texts: How to require two keyholders to decrypt a document?

texts:
I want to create a system to encrypt a document and store it with a 3rd party, but not have the 3rd party be able to decrypt it until some unspecified later date. It seems like the solution would be to split the key into two parts, given to two different trusted 3rd parties. Then when the date arrives those 3rd parties can come together to decrypt the document.

I realize that splitting a key effectively reduces the strength of the key in half for anyone who has half of the key.

Is splitting an AES key into two parts is an effective method of preventing either party from decrypting a document?
Is there a preferred method of splitting a key? Down the middle? Every other byte, etc.?
When splitting a key will one party have an advantage over the other party in a brute force attack? In other words, are certain parts of the key more important than others?


texts: random oracle model vs standard model vs selective model

texts:
Can someone clearly outline the main difference between each of the three security models:

random oracle model
standard model
selective model

This post What is the "Random Oracle Model" and why is it controversial? gives a very good description of the random oracle. According to what I have been reading, the standard model depends on some strong assumptions (for example DDH).

What I don't understand is how the selective model is different from both. And to what extent is it weak.


texts: How can I handle the situation if key size is less than 64 bits in DES?

texts: If the data is not a multiple of 64 bits, then I can use padding. I know that it is not secure. But if the key is less than or more than 64 bits, should I ask the user to enter the key again, or should I pad / truncate it?


texts: Burmester-Desmedt (BD) key agreement protocols

texts:
How do you perform the Burmester-Desmedt key exchange Protocol, in Diffie-Hellman
extension protocol?

I've been searching high and low, but couldn't locate an example on how to prove if all the party is getting the same session key.

Here is the explanation that I got from the net:

I don't really get all the formula, especially this calculation:

$k_i = (k_i + 1 / k_i - 1)^{x_i} \mod p$

Example:

$k_i = g ^{x_1} \mod p$

assuming $x_1 = 4, g = 2$ ( 2 is a generator from $Z_{11}^*$ ) and $p = 11$

$k_1 = 2^4 \mod 11$

$k_1 =  5$

therefore,

$k_1 = (k_1 + 1 / k_1 - 1) ^ x_1 \mod p$

$= (5+1 / 5-1) ^ 4 \mod 11$

$= (6 / 4) ^ 4 \mod 11$

= ...

How should I proceed from here on?

ADDITIONAL

And after the k1 is found, how can i prove that other parties (n = 3) are getting the same session key (K) ?


texts: Practical consequences of a honest-verifier zero-knowledge of the Schnorr protocol

texts:
Schnorr protocol is known to be honest-verifier zero-knowledge and not perfectly zero-knowledge.

What are the practical consequences of this fact? Does it mean a dishonest verifier can do something to discover the secret exponent $x$?

Setup

$P$ chooses a large prime $p$ and a generator $g$ of the $q$ order subgroup of $\mathbb Z_p^*$.
$P$ chooses a secret $x \leftarrow_{uniform} \mathbb Z_q^*$, computes $y = g^x$ and gives $y$ to $V$.

Protocol

$P$ chooses $r \leftarrow_{uniform} \mathbb Z_q^*$, computes $t = g^r$ and sends $t$ to $V$
$V$ chooses $c \leftarrow_{uniform} \mathbb Z_q$ and sends it to $P$
$P$ computes $s = r + cx$ and sends $s$ to $V$
$V$ verifies that $g^s = ty^c$.


texts: What's the deal with conditional and jump operations in homomorphic encryption?

texts:
I'm doing some research about full homomorphic encryption (FHE). As I figured out, algorithms are implemented in circuits. I suppose that they are called circuits because the Holy Grail is to realize a NAND gate and then be able to do any kind of logic with that.

My question is: how does homomorphic encryption deal with conditions and jump operations? How could you calculate the nth item of a Fibonacci series recursively with a circuit?

Most of the manuals of FHE implementations don't talk about conditions and jumps. Is the idea that some instances do some preparation of the circuit before execution?


texts:
I'm currently working on an application that requires me to add two ECDSA private keys in order to make a new private key. The result has to have the property, that its corresponding public key is the same as one would sum the public keys corresponding to the first private keys.

I managed to get most of that going, but I have problems when the sum of the private keys gets so big that I need to mod it by the curve's $N$ parameter.

What are the correct steps I should take in order to ensure a proper private key sum is generated?


texts:
A client application needs to encrypt a UDP datagram for a server with known EC public key $P$. Performing a full ECDH key exchange would defeat the benefit of using UDP as a connectionless protocol. I am therefore looking at ways to share a temporary symmetrical key decided by the client only.

Two solutions to that constraint seem to be :

Generating an ephemeral key pair $(k,K)$, and encrypt the payload with $kP$ − ECDH.
Generating a random key $r$ and encrypt it with EC ElGamal.

The ECDH approach requires 1 EC multiplication from the client ($kP$), 1 EC point to include in the datagram ($K$), and 1 EC multiplication from the server ($pK$).

According to the link above, the EC ElGamal approach seems to require 2 EC multiplications from the client, 2 EC points to include in the datagram, and 1 EC multiplication from the server.

Diffie-Hellman is apparently lighter in computation and header data. What is the advantage of using ElGamal ?


texts: What is the smallest plaintext/ciphertext size for an algorithm like?

texts: When I read about a choosen plaintext attack, for example on AES the block size is always 128 bits, does it mean the attacker will only supply 128 bits data words as "plain text" ?


texts: Security of somewhat homomorphic encryption via LSB encoding?

texts:
I'm reading this paper
https://eprint.iacr.org/2011/344.pdf

It says that
"The secret-key encryption scheme whose security is based on the LWE assumption is rather straightforward.
To encrypt a bit, $m \in \{0, 1\}$ using secret key $\mathbf{s} \in \mathbb{Z}_q^n$, we choose a random vector $\mathbf{a}\in \mathbb{Z}^n_q$ and a "noise" $e$ and output the ciphertext

$$
 c = (\mathbf{a}, b = \langle \mathbf{a}, \mathbf{s}\rangle + 2 e + m) \in \mathbb{Z}^n_q \times \mathbb{Z}_q
$$

The key observation in decryption is that the two “masks” – namely, the secret mask〈a,s〉and the “even mask” 2e– do not interfere with each other. (* Footnote)
"

The footnote says that
"We remark that using $2e$ instead of $e$ as in the original formulation of LWE does not adversely impact security,so long as $q$ is odd (since in that case 2 is a unit in $\mathbb{Z}_q$)"

Does this mean using even $q$ incurs vulnerability of the scheme?
If so, what is the intuition behind that?


texts: Difference between Key Scheduling and Key Generation?

texts:
I am a little bit confused in the terms i.e Key Scheduling and Key Generation. What is the actual difference between these two terms? According to Wikipedia, the terms are described as:

Key Generation: Key generation is the process of generating keys in cryptography. A key is used to encrypt and decrypt whatever data is being encrypted/decrypted. A device or program used to generate keys is called a key generator or keygen.

Key Scheduling:  A key schedule is an algorithm that calculates all the round keys from the key.

From the above definition and after reading more details about this on the internet what I summarized is:

Key generation is just a process while key scheduling is about the calculation of key in the algorithm. Means this process is called key generation, am I right here?

Moreover, what we will be called if we calculate a key using any method in our algorithm. Just for example say that I calculate a key using different chaotic equations. Combine these equations in a particular way and generate a final key. Is it will be key scheduling or key generation?


texts: Public-key cryptosystems without poly-time quantum attacks

texts:
It's well-known that Shor's algorithm can solve integer factorization, discrete logarithm and discrete log over elliptic curves in cubic time.  This implies that cryptosystems like RSA, ElGamal, and Elliptic Curve Diffie-Hellman (ECDH) are vulnerable to quantum computers.

Are there any existing public-key cryptosystem that are NOT known to have a polynomial-time quantum attack?

This question was inspired by this blog post.


texts: Are there any successful preimage attacks?

texts: Are there any successful preimage attacks on any serious cryptographic hash algorithm or at least on serious-looking non-cryptographic hashes (like MurmurHash)?


texts: AES 128 bits with 12 bytes IV vector composed of a 4 bytes counter : safe?

texts:
I have a 128 bits AES cypher (GCM, Galois/Counter Mode) using a 12-byte initialization vector (IV) composed of:

8 constant bytes:

6 bytes (device ID)
2 bytes (zero)

4 bytes (incrementing frame counter)

Is this really safe? Assuming the frame counter may overflow in the long run.


texts: Is it possible to decrypt an ECDSA private key if the same nonce is used across different private keys?

texts:
If the same nonce is used across different messages under the same private key, the private key can be easily revealed.

However, let's consider another scenario.

Two private keys, x1 and x2, are used with the same pair of nonces, k1 and k2. Thus, for each pair of signature (r,s) and hash message h, we get:

$$ s_1=k_1^{-1}(h_1+r_1x_1) \pmod p $$

$$ s_2=k_1^{-1}(h_2+r_1x_2) \pmod p $$

$$ s_3=k_2^{-1}(h_3+r_2x_1) \pmod p $$

$$ s_4=k_2^{-1}(h_4+r_2x_2) \pmod p $$

Therefore, no nonce is used twice by the same private key, but nonces have been reused across different private keys.

Is it possible to retrieve x1 and x2 in this scenario? From what I can observe, the four equations are linearly independent withe each other and consist of four variables. Therefore, there are unique solutions for x1 and x2, right?

Or did I miss something?

SOURCE: This idea was first suggested in this paper: https://link.springer.com/chapter/10.1007/978-3-030-00470-5_29


texts: How can Peggy prove she knows one of Victor's passwords in zero knowledge?

texts:
Say Peggy wants to prove to Victor that she knows one of his passwords. She doesn't want Victor to know which password she knows, because she knows that some passwords are more valuable to Victor than others, and wants to keep the advantage that Victor doesn't know which of his passwords she knows.

Victor wants to verify that Peggy knows one of his passwords to ensure she's not lying, but he also doesn't want Peggy to trick him into giving her any knowledge of what passwords he has/doesn't have. That is, he doesn't want to send her anything that she could use to verify that she actually does have one of his passwords, or that she could use to perform a brute force attack and reveal any additional information about his passwords.

Is there a way to prove this in zero knowledge?


texts: How measurement error works in PRNG operation?

texts: Suppose, I have PRNG with seed key length of $|K_s|$ and output sequence length of $2^{|K_s|}$, so the complexity of the PRNG is of the order of $2^{|K_s|}$. Now, if there is any measurement error in the output of the PRNG, how this measurement error works in the overall complexity of the PRNG?


texts: How can one show that an ElGamal-like signature verification scheme is valid?

texts:
For an ElGamal-like signature scheme, I am given two things:

The signing function,
the verification function.

How can I show that the verification function is valid?

Example 1:

Signing: $s := x^{-1}(m - k·r) \pmod {p - 1}$

Verification: $g^m = (g^x)^s · r^r \pmod p$

NOTES:

$g$ is the generator over the set $\mathbb Z^*_p$.

$x$ is the secret value, $g^x$ the public one.

$r := g^k \pmod p$


texts: What is the algorithm behind PasswordDeriveBytes?

texts: Microsoft has created an implementation of PBKDF1 in the PasswordDeriveBytes class. It can however generate more bytes than PBKDF1, which is limited to the number of bytes generated by the underlying hash function. How is this proprietary extension of Microsoft defined?


texts: Collision resistance of a function which chooses the hash from a large table of hashes

texts:
Let's say you know a (possibly) large table of ids and some corresponsing hashes $h_{ID_j} = H(ID_j | secret_j)$. The resulting table looks like
$$ ID_1 | h_{ID_1} $$
$$ ID_2 | h_{ID_2} $$
$$ ... $$
$$ ID_n | h_{ID_n} $$

The hashes of the ids are secretly created by n id owners with each knowing a randomly generated secret $secret_j$. No owner inputted more than one entry.

Now I want to have a look on the the public boolean circuit functions
$$f_1(ID|secret) := H(ID|secret) = h_{ID_1} \lor H(ID|secret) = h_{ID_2} \lor ... \lor H(ID|secret) = h_{ID_n}$$
or
$$f_2(ID|secret) := H(ID|secret) = h_{ID_{r_1}} \lor H(ID|secret) = h_{ID_{r_2}} \lor ... \lor H(ID|secret) = h_{ID_{r_t}} \lor H(ID|secret) = h_{ID_s} \lor H(ID|secret) = h_{ID_{r_{t+1}}} \lor H(ID|secret) = h_{ID_{r_{t+2}}} \lor ... \lor H(ID|secret) = h_{ID_{r_u}}$$ with random chosen $t, r_q, q < n, u < n$ and $f_2, s, u$ being fixed chosen and published.
My questions now are

if $f_1$ is collision resistant (finding two ID|secret and ID'|secret' such that $f_1$ outputs 1) if H is a random oracle.
if $f_1$ is collision resistant (finding two ID|secret and ID'|secret' such that $f_1$ outputs 1) if H is only a collision resistant function.
if there a way to define the random values $t, r_q$ such that they reveal as less about the ID of the proof as possible. Which formal security model can apply there?
if there exisits a secure function which outputs 1 if $f_1$ or $f_2$ outputs 1 and the chance that function outputs 1 if $f_1$ or $f_2$ outputs 0 is negligible and is faster to describe in boolean circuits than $f_1$ or $f_2$.


texts: Does the output hash of simple hash and Merkle hash are same for same data>>??


texts: How broken is a xor of two multiply with carry generators?

texts:
How broken is a xor of two LCGs?
How Brittle Are LCG-Cracking Techniques?

Based on the above two questions, I have simply one additional question: how broken is a XOR of two 64-bit multiply with carry generators, with one generator's output rotated by 24-bits before the XOR, and independently generated seed states, with the first output discarded?

Furthermore, what is the fastest attack against this generator with only $2^{20}$ outputs?


texts: Is the additive discrete Logarithm problem always easy in Fields?

texts:
While thinking about additive DH key exchanges, I somehow had the idea that additive DH key exchange may always be easy to break, if we are in a field.

So here's (directly) the question:
In any finite field, is the additive discrete logarithm and / or the computational diffie-hellman problem always easy?

Here's some more info on the details:

It can safely be assumed that doing addition and multiplication is fast
The additive discrete logarithm problem in a field $(\mathbb F,+,\cdot)$ is to find the smallest $k\in\mathbb Z^+$ such that such that $Q=k\odot P$ holds for given $Q,P\in\mathbb F$, where $\odot$ denotes repeated addition of an element to itself k-times (as usual).
If solving these problems isn't always easy, I'd also be interested whether there are certain properties of the field that would make it easy.


texts: Can you determine an unknown value when it is combined with a known value and you are given the resulting hash?

texts: Say I have a string that I want to keep hidden. You can then enter a known string which is added to the end of the hidden string and you are given the sha256 hash of the combined string. If you were to do this many times with whatever strings you wanted and the hidden string remained fixed, would there be a practical way to determine the hidden string?


texts: How to generate unique (random) numbers that can be traced back to a unique source number?

texts:
I need to generate unique (random) numbers that I can trace back to a unique source number.

For example:

source number A can generate numbers A1, A1, A3 .... Am
source number B can generate numbers B1, B2, B3 .... Bm
...
source number N can generate numbers N1, N2, N3 .... Nm

All the source numbers A, B, .. N and generated numbers Ai, Bi, Ni should be unique and mutually exclusive.

Now for any generated number Ai, I should be able to compute unambiguously the source number A (and the same goes for Bi, Ci, ... Ni).

Can anybody help with the algorithm for this?

Use case: a user types a numeric code generated by this algorithm. The server should be able to identify this user, from the code alone. For others it should not be possible to identify the user, nor generate subsequent codes for that user.


texts: Should I encrypt the signature along with the message?

texts:
Given that A wants to send a message M to B,
I have 2 scenarios as shown:

The difference between the 2 is that for case 1, the digital signature is appended to the message before being encrypted using the symmetric key. For case 2, the digital signature is not encrypted using the symmetric key.
May I know which case is better? What are the security concerns of each of the case?


texts: NFC with AES : how works the exchange of key

texts:
I'm trying since days to understand the security protocols on NFC devices. I'm not a professional in security, I'm just a student and want to understand (additionally, English is absolutely not my mother tongue ^^).

I see that AES-128 is implemented on several devices, like the MIFARE DESFire EV1 (and2) but I don't understand several things :

How is the key exchanged with the reader and the tag ? AES-128 is a symmetrical protocol, so the private key must be shared between the two devices. I can't understand - reader the documentation - how does it work.
For instance, I can read here http://www.ti.com/lit/an/sloa213/sloa213.pdf the process of authentication with AES. I'm sorry, I don't understand how the key can be shared and formally, what functions are used :/
I'm not sure neither to understand the meaning and utility of the UID (or RID with DESFire). It is only a unique number to avoid the cloning ? But in the case of a RID, how does it work to ensure that the card is not cloned ?
Finally, is the random generator known ? I think it is a 16 bits generator, is that possible to know what function is implemented on it, and how is chosen the salt (I know that in the past, the RGN was a big issue with CRYPTO-1, I guess that the method is know different but is that known ?) ?

Thanks a lot :)


texts: I'm trying to understand why is this, in my opinion, counter intuitive construction secure. ECDSA is a tuple of two numbers (r, s) whose validity can be verified by public key. However I don't see the reason why the only way to forge the signature is breaking the DLog problem on the EC. I spent many hours thinking about it and still don't comprehend where is the bottleneck. How do we know that there is no other algorithm for generating (r, s) without the knowledge of private key?


texts: Issue with only applying key addition layer before first round of AES

texts: What would be the issue if AES only applied the key addition layer once, before the first round? As in, how would this make the algorithm vulnerable to attack?


texts: How to compute the output length of randomized encoding (or garbling)?

texts:
We consider randomized encoding for circuits as a equivalent primitive as the circuit garbling scheme. However, I have a question arised from their syntax, that is, how to compute the output length of randomized encoding?

From the syntax, the encoding algorithm of randomized encoding takes as input the circuit $C$ and an input $x$ and outputs a randomized encoding $\widetilde{C}(x)$, but the circuit garbling scheme handles the circuit $C$ and input $x$ separately, that is, the circuit garbling algorithm takes as input the circuit $C$ and outputs a garbled circuit $\widetilde{C}$ and a garbling key $K$; the input garbling algorithm takes as input the input value $x$ and the garbling key $K$ and then ouptuts a garbled input $\widetilde{x}$

does it mean $|\widetilde{x}|+|\widetilde{C}| = |\widetilde{C}(x)|$? I know that the online complexity of garbling scheme gives a bound on the size of $\widetilde{x}$, but what is the size of the garbled circuit $\widetilde{C}$? Can we implicitly regard it as $poly(1^\lambda, C)$


texts: Is encrypting credit card numbers one by one with rsautl secure?

texts:
I wish to encrypt credit card numbers one by one using asymmetric encryption on the command line. My current approach is this…

Encrypt:

/usr/bin/openssl rsautl -encrypt -inkey 'myKey.pub' -pubin | /usr/bin/openssl enc -base64

Decrypt:

openssl enc -base64 -d | openssl rsautl -decrypt -inkey myKey.pem

It is my understanding that this is secure, even when using the same key for each number, because rsautl introduces randomization to prevent finding patterns in the cyphertext.

Am I correct, and is the approach therefore secure?


texts:
I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen
Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is Existentially Unforgeable Under Chosen Message Attacks
(EUF-CMA) if the hash fuction is uniformly random.

However, to my surprise, on online Cryptography forums and some Cryptographers say that the security model behind RSA-FDH, so EUF-CMA
can be broken if one can find collisions in the hash function itself. The thing is, I have not been able to find such examples or even
understand how this is even possible. I read in a lecture slide online that if we ask signatures $σ_1$, $σ_2$ for $m_1,m_2 \in \mathbb{Z}_n^*$ and
output $(m^*, σ^*) := (m_1 \cdot m_2 \mod{(N)},\ σ_1 \cdot  σ_2 \mod{(N)})$. But then I still don't know how it practically applies to RSA-FDH IF the hash function has collisions.


texts: Is F' a pseudorandom function when F is composed with G, a pseudorandom generator?

texts:
If $F$ is a pseudorandom function, is $F'$ also a pseudorandom function in the following:
$$
F'_k(x)=F_k(G(x)) \space \space \text,
$$
where $G$ is $a$ pseudorandom generator?

Also, does the other directions holds (i.e $F'_k(x)=G(F_k(x))$)?


texts: DH with AES - is that an acceptable security scheme over UPnP?

texts:
I'm trying to devise a good security scheme to protect comms over Wi-Fi.

Right now, I have 2 devices that already communicate via UPnP but I need to secure this communication. I've come up with this:

Once the client sees the other host, picks a pair of Diffie-Hellman parameters (out of 1000 pregenerated pairs of $g$ and $p$) and enacts a DH key agreement with the host. This happens each time both devices want to initiate a session, and auth persistence is not needed (generated keys are discarded after the session finishes).
Once both devices have calculated the same secret, this secret is hashed with SHA-256 to create a common key.
When the client wants to send a message to the host, it encrypts it with AES-CBC-PKCS#7, using the key, it appends the generated IV and sends it to the host. The host's response follows the same method.

Whoever observes a session can only see $g$, $p$, $A$, $B$, the ciphertexts and their corresponding $IV$s.

Is this secure enough?

P.D.: I'm under the impression that trying to use TLS is way too much for such a simple need and it would be too complicated to get out in a reasonable timeframe.


texts: Authentication without decrypting the password?

texts:
To my knowledge it works like this:

The server receives the username-password values over a secure & encrypted channel.
The username-password values are decrypted in the server and are present as plaintext.
With the username the according salt gets retrieved for the user.
The salt is appended to the plaintext-password and is finally hashed.
The hash is compared to the stored hash and depending if the hashes match or not the user gets logged in or receives some sort of a message that says that the username / password is wrong.

Hypothetical problem: If for example we have a vicious programmer "Mallory" that works as a programmer for the company he could write a piece of code inside the authentication process to receive the plaintext password:

private bool Authentication(string username, string password)
{
    // Some code ...

    log($"{username}, {password}"); // Logs the plaintext username & password for Mallory

    // Some more code ...
}

For this example we assume that the company fully trusts Mallory and that nobody else ever checks the source code.

My questions are:

Is it possible to change this authentication mechanism in a way so that the password is never present as plaintext?
Is it possible to prevent this without changing the effort for a user, like introducing two-factor-authentication or something similar?


texts:
It seems there would be some collisions in what the different symbols map to, resulting in loss of information.

For example, say we use the English alphabet, multiply by 2 and take the congruence mod 26.  In this case, A and N will both map to the same ciphertext letter, regardless of what the shift value is.  Same with B and O, etc.  In fact, if the formula is $(ax + b) \mod n$ where $n$ is the size of the plaintext alphabet, then the ciphertext alphabet will have only $1 \over a$ as many symbols as the plaintext alphabet.

Am I misunderstanding something?


texts: How were the best AES whiteboxes in the CHES 2017 CTF challenge built and broken?

texts:
Along CHES 2017 was a Capture the Flag Challenge, aka The WhibOx Contest.

Participants submit C source code with interface

  void AES_128_encrypt(unsigned char ciphertext[16], unsigned char plaintext[16]);

that performs AES-128 encryption with some key. Other participants attempt to find that key from the submission. A mechanical referee checks if a guess of the key is correct. A rating system awards points (strawberries and bananas) as a function of how much time one's submission remains unbroken, and for breaking a submission. Survival range has been from 1 minute to a record 28 days 13h 42'.

What where the techniques used by the leading participants, both for making whiteboxes, and attacking them? The only clear thing is that there was an inflation in size; the winner is 28MByte.


texts:
I am currently trying to implement the pathORAM algorithm as describe in this paper:
https://eprint.iacr.org/2013/280.pdf

The paper states that with high probability, the stash size will be bounded by some R.  Is there a way to know what this R will be?  Additionally, is there an intuitive way to understand why it should be bounded?
Thanks


texts: Perl DES PCBC as protection against decryption/crypt analysis

texts:
Is error propagation in DES PCBC a good method to prevent decryption/crypt analysis by third parties?

If I had a very large file encrypted with Perl's DES with the PCBC option, and then removed the first megabyte of the resulting ciphertext would this render the remaining ciphertext 100% immune to crypt analysis ? Why or why not? Suppose that the missing 1 megabyte file disappeared forever would the ciphertext never be able to be decrypted? I'm assuming that too much information is being lost by not having the first megabyte of the ciphertext for it ever to be decrypted or any further information about the plaintext to be discovered.

What if the data was encrypted first in AES-CBC for more protection and then re-encrypted with DES PCBC for the intended error propagation? Could this weaken it or would it strengthen it slightly?

I am considering using the PERL DES cipher with the PCBC option since this seems to be the easiest and fastest way to implement this.


texts: Digital signature providing a proof of file authenticity

texts: How can a digital signature provide proof the authenticity (not integrity!) of a file?


texts: What is "blinding" with cryptographic hash functions?

texts:
What is blinding with a SHA256() or similar cryptographic hash function?
What applications does it have?
An answer to a recent question briefly mentioned "Consider blinding before calling an external function [such as] SHA256()".
( https://security.stackexchange.com/questions/246209/is-it-safe-to-publish-the-password-hashes-from-my-sha256-md5-custom-password-h/246275#246275 )
The Wikipedia article "blinding (cryptography)"
currently mentions several different types of blinding, including asymmetric encryption, asymmetric digital signatures, and the one-time pad (a kind of symmetric encryption), but never mentions hash functions.
Most applications in that article involved tweaking the plaintext slightly, then running the tweaked plaintext through some (untrusted) function to get some intermediate output, then untweaking to get the final output, in such a way that we get the same final output without the tweaking and untweaking, but without handing over plaintext to the (untrusted) function. Does SHA256() support such tweaking and untweaking?
Whether or not it does, what is the proper approach to blinding with SHA256() or other cryptographic hash functions?


texts:
In BLS short signatures paper, the authors describe a hash function $H\colon\ \{0, 1\}^∗ → G^∗$, where $G$ is a Gap-Diffie-Hellman group.
They present a structure where a standard hash is used on a field element, and then mapped to a subgroup of $G$, later to be used in the security proof as a random oracle.
How would the security proof change (or break) if we'll simply use an exponentiation of some generator of $G$? i.e., to have $H(m) := g^m$ for some generator $g$.


texts: Why does this square root algorithm work?

texts:
I've been doing some elliptic curve cryptography, and a library I'm using has this slightly bizarre algorithm for computing modular square roots:

Let $x$ be some quadratic residue modulo $p$ for some large prime $p$. Let $h$ be some element of $\mathbb{Z} \setminus p\mathbb{Z}$ such that $h^2-4x$ has no square root modulo $p$. Let $V_n$ be the Lucas sequence with $V_0=2$, $V_1=h$ and $V_n=hV_{n-1}+xV_{n-2}$. Let $k = \frac{p+1}{2}$. Then $V_k = 2\sqrt{x}$. This is obviously less efficient than the well known algorithm for $p \cong 3 \mod 4$, but apparently works in a more general case

Immediately, one might believe this definition to be contradictory; indeed the characteristic equation of this recurrence is solved by square rooting $h^2-4x$, but, being a Lucas sequence, this impossible term never appears in any particular value of $V_k$.

The only reference to this algorithm I've found is as an exercise in an undergraduate-level textbook, which suggests that this is solvable by some fairly simple maths, but nothing I've tried seems to result in a solution -- computing $V_{\frac{p+1}{2}}^2$ yields $V_{\frac{p+1}{2}}^2 = V_2 + 2x^{\frac{p+1}{2}} = h^2 - 2x + 2x^{\frac{p+1}{2}}$, which looks almost nothing like the $4x$ I would expect.


texts: PKCS#7 CMS - Message digest calculation process

texts:
i'm studying RFC 5652 in order to know exactly how to encode/decode PKCS#7 ASN.1 data.
I don't understand how one can create a signature when the field "signedAttrs" is present:

The result of the message digest calculation process depends on
whether the signedAttrs field is present.  When the field is absent,
the result is just the message digest of the content as described
above.  When the field is present, however, the result is the message
digest of the complete DER encoding of the SignedAttrs value
contained in the signedAttrs field.  Since the SignedAttrs value,
when present, must contain the content-type and the message-digest
attributes, those values are indirectly included in the result.

By reading the above text I get confused: SignedAttrs field contains message-digest and content-type values but message-digest can be present once calculated and the digest has to be calculated on:
eContent OCTET STRING + full DER encoding of SignedAttrs field (Containing message-digest field).
In the example below there is a PKCS#7 Signed data structure where the envelopedData content field value is being signed + the signed attributes. Where
does exactly the messageDigest value come from?


texts:
So according to the wikipedia page https://en.wikipedia.org/wiki/General_number_field_sieve the algorithm has complexity $$\exp \left( \left(\sqrt[\leftroot{1}\uproot{0}3]{\frac{64}{9}} + o(1) \right) (\ln n)^{\frac{1}{3}}(\ln \ln n)^{\frac{2}{3}} \right)$$ but I am not too familiar with this notation.

I understand the big-O notation for complexity if somebody could explain how this is similar and what it means for the running time it would be appreciated!!

Also I know that this is subexponential in the size of $n$ running time, but I am unsure how to show this just from this complexity.


texts: Is it safe to reuse a symmetric key when using asymmetric encryption?

texts:
I've written a C# Library that I hope will be used for security purposes in a commercial application.  The application will communicate through the internet and not on an internal network.  I am using RSA for Asymmetric Encryption and Rijndael for Symmetric Encryption.  Currently the process I am using is as follows:

The Client sends it's RSA Public Key to the server.
The Server encrypts the Rijndael Symmetric Key using the Public Key and sends the result to the client.
The client decrypts the Symmetric Key and stores it.
When either party sends any data, a new IV is generated each time, but the Symmetric Key remains the same.

I expect the lifespan of the connection between the Client and Server to last for at most 10 - 20 exchanges of information before the connection closes, thus being 10 - 20 sets of data encrypted with the same key, but with a different IV.  Past this, the Symmetric Key is destroyed.  Both Asymmetric Keys, the Symmetric Key and IV are all generated by the classes I'm using.

Is what I am doing safe?  Are there any major security flaws I'm missing?

EDIT: I send the IV along with the Rijndael Encrypted data, where it is seperated from the data and then used by the receiving party to decrypt the data.  I have read elsewhere that this is safe practice?


texts: Encrypt-then-MAC: full random keys or keys derived from master key?

texts:
I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better:

Use the CSPRNG to generate two distinct keys of 32 byte each

or

Use the CSPRNG to generate a master key of 32 byte and then use HKDF to derive the encryption and authentication key

I'd like to add that no human interaction is involved: this keys are stored inside a DB and are only used by machines.

Thank you very much!


texts: Injecting salt into PyCrypto KDF - useful?

texts:
I have noted some sources indicate that when using a KDF like PBKDF2 (alternatively) some advocate injecting the salt at the time of execution - like this:

dv = salt + PBKDF2(salt + password, salt)

Versus the "plain" usage of

dv = PBKDF2(password, salt)

When using the PyCrypto.Protocol.KDF  PBKDF2 function or Armin Ronacher's version (both linked above), do the extra salt parameters add any benefit if no two passwords will have the same salt (but the salt will be stored with the password)?

Presumably the risk is having an oracle whereby identical passwords would be revealed as-such, encoded. Is this the case or is there another concern one ought to be mindful of?

If this is the only concern I would expect, in the absence of a fault in the algorithms that permits short-circuiting, a plainly used salt obliges one to recheck every password the entire number of iterations. Is this the case?

(Incidentally, this is copied from my post on SO, which was inexplicably closed).

EDIT:

It is worth linking:

How to store a salt
How to securely hash passwords
and Password Hashing add salt + pepper or is salt enough?

The last link in particular states, in the question:

  As far as I know, the recommended/approved method for storing password verifiers is to store:

$verifier = $salt + hash( $salt + $password )

In a sense this question becomes "is it necessary to inject the salt into a KDF in the same way as is recommended for a hash"? (presuming of course that the theory supports the injection of a salt for a hash - though I believe it does)


texts: Key size, performance, and security tradeoffs for AES GCM / CCM

texts:
AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption? and other answers). It appears that from a practical standpoint, 128 bit keys are sufficient for using AES encryption alone.

However, it seems like this equation changes when we use AES GCM/CCM. My understanding is that the same performance effects of using larger keys do apply for AES GCM and AES CCM, but the security strengths of brute forcing the key are different ($n \over 2$, https://tools.ietf.org/html/rfc3610) due to pre-computation attacks enabled by reuse of nonce/IV for different keys. There appear to be suggestions in the RFC where the nonce/IV for these modes include a salt(random) and a counter to provide a slight increase in security against pre-computation attacks.

Does this not reduce the number of blocks and max data size that can be encrypted under the same key? The amount of encrypted data reduces for a randomly constructed nonce with AESGCM; why would this reasoning not apply for CCM?

In summary my questions are:

What are the main reasons why 256 bit keys are recommended for AES GCM and CCM instead of 128 bits, and why is AES-128 bit sufficient for encryption otherwise?
Will there be significant gain in performance using 128 bit vs 256 bit keys with AES GCM / CCM or do non-AES part of AES GCM / CCM dominate performance or execution time?
Do the restrictions on message size and total amount of data authenticated under the same key change with TLS like nonce construction (32 bits random, rest of it a counter)?
Is ChaCha20-Poly1305 vulnerable to this pre-computation attacks?

ChaCha20-Poly1305 seems to provides 256 bit strength for encryption and a little more than 100 bits of security for authentication and the only condition seems to be related to the nonce just like the rest.


texts: Do $v_1=\alpha\cdot r_1$ and $v_2=\alpha\cdot r_2$ leak information about $\alpha$

texts:
Please consider we have finite field $\mathbb{F}_p$ for large prime number $p$. We have a fixed field element $\alpha$. By $r_i\leftarrow \mathbb{F}_p$ we mean we pick $r_i$ uniformly random from the field. We assume the values $r_i$ are distinct so $r_i\neq r_j$

Question: Given $n$ values $v_1=\alpha \cdot r_1 \bmod p,..., v_n=\alpha \cdot r_n \bmod p$ for a large $n$ can the adversary learn the value $\alpha$?

Intuitively one may say the adversary can compute $gcd(v_1,...v_n)$ to extract value $\alpha$.

Am I right that the adversary cannot learn anything; otherwise, ElGamal encryption would not be secure?


texts: A question regarding next-bit predictors

texts:
Consider a probability distribution $D$ over $n$ bit strings. Consider a next bit predictor $A$ as follows.
\begin{equation}
\underset{X \sim D}{\text{Pr}}[A(X_1X_2.....X_{k-1})=X_k] \geq \frac{1}{2} + \frac{1}{\text{poly}(n)}.
\end{equation}
Here, $X_i$ indicates the $i^{\text{th}}$ bit of $X$. Consider that this predictor exists. Intuitively, if I understand correctly, this means that there should be a "gap" between the bit $X_k$ and the bit $\overline{X_k}$ (complement of $X_k$); otherwise the algorithm $A$ should not exist. In other words, I think that the existence of an algorithm $A$ implies
\begin{equation}
\underset{X \sim D}{\text{Pr}}[X_k~|~X_1X_2.....X_{k-1}] - \underset{X \sim D}{\text{Pr}}[\overline{X_k}~|~X_1X_2.....X_{k-1}] \geq \frac{1}{\text{poly}(n)},
\end{equation}
or something similar to this, with respect to the statistical property of the $k^{\text{th}}$ bit. I couldn't prove this mathematically.
Is my intuition correct and can it be made mathematically rigorous?

I tried proving my intuition, but I am still stuck. Here is my attempt.
We can show that the fact that $A$ exists and acts as
\begin{equation}
\underset{X \sim D}{\text{Pr}}[A(X_1X_2.....X_{k-1})=X_k] \geq \frac{1}{2} + \frac{1}{\text{poly}(n)}.
\end{equation}
implies
\begin{equation}
\underset{X \sim D}{\text{Pr}}[A(X_1X_2.....X_{k-1}) = X_k] - \underset{X \sim D}{\text{Pr}}[A(X_1X_2.....X_{k-1})= \overline{X_k}] \geq \frac{1}{\text{poly}(n)}.
\end{equation}
Now, I am trying to show
\begin{equation}
\underset{X \sim D}{\text{Pr}}[X_k~|~X_1X_2.....X_{k-1}] - \underset{X \sim D}{\text{Pr}}[\overline{X_k}~|~X_1X_2.....X_{k-1}] \\ \geq \underset{X \sim D}{\text{Pr}}[A(X_1X_2.....X_{k-1}) = X_k] - \underset{X \sim D}{\text{Pr}}[A(X_1X_2.....X_{k-1})= \overline{X_k}].
\end{equation}
In other words, the proof reduces to proving
\begin{equation}
\underset{X \sim D}{\text{Pr}}[X_k~|~X_1X_2.....X_{k-1}] - \underset{X \sim D}{\text{Pr}}[\overline{X_k}~|~X_1X_2.....X_{k-1}] \\ = \max_{A}\left( \underset{X \sim D}{\text{Pr}}[A(X_1X_2.....X_{k-1}) = X_k] - \underset{X \sim D}{\text{Pr}}[A(X_1X_2.....X_{k-1})= \overline{X_k}]\right).
\end{equation}
If I start with the contrapositive of the statement, I end up in the same place. I think I am missing something subtle. In spirit, the statement our proof reduces to is similar to a very similar-looking result relating total variation distance between two distributions with distinguishability bias of the best algorithm (like this answer). But also, it is not quite the same: as we only have one distribution now, not two, and retracing the same steps does not work.


texts: Node.js/OpenSSL crypto library equivalent of a Rijndael implementation

texts:
I have a Rijndael function that I've implemented as a JavaScript port of a C reference implementation in a technical specification for the MILENAGE algorithm (ETSI TS 135 206 V14.0.0 (2017-04)). My JavaScript port works fine, as verified by successful authentication of actual SIM cards.

Instead of using something implemented in JavaScript, I'm wondering if I can find an equivalent cipher within Node.js/OpenSSL's built-in ciphers to (1) avoid rolling my own (2) take advantage of potential performance gains of using a compiled implementation.

I didn't catch the TS mentioning a particular flavour of Rijndael being used in the reference implementation (are there even multiple flavours of Rijndael?). Is the hard-coded S box table always like that?

I'm also not too clear on what the relationship of AES and Rijndael is. If AES is based on Rijndael, can I find an AES flavour that matches the reference Rijndael implementation I have?

When I enumerated the available ciphers in Node.js's crypto library, I got:

> require('crypto').getCiphers()
[ 'CAST-cbc',
  'aes-128-cbc',
  'aes-128-cbc-hmac-sha1',
  'aes-128-ccm',
  'aes-128-cfb',
  'aes-128-cfb1',
  'aes-128-cfb8',
  'aes-128-ctr',
  'aes-128-ecb',
  'aes-128-gcm',
  'aes-128-ofb',
  'aes-128-xts',
  'aes-192-cbc',
  'aes-192-ccm',
  'aes-192-cfb',
  'aes-192-cfb1',
  'aes-192-cfb8',
  'aes-192-ctr',
  'aes-192-ecb',
  'aes-192-gcm',
  'aes-192-ofb',
  'aes-256-cbc',
  'aes-256-cbc-hmac-sha1',
  'aes-256-ccm',
  'aes-256-cfb',
  'aes-256-cfb1',
  'aes-256-cfb8',
  'aes-256-ctr',
  'aes-256-ecb',
  'aes-256-gcm',
  'aes-256-ofb',
  'aes-256-xts',
  'aes128',
  'aes192',
  'aes256',
  'bf',
  'bf-cbc',
  'bf-cfb',
  'bf-ecb',
  'bf-ofb',
  'blowfish',
  'camellia-128-cbc',
  'camellia-128-cfb',
  'camellia-128-cfb1',
  'camellia-128-cfb8',
  'camellia-128-ecb',
  'camellia-128-ofb',
  'camellia-192-cbc',
  'camellia-192-cfb',
  'camellia-192-cfb1',
  'camellia-192-cfb8',
  'camellia-192-ecb',
  'camellia-192-ofb',
  'camellia-256-cbc',
  'camellia-256-cfb',
  'camellia-256-cfb1',
  'camellia-256-cfb8',
  'camellia-256-ecb',
  'camellia-256-ofb',
  'camellia128',
  'camellia192',
  'camellia256',
  'cast',
  'cast-cbc',
  'cast5-cbc',
  'cast5-cfb',
  'cast5-ecb',
  'cast5-ofb',
  'des',
  'des-cbc',
  'des-cfb',
  'des-cfb1',
  'des-cfb8',
  'des-ecb',
  'des-ede',
  'des-ede-cbc',
  'des-ede-cfb',
  'des-ede-ofb',
  'des-ede3',
  'des-ede3-cbc',
  'des-ede3-cfb',
  'des-ede3-cfb1',
  'des-ede3-cfb8',
  'des-ede3-ofb',
  'des-ofb',
  'des3',
  'desx',
  'desx-cbc',
  'id-aes128-CCM',
  'id-aes128-GCM',
  'id-aes128-wrap',
  'id-aes192-CCM',
  'id-aes192-GCM',
  'id-aes192-wrap',
  'id-aes256-CCM',
  'id-aes256-GCM',
  'id-aes256-wrap',
  'id-smime-alg-CMS3DESwrap',
  'idea',
  'idea-cbc',
  'idea-cfb',
  'idea-ecb',
  'idea-ofb',
  'rc2',
  'rc2-40-cbc',
  'rc2-64-cbc',
  'rc2-cbc',
  'rc2-cfb',
  'rc2-ecb',
  'rc2-ofb',
  'rc4',
  'rc4-40',
  'rc4-hmac-md5',
  'seed',
  'seed-cbc',
  'seed-cfb',
  'seed-ecb',
  'seed-ofb' ]

I had tested a random bunch (based on uneducated guessing) of AES ciphers from above to see if I could get identical outputs to the reference Rijndael implementation but had failed.

Any pointers?


texts: Best practise for encryption in a password manager

texts:
I'm trying to make a password manager for Windows installed computers, and after researching the best ways to encrypt the passwords in the database (I'm new to cryptography) I think I've come up with a good way to do it, but I'm still not sure.
How the key is made when the user first opens the program:

The user inputs the master password, the password that will unlock the password database.
A random salt of 16 bytes and the master password will be put through a KDF (PBKDF2 using SHA512) to derive a key $k$.  $$k = \operatorname{PBKDF2-SHA-512}(password, salt)$$

How the database is encrypted:

Using the $k$, the database is encrypted using AES 256 bit CBC. $$ c = \operatorname{AES-CBC}(k,IV, database)$$

The $IV$ and the encrypted database $c$ are then encoded to base64 before store.

Where and how the database, salt (for the key $k$) and the $IV$ (for AES) are stored:

The salt, $IV$ and encrypted database will be dumped into a python dictionary, and written to a txt file e.g. {"salt": "T\x96\x829\xed\...", "iv": "00/JOAIsHs9XtB5acawBhA==", "database": "TE4nhDRTJ+JW..."}

The decrypted database file is then deleted and overwritten with random encrypted data multiple times to properly wipe it.

This txt file is then encrypted with AES 256 bit CBC, the key is 32 random bytes which is then hidden somewhere on the computer (could this part be skipped?).

I would prefer if no external devices would have to be used to store the second encryption key.
Also, every time the database is decrypted, and then encrypted back again when the user is done, a new key with a different salt is produced, and a new IV for encryption is produced.
Is this how it's supposed to be done? Or am I completely wrong?


texts: Verifying authentication by just using the root of a Merkle tree

texts: Let's say I've a Merkle tree where leaves are the hashes of some data that needs to be authenticated. Can I verify the whole of them by just using the hash of the root of Merkle tree? If yes, how?


texts: How do we measure number of possible encryptions in One Time Pad

texts: trying to brute force a specific length of ciphered pad, how do we measure the total number of possible encryptions in One Time Pad


texts: EdDSA (Ed25519) is any random number sufficient for a good private key?

texts:
Looking at a reference implementation it shows that the key pair generation simply does: read X bytes from RNG and then derive another value from these X bytes thus producing private key with derived public key.

However nowhere in documentation I see mention of what qualifies as a “good” private key (or in this case RNG). Does it mean that any [random] N between 0 and up to 64 byte max value is a “good” private key? Or did I miss any description of how the good quality keys should be generated?

Asking this because this is rather different from for example how RSA keys are generated.


texts: Does it take brute force to find a pair of plaintext and ciphertext that each follow a certain condition, given an AES encryption key?

texts:
Suppose that I have an AES key $K$, and I'm instructed to find a plaintext such that the first 32 bits of the plaintext are some string of bits $S_1$, and the last 32 bits of the ciphertext once the plaintext has been encrypted with $K$ are another string of bits $S_2$.

Is this difficult? Is there a known attack against this that's faster than just fixing one of the $S$'s and brute-force searching for a text with the other $S$?


texts: I would like to know the differences between FleXOR and Free-XOR. I searched in the web but I couldn’t understand the information I found. I understand that there are both cryptographic methods as well as optimizations for Yao's Garbled Circuits, but I don't practically understand their differences and which is to be preferred. What exactly is (or are) the difference(s) between FleXOR and Free-XOR?


texts: Why do wireless keyboards only use 128-bit AES? Why not 256?

texts:
I've looked for 256-bit AES encrypted wireless keyboards, and apparently they don't exist. Can anybody explain why this is from a cryptographic point of view?

Why wouldn't they just opt-in to the highest standard of encryption, instead of settling for the runner-up? Is there any cryptographic (or closely related) reason why industrial producers might have decided to use AES-128 instead of AES-256?


texts:
I want to reduce a multi-precision integer $x$ modulo a prime $p$, very fast. Performing the traditional Euclidean division for only calculating the modulo, is inefficient and modular reduction is at the heart of many Cryptographic primitives like Elliptic Curve Cryptography. There are other methods to perform the aforementioned task like Barret reduction, etc, but I would like to learn about Montgomery reduction and its peculiarities first, because of its practical significance.
Algorithm:
     Input : Integer x, n, k
     Output : (2^(-k) * x) mod n
    1. for t from 1 to k do
        1.1 if x is odd then
            1.1.1     x <- x+n
        1.2 x <- x/2
    2 Return x

There are restrictions on $x$ like, $0$ <= $x$ < $n^2$, and also, $n$ should be odd.
The book from which, I borrowed the above algorithm from , states two facts:

Fact 1 : Adding n to x does not change the residue, since in effect it adds one to the quotient ⌊x/n⌋. Another way to explain this is that
n is (or multiples of n are) congruent to zero modulo n. Adding zero
will not change the value of the residue.
Fact 2: If $x$ is even, then performing a division by two in $Z$ is congruent to $x · 2^{−1} \mod n$ . Actually, this is an application of
the fact that if x is evenly divisible by any $k$ ∈ $Z$, then division
in Z will be congruent to multiplication by $k^{−1}$ modulo $n$ .

I don't understand the meaning behind Fact 2. In reality, I'm having trouble in comprehending how the author transcends from regular arithmetic to modular arithmetic mod n ?
Why is it that division of $x$ by two in $Z$ (integers) is congruent to multiplication by $2^{-1}$ in modulo $n$. After all $2^{-1}\mod n$ can be  easily calculated by the extended euclidean algorithm:
Since, $n = 2*q + r$. Since $n$ is odd, $r$ should be $1$. Therefore on transposing, we get:
$n - 2*q = 1$. If we take this preceding equation modulo $n$, we get $-q$ as the multiplicative inverse of $2$ w.r.t mod n.
It would be highly appreciated, if I could get a good explanation of how Montgomery reduction works, in the first place. Why do we keep adding $n$ to $x$ , if $x$ is odd?
I am missing some very great clarity in my understanding! What are the solid principles behind Montgomery multiplication with reduction ? Since, I come from mostly programming background, I seem to be lacking some mathematical knowledge in this context.
Every help will be greatly appreciated!


texts: What is the procedure to proceed towards breaking a cipher text when the process of encryption is not known?

texts:
I mean , if one is provided with a cipher text and the process of encryption through which text has has been encrypted has not been provided , then how is the cipher text broken ? Is frequency analysis the first step towards checking the alphabet's frequency and is there any standard procedure towards breaking cipher text ?

Let's assume that I encrypted my text using a trigonometric function , but that is not known by the cryptanalyst who is trying to break the code , so what process would be traditionally deployed for breaking the cipher text ?


texts:
My question is simple: where is a good article to learn how GCM/GMAC works?
I mean not the description of the algorihm, but why this pair of algorithms for encryption/decryption is really inverse. For me it is not obvous, why encryption of (A+P) --> (C+T) followed by decyption gives again P and the same Tag T...


texts: Security of HMAC against an eavesdropper

texts:
Assume we are using HMAC-SHA-256 with 128-bit key for authenticating our messages, and an adversary has eavesdropped $n$ (message, tag) pairs.

If the adversary wants to forge a tag for a message $m'$, (I think) he has two options:

Output a random number;
Output one of the eavesdropped tags

I think the probability of success in the first option is $1^{-256}$. In the second option, the probability of success is $1^{-128}$ (birthday paradox).

Am I correct?


texts: Can the confusion/diffusion of a hash algorithm be quantified?

texts: I am wondering whether the confusion and diffusion are quantified in any way when we examine hashing algorithms and, if so, how they are quantified and what units (if any) are used to represent them.


texts: the probability of sampling a group element that falls in the subgroup on elliptic curve

texts: Given an elliptic curve $E$ on $Z_q$. There is a subgroup $<G>$ on $E$, and the order of $<G>$ is $p$, where $p$ is a prime. And the discrete log problem on $<G>$ is hard. Now we randomly sample a group element $G_0$ of $E$. Let $Q$ be the event that $G_0$ falls in $<G>$. Can we say that the probability that $Q$ happens is negligible?


texts: Understanding Feldman's VSS with a simple example

texts:
I'm trying to understand Feldman's VSS Scheme. The basic idea of that scheme is that one uses Shamir secret sharing to share a secret and commitments of the coefficients of the polynomial to allow the other party to verify that the share they received is valid. I implemented it in code following the wikipedia page, but my verification function doesn't work. Here is a simple example of the failure:

We will work in the field $\mathbb{Z}_{11}$ with generator $g=3$. Let $f(x)=5+3x+8x^2$ be our Shamir polynomial. Thus $f(1)=5$. So let $s_1=5$ be the share that party $p_1$ gets.

The dealer also must commit to the coefficients. So the commitments are $3^5=1, 3^3=5, 3^8=5$. (These are computed as $g^c$ for each coefficient $c$ of the polynomial).

For verification that $s_1$ is correct, we compute $g^{s_1}=3^5=1$ and compare this to $1*5*5=3$ (the exponents are all $1$ since $i=1$, otherwise this step is done as $k^{i^j}$ where $k$ is the commitment, $j$ is the index of the commitment). Since $1\neq3$, the verification fails. But why? It should pass assuming I have done things correctly.

Update
So working the math a little in more detail:
$g^{s_1}=1$ and $g^5 g^{3^{1^1}} g^{8^{1^2}}= g^{5+3^{1^1}+8^{1^2}}= g^{5+3\cdot 1^1 + 8\cdot 1^2} = g^{16} = g^6 = 3$ and $1\neq 3$.

Note that the exponent is $f(1)$. Wikipedia offers a small hint:

  (Typically, one takes a subgroup of $\mathbb{Z}_q^*$, where $q$ is a prime such that $q$ divides $p-1$.

Is my problem that I am not working in such a subgroup? If so, why does it not work in general for $\mathbb{Z}_p$ (Wikipedia only says that typically one works in this subgroup)? Is there a standard way to set up such a subgroup?


texts: I will be grateful if someone can explain how stream cipher works using Pseudorandom generator(PRG).


texts: If attacker knows salt and hash, how is salt effective?

texts: Maybe I'm missing something, but if my salt and hashed/salted password are stored in the same place, how is salting any more secure than just hashing? Does this just rely on attackers not knowing how the salt is incorporated into the hash?


texts: Difference between linear cryptanalysis and differential cryptanalysis

texts: What is the main difference between linear cryptanalysis and differential cryptanalysis? For example in relation to DES?


texts:
I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. This was done for the PlayStation 3 hack. I'm now trying to reproduce it in Python, using this library.

My problem is that the hack only works in some cases (at least I think so). I've not been able to reproduce it, so I hoped you could help me.

Initially we have two equations:
$$
s_1 = k^{-1} * (z_1 + y) \mod n \\
s_2 = k^{-1} * (z_2 + y) \mod n \\
$$
(where $y = r*\mathrm{privatekey}$)

We want to get rid of y and figure out k. In all explanations I've seen so far, they'll do something like this:
$$ \begin{align}
s_1 - s_2 &= k^{-1} * (z_1 + y) - k^{-1} * (z_2 + y) \\
s_1 - s_2 &= k^{-1} * (z_1 - z_2) \\
\frac{s_1 - s_2}{z_1 - z_2} &= k^{-1} \\
k &= \frac{z_1 - z_2}{s_1 - s_2} \\
\end{align} $$

This doesn't work in my code, because in this hack, the modulo operation at the beginning is just ignored. If I we don't ignore it, the equation should look like this:
$$
i*n + s_1 = k^{-1} * (z_1 + y) \\
j*n + s_2 = k^{-1} * (z_2 + y) \\
$$

I got rid of the modulo by adding $x*n$ to the left side, where x (i or j) is unknown. With this equation I'll just do the same thing as above but keep the $+ x*n$:
$$ \begin{align}
i*n + s_1 - j*n - s_2 &= k^{-1} * (z_1 - z_2) \\
\frac{s_1 - s_2 + n*(i-j)}{z_1 - z_2} &= k^{-1} \\
k &= \frac{z_1 - z_2}{s_1 - s_2 + n*(i-j)} \\
\end{align} $$

Obviously we do not know $i$ and $j$. We can ignore them if $i = j$ (as we did in the first calculation), which is only the case when $z_1$ and $z_2$ are close together or $k^{-1}$ is very small (so that it pulls the result down and therefore prevents $z_1$ or $z_2$ from making too much difference).

In theory $k^{-1}$ is pretty small (since it's $\frac{1}{k}$) and therfore the exploit works. But in practice I've seen that $k^{-1}$ is not used, but instead the smallest inverse modulo of $k \mod n$ that is a whole number is used. This number can be really large, which actually amplifies the difference between $z_1$ and $z_2$, making $i-j$ pretty large. With this implementation, I can't use the exploit as explained in theory, because I never get my exact $k$.

My questions are:

Mathematically, is there another way to retrieve $k$, even if the $k^{-1}$ part is really large? Maybe using some inverse modulo?
Why is it that many implementations use the inverse modulo instead of $k^{-1}$? (I've seen it in two libraries so far)
Why doesn't it work when I change the implementation to use $k^{-1}$?

Since this is part of an assignment for Uni, retrieving $k$ still has to work somehow. But I already spent too much time on it without any results.
Any gurus out there that can help me? :)


texts: Paillier: guessing the message when knowing the cipher and the random number

texts:
I cannot get my head around this.

In Paillier, the ciphertext is calculated using

$c = g^m.r^n\ mod\ n^2$

where $(n,g)$ forms the public key and $r$ is a random number $0<r<n$.

Assuming an attacker knows $c$, $r$, $n$. and $g$, what would it take  - in average - to find $m$ ?


texts: What is the difference between Special Honest Verifier Zero-Knowledge (SHVZK) and Honest Verifier Zero-Knowledge (HVZK)? Sometimes I see one term being used, other times the other. Do they mean the same thing?


texts: Does Camellia-GCM use Camellia-CTR to create GCM Hash?

texts: I'm still confused when reading GnuTLS/Nettle implementation about Camellia-GCM.


texts:
"Skull" or "Skull and Roses" is a table top game. The rules can be found here.

I was thinking of how I could play this game P2P. At first it seemed easy: Each time I had to place a card face down I would make a choice hash it, send it to my opponent, and then when it needed to be checked you could give out your answer and it could be verified by hashing it. The problem is that without all players revealing all of their card at the end of a round, there is no way to verify that someone didn't put down more than one skull, or put down more roses than they had. This problem seems like a simplified version of mental poker to me, so I am hoping someone with more knowledge on the subject would know how to play this game without a trusted third party.

In case the link provided goes dead here is a synopsis of the rules:
Each player gets a hand of 4 cards: 3 rose cards and 1 skull card. At the start of each hand each player places one card from their hand face down. Next players take turn place another card from their hand face down on top of their previously placed cards. When it is your turn instead of placing another card face down you are also allowed to "challenge". To challenge you announce a number of less than or equal to the number of cards placed down. You now enter a new phase of the game where players take turns naming larger and larger numbers until someone either decides to "pass" (not naming a larger number), or someone names a number equal to the number of face down cards. When the "challenge" phase is over the last player to call a number has to flip over that many cards. If the player flips over a skull he has to discard a rose card for the rest of the game, however if he does not flip over a skull card, he gets a point. Everyone now collects the cards they played face down, and a new round begins. First player to two points wins.


texts: CCA-Security Proof of a particular scheme

texts:
Suppose to have a scheme that works so:
$\mathcal{P}_k =:\{P_k\colon \{0,1\}^{2n} \to \{0,1\}^{2n} \}$ is a strong PRP family.

Encryption: $\operatorname{Enc}(k,m)=P_k(m\mathbin\Vert r)$, where $\Vert$ indicates the concatenation and $r\leftarrow \$ \{0,1\}^n$ ($r$ is random from $\{0,1\}^n$)

Decryption: $m\mathbin\Vert r={P^{-1}}_k (c)$,  return $m$;

I remember that we can define $G^{CCA}_{\pi,\mathcal{A}} (\lambda, b)$ as follows:

1) $k \leftarrow \{0,1\}^\lambda$

2) The adversary $\mathcal{A}$ choose two messages $m_0,m_1$.

3)$c_b \leftarrow Enc(k,m_b)$, where $b \leftarrow \$ \{0,1\}$. (I denote with $\$$ to say that $b$ is random).

4) Adversary must say what message has been decrypted.
Let's assume that $\mathcal{A}$ have access to both $Enc_k()$ and $Dec_k()$ (CCA-Security) algorithm. So $b' \leftarrow \mathcal{A}(1^{\lambda},c_b)$.

5)$\mathcal{A}$ succeeds if $b'=b$.

We have CCA-security if $\mathcal{A}$ can not do better than guessing, that's for all PPT adversary $A$

$$|Pr[G^{CCA}_{\pi,\mathcal{A}} (\lambda, 1)=1]-Pr[G^{CCA}_{\pi,\mathcal{A}} (\lambda, 0)=1]| \leq \upsilon(\lambda) \in negl(\lambda)$$

How can I proceed by reduction? Can someone give me an help?


texts: How can I hash an input into an arbitrary domain point?

texts:
I am trying to implement a signature scheme involving RSA signing of a message digest generated by SHA-$256$. I want to hash the input into an RSA domain point instead of the fixed $256$ bit digest generated by SHA.

Apparently, this can be achieved using a Full Domain HashingFrom the Wikipedia definition of Full Domain Hashing

  In cryptography, the Full Domain Hash (FDH) is an RSA-based signature scheme that follows the hash-and-sign paradigm. It is provably secure (i.e., is existentially unforgeable under adaptive chosen-message attacks) in the random oracle model. FDH involves hashing a message using a function whose image size equals the size of the RSA modulus, and then raising the result to the secret RSA exponent.

How would one go about practically implementing the following part of the FDH process:

  hashing a message using a function whose image size equals the size of the RSA modulus

I have tried randomly padding the $256$ bit digest, however, it requires sending extra values to remove the padding before verification.
I also looked at some papers on Random Oracles and FDH by Bellare and Rogaway(Paper 1,Paper 2) which are a little to esoteric for me and as  such, I'm looking for simplified explanation of the process.


texts: How do public key rings work in cryptographic applications?

texts:
I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might (or might not) want to publish my public key to one or another of them.

In other words, I have a basic understanding (I hope) of how PKI works and why I'd publish my public key to a keyserver so people can find me, but I'm unclear on what these different rings mean, or what their application is.

I'm wondering what would be a good analogy for them?  Like, Google+ circles?  I am looking for a better understanding of this concept.


texts: It's safe to store a known value (for checking) next to the actually encrypted values

texts:
The high level details of the encryption I'm using is:

AndroidKeyStore create/store RSA key
AES key is created and wrapped with RSA/ECB/PKCS1Padding
Encrypted AES is saved to disk.
Data is encrypted with AES/GCM/NoPadding and saved to disk.
Every encryption operation generates a new initialization vector from the platform secure random. Those are also saved to disk with their data.

The algorithm/transformation used are limited by the platform.

There are known issues on the AndroidKeyStore forgetting keys and I would like to save a known "lorem ipsum" data encrypted on first run. This known data would later be used during initialization to check the consistency of the keys and provide proper status for the system.

So my question: is it safe to store this known hard-coded value next to the real values, or with that I'm leaking everything and making it easy for someone to decrypt the real values?


texts: Using nested signatures to trust public key of inner signatures

texts:
I have a scenario where entity $A$ has an unauthentic copy of the public key $P_B$ of $B$ and an authentic copy of $P_C$ of $C$, trusted by both $A$ and $B$.

Now $A$ wants to establish trust in $P_B$.

Steps:

$B$ writes a message, signs it and sends it to $C$ : $$B \rightarrow C: M \| S_B(M)$$
$C$ is an intermediary entity and forwards the message to $A$ : $$C \rightarrow A : M \| S_B(M) \| S_C(M \| S_B(M))$$
$A$ then validates $S_C(S_B(M))$ and $S_B(M)$ successfully

Can $A$ now trust the authenticity of $P_B$ because the signature $S_B(M)$ was received in an authentic manner?

The practical example is DKIM in E-Mail infrastructure:

sender may sign her outgoing message (e.g. using PGP);
does not attach public key to not annoy non-PGP enabled receivers;
the message including the signature gets signed by the providers DKIM key;
the receiver gets a copy of the sender PK and wants to establish some trust beyond TOFU.


texts: Why (N+1)sec's mDP Implementation does not check whether all the XORED received $z$ values are 0

texts:
In the original mDP protocol once all $z$ values received from each participant the following calculation is being done:

  If either $XOR(z_1,z_2,...,z_n) = 0 $ or received invalid Signature then abort the the key computation.
  Else $z'_{j,j+1} = XOR(z'_{j_j-1},z'_{j})$

  And the final Key will be: $k_i=H_g(z'_{1,2},\ldots,z'_{n,1},sid_i)$

But on the approach used (N+1)sec of the algorithm above the check  $XOR(z_1,z_2,...,z_n) = 0$ is not performed thus I want to ask  why in (N+1)sec this check is omitted?

Also I attempted to implement the key agreement, thus I want to ask in what conditions/requirements do I need so I can omit the check $XOR(z_1,z_2,...,z_n) = 0$ as well?


texts:
In this YouTube video, Dan Boneh mentions that if both points are defined on the base field then the pairing is degenerate.

Why is that? And specifically is this true if I use the Weil Pairing?


texts: secure embedded/microcontroller crypto using AES-ctr with hmac-sha2

texts:
The embedded device is a low-power 8-bit microcontroller (memory usage is constrained to about 10kb code, 1kb ram). As the device is battery-powered and manual service should be minimal, more powerful processors are not an option.

Throughput is very limited, so performance is not too much of an issue.

The system we came up with is AES-ctr mode encryption with hmac-sha authentication:

// encryption_key, mac_key, device_id are all independent, secure random,
// unique per device pre-programmed values

// aes-ctr encryption (pseudocode)
first_nonce = nonce = device_id || counter++
for block in plaintext
    ciphertext.append(aes_ctr_encrypt_block(encryption_key, block, nonce))
    nonce = device_id || counter++ // counter is saved in non-volatile storage (e.g. flash or eeprom) to avoid re-using after power down

// authenticate nonce + ciphertext (pseudocode)
data = first_nonce || ciphertext
mac_tag = hmac_sha2(data, mac_key)

// send or store mac_tag, nonce and ciphertext
send(mag_tag || data)

The receiving side should then use the deviceID to look up the mac_tag and verify it matches.
By checking if the counter is larger than the one previously received we want to eliminate replay attacks.

If the validation checks out, the data is decrypted.

Is this a secure system? Also, what would be the effect of truncating the output of hmac_sha2 to 128 bits?


texts:
I want to update an IoT device's info by sending a REST request to the REST server and get some data in response. In this process, the IoT device will send a request to the server to update its info (like device-type) and in the response it will get a secret and id to communicate with the MQTT server.
Now I have two challenges:

Devices have very limited resources, so they can't handle the heavy cryptography algorithms.
Both sender identity and message content should be secured.

Could someone help me? Note: I already used HMAC-SHA-256 to confirm the source.


texts: Why would this method of discrete logarithm finding not work?

texts:
Say we do know $b$ but not $k$, and are given $g$ such that $g\equiv b^k\pmod p$. And say there exist factors $E = e + m'p$ ($e \equiv b^i \bmod p$) and $F = f + m''p$ ($f \equiv b^j \bmod p$) of $g$. Then $EF = g + pm = b^k$ for some $m$, $m'$ and $m''$.

So if we can find the right $(m, m')$ we can factor $G = g+pm = EF$. Then $E$ is congruent modulo $p$ to a power of $b$, and so is $F$. But note that $E$ and $F$ may not be perfect powers of $b$.

So we generate values of $E$ that are perfect powers of $b$, and then see if we can factor a member of the congruence class of $g$ mod $p$ — i.e. are any members of the congruence class of $g$ mod $p$ multiples of $E$? We can use the Extended Euclidean algorithm for this if $g$ is $\pm1$. Maybe we could also use the EEA for this if $g$ is any number $d$, by reducing the $g+pm$ and $E$ by the multiplicative inverse of $g$ mod $p$ (which we can find).

So if we can find a solution in $F$ to : $g \equiv b^i F\bmod p$ then we can reduce the problem to finding the exponent (to base $b$) of $F$ mod $p$. So then shouldn't we be able to find a sequence of exponents of our perfect power (the $E$s, the exponents being the $i$s) = until $F = 1$. At that time the sum of those exponents will be congruent (mod $p$) to the exponent of $g$.

It is on this basis that I claim that factoring is equivalent to the discrete log problem.

Is this hopelessly confused, or is there something here?


texts:
Alice creates ordered set of $N$ public messages $(m_1,...,m_N)$ and sequentially sends them to Bob. Bob evaluates $N$ functions $E_i(m_1,...,m_N)$ (possibly using a secret random value $r$ and/or his own private key $d_B$) and makes $N$ resulting values publicly available, but uses a secret permutation $P(i)$ before publishing. In other words, he publishes $E_{P(i)}$. Is it possible to construct such functions $E_i(.)$, so that

Anyone can verify that Bob's published values $(E_{P(1)},..,Е_{P(N)})$ indeed correspond to the messages $(m_1,...,m_N)$
It's hard come up with an alternative set of messages $(m^\prime_i)_{i\in[N]}\ne (m_i)_{i\in[N]}$ which would yield the values $(E_{P(i)})_{i\in[N]}$
The public information ($(m_i)_{i\in[N]}$, $(E_{P(i)})_{i\in[N]}$, $e_B$) leaks no information on the secret premutation $P(i)$


texts: Understanding why Semantic Security implies Message Recovery Security

texts:
I am stuck in the proof  where it says $$p_0=1/|M|$$ , I just do not understand how we can infer this equality.

Also, am I right in understanding that B is defined as choosing his two messages at random each time (i.e sampled uniformly from $M$)?

This is the link to two pictures: the first one containing the definition of Semantic Security, the second containing the definition of Message Recovery Security and the Proof I cannot follow:
https://imgur.com/a/ZP6xtgq

They are from Dan Boneh and Victor Shoup's free e-book 'A Graduate Course in
Applied Cryptography'"A Graduate Course in Applied Cryptography"


texts: Encryption Key derivation from numeric PIN?

texts:
I want to store data encrypted within an Android application. Keeping an encryption key safe outside the app is not an option so I looked into password derived key algorithms.

I found a nice example from Android on the blog-post “Android Developers — Using Cryptography to Store Credentials Safely ”. Let me quote the significant code:

public static SecretKey generateKey(char[] passphraseOrPin, byte[] salt)
                                  throws NoSuchAlgorithmException, InvalidKeySpecException {
    // Number of PBKDF2 hardening rounds to use. Larger values increase
    // computation time. You should select a value that causes computation
    // to take >100ms.
    final int iterations = 1000;

    // Generate a 256-bit key
    final int outputKeyLength = 256;

    SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
    KeySpec keySpec = new PBEKeySpec(passphraseOrPin, salt, iterations, outputKeyLength);
    SecretKey secretKey = secretKeyFactory.generateSecret(keySpec);
    return secretKey;
}

This method seems to imply that it's good practice to use a PIN for key derivation.
Isn't that way too easy to brute force?

In other PIN applications there is an external system that limits the number of attempts making this approach safe. In this application however I can't see how a PIN can be safe.

On a compromised system the user has the encrypted data and knows from the app/code that the pin is an $n$ digit number. So he can brute force every $10^n$ possibility and use the encrypted data to see if decryption with that derived key/pin combination returns any valid data.

Is it correct to state that password key derivation requires an alphanumeric password to be safe

Edit:

In general I understand alphanumeric passwords are better than numeric. I'm interested in feedback on my theory that I make it even easier to brute force the pin since all data except for that pin is stored on the mobile device.

I'm also looking for alternatives. Is there a way to make this safe knowing we only have a pin as secret input from the user?


texts: Can multiple Pearson permutation tables be reduced or merged?

texts:
There was a recent question answered where the accepted solution was a double Pearson hash. It consisted of the following pseudo code:- h = T1[h ^ x[i]] followed immediately by h = T2[h ^ x[i]] so effectively you run one lookup table into the other. Tables T1 and T2 are unique random 8 bit permutations. Output collisions can   occur at the classic $ 1 \over e $ rate given the presence of the 2nd table, with the hash behaving as a pseudo random function.

Developing this construction further, assume that the permutation tables are $ \pi $, giving a more general form for hashing a message $m$ with multiple consecutive but unique permutations:-

$$   h_{i} =  \pi_j [h_{i-1} \oplus m[i]]; recursive   $$

creating a functional composite as in:-

$$      h = \pi_3[(\pi_2[(\pi_1 [h \oplus m[i]]) \oplus m[i])]) \oplus m[i]]     $$

if $j=3$ . And let's call each calculation of $h$ for any given $\pi$ a 'step'.  Overall, we get $ output = H_N(m) $ for this cool/weird hash consisting of $N$ tables/steps. As an example, it might be that $ H_3(3512)=110 $  for a hash with 3 permutation tables. In the linked question we used 2 tables.

Can a new $\pi$ or set of $\pi$s be constructed to arrive at an identical output for all messages with $<N$ steps? In other words can multiple $\pi$ permutations be reduced or merged somehow into new ones, even theoretically?  Clearly they can in the special and trivial case of $|m| = 1$. What about generally for $|m| > 1$?
Considering the trivial case mentioned above, is there some relationship between $N$ and $|m|$ that determines the answer?
If  a reduced set of new $\pi$s might theoretically exist, how might   it found in practice?

Notes:

Some of this question is clearly on topic here, but not sure about it's entirely.
I see small parallels with permutations and non linearity, construction of S boxes, and their combinations.
Whilst hallucinating one might assume values of $\pi_j$  be likened to multiple keys $k_j$, so the answer to Security of a block cipher if double encryption $E_{K_2} \circ E_{K_1}$ is always single encryption $E_{f(K_1,K_2)}$ comes to mind as there is an attempt at a similar(?) reduction.
I'm happy to be migrated outa here.


texts:
ASN.1 encoding for elliptic curve cryptography is recommended by Certicom, as explained at a related question, covering curves over prime fields and binary extension fields.

I'm looking for known recommendations for encoding curves defined over prime extension fields that are suitable for pairing. At best, generally acceptable ASN.1 modules for target group elements, and $\mathbb G_1$ and $\mathbb G_2$ elements (points on curves over base prime field and over extension).

Google search returns nothing relevant. Any known recommendations please?

To refine the question, encoding is well-defined for two classes of curves: over a large extension of binary field and over a prime field. For pairing, popular choice is Barreto-Naehrig parameterized curves family defined over 12th extension of a prime field. MNT curves is another example. Both examples do not quite fit Appendix C of SEC1v2. In particular, trinomial or pentamonial polynomials do not make sense in this case.

Would it be reasonable to believe no agreement/consensus was attempted on encoding pairing-specific curves yet?


texts: Can AES ans SHA-2 algorithms be implemented in parallel?

texts:
As I understood AES GCM mode of operation gets good performance result because parallel execution of both encryption and hashing part.

Why AES and SHA-2 computation cannot be pipelined ?


texts: Does the encryption with a private key and decryption with a public key works in ElGamal likewise what is done when we use RSA for sender authentication?


texts: Is it possible to verify a python code produced an answer without re-doing the computation?

texts:
Context
Suppose Alice asks Bob to write a (python) code/function named get_sqrt(input) that computes and returns the square root of an input number named input. Next, Alice provides three random numbers as input to Bob. Bob produces the three output numbers using Bob's function get_sqrt(input) and returns to Alice:

Three output numbers that are the square roots of the three input numbers.
The python code get_sqrt(input).
Some kind of signature/hash code. This signature/hash code can consist of any combination of information derived from the input, output and python code get_sqrt(input).

Assumptions

Alice only has access to Alice's world until Alice has verified the solution of Bob. Afterwards Alice gets access to both Alice's and Bob's world.
Bob has access to both Bob's world and Alice's world (low- and high costs per operations).
Bob can do computations cheaply in Bob's world, but Bob is not trusted in Bob's world.
Re-doing the computation is too expensive in the world of Alice (for both Bob and Alice), because in the world of Alice, the costs per computation are too high.
The solutions created by the function get_sqrt(input) are reversible or easily(polynomially) verifiable. (For example, the output of Bob's function get_sqrt(input) can be verified by Alice by checking whether the square of each output equals its accompanying input.)

Challenge
However, just that the answers provided by Bob are correct, does not mean that the get_sqrt(input) function that Bob sent to Alice actually generated those answers/isn't gibberish. Therefore, I was wondering if there is some property that can be computed by Bob (and/or Alice), based on the input, output, and (python) code get_sqrt(input) that makes it possible for Alice to verify that Bob's function indeed generates those output numbers based on the given input numbers (without re-doing the computations).
Question
Is there a way with which Alice can verify that the output numbers are generated by the get_sqrt(input) function based on the set of input numbers, without re-doing the computation?


texts:
(Originally posted to SOF, but I got no answers)

I am designing a small application for use inside my company. My application needs to connect to a third party website on behalf of my application user. I would like to safely store the user's credentials for the third party site in my database. Obviously, storing the third party password as plaintext is out of the question.

What I am proposing is the following:

When a user creates an account in my application, the application generates two salt values.
The user enters a new password for my site as well as credentials for the third party site (username and password).
My application uses the first salt value and PBKDF2 or bcrypt to hash the user's local password. This hash is saved in the database for later authentication.
My application uses the second salt value and the same key derivation function to generate a second hash. The second hash is used to AES-encrypt the third party credentials. The encrypted credentials are saved in the database for authenticating to the third party site.

The only weakness that I can find is that if the users' local password is weaker than the third party password, an attacker need only guess the local password and both are compromised.

Are there any other problems with the algorithm? Is there a better way to accomplish the same result?


texts: Randomizing before Shamir secret sharing?

texts:
As I understand, the security of key-sharing depends on the cleartext actually being random.

If I split a secret which contains things like ASCII or even fixed strings (think -----BEGIN PGP PRIVATE KEY-----) what kind of preprocessing is recommended?

My current thinking is either one time Pad:

$ \text{Shamir}_{(N,M)} \left(\left( \text{secret} \otimes \text{random}
\right),\text{random} \right) \rightarrow M \text{ shares} , N \text{ required}$

or multiple rounds of AES:

$ \text{Shamir}_{(N,M)} \left(\text{AES}_{key}\left(\text{secret}
\right)^{rounds},\text{key} ,\text{rounds}\right)\rightarrow M \text{ shares} , N \text{ required}$


texts: ciphers depend on Elliptic curve cryptography

texts:
IS there any cipher dependent on the Elliptic curve cryptography?
and it is Accredited by any  origanization like RSA or El GAMAL

Which are the ciphers depend on the Elliptic curve cryptography?


texts: Is Curve25519 vulnerable to private key exposure in the case of a bad RNG?

texts:
I'm really excited by what I've learned of advancements in elliptic-curve cryptography. Curve25519 seems to be a great choice at this point in time, but if I recall correctly, some elliptic curve algorithms can be compromised during signature generation by a bad RNG: my understanding was that by a compromised RNG, the private key could be leaked.

From the documentation:

  Signatures are generated deterministically; key generation consumes new randomness but new signatures do not. This is not only a speed feature but also a security feature, directly relevant to the recent collapse of the Sony PlayStation 3 security system.

Granted that if your RNG is compromised, you're going to have a bad time in all regards, does Curve25519 suffer from this private key leak problem as well?


texts: What security vulnerabilities exists when encrypting then hashing to be able to search values in database?

texts:
im trying to find a good way to allow searches against encrypted data in the database.
Lets say i want to encrypt phone numbers, if its encrypted securely i cant search against phone numbers directly which hurts the application abilities.
From what i understood there is a main pratice that is still performant and secure enough, which is a blind index.
I wanted to know what security vulnerabilities exists for creating a blind index in this way:

encrypt phone first using AES-CBC with a deterministic IV.
hash the result of the encryption with SHA-512 without salting.
store the data in the index column.

Help would be appreciated.


texts:
Key Generation Method: Take $s \le n/2$ bits.

Generate two distinct random $n / 2$-bit prime numbers $p$ and $q$ with $\operatorname{gcd}(p-1, q-1)=2$ and
calculate $N= p*q$;
Generate two $s$-bits random numbers $d_p$ and $d_q$,
such that $\gcd(d_p, p-1)=1$, $\gcd(d_q, q-1)=1$
and $d_p= d_q \bmod p-1$.
Calculate one $d$ such that $d= d_p \bmod p-1$ and $d= d_q
\bmod q-1$.
Calculate $e=d^{-1} \bmod \varphi(N)$,
Public key= $(N, e)$,
Private key= $(p, q, d_p, d_q)$.

On the 3rd step of key generation, do I need to select between $d= d_p \bmod p-1$ and $d= d_q \bmod q-1$ or do I make the $d_p$ and $d_q$ to make same $d$ result?

It is okay to use small prime because I use $p = 41$ and $q = 59$ for study purposes.

Please help me to find the $d$.


texts: Given a SHA-256 message block, is it possible to undo the transformation of the internal state?

texts:
Consider the transformation described in section 6.2 of RFC4634 ("US Secure Hash Algorithms (SHA and HMAC-SHA)"). Given the message block M(i), and hence the message schedule W, as well as the output of the block function H(i), how hard should I expect computing H(i-1) to be?

Interestingly, the 64 "rounds" are easily reversible for this set of knowns and unknowns, but the final addition makes using this fact not trivial.


texts: Using a non cryptographic PRNG for randomized algorithms

texts:
I want to use randomized algorithms (quicksort, ect...) on a server, but secure pseudorandom generators use a lot of cpu time. But if I use a non-secure one, and the clients figure out the seed, they will be able to force a worst-case scenario. However, the users are never given the seed or output of the generator. The only way I think they can break this is by timing attacks. Will it help if I impose a delay on randomized algorithms e.g. they will be forced to run for 1 second, and if they finish earlier, just wait until 1 second passes?
Also, I can reseed it with a cryptographically generated seed every now and then.


texts: Is there a way to cleanse a picture of information from steghide?

texts:
Recently I learned of the steghide application (a command-line tool allowing the use of steganography, the art of hiding information inside other information, used in practice with JGP and WAV files primarily with gzip compression and AES encryption).

Excitedly, I hid sensitive data in my desktop background, deleting the original desktop background in it's place.

After more research, I realized that the default algorithm used (128-bit AES) is considered weak (for my standards, anyway. It's nice to be ahead of the game, using 4096-bit RSA and 256-bit AES for things).

Is there a way to cleanse this JPG file of the irrelevant bits that the embedded file is stored in?

I'm not entirely sure how the use of the passphrase (aside from encryption) is implemented to hide the file in a recoverable place using steghide, but I would assume that if you know the passphrase, you can find the exact bits that the file is located in. Is there a way to locate these bits and overwrite them in the same manner you would use to shred a file, but keeping the original image the same (to the human eye)?
Or am I boned?


texts: Is there any way to prove two numbers that are equal after Paillier encryptions?

texts:
I have two numbers $x_1$ and $x_2$, and there are two Paillier homomorphic encryption (public, private) key pairs $(p_1,r_1)$ and $(p_2, r_2)$. I only know $p_1, r_1$ and $p_2$. Suppose $C_1=E_{p_1}(x_1)$ and $C_2=E_{p_2}(x_2)$, here $E$ means Paillier homomorphic encryption.

How can I prove $x_1$ equals $x_2$ when I only gives $C_1$, $C_2$, $p_1$ and $p_2$? Thank you!


texts: Text partially decrypted regardless of IV

texts:
I'm trying to work out which AES cipher is best to use.  I'm working with the OpenSSL ruby gem.

While testing the various options I noticed that most of the ciphers result in partial or even full decryption regardless of the IV value.

I'm just wondering if this is something I should be concerned about, or even if it is a bug that the gem maintainers should be aware of.

Eg: CBC, CFB8, CFB1, CFB, CBC-HMAC-SHA256, and CBC-HMAC-SHA1, only the first 16 bytes remain encrypted.

Eg: ECB allows full decryption regardless of IV

This is the ruby code I've used for testing.

ciphers = [
    'AES-256-CBC', 'AES-256-CTR', 'AES-256-XTS',
    'AES-256-OFB', 'AES-256-OCB', 'AES-256-ECB',
    'AES-256-CFB8', 'AES-256-CFB1', 'AES-256-CFB',
    'AES-256-CBC-HMAC-SHA256', 'AES-256-CBC-HMAC-SHA1',
  ]

def encrypt(plain_text, pwd, salt, cipher_name)
  cipher = OpenSSL::Cipher.new(cipher_name)
  cipher.encrypt
  cipher.random_iv # purposefully set to random
  cipher.key = OpenSSL::PKCS5.pbkdf2_hmac(pwd, salt, 20000, cipher.key_len, OpenSSL::Digest::SHA256.new)
  encrypted = cipher.update(plain_text)
  encrypted << cipher.final
end

def decrypt(encrypted, pwd, salt, cipher_name)
  cipher = OpenSSL::Cipher.new(cipher_name)
  cipher.decrypt
  cipher.random_iv # purposefully set to random
  cipher.key = OpenSSL::PKCS5.pbkdf2_hmac(pwd, salt, 20000, cipher.key_len, OpenSSL::Digest::SHA256.new)
  decrypted = cipher.update(encrypted)
  decrypted << cipher.final
end

ciphers.each do |cipher_name|
  pwd = 'some hopefully not to easily guessable password'
  salt = OpenSSL::Random.random_bytes(16)
  plain_text = "Spicy jalapeno tail ribeye dolore ut. Pork belly ut porchetta culpa aliquip brisket shank est. Pastrami ribeye porchetta cow qui."
  begin
    puts
    puts '== %s ==' % cipher_name
    encrypted = encrypt(plain_text, pwd, salt, cipher_name)
    puts decrypt(encrypted, pwd, salt, cipher_name)
  rescue => e
    puts e.message
  end
end

For those without ruby, this is the output of the above code:

== AES-256-CBC ==
��l�~��u@�=o� ail ribeye dolore ut. Pork belly ut porchetta culpa aliquip brisket shank est. Pastrami ribeye porchetta cow qui.

== AES-256-CTR ==
/&  q]$���{�YhwH�X*�N���.p�E�̕;�� 3|t�L
                                          v�'�﬉�T�KCأ���y�X���ՎR`/��]d`L�WI�"�?P���Ǖ�B|E�u5������Zq����LϠ�4

== AES-256-XTS ==
^��:ok
@6�4^O�cNJ��'�  C/ ���V�(�)k5��)��S
                                  ^�3���4�r��A���q�=����p�^�d3;�    �.U˕|k�U/�ʝ��y��qd�/���7HΒ����l�e

== AES-256-OFB ==
iH�"�=�tL�eG��Z~o
��moӦQ!��<z��vր2}�#6�
���%�oM��XI#y�t���($���"~

== AES-256-OCB ==

== AES-256-ECB ==
Spicy jalapeno tail ribeye dolore ut. Pork belly ut porchetta culpa aliquip brisket shank est. Pastrami ribeye porchetta cow qui.

== AES-256-CFB8 ==
�xYa���ShR�
          ail ribeye dolore ut. Pork belly ut porchetta culpa aliquip brisket shank est. Pastrami ribeye porchetta cow qui.

== AES-256-CFB1 ==
+��g~ᲆ$e�
        ��ail ribeye dolore ut. Pork belly ut porchetta culpa aliquip brisket shank est. Pastrami ribeye porchetta cow qui.

== AES-256-CFB ==
���=�?)�2�96`�2�ail ribeye dolore ut. Pork belly ut porchetta culpa aliquip brisket shank est. Pastrami ribeye porchetta cow qui.

== AES-256-CBC-HMAC-SHA256 ==
_?��?���p��}ail ribeye dolore ut. Pork belly ut porchetta culpa aliquip brisket shank est. Pastrami ribeye porchetta cow qui.

== AES-256-CBC-HMAC-SHA1 ==
[˲��H"`��.qv�ail ribeye dolore ut. Pork belly ut porchetta culpa aliquip brisket shank est. Pastrami ribeye porchetta cow qui.


texts: Protection of Elliptic Curve Implementations against side-channel attacks

texts:
Recent fast elliptic curve implementations, for example a presentation at Eurocrypt 2014 (earlier presentation slides, the paper) talks about protection against only timing attacks. Why only timing attacks?

If these methods are implemented in hardware then I think it should have been protected against power attack and fault attack also.


texts: Cut through mode for TLS AES-CBC / SHA ciphersuite

texts:
I am looking at RFC5246 and it seems that AES-CBC/SHA cipher suites cannot be implemented in a cut-through mode.

Let's suppose that received record spans two segments.
As i understood HMAC calculation can be started only after the last byte (pad_length) of second record is decrypted, that requires to buffer both segments comprising a record.

Am I missing something ?


texts: Research question: usefulness of newly discovered symmetric key cryptosystem

texts:
both myself and my collaborators are pure mathematicians with only tangential experience in the study of cryptographic systems, so if this question is unclear or does not belong here, please do let me know.  I apologize for the length of this question, after necessary background my questions appear in the last part.

As previously stated, my collaborators and I are pure mathematicians and over the coming months we will be publishing work on a new class of mathematical system we have discovered (it relates to many different areas in mathematics, the details are not important for the purpose of this question).  One of my collaborators pointed out that certain properties of this system make it ideal for use in cryptography, and indeed upon further analysis this is what we have found.

Using the Alice/Bob/Eve analogy, the basic distinguishing properties of such a cryptographic system are as follows.  Because this is a symmetric key system, Alice and Bob must meet to generate their random key.  Once Alice and Bob wish to send a message, they publicly chose a particular type of mathematical object at random, call it $T$ (the type of mathematical object is not important), and use this along with their key to generate a set of coordinate points that will each uniquely map to a 0 or a 1.

With this, Alice can send Bob a subset of these coordinates (with each coordinate mapping to 0 or 1), and because Bob has the same set of coordinates he can "decrypt" the message of coordinates to obtain the bit string Alice wished to share.

So far this description appears to offer nothing new, and in fact if Alice wishes to only send Bob one message this is equivalent to the one-time pad.  The issue with the one-time pad of course and similar systems is that sending multiple messages with the same key leads to leaks, so for every new message Alice and Bob must use a new key, which of course means sharing the keys in the first place which is difficult.

The unique (we think) property of the cryptosystem offered by this mathematical discovery is that so long as Alice and Bob publicly choose a new particular mathematical object ($T$) to apply their key to before each message sent (of which there is a continuum of choices for $T$), they can use the same initially chosen key to send an arbitrary number of messages, for we can prove that it would be mathematically impossible for Eve to ever determine the key if such a method was used.

In fact, we can also prove that so long as Alice and Bob publicly choose a new $T$ for each message, to Eve each message of coordinates sent between Alice and Bob would random, so no cryptanalysis would work.

Further, one of my collaborators has a (light) background in quantum computing and is highly confident that this system is not susceptible to brute-force attack from quantum computers (much less classical ones).  We also remark that this encryption scheme is highly efficient, and its encryption/decryption time complexity scales linearly with just the size of the secret key chosen (and the complexity of the encryption scales exponentially with the length of encryption key).

My questions are as follows.  Does a cryptosystem exhibiting such properties already exist? Would a cryptosystem exhibiting these properties be of any possible use to the community?  Even if not (ie. analogous systems already exist), should we pursue publishing the method in a journal?  If so, can anyone here recommend any journals, and things to watch out for when publishing in cryptography?

I know I have been incredibly discrete in discussing the details of the mathematical system for I cannot give too much more at the moment, but I hope this information is sufficient for giving general answers to the questions.

Thank you all so much for your time and help.


texts: DDH and pairings are not contradictory in RingCT 2.0?

texts:
As I know DDH assumption and bilinear pairings are contradictory, but I see this in a paper, RingCT 2.0.

How could this be ok? Linkable ring signature will be attacked by bilinear pairings.


texts:
I am trying to understand how to prevent a UKS (unknown key-share) attack, but I am having trouble finding many resources out there to help.

Let's imagine a hypothetical secure messaging application that uses public keys to encrypt messages between any two people trying to communicate. Assume 3 people, $A$, $B$, and $M$, where $M$ is the attacker. My understanding of a UKS attack would be:

$M$ announces his public key as $B$'s public key (instead of his own)
$A$ sends $M$ a message, but $A$ is unaware that he is really encrypting with $B$'s public key
$M$ can't read the message since he doesn't have $B$'s private key, but he forwards it to $B$.
$B$ thinks the message came from $A$ (which it did, technically) except $A$ did not intend for $B$ to see the message (he thought it was going to $M$!)

You could disallow two people from having the same public key in the system, but then you could run into some confusing issues for the user if someone "stole" their public key before they joined.

My question is two-fold:

Are their any other ways to prevent these types of attacks?
What other nefarious things could $M$ do in this scenario? Is it ever practical to alter the ciphertext before sending to $B$ to change the meaning of the message in some way?


texts:
My friend is trying to convince me that his linear hash function (with a few bit operations) is secure. Is there a way to disprove this? (Or prove this, but I've read from multiple sources that this kind of hash is very insecure).

Sources would be greatly appreciated.