know modexp, montgomery, crt, PE-array and some other circuit skills, but I can't reach such a high performance.

Could someone give me a hand please? Thanks very much.


texts: AES-CBC authentication and password validation

texts:
Let's say, Alice uses AES256-CBC to encrypt some data. The key for encryption is derived using PBKDF2, where password is some passphrase Alice and Bob agreed on (using DH) and salt is random generated (using /dev/urandom for now)*. The IV for the CBC is generated the same way as the salt.

Now Bob receives the cipher and would like to authenticate it, so he can tell for sure, that the message really came from Alice (or anyone else who knows the passphrase). Should Alice encrypt the data first, use the derived key as password, the cipher as message and append/prepend the result to the cipher?
Or she ought to use the derived key as password, the plain text as message, prepend the HMAC to the plain text and encrypt?
(There is a lot of related questions and answers, I am just confused what to use when and what are the pros and cons)

Another problem I'm struggling with is, how will Bob get the IV and the salt which were randomly generated at encryption time?

Last problem I'm trying to solve is, when Bob will decrypt the cipher, how can he know the password he entered is correct, without decrypting all of the data?

*Is /dev/urandom secure enough to generate random salt and IV?

Just to clarify, I don't intend to use this implementation in real world situation, this is purely for educational purpose


texts: Possible ECC backdoor and its impact on Internet traffic

texts:
In a recent article, Bruce Schneier suggested that he prefers classic discrete log crypto over ECC because "I no longer trust the constants. I believe the NSA has manipulated them through their relationships with industry."

Can someone elaborate on a case study what the above phrase would mean in the real world? Could a backdoored ECC allow the passive sniffing of HTTPS traffic that uses ECC for the ephemeral key?
Can someone explain the logic behind this fear?


texts:
I am trying to understand the safety precautions regarding the variables used in Diffie-Hellman and I was refered to this post answer Does the generator size matter in Diffie-Hellman?.

  In more details: for DH, we use a subgroup of size q of the integers modulo p (a big prime) with the multiplication as group operation. q should be a prime of length at least 2n bits for a 2n security level (or, at least, q should have a prime divisor of at least 2n bits). Typical parameter sizes are 160 bits for q and 1024 bits for p, or 256 bits for q and 2048 bits for p. The generator g is an element of order q.

What is meant by for DH, we use a subgroup of size q of the integers modulo p I assume the group is the potential congruences of $\mod p$, but what is the subgroup. Since the generator should be a primitive root of p doesn't that mean that the group is $[1,p-1]$? This leads me to believe that $ q = p-1$. However this makes no sense when considering the following sentence q should be a prime of length at least 2n bits for a 2n security level (or, at least, q should have a prime divisor of at least 2n bits). I am not sure what the n variable symbolizes?


texts: Why require that public and private key each have length at least the security parameter?

texts:
In Jonathan Katz and Yehuda Lindell's Introduction to Modern Cryptography (3rd edition), the key generator of e.g. signature has

The key-generation algorithm $\mathsf{Gen}$ takes as input a security parameter $1^n$ and outputs a pair of keys $(\mathrm{pk},\mathrm{sk})$. These are called the public key and the private key, respectively. We assume that $\mathrm{pk}$ and $\mathrm{sk}$ each has length at least $n$, and that $n$ can be determined from $\mathrm{pk}$ or $\mathrm{sk}$.

I see why the minimum size of $\mathrm{pk}$ and $\mathrm{sk}$ must grow with $n$ (with some minimum rate) in order to meet any sound security definition, but not why that's made a requirement.


texts: How to calculate chance of missing an error with overlapping hashes?

texts:
Assume that I have a huge file, which I split up into blocks.  Each block is hashed with a hash function of $x$ bits.  The chance of an error going undetected in a block should therefore be $1/2^x$.

Now, let's assume a block is $y$ bytes in size, meaning there are $2^y$ possible values for that block of data.  As $y$ gets bigger, there are more possible collisions for any given hash value, yet the chance of such a collision occurring seems to remain the same (correct?).

For my purposes, I need to split the data in many blocks, the more the better, but the more blocks, the more hashes which at some point take quite a lot of space to store.  So I want to use a hash where $x$ can be small while still having a high chance of detecting errors.

So I got this idea that instead of hashing every block with a hash function of $x$ bits (illustation 1), I instead hash every block with a hash of $x/2$ bits.  However to ensure that it is still possible to detect errors at the same rate as before, I add a second hash over every group of 4 blocks of $x/2$ bits (illustration 2):

Illustration 1

 |-----|-----|-----|-----|   4 hashes of x bits

 Total bits = 4*x

Illustration 2

 |-----|-----|-----|-----|   4 hashes of x/2 bits
 |-----------------------|   1 hash of x/2 bits

 Total bits = 5*x/2 = 2.5*x

Are these equivalent, how do they differ if not and how can I compare them?

Another possibility would be:

 |-----|-----|-----|-----|   4 hashes of x/2 bits
 |-----------------------|   1 hash of x bits

 Total bits = 4*x/2 + x = 3*x

I couldn't find much on this topic through the usual sources.


texts: Advantages of a TLS handshake over pre-shared public keys

texts:
Lets assume the following setup:

A vendor manufactures IoT devices where each is able to generate an individual private/public key-pair. Only the public key is exposed, the private key is assumed to be secured inside the device.
A database of those public keys is provided by the vendor and is transfered to each client out-of-band.

For each connection to a device the client:

gets the ID of the target device
looks up the public key
encryptes a new symmetric key (e.g. AES) with the public key
transfers it, the AES-encrypted data and an AES-encrypted MAC
(further bidirectional data transfers)

Only the selected device can decrypt the symmetric key and thus the rest of the data. Data integrity is verifyed by the MAC.

An attack can happen anytime after the devices were deployed in the field, but please focus on the protocol. Physical side channal attacks or other modifications of the devices themselves should not be considered. The vendor is trusted. Client authentication is not needed.

Question

What are the advantages of a TLS handshake compared to pre-shared public keys?
The simple public key database would be replaced with certificates signed by the vendor to authenticate the devices.

Perfect forward secrecy would be an advantage, other extra features of TLS (like cipher suite selection or session resumption) are not needed.


texts:
I'm looking for a toy hash function, where the idea is to have high school students break (i.e. find a collision) a hash function by hand, in order to teach them how one way functions and hashing works.

Do you happen to know some function like that?

As for how hard I want it to be to breakable: Ideally a "sizeable" function so that depending on some variable it can be easier or harder, but overall I'm looking at something about between 10 and 30 minutes.