texts: Does the diffie helman rachet in double ratchet do anything if one side never replies?

texts:
I am a little confused on how this functions so apologies in advance if the question is naive.
The way i understand it, the function of the standard sending and receiving ratchets in Double Ratchet is to provide backward secrecy. Since the ratchets continually pass the key through a KDF, the attacker cannot deduce previous keys if he somehow keys a hold of the current one.
The issue is, this does not provide forward secrecy, since the attacker can now tick along with our ratchets. This is where the DH Ratchet comes into place.
I am reading from http://cryptowiki.net/index.php?title=The_Double_Ratchet_Algorithm#Diffie-Hellman_ratchet
Alice and Bob both have a DH keypair generated. This keypair is seperate from the keys used in the sending and receiving ratchets.
When Bob sends a message, he sends his DH public key. When alice receives it, she uses hey private key and forms a new key from those two. Now Alice has new key(lets call it K1) for her ratchets.
Then when Alice sends a message to Bob, she sends her private component and generates a new DH keypair since this one was used on both sides. Bob can now use this to derive the same K1 key. Bob generates a new DH keypair since this one was already used to compute K1 on both sides.
My issue with this understanding is, what if Alice never responds? Bob will keep sending his public key. Since he only ratchets on receiving messages, his DH Rachet will never activate and there is now no forward secrecy for the N messages he sent?
Also alice will receive the same public key multiple times. Surely this is an issue. Keys should be changing on sending,no?
I know theres something I'm missing here. Any help is appreciated.


texts:
I am implementing ring signatures as a part of an authorization system. Since the number of users could get high enough to make computation on end-user devices infeasible, I am thinking of "subgrouping" them.

My idea is the following:
There are $n$ users and there is an untrusted third party, the server $S$ which regularly publishes a random seed $s$ with a list of user identities $L$ for a new period of time. During this time, every user (there are malicous users) should base their actions on $(L, s)$: They deterministically (and preferably efficiently) determine some $k$ subgroups $L_{sub}$ they eventually use for their ring signatures. Every $L_{sub}$ should roughly contain the same number of users $n_{sub}$ and users can (and should) be part of multiple subgroups.

Furthermore, the "subgroup derival algorithm" should ensure that every user gets an equal amount of "mention", i.e. the number a user occurs in each subgroup should be roughly the same for all users. Ideally, a user would not have to first calculate all subgroups in order to retrieve just one.

The actual idea is to cut down the size of the subgroup lists $S$ would have transmit (and first build). With this approach, he would just have to transmit the member list (which he could later delta patch) and $s$.

Could such a subgroup derival algorithm be efficiently constructed? If so, how should one best proceed?

PS: I am not quite sure if this totally fits Crypto SE, but since I am asking for hints towards a secure algorithm and not a program (StackOverflow) or a generic security question (Security), I think this should be OK.


texts:
Let's say I use RSA encryption, it's 2048 bits and I use a simple character padding scheme, every character is turned into a 3 digit number and strung together, then encrypted. Saying that no message will be below 40 characters, ending up in a 120 digit number, how insecure is this?

Edit: The public exponent is as small as it could be, let's say 7 in this case


texts: How to understand the Bilinear mapping with an example

texts:
An efficient bilinear map is given by  $ e $: $G_{1}$ × $G_{1}$ → $G_{T} $.

How can i prove this equation with the help of an example.


texts: identifying presence of encryption of zero in additive homomorphic encryption

texts:
Lets say the server has corpus of ciphertext contains $enc(a),enc(b),enc(c), \dotsc enc(x)$. The encryption function is an additive homomorphic scheme (like Paillier). The server knows only the public key. The client holds both public and private keys.

Is there a way for client to identify if there is an encryption of $0$ in the corpus? i.e. is any of $a,b,c \dotsc x$ is a $0$. A trivial solution is for the client to iteratively retrieve each ciphertext and decrypt it to see if it is $0$. Can we do any better ? i.e. without iteratively retrieving each element or downloading the entire corpus of ciphertext ?

If it were a multiplicative homomorphic scheme, the server could multiply all the encryptions and give the result i.e. $enc(res) = enc(a)\times enc(b) \times \dotsc enc(x)$ , the client could just  decrypt the result to see if the result is $0$ . i.e. $dec(enc(res)) = 0$ if at least one of $a,b,...,x = 0$.

Are there any such tricks possible in additive homomorphic scheme ?


texts: Is it a requirement to understand mathematics when implementing (or breaking) cryptography?

texts:
Related: What is the lowest level of mathematics required in order to understand how encryption algorithms work? and Recommended skills for a job in cryptology

In the context of putting crypto into applications, in a secure manner, could it be argued to achieve this (securely implementing a crypto system) you would require a thorough and rigorous understanding of the mathematics behind the crypto system?

Or, could it be said that this is more a matter of understanding how to code securely, as the cryptographic primitives themselves can already be securely implemented via libraries such as NaCl?

Edit: I realized the obvious, and in fact necessary, extension to this question. Reversing the goal, what level of mathematics would be required to break a crypto-system? On the one hand, heartbleed seemed to be a break in a crytpo-system but was in fact entirely based in (poor) code. On the other, the BREACH and CRIME compression side-channel attacks were very much discovered in the literature first. Am i answering my own question there?


texts: Is standardizing a modified AES a good idea?

texts:
"Recently" the Ukraine standardized a new block cipher Kalyna, which according to the abstract of"A New Encryption Standard of Ukraine:
The Kalyna Block Cipher" by Oliynykov et al. (warning: the paper contains a lot of test-vectors) is basically a modified version of AES.

The high-level changes (to Rijndael) were described as "four new S-boxes, new pre- and post-whitening, a new larger MDS-matrix and a new key schedule".

What was the (likely main) reason to not standardize Rijndael or AES?

As a "bonus" / side question:
What was the (most likely) design rationale behind the changes being made to Rijndael?


texts: GCM cipher M0 tables : semantic questions on how to implement GCM

texts:
I`m reading the PDF "The Galois/Counter Mode of Operation (GCM)". In section 4.1 on the optimization of multiplications with tab, in algorithm 3 I have the following questions:

A vector called M with 128 bits is created, then the value of H is copied into that vector, now M [128] is the same as H, is not it? Or is it after those 128 bits? In programming would be that way.

If I believe that the 128-bit vector is created, and these remain null. because if not the while cycle does not make sense. in this the value of i is multiplied by 2 this results in 128, and the principle of H would be multiplied with the plain text?

P in the plain text, but no matter how long this is, only the first 128 bits of the plain text will be multiplied with H?

Later, it is stored in the vector, but it is being overwritten by what I see in the division of i / 2?


texts: Schnorr Identification Scheme under active adversary

texts: According to the paper “GQ and Schnorr Identification Schemes: Proofs of Security against Impersonation under Active and Concurrent Attacks” by Mihir Bellare and Adriana Palacio, the Schnorr identification scheme is secure under an active adversary who changes messages. I have been told that Schnorr is actually not secure against such an adversary but I am not able to find any new literature on it. Any ideas?


texts: Is my implementation of a PRG at least intuitively secure?

texts:
I've devised a PRG using Bezier curves , constructed with Bernstein polynomials, and I was wondering if you guys could help me with some suggestions or constructive criticism.

Basicly I take a random set of 2d points(seed), used as control points for a number of concataned Bezier curves, this makes up my space. The generated space of the curves is alot greater than the set of initial points. When I wish to generate binary output I go through the space, and because of the formula using Bernstein polynomials, each point of the curve is generated with a number of decimals, from wich I extract the raw binary and concatenate a result. It would seem that the binary of the decimals behind the x,y of each point don't give away any indication of the curve.

I keep an index to know how far along the space I've traveled so I don't use the same data again. The original points that will generate the space are random.

I've tested the output with sts. from NIST and it passed everything, but I was told that is hardly enough for a viable PRG. Then I got redirected to stackexchange :)

Any thoughts?

ps: do you guys know any other tests for a prg?


texts: Functional signatures vs homomorphic signatures

texts:
I found that homomorphic signatures allows an agency to carry out arbitrary computation $f$ on the signed data $m$ and accordingly gain a signature for the computation result $f(m)$ with respect to $f$. Another related notion is functional signatures, in which DO hands out a secondary key $sk$ to allow a specified agency to sign messages $m'$ which satisfy that $m' = f(m)$.
Could you please let me know: What are the differences between these two schemes? Because to me they appear to be the same.


texts:
I have been reading up on RSA attacks and came across a problem that could be called a most-significant-bit (MSB) oracle attack.

For the sake of clarity, let's define RSA primes $(p, q)$, private key d and the public key $(e, N)$ where N is the modulus.

Now assume an oracle exists that will decrypt a given ciphertext $C$ using the private key d and checks the decrypted cipher -- it will return true or false if the decrypted cipher's most significant bit is 1 or 0.

How can I achieve such an attack while given a challenge cipher $C$!
http://www.cits.rub.de/imperia/md/content/may/hw2.pdf


texts: Necessity for finite field arithmetic and the prime number p in Shamir's Secret Sharing Scheme

texts:
Shamir's original paper (PDF, 197kb) describing a threshold secret sharing scheme states:

  To make this claim more precise, we use modular arithmetic instead of
  real arithmetic. The set of integers modulo a prime number $p$ forms a
  field in which interpolation is possible. Given an integer valued
  data $D$, we pick a prime $p$ which is bigger than both $D$ and $n$. The
  coefficients $a_1,...,a_{k-1}~$ in $q(x)$ are randomly chosen from a uniform
  distribution over the integers in [0, $p$), and the values $D_1,...,D_n$
  are computed modulo $p$.

Where:

$D$ is the secret to be shared
$n$ is the number of shares
$k$ is the threshold number of shares needed to reconstruct $D$
$q(x)$ is a $k-1$ order polynomial with $q(0)=D$ and the coefficients $a_1,...,a_{k-1}~$
$D_1,...,D_n$ are individual shares (points on the polynomial $q(x)$)

Can someone please explain (in the simplest possible manner) the reason that Shamir's Secret Sharing Scheme uses finite field arithmetic? Also, why must the size of the Galois field be a prime number with the requirements that Shamir put forth?

The reason for asking these questions is: I would like to implement Shamir Sharing in Javascript using a field of size $2^8 = 256$, which:

will obviate the need for a big integer library for Javascript, such as jsbn
will simplify the math.

Whatever the size of the secret to be shared, it could be broken down into byte-length segments and the math performed on those segments. The resulting share would be a concatenation of the results of the necessary operations on each segment.

To find the secret, the shares can again be broken down into byte-length segments. The polynomial interpolation can be done with the corresponding byte-length segments from the shares to get individual segments of the secret. The segments can then be concatenated to form the complete secret.

Would this work and be cryptographically secure?

If there is indeed an absolute necessity for a prime number $p$, could I use any small prime number with the concatenations described to perform the necessary operations in Javascript and still remain cryptographically secure?


texts: How to convert ECDSA P256 curve signature to SECP256K1 curve?

texts:
I would like to get the ATECC608A microchip to sign data with ECDSA secp256k1 curve, but the chip only signs using the P256 curve.

Is there an operation I can do using the original message and the signature under P256 that would produce a signature under secp256k1?


texts: Is this zero knowledge protocol for honest verifiers?

texts:
Assume the zero knowledge protocol where the prover knows a $x$ such that: $g^x = h \pmod{p}$.

The prover chooses a random $t \in \mathbb{Z}^*_m$ and sends $y = g^t \pmod{p}$
The verifier sends random $c \in \mathbb{Z}^*_m$ and sends it
The prover calculates $s = t + c + x$ and sends it
The verifier accepts if and only if $g^s = yg^ch \pmod{p}$

Is this for honest verifiers?
Attempt:
The real transcript is $(t, g^t \pmod{p}, c, t +c+x)$, but I cannot find a simulated transcript $(t, \cdot, c, \cdot)$ that has the the same distribution as the real one. Can you give me some hints?


texts: Efficient function/algorithm/method to do modular exponentiation

texts: I was working on this project where I needed an RSA key, and I wondered if there was and more efficient way of doing $g^a \bmod n$ other than calculating $g^a$ and then finding the remainder when you divide?


texts: How does a cache timing attack work on AES with lookup tables?

texts:
I was trying to make a software only implementation of AES (Rijndael). At first I was able to implement it using table lookups for the Galois field multiplication and also for the SBox, but, I really wanted to remove all table lookups as they are prone to cache timing attacks. But implementing the Galois field Multiplication opened new avenues of side channel attacks, and also reduced the performance drastically...

This is a sample code I use for Galois field multiplication:

uint8_t GFm(uint8_t a, uint8_t b)
{
      uint8_t p = 0;
      while(a&&b)
      {
            if(b&1)
            {
                p^= a;   // I realized this
                 branching is
          vulnerable to power analysis
         attacks...
            }
            if(a&0x80)
            {
                 a = ((uint16_t)a<<1)^0x11b; //
    We reduce by using the Rijndael
        polynomial.
            }else{
                 a <<=1;
            }
            b >>= 1;
      }
      return p;
}

Does replacing if(b&1){p^= a;} with p = p^ (b&1)*a; offer any protection against power analysis attacks?
Should I replace the while() with for(int i = 0; i<8; i++), to prevent the leakage of bit length of b ? (The for loop makes my implementation more slower as it has to run 8 times always.)
Is there a way to hide the traces of table lookups... ?
Is there an even faster method to do $GF(2^{8})$ multiplications? This function is crucial since I use it in calculating the multiplicative inverse of elements in $GF(2^{8})$ by modular exponentiation. Those multiplicative inverses will go through the affine transformation to calculate the S-box.

Every help will be greatly appreciated!!! :)


texts: Does TLS 1.3 really send PSKs encrypted?

texts:
In the following link it says:

  When a 1.3 client connects to a 1.3 server they agree on a resumption key (or PSK, pre-shared key), and the server gives the client a Session Ticket that will help it remember it. The Ticket can be an encrypted copy of the PSK—to avoid state—or a reference number."

https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/

I have read through the draft of TLS 1.3 and have only found that a Client sends an PSK-identifier, which is a number, that belongs uniquely to a PSK. I couldn't find any mention of "an encrypted copy of the PSK".

Am I wrong? Did I miss something in the draft? Because if I did not miss anything, servers would need to keep state of every PSK they have established, no?


texts: what's the purpose of passphrase in hybrid cryptography?

texts: What's the purpose of a passphrase in hybrid cryptography? can it actually be used for authentication or if i put in another signature algorithm will it be like, two authentications?


texts: Naming convention for NIST elliptic curves in OPENSSL

texts: NIST standardized 5 elliptic curves (P-192, P-224, P-256, P-384, P-521) for prime fields. When I looked into openssl, these curves are named as prime192v1, secp224r1, prime256v1, secp384r1, secp521r1. Is there any reason why the name convention was different for different curves?


texts: How to hash a structure that needs to include that hash's outcome?

texts:
so I am busy writing a TCP protocol in which I send a "packet header" with each packet of data. This packet header is a structure that contains information about the data that was sent. I want to verify whether the header was tampered with in some manner and I am thinking of using a hash of the header to ensure it was not tampered with. I want to know if it is possible to include this hash in the header itself. Here is what the packet header looks like.

struct PACKET_HEADER
{
    DWORD dwMagic;
    BYTE lpvChecksum[32];

... Rest of header follows

I am not sure if this method will work and I am open to any other suggestions on how to verify the header.

Thanks


texts:
I've (finally) implemented the answer to this question in our library, which stated how to transform montgomery curves (and points) to weierstrass curves (and points).

Now, for scalar multiplication, we currently use our Weierstrass code, but want to replace it in the long run. Clearly the Montgomery ladder is the algorithm of choice when it comes to scalar multiplication on Montgomery / Edwards curves. However the ladder usually is given very simplified (always double and add but swap what is doubled and what is added based on the bit in question).

I'm asking for the best, side-channel resistant technique to implement scalar multiplication on Montgomery / Edwards curves.

Note:

Same-base pre-computation speed-ups are welcomed.
Advanced projective coordinate tricks (tripling and such) are welcomed as long as they don't break side-channel resistance.

My definition of the "best" technique: It should be as fast as possible and as side-channel resistant as possible (side-channel resistance has priority).


texts: How can I turn this cipher into a perfect cipher by altering only its encryption algorithm?

texts:
Given a toy cipher that picks a key, k, from the key space of {00,01,10} and a message,m, from the same set {00,01,10} and encrypts using E = m ⊕ k.

How can I change the encryption function E in order to make this cipher perfect(according to Shannon's perfect secrecy rule)?

NOTE: This cipher is not perfect because there's no way to get a ciphertext of 11 if the k or m are 00 thus the ciphertext reveals extra information about the plaintext which makes this cipher imperfect.

Any hints or suggestions as to how to approach the problem would be helpful.


texts: How to authenticate two devices with CA?

texts:
i am trying to figure out a man-in-the-middle safe authentication scheme for some devices. I understand that this could be achieved via CA's.

But what is unclear to me is how can the authenticity of a device be guaranteed in such a setup. To me it seems that a DEV3 (an imposter) could easily send its public key to the CA, which is then signed by the CA. Also, DEV3 probably has CA PUB key.

Here is a doodle :


texts: What one-way functions are there based on the Diffie-Hellman problem?

texts:
Mathematical hardness assumptions like that of the factoring problem, the RSA problem, and the discrete log problem all straightforwardly lead to one-way functions.  But what about the computational Diffie-Hellman (CDH) problem?
My question is, what one-way functions have been constructed based on assuming the hardness of CDH?
All I've come across are this paper, which constructs a trapdoor one-way function based on assuming the hardness of CDH, but the construction is rather complicated.  Is there a simpler construction which just gives one-wayness, even if there's no trapdoor?


texts: open source whitebox-crypto implementation

texts:
I am trying to code a simple WBC situation to help my understanding about white-box cryptography.

Details:

I have 2 programs, a "server" and a "client", the server utilises caesar cipher (key = 2) encrypts the plaintext "HELLOWORLD" and sends it to the client.
On the client side, key = 2 is embedded into the source code.

how would the WBC implementation of either my "server" or "client" be different from a normal "server" and "client"


texts:
My friend asked once a question which sounds very interesting:

  If a function does not have inverse, does it mean that the message cannot be deciphered ?

What is the answer to this question ? In my opinion it is a definitely yes


texts: What is the exact algorithm and functions of the 4 way handshake?

texts:
I have to make a detailed diagram of the 4 way handshake and formulas for its functions so I need to know the exact process behind it. Like precisely what functions are used in it?

I have been trying to search this for days but all I can find is very "on the surface" level of information. For example it says that the PTK is produced by concatenating PMK, AP nonce, STA nonce, AP MAC address, and STA MAC address and then is put through the PBKDF2-SHA1 hash function. That is all good but the problem for me is that there are no details in that description. Given only information like that I can't make detailed step by step diagram about the 4 way handshake.

To put it in one question what is the precise description of the functions in the 4 way handshake? Also in which algorithm are they sequenced?


texts:
I'm trying to educate my self in key management, how to store them, how to generate them, how to use them properly.

I've been trying to find how you would generate a key for symmetric encryption (say AES-128), there is enough to find for public key crypto but that's not what I'm looking for.

For what I understand so far is that simply generating a 128 bit random number through a crypto-secure RNG would be sufficient, Is this correct? or are there special algorithms for creating an aes key?

The key will probably be generated when we flash our embedded devices, so it will be done on a windows PC.


texts: With composite $n_1$ = $p_1q_1$, and a separate $n_2 = p_1q_2$, can the primes be calculated more efficiently than factorization?

texts: Supposing that the (3 total) primes are kept secret? Does the reuse of $p_1$ allow an attacker to compromise $n_1$ and $n_2$ if the attacker guesses that both were generated with a shared prime between them (each having one unique prime)?


texts: How to show something is not a one-way function?

texts:
Lets say that $f:\{0,1\}^* \to \{0,1\}^*$ is a strong one way function.
Let
$h(x)=f(x)||x_n$ where $x_n$ is the $n$th bit of $x$.

I understand that $h$ will not be a strong one-way function. However, I wish to gain an intuitive understanding why that is.


texts: TLS 1.2 is still secure or should we move to TLS 1.3?

texts:
There are some vulnerability such POODLE, that allows the attacker to gain access to encrypted blocks of data and then gain exposure to plain text information using side channels.
Another vulnerability is TLS 1.2 which allows the GOLDENDOODLE attack to breach outdated crypto methods.
Is TLS 1.2 still secure and reliable or should we leave it and migrate to 1.3?


texts: Given the first half of a SHA-1 hash, can you predict the second half?

texts: I know this applies to secure ciphers, but does this also apply to hashes?


texts: Does the Server Key Exchange sign a hash or text

texts:
In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over a hash of the parameters or over a plain text of the parameters?

The specs does not clarify:

  struct {
      select (KeyExchangeAlgorithm) {
          case dh_anon:
              ServerDHParams params;
          case dhe_dss:
          case dhe_rsa:
              ServerDHParams params;
              digitally-signed struct {
                  opaque client_random[32];
                  opaque server_random[32];
                  ServerDHParams params;
              } signed_params;
          case rsa:
          case dh_dss:
          case dh_rsa:
              struct {} ;
             /* message is omitted for rsa, dh_dss, and dh_rsa */
          /* may be extended, e.g., for ECDH -- see [TLSECC] */
      };
  } ServerKeyExchange;

  params
     The server's key exchange parameters.

  signed_params
     For non-anonymous key exchanges, a signature over the server's
     key exchange parameters.

As you see, it says on the signed_params:

  a signature over the server's key exchange parameters


texts: Could RDRAND (Intel) compromise entropy?

texts:
I was recently discussing the issue of RDRAND in Intel chips and the whole issue about how NSA could potentially be influencing Intel to weaken or create backdoors in their design.

This petition was posted asking Linus Torvalds to ignore RDRAND and not include it as a source of entropy in /dev/random/. You can see Linus' response here.

My main question is, would using RDRAND as one source of entropy (amongst many others) potentially compromise the 'randomness' of /dev/random by adding some predictability? Or is he correct in saying that It really does not make any difference as long as its not the only thing entropy is generated from?


texts: How is HMAC(message,key) more secure than Hash(key1+message+key2)

texts:
I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction.

What I don't understand is, how or why is $\operatorname{HMAC\_SHA256}_\mathrm{key}(\mathrm{message})$ safer (in terms of resistant against certain attacks) than $\operatorname{SHA256}(\mathrm{key}_1 \mathbin\| \mathrm{message} \mathbin\| \mathrm{key}_2)$, assuming that all key strings are sufficient in length and entropy?


texts: Cipher Block Chaining Ciphertext Alteration

texts: I am new to cryptography. My professor's slides say that "Disadvantage: altered ciphertext only influences two blocks" for the CBC. However, since we xor the ciphertext from the previous block and the present plaintext, before encryption; it seems to me like if I alter a ciphertext block, every ciphertext block coming afterwards will change. I do not understand why would this chain reaction only influence two blocks.


texts: NIST's Recommendations for Protection of CLASSIFIED Data?

texts:
In NIST Recommendation for Key Management Part 1 Rev 4, It states in Section 1.Intro

  This NIST Recommendation applies to U.S. government agencies using
  cryptography for the protection of their sensitive, unclassified
  information.

and in Section 1.3Scope

  All cryptographic algorithms currently approved by NIST for the
  protection of unclassified, but sensitive information are in scope.

What are the NIST Recommendations for Protection of sensitive and classified data in terms of Cryptographic primitives

Symmetric Encryption
Asymmetric Encryption
Hash Functions


texts: Recommended Books for Cryptography : Theory and Implementation

texts:
It is a great idea if experts in Cryptography from mathematicians to security engineers introduce books and textbooks which they think is helpful or instructive for all people interested in the field.I didn't find such topic in previous posts.

I think a good format for answering would be like this:

I.
Theory, Analysis, Algorithms, Complexity,...
II.
Design, Implementation, Code Writing( in C/C++, Java,...),...
III.
History, Development, Future possibilities,...

Thanks in advance to all contributors for sharing your knowledge


texts: Why use prime number $q$ such $q$| $(p-1)$ in discrete logarithm based schemes?

texts:
In discrete logarithm based schemes on finite field we have a prime number $q$ that divides $p-1$ and $q$ is to specify a subgroup with the order $q$. But why do we do that? Why do not we work on the group with the order $p$ and need a subgroup with order $q$.
This is for security reasons (discrete logarithm calculation algorithms) or for computational optimization?


texts: One-Time Pad Distribution of Keys Between Two Parties

texts:
Consider the One-Time Pad (OTP). Suppose two parties, A and B, generate a completely random secret key in a real-life meeting, and they keep this secret. Now A wants to send some message to B using the OTP. The point is that in the OTP we can use any key only once. So we have to come up with a system to share a newly chosen key in a secret way.

Why cannot A just concatenate a new randomly generated secret key (needed for the next communication between the two parties using the OTP) to this message?

For instance, A could concatenate this new key at the beginning of the message.
(Supposing they have agreed upon a fixed key-length beforehand, so that B is able to tell which is the new key and what was the "actual" message.) In this way A and B would agree on a new secret key which they can then use for their next communication.

Probably this is insecure, but I do not immediately see why…


texts:
I want to make a password manager that from a single master password generates passwords for my services. For that I thought that HKDF suits my needs, as it is able to generate multiple keys from a single strong key.
Here I read that HKDF is secure if the key is "good" which password aren't. So I thought about using PBKDF2 to generate the key to be used with HKDF.

Is this design good?

master_key <- PBKDF2(master_password, ...)
service_key <- HKDF-Extract(master_key, ...)

How would I then handle salt? It should be random, so it should be stored somewhere. Can I store it anywhere? Can I use the same salt for the two phases?

EDIT: I think I should add a clarification.

The reason why I would do this is to have a way to have my password wherever I am without the need to have on every single device I am using the database file (I've used keepassx for a while and that was frustrating, because you then need to handle syncing and such). This way the user is required to remember only the master password (and the salt?) and perform the calculations with a specific tool.


texts: Could a C25519/ED25519 cryptographic module be FIPS certified?

texts: NIST algorithms include ECDH and ECDSA. NIST also specifies curves. Is the use of NIST curves required for FIPS certification or could other curves theoretically be certified if someone were willing to do the work?


texts: Convert ciphertexts of one encryption scheme to another without decryption

texts:
I want to convert ciphertexts of one encryption scheme to another without decrypting them under the first scheme and then encrypting with the second scheme.
For example convert OPE encryption to Paillier without decryption. Does anyone have any idea?


texts: How to multiply a matrix of bits with another?

texts:
For example, assume I have two 4x4 matrices of bits:

1 1 1 1       1 1 1 0

0 0 0 0       0 1 1 1

1 0 0 1       1 0 1 1

0 1 1 1       1 0 1 0

I want to apply matrix multiplication for the modified IDEA (International Data Encryption Algorithm). How does one multiply a matrix of bits with another matrix of bits?


texts:
Say I have a graph of messages like this:

   A
   |
   B
  / \
 C   D

By including the parent hash in the message to be hashed I can show that B is a child of A, and C and D are children of B.

For example

Hash("This is message A") = ab3ed
Hash("This is message B + ab3ed") = e4c90
Hash("This is message C + e4c90") = 83e39
Hash("This is message D + e4c90") = 456aa

This way I can prove that C and D are children of B, and descendants of A.

Is there a way I can cryptographically prove that a certain node is the only child ie has no siblings?


texts: Is this a valid "fix" for deterministic encryption in encrypted databases?

texts:
It appears (after doing some light research) that for encrypted databases to be practical enough to be usable, deterministic encryption is required, specifically with regard to the type of encryption that always produces the same ciphertext for a given plaintext and key pair. I understand that deterministic encryption allows equal plaintext values to be detected, is possibly vulnerable to frequency analysis and lacks semantic security i.e. is vulnerable to chosen plaintext attack.

However, is it possible to minimize or remove these drawbacks by:

ensuring only authorised use of the database (to prevent chosen plaintext attacks), and
by injecting known encrypted tuples of carefully selected (bogus) values to balance out the cyphertexts to deflect frequency attacks? These bogus values would be dropped from a user's query results at the user's end prior to being presented to the user.

Of course, this would mean possibly doubling the database size, but I would like to ignore that for now...


texts: How are the functions used in cryptographic hash functions chosen?

texts:
I'm learning about cryptographic hash functions and I have some questions about the functions used in the compression function.

MD5 uses the following functions:

$f_{1}(B,C,D)=(B\wedge C)\lor(D\wedge \lnot B)$

$f_{2}(B,C,D)=(B\wedge D)\lor(C\wedge\lnot D)$

$f_{3}(B,C,D)=B\oplus C\oplus D$

$f_{4}(B,C,D)=C\oplus(B\lor\lnot D)$

SHA-1 uses these functions:

$f_{1}(B,C,D)=(B\wedge C)\lor(D\wedge \lnot B)$

$f_{2}(B,C,D)=B\oplus C\oplus D$

$f_{3}(B,C,D)=(B\wedge C)\lor(B\wedge D)\lor(C\wedge D)$

$f_{4}(B,C,D)=B\oplus C\oplus D$

SHA-2 uses these functions:

$f_{1}(B,C,D)=(B\wedge C)\lor(D\wedge \lnot B)$

$f_{2}(B,C,D)=(B\wedge C)\oplus(B\wedge D)\oplus(C\wedge D)$

I am wondering how these functions were chosen.

I know that XOR is very effective at mixing the bits of input, but I don't know why a function like $(B\wedge C)\oplus(B\wedge D)\oplus(C\wedge D)$ (SHA-2) is more effective than $(B\wedge C)\lor(B\wedge D)\lor(C\wedge D)$ (SHA-1).

Could someone clarify why certain functions perform better? And how the specific functions were chosen.


texts: Identity-based proxy re-encryption using different system parameters

texts: I am wondering if there is an identity based proxy re-encryption scheme (such as the Green-Ateniese scheme https://eprint.iacr.org/2006/473.pdf) that converts an encryption computed with ID1, system parameters1 into one intended for ID1, system parameters 2, i.e., the ID is the same but the system parameters change.


texts: Does OAEP make sense for use in an ECC ElGamal cryptosystem? The way I see it, OAEP makes questionable sense even for RSA because even though it's a "all or nothing" transformation, many RSA ciphertexts already have to be split up into multiple blocks so that no one block exceeds the size of the modulus.


texts: Can RSA re-encrypt a message without decrypting it?

texts:
The goal of this question is to allow a server/proxy to forward an encrypted message without being able to read it with this procedure being transparent to the original sender and receiver.
Assume we have Admin RSA Keys $(e,d,n)$ and Bob RSA Keys $(e_b,d_b,n_b)$ where Alice wants to send a message $m$ to Bob with only knowing the Admin's public key $(e,n)$. She sends $c_0 = m^e \mod n$ to a proxy where $c_0$ is transformed to $c_1$ which is forwarded to Bob who decrypts it as $m = c_1^{d_b} \mod n_b$.
The magic is in the transformation from $c_0$ to $c_1$ without giving the proxy the Admin's private key $d$.
My thinking here is that if (!) $n = n_b$ we could compute a re-encryption key
$$
r = d \cdot e_b
$$ in advance. If we also could protect $r$ in such a way that the proxy is unable to retrieve $d$ from $r/e_b$, I believe we could simply compute
$$
c_1 = c_0^{r} \mod n_b
$$
These are a lot of assumptions that will not likely hold in practice. Especially, the biggest difference will be that $n \neq n_b$.
So the question is, can these obstacles be overcome with modulo arithmetic or is there another way to create a re-encryption (pseudo-)key in RSA that prevents retrieval of $m$ while transforming $c_0$ to $c_1$.


texts: As my understanding goes, it is generally more secure to add more rounds to an algorithm (though it may increase processing time). Is there any exceptions to this rule? Theoretically - if your processor could handle it - could you run AES, but with 8 additional rounds, dramatically increasing the security? With what algorithm(s)/methods does this not apply and why?


texts:
As a senior programmer entering blockchain projects, i'm looking for a comprehensive introduction to relevant cryptographic tools/primitives, preferably one that puts less emphasis on the math and more on the usage.

Are there recommended resources for the mathematically uninitiated?


texts:
What are the assumptions we make to propose a one-way function? I only know of some number theoretic assumptions, but what are the other assumptions you can possibly make, which if true, would imply that $f$ is a one-way function?

(Considering pre-image resistant hash functions, what is the assumption there? Hashes as far as I know do not rely on any assumption other than the fact that it seems to  be hard)

Edit:

Example: Say we assume factoring a semiprime $N = pq$ is hard. Then we can say that the function $f(p,q) = p*q$ is one-way. What other assumptions exist?


texts:
What 'container' is used normally to store/transport secret keys (for symmetric algorithms)?

I have come across PKCS12 format where a public key certificate as well as a private key can be bundled together and stored in an archived file format.

Similarly how can an array of random bytes that can be used as a secret key be bundled/packed?


texts: Are SSH key-pairs an example of a zero knowledge proof?

texts:
Quoting from source, authentication using SSH key pairs goes something like this:

  1) The client begins by sending an ID for the key pair it would like
  to authenticate with to the server.

  2) The server check's the
  authorized_keys file of the account that the client is attempting to
  log into for the key ID.

  3) If a public key with matching ID is found
  in the file, the server generates a random number and uses the public
  key to encrypt the number.

  4) The server sends the client this
  encrypted message.

  5) If the client actually has the associated
  private key, it will be able to decrypt the message using that key,
  revealing the original number.

  6) The client combines the decrypted
  number with the shared session key that is being used to encrypt the
  communication, and calculates the MD5 hash of this value.

  7) The
  client then sends this MD5 hash back to the server as an answer to the
  encrypted number message.

  8) The server uses the same shared session
  key and the original number that it sent to the client to calculate
  the MD5 value on its own. It compares its own calculation to the one
  that the client sent back. If these two values match, it proves that
  the client was in possession of the private key and the client is
  authenticated.

This seems to achieve all the necessary requirements of a zero knowledge proof. It is complete, sound, and the server learns no new knowledge of the user's private key.

I found this question that seemed related at first.

Is Using Digital Signatures to prove identity a zero knowledge proof?

However, the OP in this question required the Validator send a text, have the Prover encrypt it using their private key, and the Validator verify it using the public key. Thus some knowledge is being leaked (namely the private-key ciphertext and its corresponding challenge). Using the SSH key-pair protocol though, only the public-key ciphertext is being communicated, which is already public knowledge. As no new knowledge is being communicated, SSH meets the requirements of zero-knowledge proof, right?


texts: Prove that two commitments are commitments to the same value

texts:
Let $x$ be the secret value, $(n,a,b,c)$ a public key, $(n_C, g, h)$ the commitment public key. Furthermore let $r, r_C$ be two random numbers.

Define $C = g^x h^{r_C} \bmod n_C$, $C_x = a^x b^r \bmod n$.

I want to prove that $C$ and $C_x$ are commitments to the same value without revealing $x, r$ and $r_C$.

My idea is:

Proofer $P$ chooses a random $s$ and sends $t = (a^s \bmod n) (g^s \bmod n_C)$ to the Verifier $V$.

$V$ chooses a random $c$ and sends it to $P$.

$P$ sends $\tilde{s} = s + c*x$ and $\tilde{b} = b^{cr} \bmod n$, $\tilde{h} = h^{cr_C} \bmod n_C$ to $V$.

$V$ checks whether $(a^{\tilde{s}} \bmod n)(g^{\tilde{s}}\bmod n_C)\tilde{b}\tilde{h} = tC^cC^c_x$.

I guess that will not work, because there is missing some modulo in the end.
The question is how to combine the modulos of $n$ and $n_C$. Can I use the gcd of $n$ and $n_C$?

EDIT:

Or maybe there is an easier way, because this will not just prove that the commitments are about the same value but also proves knowledge of x?

EDIT 2:

Here is an attempt to fix my problem:

Proofer $P$ chooses a random $s$ and sends $t_1 = a^s \bmod n, t_2 = g^s \bmod n_C$ to the Verifier $V$.

$V$ chooses a random $c$ and sends it to $P$.

$P$ sends $\tilde{s} = s + c*x$ and $\tilde{b} = b^{cr} \bmod n$, $\tilde{h} = h^{cr_C} \bmod n_C$ to $V$.

$V$ checks whether $(((a^{\tilde{s}} \bmod n)\tilde{b}) \bmod n) (((g^{\tilde{s}}\bmod n_C)\tilde{h})\bmod n_C) = ((t_1C^c_x)\bmod n)((t_2C^c)\bmod n_C)$.

This should work, right?


texts:
Strange question maybe, but say I want to specify a protocol that complies with NIST SP 800-108. This lists a whole set of key based key derivation functions, with a very loose set of parameters.

How should I identify the KDF used? It seems that the KDF's in this document have neither a name, an OID nor an ASN.1 module. Are there any compliant KDF's in the world that comply to the descriptions and that do have a name/OID/ASN.1?

Or do I have to do this  work myself and then test myself against the available test vectors?


texts: As I understand it the proof that RSA-OAEP is secure in the random oracle model is much tighter for exponent 3.  Does that mean that exponent 3 should be chosen?


texts: Can I achieve data authentication with ChaCha20 without MAC?

texts:
My case is rather special. I need to send data in small chunks, each under 32bytes. ChaCha20 state is 64 bytes.

Since I will be receiving data stream in chunks, id like to verify it on the fly (i.e. after I receive each chunk, make sure it was not tempered with).

Using MAC is a bad choice, as I'd have to compute MAC every time I send my 32byte chunk and append it to the message. And I don't think this is a standard approach as with Poly1305, where as I understand, you compute MAC only once when ALL the data is transferred, not sending intermediate MACs.

So I got this idea: instead of computing MAC (with Poly1305 or other), why not just use the 32byte data twice, make a 64byte chunk that can be XORed with one state of ChaCha20.

Upon deciphering, I verify that the first 32 bytes are equal to the latter 32 bytes. If yes, there was no modification. If no, there was some tampering / transmission errors.

So my questions are:

1. Does repeating ciphertext twice compromise security of the stream cipher? (Assume attacker knows this)

2. Is there some standard way how to provide message authentication with stream ciphers without this "hack"?

Thanks for answers and opinions!


texts: Merkle tree (dm-verity) with SHA-256 vs. SHA-1

texts:
Is there any knowledge or research on the use of different hash functions within a Merkle tree? My use case is file integrity protection. I am thinking about using different hash functions due to performance restrictions:

Linux device mapper verity target allows you to select different hash functions. I originally aimed at SHA-256, however SHA-1 is measurably faster and I would like to know if its insecurity is still there, when used in a Merkle tree. (Btw: root hash is protected by RSA signature) Assuming a storage device with 2GB of data and 4Kb blocks, verity creates a merkle tree with 3 tree levels between data and and the root hash. I understand that a single SHA-1 is unsecure for the integrity of a file, but what about the approach of having a hash per 4Kb of a file. If an attacker changes one block only, the input data for intermediate hashes change only at 20 bytes (32 byte for SHA-256) while the remaining 4064 (4076) byte are identical. So does this make finding a collision really harder or is this a misinterpretation? This partial change in data propagates up to the root of the tree.

Ok, changing only one data block with a collision in the corresponding hash breaks the hash tree, as the collision at the bottom yield to the same hash tree. This is easier with SHA-1, isn't it?

What about changes in a block without a collision where collision at the intermediate nodes must lead to the same root hash value. Is this harder?

What hash would you suggest for such a use case? There is no recommendation with Linux kernel implementation of dm-verity. Is SHA-1 too weak?


texts: Secret sharing over reals - Difficulty with Computer implementation

texts:
I asked a question recently regarding the paper "Secret Sharing Over Infinite Domains" - B. Chor and E. Kushilevitz which describes a secret sharing scheme for real numbers in the interval $[0,1]$. I got a fantastic answer as to how to construct a $(k,n)$-scheme.

However, I am struggling to implement the recommended scheme for a general case - I would like to believe there is an algorithm to do this; however, I was unable to do so. Below is a summary of where I am stuck -

For the case $(k,n) = (3,5)$, I used a "2-space diagonal assignment" technique which I have described below:

We have 10 independent $(3,3)$ schemes to construct denoted by
$$r_{j,1}, r_{j,2}, S - r_{j,1} - r_{j,2} \pmod 1 \;\;\forall j \in \{1,\ldots,10\}$$

let $r_{j,3}$ denotes $S - r_{j,1} - r_{j,2} \pmod 1$

My assignments were as follows;

$1 \rightarrow (r_{1,1},r_{2,2},r_{3,3},r_{6,1}, r_{7,2} ,r_{8,3} $)
$2 \rightarrow (r_{2,1},r_{3,2},r_{4,3},r_{7,1}, r_{8,2} ,r_{9,3} $)
$3 \rightarrow (r_{3,1},r_{4,2},r_{5,3},r_{8,1}, r_{9,2} ,r_{10,3}$)
$4 \rightarrow (r_{4,1},r_{5,2},r_{6,3},r_{9,1}, r_{10,2},r_{1,3} $)
$5 \rightarrow (r_{5,1},r_{6,2},r_{7,3},r_{10,1},r_{1,2} ,r_{2,3} $)

I hypothesized that this assignment technique which appears correct is either re-usable for other (k,n) schemes or depends on the difference (n-k).

I tried the both a 2 and 3- space diagonal assignment for a $(3,6)$ scheme..

However, I was unable to work out an assignment technique for the said (and general) case.

Would appreciate any help in finding a general assignment to progress further with my investigation into this scheme. Thanks in advance.


texts: How is the following different than RSA Signing of a document?

texts:
If the goal is to demonstrate that you are who you say you are, I think the following will work: Bob wants to know that you are Amy. Bob encrypts a number using Amy's public key and then asks her what that number is. If Bob gets back the number, "Amy" at least had Amy's private key.

From what I have read, this is not what signing a document using RSA is. It is clear that it requires more emails to be exchanged; but is the fundamental idea different from Bob encrypting using Amy's public key and wanting to get back the correct decrypted message?


texts: Finding missing probabilities for formal proofs

texts:
In formal proofs, you often need to use probabilities to show that the Advantage of an algorithm is negligible. In proofs by contradiction, these probabilities are often tied to probabilities of other, hypothetical algorithms. However, you may end up in situations where you need probabilities that you cannot simply infer. How can you continue the proof at this point?

As an example, let's say I want to proove a specific unlinkability property of a random oracle by contradiction. The basic scheme would be (very informally):

Assume the output of querying a random oracle $h$ with two successive numbers, $x_1=h(n)$ and $x_2=h(n+1)$, was not unlinkable. This implies a PPT algorithm A that links $x_1$ and $x_2$ with non-negligible advantage $Adv_A$, returning $1$ if the values are the result of querying a random oracle with successive numbers, and $0$ otherwise. We use this to construct a Distinguisher $D$ that distinguishes $O$ from true randomness.

We define $O$ to be an Oracle with a hidden variable $b \in \{0,1\}$, which determines if $O$ uses $h$ ($b=1$) or returns truly random data ($b=0$). $D$ can query $O$  polynomially often and tries to determine if $b=1$ or $b=0$.

The distinguisher $D$ could now pick an $n$ and query the Oracle to receive $x_1 = O(n)$, $x_2 = O(n+1)$. He could then run $A$ on these results. If $A$ returns $1$, he outputs the guess $b=1$, otherwise $b=0$.

The probability that $D$ is correct if $b=1$ depends directly on $Adv_A$:

$$Pr[D(O)=1\ |\ b=1] = 0.5 + Adv_A/2$$
$$Pr[D(O)=0\ |\ b=1] = 0.5 - Adv_A/2$$

However, what happens if $b=0$? We don't have any information on how our hypothetical $A$ performs on truly random data, so we cannot determine the probability that it gives the "correct" result (by claiming that $x_1$ and $x_2$ are not the result of querying successive numbers). How would be determine, for example, $Pr[D(O)=0\ |\ b=0]$, which we need to compute the non-negligible Advantage of $D$ (and thereby show the contradiction with the assumption that $h$ is a random oracle, since those are indistinguishable from truly random data)?

(The same question crops up for other proofs, I'm just using random oracles for illustration.)


texts: Better than diceware? And sha512 related question

texts:
I am working on a secure password generator based on the following setup:

choose a publicly know (text) file
make some deliberate memorable changes to it
use collected entropy for a secure password ???

Details:

The text file can be anything provided it has a reasonable character count.
For example: pick a book with $2^{20}$ characters ≈  550 pages of human readable text
Changing/inserting *) a character within this text from the base64 alphabet yields an estimated entropy of: 20 + 6 + 1 = 27bits  correct ???

20bits = from the positions within the text

6bits = from the changed character (this is slightly less since the character that is to be changed can not be used from the base64 alphabet, but we can add an additional special character to base64 to overcome this)

1bit accounts for insertion or change of a character

*) any modifications to the text add different additional entropy: deleting passages, copying passages to different location, reversing passages, deleting pages etc,…

This yields more than twice the bits of diceware entropy (≈ 13bits)

3) Repeat step 2 to accumulate desired level of entropy in an other location of the file. Thus one could accumulate 135bits of entropy with only 5 modifications!?

4) Use this entropy to generate the password but how???

PROBLEM:
I find using a simple sha512 on the modified text file and using the output as password might endanger the setup since:

The idea is to make the unmodified text file public and the adversary would then know  $2^{20}$ - 5 = 1048571 characters (that’s almost 100%)  that were not changed.

Is the below solution viable???

1) Transfer the text file into a $2^{10}$  characters by $2^{10}$ + x  matrix
(x is for padding, since the original length of the text file of $2^{20}$  characters  might have increased if the user inserted some characters as part of his/her modification)

2) Hash with sha512: line by line to create an other $2^{9}$ bit by $2^{10}$ + x  matrix

3) Hash the resulting matrix with sha512: column by column to create the final $2^{9}$ by $2^{9}$  matrix

4) finally xor the resulting matrix line by line to receive the $2^{9}$ bit password

Would this withstand the issue with the adversary knowing  $2^{20}$ - 5 = 1048571 characters?

thanx


texts:
I have been reading about the Challenge-Handshake authentication Protocol (aka CHAP).

Why send a challenge to the user and ask them to hash that challenge with the symmetric key and send that hash back to the server? Why not just ask for a hash value of a symmetric key? And what is the point of this protocol at all when you both have symmetric keys?


texts: Do the Syllae algorithm and Malaysian cipher from Rubicon exist?

texts:
In the first episode of a tv series Rubicon (exactly in 482 and 491 lines of an English subtitles) there is mentioned “Syllae algorithm” and “Malaysian cipher”. I could not find any details about these crypto technics.

Are they real? If so where could I find more info about them?


texts:
What is the message space in the following example and how does a message space relate to a security definition?

I mean, what difference does it make to such a definition if your message space is $\{0,1\}^n$ or if it is $\{0,1\}$?

  We say $(\mathsf{K},\mathsf{E},\mathsf{D})$ is $(t,\epsilon)$-IND-CPA secure if for all $t$-bounded adversaries Adv:

  $|\mathrm{Pr}[ (pk,sk)←\mathsf{K}(1^n); (m_0,m_1)←\mathrm{Adv}(pk);c ← \mathsf{E}_{pk}(m_0): \mathrm{Adv}(c) = 1]$
  $-\mathrm{Pr}[(pk,sk)←\mathsf{K}(1^n); (m_0,m_1)←\mathrm{Adv}(pk); c←\mathsf{E}_{pk}(m_1): \mathrm{Adv}(c) = 1 ]| \leq ε$

  where Adv outputs $|m_0|=|m_1|$


texts: Does AES use different keys for each block of plaintext?

texts: If you have 4 16-byte blocks of plaintext to encrypt does each block have a different 128 bit original key? Or do they all use the same?


texts: Do any probabilistic hashing algorithms have additive homomorphism?

texts:
What I am looking for is a function that meets the following criteria:

For each possible input (assume integers from [0, 255]), there must be trillions of possible outputs so as to prevent preimage attacks and is hence probabilistic.
The function must be a one-way hash, so given an output the input cannot be deduced.
The outputs must exhibit additive homomorphism such that some operation on f(a) and f(b) will equal f(a+b).

Is such a scheme possible? I've read many papers that have developed methods close to this, but none that I understand fully meet my criteria.

Paillier exhibits these properties, except it's an encryption scheme as opposed to a hash, meaning it requires public and private keys. In this scheme, there should be no feasible way to "decrypt" an output.

I've found several homomorphic hashing schemes, but each one seems to fall short in some way:

LtHash is interesting, but not probabilistic, as an input maps to only one output and a small input set should be easy to preimage.
The cryptosystem proposed in this paper seems like it could be a good fit, but I don't entirely understand how the global vs per-publisher hashing would work.
This blog post outlines a similar mechanism, but I'm not sure if it's still vulnerable to pre-imaging and always maintains it's homomorphic properties.

I've read through StackExchange, and I've only seen a few posts in the last few years relevant to the question, including this one, but I don't see how Merkle or Hash trees could be used as a solution to these criteria.

The purpose of this function is to obfuscate values in a distributed ledger, while still allowing arithmetic operations to be conducted on them. Paillier would work perfectly if only a public key was distributed, but the potential existence of a private key doesn't work for this scenario, as it would allow one party to read all of the data.

If one of these solutions does, in fact, meet the criteria outlined, a quick explanation as to how would be greatly appreciated. Thanks.


texts: Simple XOR cipher with pseudo random plain text of arbitrary length

texts:
We all know that simple repeated XOR cipher over plaintext is trivially vulnerable to known plaintext attack, even when just a part of plain text is known and even to ciphertext only attack if you know the underlying message structure. But what if the plaintext is random/pseudo random. My reasoning is it should be secure against cipher-text only attack in this case(only confidentiality with indistinguishably, authentication is assumed for now), because if it was insecure this way, CTR mode would not be IND-CPA (which it is thought to be). Because, IF YOU REVERSE THE ROLES BETWEEN KEY AND THE PLAINTEXT,which we can do because it is just XOR and Plain-Text is pseudo-random, one can just send two plain texts with repeated blocks as challenge plain text. If anything about the key (or the plain text) could be revealed that way, the adversary could distinguish which plaintext it was (or equivalently with key in xor cipher) from challenge cipher text of CTR as well.
EDIT:
Further clarification:
My reasoning is that if repeating XOR cipher for random plaintext is insecure, then key distribution by encrypting it with any stream/streaming mode ciphers (see my last sentence) should be insecure as well, thus I am just trying to be sure I am not missing anything.I am sharing a key k over some parties securely. Using a key derived using ECIES, each party will have derived keystream $s_1,s_2...s_n$. So, GCM mode ciphertext for each node will be $k⊕s_n||[authtag]$. Ignoring tag, what an attacker sees is same as if $s_1||s_2||s_3...$ encrypted with $k$ using repeated xor. But it is also same if you encrypt $m||m||...m$ in GCM mode which internally uses CTR so I only mentioned CTR because I am not interested in authentication. So, it should be safe to share keys like this IMO.
Of course there are other options for key sharing like I mentioned earlier but asking it


texts: Attacks on RSA with partially known plaintext

texts:
I know modulus $N$, public exponent $e$ and have some crypted messages $c_i$, $c_i = m_i^e mod N$. I know something about each $m_i$: they have a sequence of bytes BAADF00D at offset $t$.

Is there any kind of attack which helps me to recover any $m_i$ or even $p$ and $q$ used to make $N$?

I thought about an Oracle attack, but the papers I read discussed Oracles with MSB or LSB bits. What with bits in the middle of a message?


texts:
Given a PKI infrastructure with a root node that signs CSR's for nodes Alice, Bob, and Carol.  Is it possible for Alice to encrypt some information, store it publicly somewhere, then later Bob or Carol can decrypt that information, without Alice, Bob, nor Carol directly communicating?

The only thing they have in common is their PKI (each their private key, their public key and root's public key), and the one-way transfer of ciphertext from Alice to the public storage, then on to Bob or Carol.

Neither Bob nor Carol's public keys are available to Alice (in the real problem, Bob and Carol don't yet exist but will in the future, after Alice has generated the ciphertext)

The root CA cannot participate in this other than as a typical signer; that is, we cannot ask the root to do the encryption/decryption for us.


texts: What is Phase space reconstruction attack on chaotic encryption algorithm?

texts:
What exactly does it mean? How can someone attack an algo using phase space reconstruction?
I have been searching the internet for more than 3 days and cannot find anything close to explaining this topic.


texts: How hard is it to generate a simultaneous MD5 and SHA1 collision?

texts:
I was recently reading that MD5 is "broken" because it's pretty easy to generate collisions (like 2^(L/2)). And the SHA1 (theoretically) fares no better. The solution seems to be hash algorithms that are very slow in comparison.

I am wondering why can't people combine these fast algorithms to get the best of both security and speed? What would be the time complexity to generate a simultaneous MD5 and SHA1 collision? And if it's hard enough, would these make a viable candidate for collision resistant hash applications?

(By simultaneous collision I mean generating a string with same MD5 and SHA1)


texts:
I'm working through an exam paper for a cryptography exam and I've come across a question I'm unsure on.

Six users have been given the partial keys below

$P(x) = (k + \sum_{i=1}^2 c_ix^i)\bmod{503}$

User X Y

1   10 25
2   20 405
3   30 272
4   40 129
5   50 479
6   60 316

Reconstruct the secret key K to verify it is 138.

I've tried using Newtons Divided Difference to skip using the formula but that didn't work. I also tried using the Chinese Remainder Theorem on the data but that did not work either. I've tried filling into the equation but I don't think I've been doing it right so any help on how to go about this question would be appreciated


texts: What's the likelihood of a collision if I use a hash to detect data change?

texts:
I have a set of data that I want to sync, and instead of sending an entire set of data, I wanted to use a hash.

It is basically a list of GUIDs with either "true" or "false".

eaa54efe-2b10-4d3b-b9c2-30d2bcca7e06 : true
94297d72-573a-4e6c-a45e-37a390750b64 : false
36d1acbd-b2dc-4a90-a7be-fb65b63639a5 : true

I plan to generate a hash of the entire list so that I can send much fewer data to sync than the entire data set.

Should I ever be concerned that a specific change of true/false will happen to randomly result in a collision and become "undetected" or is that really not going to happen?

I don't really understand the math and proofs behind the hashes, but I also understand that good hashes are supposed to be designed against trivial collision.

Note: the main goal is just data comparison.  There is no encryption of the data because they're useless data without the meaning behind the GUIDs.  This is, literally, live data I just posted.


texts:
If I had two ciphertexts

$$c_1 = m_1 \oplus y_1 \text{ and } c_2 = m_2 \oplus y_2$$

will it be possible to obtain

$$z_1= (m_1 \lor m_2) \oplus y_1 \oplus y_2 \text{ and } z_2= (m_1 \land m_2) \oplus y_1 \oplus y_2$$

from $c_1$ and $c_2$ without revealing $m_1$, $m_2$, $y_1$ and $y_3$?


texts: Given that F is a secure PRF in the example $$F'(k,x)= F(k,x)\mathbin\|F(k,F(k,x))$$ I'm not sure why this isn't a secure PRF? Under what condition $F(k, F(k,x))$ when concatenated to $F(k,x)$ the adversary will be able to distinguish between $F'$ and true random function?


texts:
Currently I have:

H1 = SHA256

H2 = SHA1

Both H1 and H2 have fixed length. What's the most efficient way to bind H1 and H2 together into H3? The goal is to maximize protection in case when one of them leaks.

For example:

H3 = H1+H2
H3 = SHA512(H1+H2)
H3 = ???

Length preserving is not needed. This should be calculated instantly so no KDF.

Thanks for your help.

EDIT: I plan to use it as password creation scheme. H1 and H2 should not be changed.


texts:
I am implementing ECDSA over $GF(2^n)$. I am following RFC 6979 and compare my results with the example in Appendix A (which uses curve SECT163K1).
My calculation of $r$ is correct, but I am struggling with $s$.
A few parameters determine $s$ and I am not sure which one I got right and which wrong.

$s=k^{-1} * (m + r * d_A) \mod q$

$q$ is the order of the curve's generator (in other sources refered to as $n$). $r$ is correct/was given and $d_A$ was given, which leaves $k^{-1}$ and $m$.

m

The hash of the message is h1 = AF2B DBE1 AA9B 6EC1 E2AD E1D6 94F4 1FC7 1A83 1D02 68E9 8915 6211 3D8A 62AD D1BF, which is shortened with bits2int(h1, 163). I presume it to be correct.
m = 5795 edf0 d54d b760f 156f 0eb4 a7a0 fe38 d418 e813

$k^{-1}$

The value of $k$ was given in the example with 2 3AF4 074C 90A0 2B3F E61D 286D 5C87 F425 E6BD D81B. I calculated $k^{2^{162}-2} \mod q$  to get. I checked it with $k^{-1}*k = 1$. The algorithm also works with other curves and $k$'s. I also checked the results against the Python package BitVector, which also implements a modular inversion in $GF(2^n)$.
k^-1 = 3 759d 2532 cdd0 d539 5f03 eaed b650 3045 d218 9bad

I implemented all operations in "binary" (i.e. addition as xor, mod as polynomial division, ...).
Other intermediate results:
$r * d_A$: 14d1 14fe1 04b4 a34f 3bf6 fd30 02aa f767 3ed8 c786
$m + r * d_A$: 4 344f 90ec 506f d540 2e99 f384 a50a 095f eac0 2f95
$s$: b957 16f7 2680 def2 d19f d596 6a2e 93fe 8c0c fea9

Question

What goes wrong, where is the error?

I can also post my (Python) code, but I would have to clean it up first.


texts:
I'm currently looking into OpenSSL and its API and I'm not really familiar with cryptography.
So I was looking at the example on asymmetric encryption of an envelope. And it says the message is symmetrically encrypted with a session key that is then encrypted with the actual asymmetric key.
Then my question would be how are the session keys generated and how could I search to find this concept in some other programming language.


texts:
In an RSA-encryption scenario, Bob's public key pair $(n, e)$ is $(143, 43)$. An attacker Mallory tries brute-force and comes to $d = 7$ as the private key.
The value of $φ(143) = 120$ is not known to Mallory.
However from $43 \cdot d \equiv 1 \bmod 120)$, one can calculate the first positive element $d = 67$ from multiplicative group $d = 120 + 67n$ and $n \in \mathbb{Z}$
$d = 7$ clearly doesn't fit in that multiplicative group, so how come it can successfully decrypt the encryption?


texts:
Using LUC RSA, I have a list of 8 public keys $(R_1,n_1)$ through $(R_8,n_8)$, and a list of $8$ messages $M_1\dots M_8$. The messages have all been  double encrypted. However, one of the public key exponents, $n_5$, is not given. The problem is to decrypt all of the messages, and so I must also determine the value of the missing $n$. The hint is that the exponent was constructed "poorly".

Having factored all (including $R_5$) but two of the $R$s, I have decrypted $5$ of the messages.

My question is, what exactly is a poorly constructed public exponent look like, and how can I use what I have been given to discover the missing $n$?

Given the length of one particular encrypted message ($M<R$), it is likely that it was encrypted the last time with $R_5$.

So, I suppose what I'm asking is: Can you solve for n given $E=M^n \mod R$ where only R (public modulus) and E (ciphertext) are known? I suppose that's basically the DLP...


texts:
Blum Blum Shub is a stream cipher that is provably reducible to the difficulty of factoring integers.

I'm wondering whether there is a similar construction for discrete logs?

For example, I could imagine having something like this being the update function for the internal state:

$x_{i+1} = g^{x_i} \mod p$

And then you just XOR the least significant byte with the plain-text.

Does anyone know of analysis of these type of constructions?


texts: How is a public/private key pair generated from a Diffe-Hellman key exchange?

texts:
I very well understand the DH key exchange. But what is the public key and private key at the end of the exchange.

For example:
Alice and Bob agree to use a modulus $p = 23$ and base $g = 5$ (which is a primitive root modulo $23$).

Alice chooses a secret integer $a = 6$, then sends Bob $A = g^a \bmod p
= 5^6 \bmod 23 = 8$

Bob chooses a secret integer $b = 15$, then sends Alice $B = g^b \bmod p
= 5^{15} \bmod 23 = 19$

Alice computes $s = B^a \bmod p
= 19^6 \bmod 23 = 2$

Bob computes $s = A^b \bmod p
= 8^{15} \bmod 23 = 2$

Alice and Bob now share a secret (the number $2$).

So is $2$ the private key here ? If it's a private key then both Alice and Bob know it even though the eavesdroppers don't know. Please explain how public key/private key pair is generated from this shared secret $2$.


texts: Good enough deterministic PRNG based on hashes

texts:
Lets say I have a seed named iv which has a decent amount of entropy.

Are there any glaring issues with the following?

First 64 bytes are generated by SHA512(iv)
Next 64 bytes are generated by HMAC_SHA512(iv, Previous64Bytes)
and so on...

Obviously if I needed "perfect" security I could use something like HMAC-DRBG (NIST SP 800-90), but I need something that's good enough, easy to implement and I do not care if a supercomputer breaks it in 10 years.

Edit - More info:

This will not be used to generate more than 500 bytes of data per run
The implementation will be out in the open (javascript)
Speed of the algorithm doesn't matter


texts: Carrying out a known-plaintext attack on a cipher

texts:
Previously posted here. Someone suggested I could post it here to get some answers.

I am trying to solve a CTF challenge, here. Basically we're given message and key inputs to a cipher and its resulting ciphertext. We're then given a encrypted message we have to decrypt.

I started trying to reverse engineer the algorithm's structure (around what operators its based on, very vaguely)

Input output pairs:

'1', 1 = 2^0
'VKMAP VAcD4', 5 = 54306932426718011115164597401855430^1 247446999007947711814704977^4
'0', 1 = 29^0
'3', 1 = 5^0
'2', 1 = 3^0
'q', 1 = 31^0
'9', 1  = 23^0
'abcd', 13 = 11575382871136615104^11
'e', 1 = 41^0
'W', 1 = 163^0
'VAcD4' 22 = 56237954319988116321523858^13
'Q', 1 = 157^0
'HJ', 13 = 1067796^11
'w', 1 = 37^0
'r' 1 = 43^0
'n' 1 = 149^0
'V' 1 = 277^0
'M' 1 = 293^0
'm' 1 = 151^0
'V' 45 = 6^7
'V' 5 = 55^2
'abcd' 1 = 150479977324775996363^0
'N' 1 = 283^0
'abcd' 1 = 150479977324775996363^0
'V' 13 = 21^4
'R' 1 = 173^0
'E' 1 = 167^0

The string is the message (in single quotes), the second input is the key (an integer always < 12000) the output is the ciphertext.

Interesting things I found:

Every output with ^0 is a prime number. 173, 167, 283 ...
Longer the string bigger is the base. (base^exponent)
The exponent is always smaller than the key and its always 0 if the key is 1. Hints on the use of a mod here?
The greater the key, smaller is the base in the output.

I have spent around 2-3 hours on this trying to find patterns. How do I go about solving this from here?


texts: RSA - Ecrypting the same data with the same public key = same ciphertext?

texts:
If an adversary knows my public key and guesses what was my plaintext, can he test for it somehow?

The most obvious way is encrypting the guessed plaintext with my public key and the same parameters that he can probably discover from the ciphertext, to see if the result is the same.


texts: Can Alice send Bob a secure message with only DSA and no key exchange?

texts:
Suppose Bob has a DSA key pair, and Alice has Bob's public key. Is there any secure way that Alice can send Bob a message only he can read if Bob can not send any reply?

I think the answer is no, since DSA is only for messaging signing, so can only be used for things like authentication and Diffie-Hellman key exchange.


texts: I'm currently prototyping something with the NTRU encryption scheme but I wish to use it in "reverse" -- distribute private keys so anyone can decrypt, but keep the public keys secret and thus only allow certain entities to create new messages. Is NTRU still secure under such a scheme? It seems from the literature that chosen-ciphertext attacks using decryption oracles (which essentially every entity would have) have had some success in breaking traditional NTRU. In general, does knowledge of the private key give us any information about the public key?


texts:
For a university project, I am currently implementing the RingCT Ring signatures as  used in Monero (before the introduction of Bulletproofs) as laid out in this paper.
To close the ring we calculate the last $s$ like this: (where $\alpha$ is the random value initially chosen and $l$ is the order of the elliptic curve group)
$$s_j = α − c_j· x_j \bmod l $$

So as I understand the modulo in this case only applies to the $$c_j· x_j$$ otherwise we might get an out of range scalar, but then if this value is bigger then $\alpha$ it could happen that the $s$ is negative? Do I need another modulos here or do I understand something incorrectly?


texts: In a hybrid cryptosystem is safe to send the encrypted key together with the encrypted message?

texts:
I am encrypting a message using an hybrid cryptosystem:
I encrypt my message using AES-256 and I encrypt the symmetric cipher key using RSA.
The following questions come to my mind:

I want to know if it safe to send the encrypted message with the encrypted key together ?
What does it imply for an attacker to get the RSA encrypted key with the encrypted message ?
What is the correct way to send the message and the encrypted key ?


texts: Is predictable ciphertext/plaintext bad?

texts:
I have a cryptosystem that I'm using for secure chat.

It is using AES 256 (with RSA 2048 for key exchange).

Would a predictable, and repetitively sent ciphertext plaintext compromise the cryptosystem?

For example, if Eve knows that the string "Username: testuser" is sent with each message (making it predictable), would that compromise the system?

Or something like an "html" tag at the very beginning?


texts:
Why did the NTRUencrypt team not maintain the NTRU1024 release in the NIST second-round competition?

Is this because of the speed performance or security performance or other things?


texts: Implement the joint-feldman DKG algorithm

texts:
I am looking for a work implementation of joint-feldman DKG or at least some library that can help me in the implementation
Anyone can help me?


texts: AES-128/192 safer than AES-256 in practice?

texts:
Related-key attacks can break AES-192 and AES-256 with complexities 2^176 and 2^99.5, respectively.

Quote from: http://en.wikipedia.org/wiki/Advanced_Encryption_Standard

It seems that more bits/key length doesn't necessarily mean more (confidence in) security (At least above a certain minimum key length).


texts: What is the relation between RSA & Fermat's little theorem?

texts:
I came across this while refreshing my cryptography brain cells.

From the RSA algorithm I understand that it somehow depends on the fact that, given a large number (A) it is computationally impossible to derive at the two prime numbers (B & C) whose product it is.

But that isn't the Fermat Theorem, is it?
It's something on the lines of showing that there is no solution $n$ ($n > 2$) such that: $X^n + Y^n = Z^n$.

Can someone throw some light on this?


texts: Performance analysis of roaming authentication protocol using pbc library

texts:
Recently, I have surveyed a few research papers related to roaming authentication protocol for wireless networks. For example: “Efficient Privacy-Preserving Authentication in Wireless Mobile Networks” by Hyo Jin Jo, Jung Ha Paik, and Dong Hoon Lee and “Secure and Efficient Handover authentication Based on Bilinear Pairing Functions” by He et. al.

They used type 1 pairing having MNT curve with embedding degree 6 for implementation of their protocols. They used PBC library for implementation. I have a three doubts regarding this:

Is their schemes will provide the same security and efficiency as provided by the type 3 pairing using the same security parameters?
Can we convert type 1 to type 3?
Can we compare two protocols where one of them uses type 1 pairing and other uses type 3 pairing?


texts: Why does a broken hash function undermine an HMAC?

texts: For instance, what makes MD4 a bad choice for an HMAC?  In this case I am asking about MD4 because its less than ideal.  I know that a preimage attack can be used to undermine the system,  but why?  What is the attacker calculating?


texts: What do the security definitions of SHA-3 mean, quantitatively?

texts:
In the SHA-3 standard (page 31) the security of SHA-3 is defined quantitatively, for example, they are saying SHA3-256 provides 256 bits of preimage resistance. How is this number of bits to be interpreted?

The definition of preimage resistance that I know doesn't speak of bits, but of a running time $t$ (and a success probability $\epsilon$).

Intuitively, I'd interpret it like this: An attacker can only find a preimage (with a decent probability) after running $t = 2^{256} \cdot t_H$, where $t_H$ is the time required to calculate one hash. Is that correct?

Bonus: Is there a (citable) source for this? The SHA-3 standard has shockingly few references, and the Keccak reference doesn't speak about preimage resistance at all.


texts: Do I need to use null bytes and \x80 in hash length extension attack?

texts: Say I want to perform a hash length extension attack. All the tools I have used use \x00 and \x80 to pad hashes (hlextend and hashpump). But is it necessary to use these bytes? Based on my understanding of padding (and this question: Computing the padding of MD5), it seems that I can use any byte I want. If so, how would I compute the new hash? Would it be the same with using some arbitrary character, like "5", as padding as if I had used null bytes?


texts:
Is there a way to encrypt a file with expiry date?

I want to share a file which can be decrypted using a key until certain date. After that date, the recipient should not be able to decrypt the file.


texts: How can I guess that a combination of Atbasch and Caesar / Vigenère has been used?

texts: If I'm given a ciphertext, what kind of patterns, index of coincidence, frequency analysis would lead me to guess that it had been encrypted by a combination of Atbasch plus Caesar / Vigenère?


texts: Keyless Signature Infrastructures as a secure Post-Quantum Scheme

texts:
I came across a company that relies on hashing, similar to block chain technology.  They explicitly stated in their white paper that hash based cryptographic schemes are inherently post-quantum schemes.

Counter to this, is an article co-authored by Schneier (linked in blog post) that lends support to the idea of Grover's algorithm enabling cryptanalysis of "Keyless Signature Infrastructure" (KSI).  Is the position that KSI is inherently a PQC scheme tenable simply because no conventional device is known to have broken it?

It seems like this argument is sleight of hand, given it does not rely on a security reduction of an NP-Hard problem which as I understand is essential to any PQC scheme.  Is their use of a modified blockchain method actually post-quantum secure?


texts:
$G$ is a PRNG used in a stream cipher and defined in the following way:

G receives $s_0$ as an input, which is a random string drawn from a uniform distribution.
The output of step $i$ is $s_i = (s_{i-1}\cdot (N+1) + 1) \bmod{N}$, for $i=1,2,3\dots$

Is this PRNG secure? If not, what is the distinguisher?


texts: Security of a parallelizable block cipher mode

texts:
This is the scheme of a parallelizable block cipher mode of operation:

$IV$ is the initialization vector.
$BN$ is the zero-based index number of a block in a stream of data.
$BT$ is the tweak that is used in the encryption process of each block.
$K$ is the key.
$PT$ is a plaintext block.
$CT$ is a ciphertext block.

Encryption and decryption are as follows:

$BT = IV \boxplus BN$
$CT = \mathrm{Encrypt}(K, PT \oplus BT)$
$PT = \mathrm{Decrypt}(K, CT) \oplus BT$

What is obvious to me about this scheme:

It is parallelizable.
It does not suffer from the drawbacks of ECB mode.
There is no cascading effect as seen in CBC, PCBC, and OFB modes of operation.

Are there any security drawbacks with this scheme?

Update: I've considered the criticism and now $BT = \mathrm{Encrypt}(K, IV \boxplus BN)$. What impact does this have on the security?


texts:
The Linux kernel's random driver generates randomness by hashing an entropy pool using SHA-1. From the driver's source, the SHA-1 hash is apparently folded in half before being returned:

/*
 * In case the hash function has some recognizable output
 * pattern, we fold it in half. Thus, we always feed back
 * twice as much data as we output.
 */
hash.w[0] ^= hash.w[3];
hash.w[1] ^= hash.w[4];
hash.w[2] ^= rol32(hash.w[2], 16);

The reasoning in the comment strikes me as a bit odd. Why would there be any expectation that SHA-1 would have a pattern in output, much less one where folding the hash in half would solve the issue? It looks to me like the kernel developers are attempting to design a worthless "hash" to try to solve some supposed problem with SHA-1. This behavior even goes back to 2003 (and possibly before), in kernel 2.4. Is there any possible advantage to this behavior, or is it wholly unnecessary?


texts:
I would like to know if there is any existing research on the following problem:

$$\text{For }a, b \in \mathbb Z \text{, given }n = a^2 + b^2, \text{output }a, b$$.

Searching for "sum of squares", "quadratic sum", "two squares", etc. on eprint did not return any related results that I could find. The problem itself may have been given a particular name, but if it has I don't know it and so I can't search for it.

I did a search on some of the math stackexchange sites and:

There appears to be a relation between a decisional variant of the problem and factoring. Namely, "determine whether or not $n$ is a sum of two squares" can be solved with knowledge of the factorization of $n$.
I found a result that allows the problem to be solved efficiently when $n$ is a prime congruent to $1 \bmod 4$.

The naive algorithm for solving the problem runs in time $O(\operatorname{sqrt}(n))$ by simply guessing all possible values for $a$ up to $\operatorname{sqrt}(n)$, squaring them, subtracting $a^2$ from $n$, then checking whether the result is a perfect square.

I would like to know any of the following:

Is there pre-existing research on the problem that I can consult

Does the problem have a name other than "Sum of two squares"

Can we prove that the problem is either "hard" or "easy", for the usual definitions of the terms on a hard instance of the problem (e.g. one where $n$ is not a prime congruent to $1 \bmod 4$)


texts: RSA: Find message (m) given that you know p,q, cp and cq where cp=m^dp mod p and cq = m^dq mod q


texts:
From my understanding of blockchain, I feel the main use of blockchain is to do something in a decentralised way as compared to the traditional centralised way which involves a middle man. Usually, the centralised way is a much simpler way, but use of a more complicated way (blockchain) becomes justified because you are able to decentralise.it.

However, I see a lot of companies which are currently the central party trying to get into Blockchains. For e.g. banks etc. I am not sure what advantage there is here.

For example, take a look at this - ironmountain.com - What-is-blockchain-and-why-should-records-management-professionals-care

In my opinion, regular PKI is best suited for this. A user signs his document with his private key & then submits it to Iron Mountain. This will ensure integrity. So what advantage is it to either Iron Mountain or the user if Blockchain is adopted in this case.

It also seems as if Blockchain is getting forced into places where it's not necessarily the best solution.

Or am I wrong?


texts: I am trying to derive equations for s and t in the cryptanalysis of a Simple DES algorithm, but I haven't been able to deduce it. I have attached an image of the portion that I'm referring to, and I would appreciate it if someone could explain as to how the equations q and r are derived and what would be the derivation for s and t.


texts: Which algorithms are used to factorize large integers?

texts:
Even if RSA decided to cancel the Factoring Challenge, it seems that some teams keep working on it. According to Wikipedia, RSA-768 has been factored in late 2009.

What are the current large integer factorization algorithms and what the mathematical principles behind them? What are the ways for improvement (faster algorithms, better implementations...)?


texts: Is a modulo addition safe for the encryption of private keys?

texts:
I'm writing a JavaScript library which needs to encrypt 256-bit private keys. The algorithm often used for that is AES, but the shortest implementation around has 172 lines of code.

I'm trying to optimize for code size, so I'm looking for shorter alternatives. I've done some research and believe this should work well enough:

encrypt(key, password):
    salt = random64Bits()
    hash = keccak256(salt + password)
    enc = []
    for i from 0 til 32:
        enc[i] = (key[i] + hash[i]) % 16
    return enc + salt

I.e., the modulo-16 addition of each byte of the password and the hash of (key + a random salt). It can be implemented in about 10 lines, so, if there isn't anything inherently wrong, I'd certainly favor it.

Is this encryption scheme secure? Are there equally simpler alternatives properly standardized?

Note that I already require Keccak for other functionality, so the Keccak code base doesn't count to the amount of code required.


texts:
Grover's algorithm can search an unordered list of length $N$ in time $\sqrt{N}$  on a quantum computer. Applied to cryptography, this means that it can recover n-bit keys and find preimages for n-bit hashes with a cost of $2^{n/2}$.
But the basic version of Grover's algorithm is sequential. Each iteration uses the output of the previous iteration as input. I don't see an obvious way to parallelize the algorithm. Reducing the number of iterations significantly reduces the success probability more than linearly.
If the algorithm is inherently sequential, building a bigger computer won't speed up the attack, limiting its impact. $2^{80}$ sequential cipher invocations looks pretty hard to achieve to me. On the other hand, $2^{80}$ parallel cipher invocations is already on the edge of feasibility today using classical computers.
Assume an attacker using a quantum computer is limited to $T$
timesteps with $T<\sqrt{N}$, so they can't run Grover's algorithm with the optimum number of sequential steps. What's the cost for finding a preimage/recovering a key? What is the average cost per-break if they have multiple targets?


texts:
Imagine I am a software developer.  I want a block cipher, and I have the choice of using AES or Camellia.  Which should I use?  Which makes more sense from a technical perspective, and why?  I need to select the preference order for TLS ciphersuites: should I put the AES ciphersuites above or below the ciphersuites?

For example, Firefox's SSL/TLS libraries currently list Camellia ciphersuites as preferred over AES ciphersuites.  Is that the right choice?  Should others follow Firefox's lead, or should they list AES ciphersuites as preferred over Camellia?

(See also Why does nobody use (or break) the Camellia Cipher? and Why is CAMELLIA suddenly so widely used?, which are related but not identical.)


texts: Why can't they just fix SHA-1 if it's broken?

texts:
Presently 160 bits of hash block width seems to provide adequate security against brute force attacks.  The recent developments concerning SHA-1 have reduced the effort to force collisions by 5 orders of magnitude according to the latest Wikipedia edit.

Other cryptographic primitives have been evolved to fix issues that were similarly found, such as:-

RSA -> increasing bit count
RC4 -> RC4A -> Spritz
Whirlpool0 -> WhirlpoolT -> Whirlpool

I'm specifically using the term fix, to mean keeping the SHA-1 160 bit essentials and making internal changes /improvements.  So some (but not limited to) changes might be:-

amending the round count with perhaps double rounds to tie in with the existing key schedule as 80 x 2 instead of 80 x 1
changes to key schedule to increase rounds directly
something akin to internalising SHA-1(SHA-1(message))
additional bit wise operations

Hopefully you get the idea.  Why can't we do this so that it forms a plug in upgrade whereby the existing block size can be kept?  My intention is to easily prolong the life of SHA-1 in existing code and data bases without huge and far reaching programmatic changes.  I realise that 160 bits will someday become insecure requiring it's ultimate replacement by a wider hash.


texts: Is there a practical way to crack an AES encryption password?

texts:
I heard that the fastest method to crack an AES-128 encryption, or and AES-256 encryption is by brute force, which can take billions of years. But I can't help thinking there's got to be a faster way.
Because the AES encryption scrambles the data contained in a zip file, the password could be found by unscrambling that data correctly. Say if a portion of the data in the file is known, for example a string at the end of a file, or a header containing an expected sequence of bytes in a known file type.
 Then by comparing the scrambled bytes with the 'expected' unscrambled bytes, the password can easily be determined by computing an algorithm that converts those bytes because both the scrambled bytes and the unscrambled bytes are known. Only the formula is unknown.
However, the condition for this type of cracking is that the zip file contains known file types which have a determined data format and places certain data in certain locations in the file. For instance, a 3ds file always starts with a header containing the bytes "4D4D".
Hence a list of possible passwords to rearrange the sequence begin to be narrowed down as the cracking progresses.
So is this method plausible? or is there something wrong with it,  like maybe the actual address of the bytes in the zip is different from the address in the unzipped file.


texts: what motivated the design decisions of RFC 8291 ("Message Encryption for Web Push")?

texts:
Related question here.
I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile application), using an untrusted "push service" (think APNS or FCM) as an intermediary. The constraints appear to be as follows:

The user agent and the application server are assumed to have an out-of-band secure channel for initial setup (typically a direct TLS connection)
After initial setup, the application server needs to be able to asynchronously send messages to the user agent, achieving confidentiality and integrity

The RFC takes what seems to be a fairly complex route to solving this problem, using three different primitives: elliptic-curve Diffie-Hellman, HKDF, and AES-GCM:

During the initial handshake, the user agent generates a long-lived ECDH keypair and symmetric secret, then sends them to the application server over the secure channel
To send a message, the application server:

Generates an ad-hoc ECDH keypair and carries out ECDH with the user agent's public key, deriving a shared secret
Combines this ad-hoc shared secret with the long-lived symmetric secret using HKDF, deriving a key
AEADs the message with AES-GCM and sends it to the push service, which relays it to the user agent

As I understand it, ECDH is used for confidentiality and the symmetric secret is used for integrity (it authenticates the server to the client). One might think that ECDH is also used to achieve forward secrecy. But technically, this protocol is not forward-secret, since there is a long-term key (the private half of the user agent's ECDH keypair) that can be used to decrypt any message.
My question is: how does this protocol improve on transmitting a single symmetric key over the secure channel, then sending messages protected by a single AEAD (XChaCha20-Poly1305 seems especially attractive for this use case)? Is it because the user agent's private key is thought to be harder to attack than a symmetric shared secret (e.g., because individual client devices are harder to attack, or because it can be stored in a secure coprocessor)?


texts:
So for block ciphers you need a fixed size block.

If the plaintext length is not a multiple of the block length then you need to pad it.

One way you could do this is that for the last block you just pad the blocks with 0s or some random characters except for the last character of the last block which represents the number of characters padded.

Of course the problem is what happens when the plaintext is a multiple of the block length (i.e. fits exactly). In this case you just add a dummy block of 0s or 1s. Then when you decrypt you know that if you encounter such a dummy block then the previous block has no padding.


texts: How do I generate a challenge for elliptic curve signing using NIST standards?

texts:
Basically, NIST FIPS 186-4 describes a standard for generating some message that will be signed by an elliptic curve private key. However, I'm having difficulty interpreting how this message should look.

To give more context, with RSA, I've been attempting to follow PKCS #1 v1.5, so I'm basically doing pad(sha1(crypto.randomBytes(256)), which I believe creates a sufficiently random challenge of appropriate length in the case of RSA. (If I'm wrong here, please let me know that as well).

What are the discrete steps in the case of ECC? (I'm trying to follow B.5.1 Per-Message Secret Number Generation Using Extra Random Bits and B.5.2 Per-Message Secret Number Generation by Testing Candidates of the publication above).

  In this method, a random number is obtained and tested to determine that it will produce a value of k in the correct range. If k is out-of-range, another random number is obtained (i.e., the process is iterated until an acceptable value of k is obtained.

So in plain English looking at the publication, it appears I do the following to create a challenge, k:

Find the bit length N of the public key
Generate a string of N random bits
Convert the string of random bits to a non-negative integer c (using the method for bit-to-string conversion in the same publication)
If c is greater than n-2, start over...
k = c + 1

Make sure k and the inverse of k are within the limits [1, n–1].

However, there doesn't seem to be any hashing going on. In the context of RSA, I've been reading you should always hash this random bit string before signing it (and of course, we must pad it appropriately so the message is the correct size). Am I missing something in the case of ECC? (Of course, I could theoretically just send any random message to be signed, but I want to follow some standard for the challenge, and it looks like NIST is the way to go...)


texts:
I am implementing a timing attack on RSA for school and I need to generate two sets of messages $Y$ and $Z$ for which holds:

$ (Y^d \mod N) \cdot Y < N $ and
$ (Z^d \mod N) \cdot Z > N $

where $d$ and $N$ are known. How can I efficiently find solutions for $Y$ and $Z$?

I have tried using a random function but it takes too long to complete or it doesn't complete at all.


texts: Can I use different initialization vectors (IV) for the same data in AES-CBC?

texts:
Every time I encrypt the data, I generate a different IV. Suppose the attacker has access to all files ever encrypted. They don't know the key, but they do know the IV. The problems is: if I save the same data with the same key several times, I generate different encrypted data. Theoretically, this could give the attacker some information about the key or the data, assuming they know that neither have changed. Should I worry about this?

This is mostly a theoretical question. In practice I could simply check if the data or the key have changed. If not, then I don't change the encrypted data.


texts: Affine cipher finding the decryption map

texts:
Given two letters of the plaintext 'ZP' corresponding to the ciphertext 'AE' respectively, I have found the key to be (a,b)=(10,10) (modulo 26).

Therefore the decryption map $D(x)=a^{-1}(x-a)\bmod26$ I obtain here is $D(x)=10^{-1}(x-10) \bmod26$. However, $10^{-1}\bmod26$ does not exist so how am I able to find this? Have I got the key wrong? I know $(23,23)$ also works but i dont know how to find that key with my working.

This is my working:

$25a+b\equiv0 \pmod{26}$,
$15a+b\equiv4 \pmod{26}$

where $(a,b)$ are the two elements of the key, and $Z,A,P,E$ correspond to the numbers $25,0,15,4$ using the standard translation of the alphabet to numbers, starting with $A=0$.

Then using simultaneous equations I get:

$10a\equiv-4\pmod{26}$ which can be written as $10a\equiv22\pmod{26}$ as $-4\equiv22\pmod{26}$.

Then dividing by $2$ you get $5a\equiv11\pmod{13}$ so $a\equiv11\cdot5^{-1}\pmod{13}$ then by using the extended euclidean algorithm you can calculate the inverse of $5\bmod 26$ which is $-5\pmod{13}$ or $8\pmod{13}$.

Therefore $a\equiv11\cdot 8 \pmod{13}$, $a\equiv88\pmod{13}$ and so you get $a\equiv10\pmod{13}$.

Therefore $a=10$ and by plugging $a=10$ into $25a+b\equiv0\pmod{26}$,

I get $250+b\equiv0\pmod{26}$ and so $b\equiv-250\pmod{26}$ which then gives $b=10$ and so $(a,b)=(10,10)$.