texts: Are Anonymity and Authentication possible together?

texts: Anonymity and authentication look to be seemingly contradictory but are both possible together ? I tried reading couple of papers but could not get the big picture. So what are the major approaches tried in solving anonymity preserving authentication ? (Am not really looking for references or recommendations but the solution approaches tried so far, there is not any wikipedia page too to get a summary)


texts:
I am studying Fractal Merkle Tree Traversal algorithm in the book “Post Quantum Cryptography” (PDF). On the [pag. 54] I don't understand this paragraph:

  We may determine the number of pebbles returned at these times by observing that a leaf is returned every single round, a pebble at height
  $ih + 1$ every two rounds, one at height $ih + 2$ every four rounds,
  etc.

Now, please look at Figure 4.1 of “Merkle-Tree Traversal Techniques” (PDF):

In round 1 is true that leaf $n_0$ no longer needed. Now in paragraph says "pebble at height $ih + 1$ every two rounds, ... " then for the second round, in the case of $i = 1$ and $h = 1$, we see that in the height $i*h+1=2$ should have a node that is no longer required. Which would be in this example that node?

Also, can someone explain the meaning of $A$ in the equation on page 55?
$$A+[A/2]+[A/4]+\cdots+[A/2^h] $$


texts: Ed25519 threshold signature verification without knowing the single personal public keys

texts:
I read about ways to create a t-of-n threshold signature, corresponding to a collective public key of n players. (https://tools.ietf.org/html/draft-ford-cfrg-cosi-00 and Does Ed25519 support cryptographic threshold signatures?).

Is it possible to verify a t-of-n signature, by knowing only the collective public key of all n players, and not the personal public keys of the signing (t) players? I.e. the signature can be treated (verified) like a "normal" Ed25519 signature?


texts:
I`m on searching of any method of building system equations for S-boxes.
Firstly, I just cannot undestand exact meaning of "system equations", is it anf for each input (I know how to make it using Sage, maybe someone can help you make it using Magma)?
If not, please, maybe you have any articles or can a little bit describe algorithm.


texts: Multiple XML files and known-plaintext attack

texts:
I have created an app which collects data in sets which may contain up to 20000 XML files of an average size of about 5 KB, and all with the same header and XML structure, so that only the data they contain differ.

For certain reasons I've decided to encrypt these XML files so that the data they contain cannot be exported without my consent. Problem is that the current users of the app already have a lot of unencrypted XML files and after these have been encrypted (they're required to be in order to use future versions of the app) they may still have backups of the unencrypted XML files, which I can't do anything about.

But that also means that they have the means for doing a known plain-text attack, in order to extract the key and thereby have access to also export the content of encrypted XML files added in the future. So I want to ensure that they're encrypted in a way that makes this if not impossible then at least very difficult.

As I understand from reading posts here, AES should be safe against known-plaintext attacks in a case like this, if it's correctly implemented. So I'm trying to encrypt the files using AES. I just want to be sure if I'm doing it correct, and hope someone here can tell me.

I'm using the code listed here:

Simple AES byte encryption and decryption routines in C#

and a 64 byte key with a 32 byte salt/IV. Same key and salt for each file. I've set iterations to 4096 as a higher number will slow things down too much.

I can create a unique key or salt/IV for each file as there is a unique ID connected with each XML file but it will complicate things a lot and in rare cases the ID for a file may change (beyond my control), so I want to avoid it if possible.


texts:
I ran the following Sage script from  A.3. Base Points Section of rfc7748 for Curve25519

def findBasepoint(prime, A):
       F = GF(prime)
       E = EllipticCurve(F, [0, A, 0, 1, 0])

       for uInt in range(1, 1e3):
         u = F(uInt)
         v2 = u^3 + A*u^2 + u
         if not v2.is_square():
           continue
         v = v2.sqrt()
         point = E(u, v)
         pointOrder = point.order()
         if pointOrder > 8 and pointOrder.is_prime():
            Q=u^3 + A*u^2 + u
            return u, Q, sqrt(Q), point

res=findBasepoint(2^255 - 19, 486662)
res

(9, 39420360, 14781619447589544791020593568409986887264606134616475288964881837755586237401, (9 : 14781619447589544791020593568409986887264606134616475288964881837755586237401 : 1))

and got the expected result (from 4.1. Curve25519):

The base point is u = 9, v = 1478161944758954479102059356840998688726
   4606134616475288964881837755586237401.

But now I can't understand how sqrt(39420360) can be such an enormous value. Seems sqrt() is not math.sqrt() here. How did Sage calculate it?


texts: Authentication of machine before installation (to stop piracy)

texts:
I have a web-software project which needs a bit of protection in form of authencitation…

This web based software runs on an intranet. There is no access to the internet from these terminal machines. Nevertheless, I want to stop anybody who copies the (PHP-based) software and tries to run that software on another machine. Simpler said: it should only run in the machine in which it got installed and just stop during authentication-level on any other machine.

I would be grateful to anybody who can suggest me the logic of achieving it.


texts:
Are there any known MD5 hashes that can´t occure, no matter what (finite) input is taken?

Thanks


texts: Plaintext-aware encryption for symmetric schemes?

texts: The notion of plaintext-awareness is well-known for asymmetric encryption, but the notion seems to make sense for symmetric encryption as well. Is this a known concept?


texts: For uniterated SHA-256 of salted password, should the password precede the salt?

texts:
This is a follow-up to this question (thanks to answers from @fgrieu and @kelalaka
) about the format of a salt when hashing a salted password.

I realize this is pretty much academic, as the proposed uniterated SHA-256 of a salted password is already acknowledged to be much less secure than trusted password storage algorithms (scrypt, Argon2, PBKDF2, etc.). And, this may be a very obvious point, but I haven't found anything mentioning it (quite the opposite).

Nevertheless, considering the use of this (ill-advised, but currently available) approach, when concatenating salt & password, if the salt precedes the password, wouldn't that allow an attacker to optimize away the salt when doing a dictionary or brute force attack, and speed up the results?

Here's my thought:  A SHA-256 hash is a left-to-right processing of the source data. While processing the data, the SHA-256 code could be modified to take a snapshot of the intermediate algorithmic values (variables) as the salt is being processed, but just before the first password character is read. This would be done once to collect the values. Then a further modification of the SHA-256 code, which allowed the hash for each try to begin with the intermediate values previously stored. This would allow only the characters of the test passwords to be processed on each try, eliminating the overhead of processing the (presumably 256-bit) salt, but still providing the correct SHA-256 result.

Again, assuming no iterations, and no nested hashing, wouldn't it be better for the password to precede the salt, so that the attacker had to process the salt data to obtain the correct SHA-256 value for every try?


texts: Does a big salt have the same memory effects as Bcrypt?

texts:
Citing Thomas Pornin on the question Why can't one implement bcrypt in Cuda?:

  bcrypt is a variant of the Blowfish key scheduling, which is defined over a table (a few kilobytes) which is constantly accessed and modified throughout the algorithm. Due to the size of the table, each core will have to store it in the GPU main RAM, and they will compete for usage of the memory bus.

In short, it's slow because it uses a relatively big amount of RAM. This is its advantage over PBKDF2, again from Thomas Pornin:

  Bcrypt happens to heavily rely on accesses to a table which is constantly altered throughout the algorithm execution. This is very fast on a PC, much less so on a GPU, where memory is shared and all cores compete for control of the internal memory bus. Thus, the boost that an attacker can get from using GPU is quite reduced, compared to what the attacker gets with PBKDF2 or similar designs.

As far as my understanding goes, this means both PBKDF2 and Bcrypt's password hashing features can be summarized as:

function password_hash(password, iterations, memoryUsage) {
  salt = system("cat /dev/urandom | head -c " + memoryUsage);

  for i = 0 to iterations {
    # hash() is a function like SHA256
    password = hash(password + salt);
  }

  return salt + "," + password
}

# 1 million iterations; 8KiB memory usage
password_hash("letmein", 1000 * 1000, 1024 * 8);

(Where + is concatenation.) Basically this does iterated hashing with a big salt.

I know PBKDF2 can output arbitrary key sizes for e.g. block cipher encryption purposes. I also know Bcrypt accepts iterations in the form of a log number, which makes more sense. And I've considered using HMACs instead of just hash(), but I don't see how this could be exploited, especially since we're not in the message authentication business here. So in general, isn't this equivalent to what Bcrypt and PBKDF2 do in terms of password storage security?

I've commented basically the same question on the post which I linked earlier, but didn't understand the answer, and perhaps it's better as a new question anyway.

Another question I've found is very specific for SHA3; and another once again reiterates that "bcrypt needs more RAM than PBKDF2 and is thus slower on GPUs" (once again from Thomas Pornin).

Disregarding the bigger storage required to store all those huge salts, and ignoring algorithms like Scrypt and Argon2 which use even more memory but without the additional storage requirements, the only reason I see for not wanting to do this is "you shouldn't be designing your own crypto anyway." Is that correct?


texts: Sending KCV (key check value) with cipher text

texts:
I was wondering why it is not more common to send the KCV of a secret key together with the cipher text. I see many systems that send cipher text and properly prepend the IV to e.g. a CBC mode encryption. Wouldn't it be easier to prepend another  bytes with the KCV together with it? A good block cipher should not be vulnerable to known plain text, so I personally don't see any issue with sending the KCV.

It would of course be less efficient, but the upside is that you can distinquish with some certainty between using the wrong key and a general decryption failure. I say "some" certainty because if the first [blocksize] bytes are (too) garbled, then the compare would obviously fail. That said, it's unlikely that an single block, ECB mode encrypt of [blocksize] bytes would go wrong in any way.

PS The cryptoki standards only use the first three bytes of the KCV, but I think that this is mostly a convenience, and only partly a security measure (against brute force)?


texts: RSA, proof of correct work, if p is not a prime number

texts:
Is there any proof of correct work of RSA algorithm, if p is not a prime number? For example: n = p*q, p = p1*p2, where p1 and p2 are primes.

Edit:
I found that it's called Multiprime RSA, but i didnt find proof of Correctness for it.


texts:
I'm designing a system where my hardware piece uses an ATECC608A to calculate an ECDH shared  secret in order to exchange data with a HSM in the cloud.

For some unknown reason, whenever the first nibble of the shared secret generated by the device is zero, the correspondent shared secret generated by the HSM is shifted 4 bits.

ATECC output :  0D E8 A2 9D 8F .....
HSM output   :  DE 8A 29 D8 FE .....

The HSM never generates a shared secret starting with 0, while the ATECC generates it at a rate statistically compatible with 1:16.

My questions are:

Is it mathematically possible to generate a shared secret starting with 0x0n using ECDH? (My guess is "yes")
Is there any rule or convention  stating that a shared secret should be shifted so that the first nibble shall never be 0?
Since I'm not the guy working on the HSM side, and don't know anything about it. Is it possible that there is some sort of configuration flag enabling or disabling the generation of shared secrets starting with nibble 0?

I don't believe there is a bug in such a widely used device, nor that at least two different software packages running on the HSM (as the HSM guy told me) are also wrong.

Added information: the generated shared secret is 32 bytes long.

Any ideas?

Thank you very much for any help.


texts: Concept for a RSA "repeater". Is it sensible?

texts:
I have been using RSA signed/encrypted mailing a lot recently. Naturally, I wanted to use RSA mailing also on my phone, not only on my computer. However, I feel uneasy having my private key on my phone (what if I lose my phone?). Therefore I have been thinking about a scheme which allows RSA on mobile devices without spoiling the private key.
My setup is the following: I usually read/write emails using Thunderbird with the Enigmail plugin on a Linux based laptop. Since this computer is portable and will not be online at all times, it can not be used to forward decrypted emails to my phone.
You need two pairs of RSA keys, two mail addresses (one might suffice) and a server that you can trust. Your first key pair (the one that you usually use) is then placed on the server, the second key pair is placed on the phone.

The server fetches your mail from the first mail address
The server decrypts your mail with the first key pair
The server encrypts your mail with the second key pair
The server sends the encrypted mail to the second mail address
Your phone fetches the mail from the second mail address
Your phone decrypts the mail with the second key pair

If you want to send an email, it works just the other way around. Encrypt the mail with the second key pair on your phone and send the mail to the first mail address. The server decrypts the mail, encrypts it again with the first key pair and finally sends it to the recipient.
In this way, if your second key gets compromised, all you have to do is to revoke the second key pair.
My questions are:

Is this a sensible protocol?
The downside of this protocol is that you obviously need a server that you can entrust your private key. Since the key transfer is only ever really safe if you transfer them physically and personally, the only real option for this would be a personal server located at a safe place (e.g. raspberryPi at home).

Is there a more elegant solution to this?


texts: Method for Cryptanalysis of a keyword-keyletter cipher?

texts:
I am a CS student who is in an introductory Cryptography course. I am not looking for the complete plaintext of this message, as I am not looking to cheat. I am simply stuck, and have no idea what to do for this part of an assignment. I have attempted frequency analysis and have a link to it below. I have attempted substituting in E, T , trying trigraph THE etc. at the most common points but have not been able to deduce anything. To my knowledge there is no easy way to brute force this as I would have to try every keyword (170k words in the english language) at every position in the alphabet (42). Its possible, but crazy inefficient.

We are instructed to launch a ciphertext-only attack on the given ciphertext. Our alphabet is 42 characters: 26 upper case English letters,10 digits, and 6 punctuation signs including "," (comma), "." (period), " (whitespace)", ";", ":", "!". This keyword cipher involves this.

So far in the class I have cracked an affine cipher and Vignere using the Kasiski method. I have also done a couple other coding projects. I have been searching for hours on ways to potentially tackle this variant of the keyword cipher but I am at an utter loss. I am not seeking someone to decode the ciphertext but rather provide a potential method for me to tackle this or lead me in the right direction. Partial decryption is fine, but I really want to solve this on my own. I am trying to find the keyword, but ultimately I just have to decrypt this. If I can somehow do that without finding out the keyword that is a viable method. Our textbook thoroughly covered decryption methods for other ciphers, but doesnt have a description on how to tackle this at all beyond frequency analysis which I have been unsuccessful at.

Here is the ciphertext

Here is what I have done so far (Includes frequency analysis)


texts: can half of an encrypted photo be decrypted with the key?

texts:
if we have like some part of the encrypted picture,is it there any way that the picture can be decrypted. is there any specific algorithm that allows this. like can from 60 per cent of the encrypted picture, can we build it up to determone the actual picture
we also has access to the key. we know the algorithm. our purpose is to convert yhe 60 percent of cipher to image  form


texts: How can I determine key length for message encrypted by many-time-pad?

texts: For message $ m $ and key $ k $ I get encrypted message $ c $ ($ m \oplus k = c $) where $ length(k) < length(m) $. Additionally I know that message $ m $ is English text. Instead of using pure brute force method, I want to narrow possible keys, by estimating key length using language pattern like “relative frequencies ordered by frequency” Letter frequency. So for example, for key with length 3, I should get three sets: $ \{c_0, c_{0+3}, c_{0+6}, …\}; \{c_1, c_{1+3}, c_{1+6}, …\}; \{c_2, c_{2+3}, c_{2+6}, …\} $, and each of this sets should somehow be compared with relative frequencies pattern. What is the best method (statistical?) to compare this sets with pattern, and final score for each key length, with scores for other keys length?


texts:
I have just advanced to the last grade of high school (in Denmark). In this year, we all get to do one big project, where we can build/invent/create whatever we want to "solve a problem". As I study Math, IT and electronics, I would like to build something where all these 3 subjects are included. I have thought about a project for a long time, but I don't really know about how much cryptography is applied in companies, so I would like your guidance before I start working for almost a year on it.

Many big companies use enciphering algorithms to protect any third-party companies/hackers to get access to sensitive data, however, not all the algorithms are safe and easy to use. I have been thinking about this problem for a long time now, especially because I love C#, cryptography and electronics, and making a product related to this subject would be very interesting.
(This school project is "just" a school project. We don't really sell our products anyhow when we have finished them, but it will get higher ratings if it really is useful).

I have though about making a Hardware Random Number Generator connected with a program, which will XOR the file and keyfile together.
I have thought about making a simple circuit like this one, using white-noise from an NPN transistor and/or an FM radio antenna tuned to unused frequencies. I would then collect these random output bits and send them to an Arduino (An open source electronics platform), which helps us send it through to a computer via USB. I will then program a C# application that would extract the random bits from the ARDUINO and XOR it with a file that we want to encrypt (One Time Pad).

My questions are (if you assume that I started a company selling our product):

Would it be useful for companies who need to keep their data safe?
Would the files encrypted with our "product" be safe?
I am aware of many other portable HRNG (List can be found here), however none of them seem to come with a program where they can be used. Most of them seed the linux dev/random. Can we "outperform" their product? (assuming size and transfer speed is the same, and I calculated the price to be roughly 65 US dollars).
Any idea how to improve my product? What should I do different?

I hope you can answer my questions and feedback my plans for my project.
Thank you in advance for any help you can provide!


texts: Security of a lightweight heartbeat protocol

texts:
I am implementing a heartbeat protocol so that a server can send notifications to clients. The notifications are not occurring so often, so I don't want to keep an open TCP+TLS session for each client, since the overhead would be too high.
Likewise, I don't want to use DTLS heartbeat (see RFC 6520), since I don't need a payload (and the heartbleed attack makes me think that common implementations are not mature enough).

I thought of the following protocol :

First, the client contacts the server over TCP+TLS, and they agree upon an ephemeral key $K$ and a sequence number $S$. The server also attributes an ephemeral session id $Id$ to the client (for faster lookup later). The TCP connection is then closed.
Second, the client sends heartbeat messages over UDP, containing $Id || E_K(padding || S)$, where $E$ is a block cipher (e.g. AES), $padding$ is enough zeros so that $padding || S$ has the length of a block, and the sequence number $S$ is increasing between two messages (to avoid replay attacks). Likewise, the server sends $E_K(padding||status||S)$, where $status$ is a bit indicating if a notification is available.
If no message is received after some timeout (a few minutes), the server removes the heartbeat session. Also, the session is timed-out after 1 day.

The role of the padding is to ensure that the peer knows the key $K$ (i.e. an attacker should not be able to forge ciphertexts with a valid padding). For example, $S$ could be a $32$-bit number and $padding$ would be $128 - 32 - 1 = 95$ bits (from server to client) if $E$ is AES128.

I am aware that an active attacker (or simply network congestion) can prevent packets from arriving, but apart from that is the scheme secure ? In particular :

Is it possible for an attacker to forge a packet with the correct padding (by only seeing the heartbeat packets) ?
Is it OK to pad with zeros or is does it induce some weakness ?
Likewise, can I use deterministic sequence numbers, starting e.g. at $S = 0$ ?
Is the $95$-bit padding long enough (given that the session only lasts a day) ? I could use AES256, but the key is longer, which implies more memory per client on server size. Alternatively, I thought of sending $S$ in clear in the message (i.e. $Id || S || E_K(padding || S)$), which should increase the complexity of a forgery.
Is there something else I missed ? Is there a means to improve the protocol in terms of performance ?

Note : the $Id$ that I mentioned would contain $E_k(padding || i)$ with $k$ a key only known of the server and $i$ the index of the client in the table of sessions. This is mainly for performance to avoid using a hash table on the client's IP address and UDP port, and to avoid an attacker to forge valid $Id$s (which could be the basis of a DoS attack with useless lookups in the server's memory).
Is this $Id$ implementation secure ?


texts:
I am doing project k-nearest neighbor classification over semantically secure encrypted relational data I have doubt for in smin algorithm in

1)Li ← Wi ∗ Φir′; ri′ ∈R ZN

this line it the out put is

original output
r
r
1
r
r
r

my output
-1
-1
1
r
r
r
please help how to get this output
hint:
After this, P1 computes L by combining Φ and W.
More precisely, P1 computes Li = Wi ∗ Φ
r
′
i
i
, where
r
′
i
is a random number in ZN . The observation here
is if ∃ an index j such that Φj = Epk(0), denoting
the first flip in the bits of u and v, then Wj stores
the corresponding desired information, i.e., whether
uj > vj or vj > uj in encrypted form


texts: Isn't the use of public key encryption a redundant step in Encrypting File System, which doesn't improve the security of the File Encryption Key?

texts:
With EFS, we know that a symmetric key, File Encryption Key (FEK), is used for encrypting files. The FEK is then protected by encrypting it with the public key of the user that can be recovered by decrypting with their corresponding private key.
The private key is again encrypted with the user's log-in password. My argument is, if the FEK is ultimately being protected using the user's log-in password, then the use of public key encryption is a redundant step which doesn't improve the security of the File Encryption Key (FEK) at all. Am I right or I'm missing a point?


texts:
I tried to understand some crypto text but I am new to this.

Does this:

  Let $X,X'$ be $\ell$-bit values, and $\Delta X=X\oplus X'$

means that $X$ and $X'$ have $\ell$ bits and $\Delta X=X-X'$ or something else


texts: 4th Root of RSA Modulus Attack algorithm

texts:
I am trying to solve here a task but I have no clue on how to approach it. The last few days I tried to find a way but I have no clue :( Maybe someone of you could give me a hint on how to do it.

The following assumption is given: $p-q=O(\sqrt[4]{N})$

Using the given assumption I have to show that it is possible to retrieve $p$ and $q$ in time $\tilde{O}(1)=poly(logN)*1$.

The following hint is given: $N=pq=(\frac{p+q}{2})^2 - (\frac{p-q}{2})^2$, whereby I should first show that $\frac{p+q}{2}\ge\sqrt{N}$. For the proof I can assume that $p-q=2\sqrt{2}\sqrt[4]{N}$.

I am clueless. I tried first to show $\frac{p+q}{2}\ge\sqrt{N}$ but I am wondering on how to get the $\ge$. I tried to solve the hint with by replacing $p-q$ with $2\sqrt{2}\sqrt[4]{N}$ and try to get a solution. All I get is:

$N=pq=(\frac{p+q}{2})^2 - (\frac{p-q}{2})^2$

$N=pq=(\frac{p+q}{2})^2 - (\frac{2\sqrt{2}\sqrt[4]{N}}{2})^2$

$N=pq=(\frac{p+q}{2})^2 - 2\sqrt{N}$

I don't see how this could help me.
Thank you for every hint.

Thanks guys for the hints. Here is the first prove:

$0 \ge -(\frac{p-q}{2})^2$

$(\frac{p+q}{2})^2 \ge (\frac{p+q}{2})^2 - (\frac{p-q}{2})^2$

$ (\frac{p+q}{2})^2 \ge N$

$ \frac{p+q}{2} \ge \sqrt{N}$

It hope it's all correct and I did not mistype sth. I will see if I am able to figure out the next step :)


texts:
(I realize this is yet another Argon2 "how do I configure" question, but the existing questions I've found don't really help. If I've missed one, happy to have this closed).
Deploying Argon2 (with the Argon2id variant) into a server environment to hash passwords and process site logins - the question we're grappling with is "how much memory to allocate". Now, I'm aware it's "as much as practically possible" but I haven't found any guidance on a lower limit (e.g., something that says something like "below 16MB it's not worth it").
This question suggests 32MB is good enough for most applications, and this one suggests '0.75 * (memory/users)' as a guideline, but not sure if this is reasonable?
Obviously, as iterations can be tuned upwards, we can maintain hardness in that dimension, but at what lower limit of memory would be considered "bad" or at least "not good" for Argon2? If this is pure to help avoid cache hits in a GPU then this would suggest allocations as low as 16MB may be okay, but am I missing something? If it's a case of "16MB okay, 32MB recommended, above 48MB there's nothing gained anything at the current state-of-the-art" that's also fine. I've seen people talk about 1GB allocations - this almost seems overkill?


texts: Keys: Is This Way of Encryption Already Invented?

texts:
I've invented a way of encryption where there are keys which represent a certain cipher alphabet, whether it be a scrambled alphabet, shifted alphabets, numbers or symbols/pictographs.

For example, a letter R with the number 2 above it equals E in Rot13 but, and R with a 1 above it is I in Atbash.

Is this method already invented?


texts: How is McEliece chosen plaintext secure?

texts:
Suppose a challenger creates a McEliece encryption system where there is a public key consisting of a matrix $G$ representing some linear code, and a number $t$ for the number of errors.

Then the adversary takes two messages $m_0$ and $m_1$ and uses the public key matrix $G$ to find $c_0=Gm_0$ and $c_1=Gm_1$. Then the adversary sends $m_0$ and $m_1$ to the challenger.

Then the challenger picks $b$ at random and creates $c=Gm_b+e$, and $e$ has at most $t$ errors. Then they send $c$ to the adversary. The adversary calculates:
$$e_0=c-c_0=Gm_b+e-Gm_0=G(m_b-m_0)+e$$
$$e_1=c-c_1=Gm_b+e-Gm_1=G(m_b-m_1)+e$$
Since $m_b$ is one of the two messages, then either $e_0=e$ or $e_1=e$. The adversary knows when this happens because $e$ has $t$ or fewer non-zero terms. Further, the other $e_i$ will consist of a non-zero codeword plus the error. Since the minimum distance of the code is greater than or equal to $2t+1$, then this codeword will have at least $2t+1$ non-zero terms; when $e$ is subtracted from this, there will be at least $t+1$ non-zero terms, so the adversary is sure that this was not the message. Hence, the adversary has a 100% chance of correctly guessing $b$.

Does this attack work? Is there some other aspect to the McEliece system that I don't know about that stops this attack?


texts:
In the abstract of The Exact PRF-Security of NMAC and HMAC, Gazi, Pietrzak, and Rybar state:

NMAC was introduced by Bellare, Canetti and Krawczyk [Crypto’96], who proved it to be a secure
pseudorandom function (PRF), and thus also a MAC, assuming that (1) f is a PRF and (2) the function we get when cascading f is weakly collision-resistant. Unfortunately, HMAC is typically instantiated with cryptographic hash functions like MD5 or SHA-1 for which (2) has been found to be wrong.

This implies that HMAC-SHA1 and HMAC-MD5 are not PRFs. However, I'm not sure whether SHA-2 (particularly, SHA-256) is considered to satisfy (2) from their abstract, and thus whether HMAC-SHA2 (particularly, HMAC-SHA256) is a PRF. I'm further confused by result from Bellare, 2006 which seems to contract the more recent paper by proving that collision resistance of the underlying function is not necessary in order for an HMAC to be a PRF.


texts: How does one measure the decrease in security, if any, of RC4 when mapping to a specific range of values?

texts:
For a project using RC4, the output is to be mapped to values of 0 to 35.  Thus, only 36 unique output values representing the letters A to Z and 0 to 9.

To avoid bias, the RC4 byte output (with a range of 0 to 255) is discarded if the value is greater than 251.  The output is then mod 36, which then maps the output into the range of 0 to 35.

Does this effectively reduce the strength of RC4 by taking this mapping step, or does the security remain unchanged?  How does one measure the amount of decrease in the security?  Does it relate to the loss of the values 252, 253, 254 and 255?  Or, would it also be a factor of doing the mod 36 step because of reducing the possible output values to 1/7th of the original.

Thanks!


texts:
Is there any reference to check the list of encryption & signing algorithms which are compliant to FIPS 140-2. After an exhaustive search I could find only "AES".

Any suggestions would be much appreciated.


texts: How long does it take to crack RSA 1024 with a PC?

texts:
Using an Intel Core i5 CPU, how long does it take to crack RSA using a key size of 1024 bit (generated using a secure key pair generation function)?

Suppose for instance that we have thousands of zombies or a big network of computers. To calculate all the combinations or possibilities, can we distribute the process through a big network of computers?


texts: Why do we use hex output for hash functions?

texts:
Why do we use hex representation as default for the output of a hash functions result?

For example the sha256 hash function: the output of sha256 in hex representation uses 64 characters, while using base64 on the raw output produces 44 characters.

Demo:

<?php
$password = "password";
$sha256 = hash('sha256',$password);
echo 'sha256('.strlen($sha256).'): '.$sha256.'
';

$sha256Base64 = base64_encode(hash('sha256',$password,true));
echo 'sha256('.strlen($sha256Base64).'): '.$sha256Base64.'
';

Output:

sha256(64): 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
sha256(44): XohImNooBHFR0OVvjcYpJ3NgPQ1qq73WKhHvch0VQtg=


texts:
How would you go about solving basic custom made ciphers - e.g. one generated from this website http://www.wikihow.com/Write-a-Custom-Cipher-Carefully?

This is solving it without knowing the method of the cipher beforehand.


texts: Has anyone seen a stream cipher being used for FDE

texts:
So I am a newbie to this. Has anyone experimented implementing a stream cipher for full disk encryption?

EDIT

With the caveats that come with using a stream cipher over a block cipher of course! I am thinking in the context of mobile storage. I keep reading about these block ciphers but never stream ciphers.


texts: Zero-knowledge proof for subset sum problem?

texts:
What is the currently most efficient (interactive) zero knowledge proof/argument for the subset sum problem?

The most recent relevant paper I have found is Efficient Modular NIZK Arguments from Shift and Product - Prastudy Fauzi, Helger Lipmaa, Bingsheng Zhang, but it considers NIZKs and is quite involved.

I assume there are more efficient interactive protocols?


texts:
I know this sounds too broad. But I noticed that there was a chapter on chaotic crypto in the recent Handbook of Information and Communication Security
Editors: Stavroulakis, Peter, Stamp, Mark (Eds.) by Springer. Sorry about the paywall, the text has all the usual chapters you'd expect, in addition to chaotic encryption.

http://www.springer.com/gp/book/9783642041167

Here's a synopsis of the chapter actually entitled "chaos-based information security" authored by Jerzy Pejaś and Adrian Skrobek

6.1 Chaos Versus Cryptography
6.2 Paradigms to Design Chaos-Based Cryptosystems
6.3 Analog Chaos-BasedCryptosystems
6.3.1 Additive ChaosMasking
6.3.2 Chaotic Switching
6.3.3 ParameterModulation
6.3.4 HybridMessage-Embedding
6.4 DigitalChaos-BasedCryptosystems
6.4.1 State of the Art
6.4.2 Notes About the Key
6.5 Introduction to ChaosTheory
6.5.1 Basic Information for Dynamic Systems
6.5.2 Some Examples of ChaoticMaps
6.5.3 Applying Chaotic Systems to the Environment of Finite-Precision Computations
6.6 Chaos-Based Stream Ciphers
6.6.1 A Model of Chaos-Based Stream Cipher
6.6.2 Analysis of Selected Chaos-Based Stream Ciphers
6.7 Chaos-Based Block Ciphers
6.7.1 A Model of a Chaos-Based Block Cipher
6.7.2 Discretization of Chaotic Maps to Invertible Maps
6.7.3 Analysis of Selected Chaos-Based Block Ciphers
6.8 Conclusions and Further Reading

Does anyone here have any opinions on why/why not chaotic encryption is secure?

Why anyone would bother, given the hoops one seems forced to jump thrugh to get it working on finite precision systems, unlike finite field and number theory based classical cryptosystems?

FWIW, some of the other chapters are authored by recognised names in the traditional cryptography community.


texts: On a proposition in NTRU original paper: $\gamma_1 |f|_2 |g|_2 \leq |f \circledast g|_\infty \leq \gamma_2 |f|_2 |g|_2$

texts:
In the original paper of NTRU cryptosystem, we have the following proposition (that is said to be suggested by Don Coppersmith):

  For any $\epsilon > 0$, there are constants $\gamma_1,\gamma_2 > 0$, depending on $\epsilon$ and $N$, such that, for randomly chosen polynomials $f,g \in R$, the probability that they satisfy
  \begin{align*}
\gamma_1 |f|_2 |g|_2 \leq |f \circledast g|_\infty \leq \gamma_2 |f|_2 |g|_2
\end{align*}
  is greater than $1-\epsilon$.

However, it lacks of a proof (we only can see experimental evidences).

The paper (and many others found) says that is a proposition, so:

Where can I find a proof of this?


texts: How to caculate the summation of successive modular inverses?

texts:
$p$ is a big prime. $p>2^{2048}$.
So how to caculate the summation of successive modular inverses over $p$?
$$
\sum_{i=1}^{\frac{p+1}{2}-1}{i^{-1}}\pmod p
$$
As to $p$ is a big prime, it's impossible to caculate the modular inverses one by one and sum them at last.
I found someone give a formula which approximates the result, but I couldn't prove it.
$$
p - \frac{2^{p}\pmod {p^2}-1}{p} \pmod p
$$
Can you help me prove the formula, or give your answers to calculate the summation? Thanks sincerely!


texts: Is cryptographic function used in MAC/HMAC public knowledge?

texts:
I would like to store password digests in structure that contains information how digest were generated; There will be concatenated these three values:

{Name} of hashing functions used for computing HMAC (e.g. SHA256)
{Salt} - randon 32 bytes of key data
{Digest} - derived digest from {Salt} and cryptographic function {Name}

As divider I would like to use "$" (U+0024, DOLLAR SIGN) and encode it into Base64, this encoded value I would like to store in database.

Something like this:

SHA256${...salt data...}${...digest data...}

Reason why to store hashing function name is because backward / forward compatibility (authenticating).

Question - is information about hash function in this structure a security vulnerability? Is hashing function public knowledge?


texts: I am doing probabilistic decryption, I was given that A and E had the highest frequency count in the plain text. H and X have the highest frequency in the encrypted text. So in solving for a and b I got a=4 and b=7, but that a won't work because there is no inverse of 4 in mod 26 (which I need for the decryption parameters) What can I do from here?


texts: TLS 1.3: the key_share in a ClientHello after a HelloRetryRequest

texts:
In TLS 1.3 draft-21, if there is a ClientHello with a key_share, say, $(G_1, g^x)$, the server can send a HelloRetryRequest to request a new key_share value, e.g. ($G_2, g^y)$.

My questions are:

When the client send the second ClientHello, does it replace the old key_share with the new one? i.e, does the new key_share in the second ClientHello becomes $(G_2, g^x)$ or becomes $[(G_1, g^x), (G_2, g^y)]$?
When the server ask for a new key_share in the HelloRetryRequest, does it send its public value with $(G_2, g^y)$ it or just the Group $(G_2)$?
What does the key_share contain? it is confusing. In some cases I get the impression it is the group and the public-key $(G_1, g^x)$, in others, like in the HelloRetryRequest, I get the impression it is only the group $(G_2)$.

Need more clarification on what is supposed to be sent in the key_share in both: ClientHello, HelloRetryRequest, and the second ClientHello after the HelloRetryRequest.


texts: Viability of using One-Time-Pad + HMAC in low-volume IoT communications

texts:
In the Internet-of-Things world there are certain applications that produce very low volume communications. For example reading a water meter once every hour comes to mind. If the reading could be encoded as a 32 bit unsigned integer and adding a 24 bit serial number this device would transmit only about 614 KBytes of data over an assumed life-time of 10 years (7 bytes * 24 hours * 365 days * 10 years).

I'd like to put for discussion whether a One-Time-Pad (OTP) solution plus HMAC could be a viable solution in this scenario. A key stream of 614 KBytes could be easily pre-generated and stored on the device, although a Hardware Security Module (HSM) implementing "OTP + HMAC" probably does not yet exist.

I am aware of the core problems of using One-Time-Pads in practice. Assuming that these challenges could be overcome (at least in a manner that is sufficiently secure for the purpose of transmitting water meter readings once every hour) the following pseudo-code explains the approach.

# KEYSTREAM is a file containing at least 614 KBytes of random bytes.
# COUNTER is the current offset into KEYSTREAM.
function encrypt_and_hmac(plaintext):
    fp = open(KEYSTREAM)
    fp.seek(COUNTER)

    # Remember the current offset into the KEYSTREAM
    pos = fp.pos()

    # Read bytes from KEYSTREAM for encrypting the plaintext
    cipherpad = fp.read(len(plaintext))
    ciphertext = plaintext XOR cipherpad

    # Read 8 bytes (in this example) from KEYSTREAM for HMAC
    macpad = fp.read(8)
    hmac = hash(ciphertext + macpad)

    # Safely(!) erase the used bytes from the KEYSTRAM
    erase(KEYSTREAM, pos, pos+len(plaintext)+8)

    return pos, ciphertext, hmac

The current offset into the key stream (pos), the ciphertext and HMAC can now be transmitted. Decryption and verification would work like this.

function decrypt_and_verify(pos, ciphertext, hmac):
    fp = open(KEYSTREAM)
    fp.seek(pos)

    cipherpad = fp.read(len(plaintext))

    macpad = fp.read(8)
    assert hash(ciphertext + macpad) == hmac

    plaintext = ciphertext XOR cipherpad

    return plaintext

Just to preempt some potential comments:

Yes, AES-EAX and the like may be a better solution.
The challenge of safely distributing the KEYSTREAM is no different from using any other shared secret unless a Key-Exchange Protocol is used.
Ideally the Encrypt-and-HMAC should be done inside an HSM module or the security could be easily compromised if someone gains access to the water meter.
Having a small number of compromised water meters may be an acceptable business risk akin to water meters that are simply faulty. This would eliminate the cost of the HSM module.
An interesting challenge arises if the payload size of the transmission channel is very small like in Sigfox (12 bytes) and the smaller packet size options of LoRaWan and Weightless. Could one transmit only the first few bytes
of the HMAC???

I am looking forward to your comments, feedback and criticism.


texts: Can cryptography be used to hide routing information from the router?

texts:
If Alice wants to talk to Bob and she has to involve a third party system run by Carol to establish, and possibly maintain, communications, then Carol knows that Alice and Bob communicated with each other.

Chuck sneaks into Carol's exchange, and now knows that Alice and Bob are talking to each other.

Carol decides to start a new exchange with new technology, with the primary purpose of never knowing who is talking to who, and she needs to figure out how to do this.

If Carol runs an exchange that is unlimited communications (meaning no per-transaction billing) then she has no business need to know who talked to who, or for how long, as long as both ends are authenticated to her servers.

So the question is:

Is there a way for Carol to design her new network/exchange/endpoints so that her equipment can route and connect two individuals on that service without knowing who is talking to who?

Obviously the service would need to be handling a lot of traffic, and the traffic would need small random delays so you couldn't simply watch the time that Alice puts in a request to the time another request is output and assume that's her outgoing connection.

But I still don't see a way to handle the actual routing and call connection in a way that prevents anyone from seeing who is communicating to whom.

I'm wondering if there's some cryptographic principle or method that might help with this.  So far all my attempts result in one point in the process where both the sender and recipient are known.


texts: What is the best way to prove that you wrote the encrypted message on a piece of paper? As most of us know, many conspirators have died because of false message implants, Mary Queen of Scots, for example.


texts: Example of partial homomorphic encryption over $\mathbb{F}_{2^k}$?

texts:
I'm looking for a partial additive homomorphic encryption over $\mathbb{F}_{2^k}$.

I know that, I can take an additive homomorphic encryption over $\mathbb{F}_2$ and just concatenate each bit that we encrypted.
(as suggested at :Additive homomorphic encryption over small fields)

But it seems very inefficiently, when  $k$ is not a constant.

All the other encryption schemes that I saw work over $Z_{pq}^*$ and some variants.

Thanks.


texts: How to derive a symmetric key from ECDH shared secret?

texts:
I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to input the x-coordinate of the shared point which is a bignum to a hashing function. The curve is secp521r1 so the shared x-coordinate is of size 66 bytes.

Question 1

What format must the x-coordinate bignum be converted to before hashing it? The other party is openssl.

Is something like below sufficient...

...
print_hex(hash_input_buffer, shared_x_coordinate_bignum_bytes, 66);
...

void print_hex(unsigned char* to, unsigned char* from, int len)
{
    for (int i = 0; i < len; ++i)
    {
        sprintf((char*)to + (i * 2), "%02x", from[i]);
    }
}

OR

sprintf(hash_input_buffer, "%64x", shared_x_coordinate_bignum_bytes);

Question 2

If the hashing function is SHA-512 and I want to derive an AES-256 key from it, should I just take the first 32 bytes of the 64 byte hash output?


texts: WebCrypto: Importing rsa key by crypto.subtle.importKey(...)

texts:
I generated rsa key by jsbn:

{
  "e": "10001",
  "n": "74a258004dd6c338b27688c1dd13d90da3269321d6dfa3cd8d7cfd7521453d0c5a9828bd507cfc6fe004ddcc09c498d2ceea8e05c214a63ab99d33c9060236f02d5f8bd1e7b334c7f74745948664aeba1a5addf7e7d76911ebf382852aabe86e06f83e0f7669be172380069547f542d8b0848b8bcf53e57c04d5e4163820ced3e4078418efe98df9f8c54c0cda66db3262f20b81464162c44216ca8b63c8f0cfe090dfe1d1950428ad6948204f3f44ba0648de44a9c44d44b91bd8f9ff7cccaceb9f20204f3ba1e228f13249fe04a7fc69cfe57d35e8897e16bc7872f585c909fec9b95a5240ab6589c3ebbe3ad614bfbdc966218daf9d9dddb39fdf6c0d3b49",
  ...}

And I want to import it by crypto.subtle.importKey.

This is the error that I find:

  DOMException: The JWK member "n" could not be base64url decoded or contained padding

Does anybody know where is the problem?

Look at the my code below.

var keyData = {
    kty: 'RSA',
    e: hexToBase64(rsaJson.e),
    n: hexToBase64(rsaJson.n),
    alg: 'RSA-OAEP-256',
    ext: true
};

var algo = {
    name: 'RSA-OAEP',
    hash: {name: 'SHA-256'}
};

var importedKey = crypto.subtle.importKey('jwk', keyData, algo, false, ['encrypt']).catch(function(err) {
         console.log(err);
     });


texts: Can passwords be stored securely so that a similarity comparison can be made?

texts:
On the Pro Webmasters StackExchange site, someone asked a question about a webapp (in this case cPanel) that refused to allow a password change because it was too similar to a previous password. I suggested that the app might be storing hashes of portions of the password.

I was going to ask whether, assuming that an app is storing hashes of portions of a password (i.e. substrings of the full password string), would doing so be less secure than just storing a single hash, but after typing out the question, I realize that it definitely would be less secure. In the most extreme case, i.e. storing a 'hash' of ever character in the full password string, an attacker could trivially recover the original password.

Is there a way to store a password securely that still allows similarity comparisons to be made?


texts:
Here is an image hidding some information.
I need to discover, what is the hidden text.

I tried to interpret this as 27 letter alphabet(with space) in columns, tried this with Ceasar cipher.
No meaningfull English word has occured.

Does somebody have an idea what else can I try?


texts: When would you increment a nonce and when not?

texts:
K is the shared key for encryption known by _Alice and _Bob. $N_A$ is a nonce created by Alice. The function f is the increment by 1 function.
(1) Alice -> Bob: $E_K(N_A)$
So Alice encrypts a nonce with the shared key and sends it to Bob.
(2) Bob -> Alice: $E_K(f(N_A))$
Bob receives it, I think first he needs to decrypt it, then increment it by 1, encrypts it again and then send it back to Alice.
The question is now, when and why would you use this use-case? What could be the scenario for these two steps?
I have seen these two steps for example in the Needham–Schroeder protocol, but I did not understand why they need these two.
My only idea is that Bob authenticates himself to Alice, because if Alice later decrypts it, Alice will see whether Bob was able to decrypt it. But why would you need to increment the nonce?

UPDATE: As my idea seems to be right according to otus, I have to ask for another use-case I've seen:
(1) Alice -> Bob: $N_A$
Alice sends the plain nonce to Bob.
(2) Bob -> Alice: $E_K(N_A)$
Bob encrypts it with the shared key and sends it back to Alice.
For this second use-case I was pretty sure that my idea for the first use-case would be right -> Just to authenticate Bob. So I thought the use-case with the increment function is for something else.
So are these two use-cases for the same purpose? Just to authenticate Bob to Alice? What is the difference between them? When would you apply which of these two and why?


texts: Modulus for elliptic curve point multiplication

texts: I want to implement a point multiplication ($k \cdot P$) operation on FPGA. I have a BN curve $y^2=x^3+2$, and a scalar value $k$. The $x$ and $y$ coordinates of point $P$ are of 256 bits. In the double and add formulas, there are three main operations: addition, multiplication, and division. Each of these are mod operations (e.g, $a+b \mod m$). What should be the value of this $m$? Could it be the reduction polynomial (remember that I am working in a prime field) or some constant integer value?


texts:
Does checking sig with DSA implies both that the sender is verified , and the msg is original without change of any bit?
(case i dont have a reference HASH for that file, only public key)


texts:
In the 51% attack on the Proof Of Work Consensus Mechanism, it's often said that you need more hashing power than the rest of the network combined. Though I can't understand why you need that much.

If we break the blockchain network down in Alice, Bob, Charlie and Eve, and they all currently are honest. They all have 1/4 of the total hashing power. From what I understand, they all compete against eachother to calculate the right hash of a block, and the one winning the race gets its block on the blockchain. This happens one time each 10 minutes. Since they're all competing, the hash-power used to create a block in 10 minutes, is 1/4 of the total hashing power.

Now eve decides to go rogue, and builds her own blockchain. The difference is now, that she don't compete with anyone. That means that she can generate a block every 10 minutes (ish) on her private blockchain, keeping up to speed with the rest of the network. Having just a bit more power, she can then build blocks faster than Alice, Bob and Charlie combined, since they are "competing". At some point Eve's blockchain grows larger than the others, and she broadcasts it, and Alice, Bob and Charlie will per the rules switch to Eve's blockchain.

In this scenario the network was compromised by only using 25%(+1) of the hashing power. So why would Eve need 51%? Doesn't she just need to be faster than the fastest honest miner?

Hope you can tell me why I'm wrong.


texts: Would it be possible to negotiate a key of 128 or 256 bits strength using Merkle puzzles?

texts:
One can be fascinated by the simplicity of the schemes created by Ralf Merkle; like the Merkle tree or his key negociation protocol over an insecure channel.

Wikipedia has some material on "Merkle puzzles"
(wikipedia_page)
and his seminal paper can be found online
(article_pdf).

But, could this venerable construction be put to use in order
to reach nowadays security strength requirements (i.e. a key
of at least 128 bits strength, or even 256 bits for the real paranoids out there).

Thanks!


texts: Why can't current quantum computers break RSA?

texts:
We have quantum computers and we also have Shor's algorithm. So:

Why isn't RSA cracked yet?
What are the current quantum computers lacking?


texts: Are all binary-additive stream ciphers reciprocal?

texts:
I'm writing a thesis focused on Maurer's provably-secure stream cipher. Long story short, this cipher works by expanding a short key into a long keystream and then XORring this keystream with the plaintext in order to obtain the ciphertext (and vicecersa).

Take this definition of a binary-additive stream cipher: a cipher where the plaintext, ciphertext and keystream are binary strings and where the ciphertext is produced as a XOR addition of the plaintext and the keystream.

Also, take this definition of a reciprocal cipher: a cipher in which the encryption and decryption algorithms are identical (they're the same involution).

With these two definitions, can I state that binary-additive stream ciphers are all reciprocal ciphers? I think so, since if the ciphertext is the XOR of plaintext and keystream, than the plaintext must be the XOR of the keystream and the ciphertext.


texts:
While reading specsheets for NXP processors (example mention in this PDF) the other day I saw the mention of the Indexed Code Book mode (ICB) for their AES acceleration hardware - the only mode they claim side-channel resistance for.
However, my search attempts have failed me and I could not identify a definition of this mode.
So, how is Indexed Code Book Mode defined?
I also found a related (?) LRICB mode if that helps in this PDF.


texts: Encrypt text message with Wireguard public key

texts:
With its public and private key(s), Wireguard looks a bit like PGP. But it is used for encryption of network packets and not normal text messages. I'm on a system with Wireguard already installed and don't want to install more programs than necessary.

How, can I use a public Wireguard key to encrypt a text message which I then can decrypt with a private key?


texts: Would it be better to split a file and then encrypt, or vice versa?

texts: Assuming that you are paranoid before storing your file (distributed across a shared location), which will be the best case scenario: splitting the file first and then encrypting or encrypting first and then splitting?


texts: Can Microsoft's SIDH (Supersingular Isogeny) keypairs be reused for encryption? If not, why?

texts:
I was considering using Microsoft's SIDH implementation for post-quantum public-key encryption because of its relatively small key size. I realized however, thanks to Issue #4, that it might not be as ideal as I had hoped:

  SIKE is IND-CCA2 secure, which means that it's ok to reuse the key pair generated [...] whereas SIDH is insecure with re-used keys [...]

So here we go:

Is SIDH actually insecure when keys are reused?
Is SIKE actually secure even when keys are reused?
If so, why? How can SIDH actually be broken? Can you demonstrate an attack?
What prevents an attacker from encrypting many messages with a SIDH public key and breaking it that way?
What's the difference between the two that makes it so one can securely use reused keypairs and one can't?


texts: Does the plaintext have to be at least as long as the key in Polyalphabetic substituion cipher

texts:
In polyalphabetic substitution cipher, if we have a key $k$ (a string of letters) of length $n$ does the plaintext $m$ (also a string of letters) have to satisfy $|m| \geq n$?

Also, side question, do we have to include a requirement that at least one letter in the key is different from the others? Because otherwise it becomes a simple shift cipher (Not poly at all)


texts: Mutual authentication with Public Key and session Key

texts:
I am trying to understand two protocols for mutual authentication and if they are secure or not.

$K$ is the session key, and it's calculated $k=H(TimeStamp)$.

Are the following both cases secure? Could they provide mutual authentication?

$Alice \rightarrow \{[TimeStamp]alice\}bob,K \rightarrow  BOB\\
 Alice \leftarrow [TimeStamp + 1]bob \leftarrow Bob$
$Alice \rightarrow \{[TimeStamp,K]alice\}bob \rightarrow  BOB\\
 Alice \leftarrow [TimeStamp + 1]bob \leftarrow Bob$

EDIT

I think both processes are secure, because only Bob can open the timestamp and compare.

In the 1st case, even if an attacker could do a forward search in the hash, Bob will find out that happened because he will compare with his hash of the timestamp that is signed and encrypted with his public key.

In the 2nd case, everything is signed and encrypted so, only Bob and Alice can open the message.

Is that correct?


texts:
I'm trying to understand the process of ECDSA signing. I already figured out the process of generating a public key out of a private key by multiplying the private key with G.

The equation for ECDSA signing is as follows: $S = k^{-1} (\text{hash} + dA * R) \pmod p$. What I'm trying to understand is the process of multiplying $dA$ (my private key) by $R$ ($x$ of public key generated from random private key). Is it a "simple" multiplication (such as 5*5 = 25) or the same way we multiply $k$ by $G$ to generate a public key?


texts: Homomorphic encryption and approximated GCD 2

texts:
This is a further question to the one reached here Homomorphic encryption and approximated GCD.

I am now thinking about a symmetric cipher in which the plaintext set is integers, illustrated as follows. For an integer $m_i$, the encryption is $c_i=pq_i+m_i$ and the decryption is $m_i=c_i\mod p$, where $p$ is the key and $q_i$ is some randomly chosen integer. I know that this cipher is not semantically secure since it cannot resist known plaintext attack or chosen plaintext attack. My question now is whether it is secure under ciphertext only attack? If so, what security definition I should use?


texts: How can we prove that the following theorem is valid for almost perfect secrecy?

texts:
We have the following theorem:

  Let $\Pi$ be a perfectly-secret scheme over message space $M$, and let $K$ be determined by $Gen$. Then $|K| ≥ |M|$.

How can we prove that the above theorem is valid for almost perfect secrecy? The definition for almost perfect secrecy is as follows:

  The encryption scheme $\Pi = (Gen,Enc,Dec)$ over a message space $M$
  is almost perfectly secret or $\varepsilon$-perfectly secret
  if for every probability distribution over $M$, $\forall m \in M$ and
  $\forall c \in C$ for which $Pr[C = c] > 0$ and for a constant
  $\varepsilon < 1$:

  $$|Pr[M = m|C = c] - Pr[M = m]| < \varepsilon$$

EDIT


texts: Where is the password hash calculated, locally on or the server?

texts:
My computer security professor uses the following notation, where S denotes a server and A denoted Alice. Alice wants to authenticate herself to the server. The hash function is a hash chain where $h^n(x)$ denotes a hash function $h(h(h(..h_n(x)..)))$. $n$ is stored on the server.

Assignment:

  The following authentication protocol makes use of the Lamport hash
  construction (sometimes simply called ‘hash chain’). The construction simply consists of repeat-
  edly applying a hash function to an input value. We write h n (x) to denote hashing x n times,
  e.g. h 3 (x) = h(h(h(x))). Each user chooses a password pw and hashes this n times. He/she then
  sends it to the server. Let us assume that initially, n = 10 000. The server then stores a tuple
  (user, n, Y = h n (pw)) for each user in a database. Users can now authenticate to the server using
  the following protocol: The server checks if h(X) = Y , then decrements n and sets Y := X. So, after a successful run of
  this protocol the server holds a new tuple (user, n − 1, Y = h n−1 (pw)).

$ A \longrightarrow S : \text{I want to authenticate} \\
S \longrightarrow A : n\\
A \longrightarrow S : X = h^{n-1}(\text{password})
$

So now the hash is calculated on the device Alice uses. I am a bit confused now, because I always would receive the user's plain-text password and then hash it and store it in a database instead of receiving the password from the user. Also, I don't think this is possible at all in a web application.

My question is whether or not this protocol is used, and if so how would it be implemented. Also, what is more secure, hashing on the user side or the server side?


texts: If Kerckhoffs's principle is correct why does the NSA not publish their Suite A ciphers?

texts:
The Wikipedia article offers little insight. To quote the page:

  the decision to keep them secret is in keeping with a layered security
  posture

How should we (the cryptographic community) interpret the NSA's decision to keep their best ciphers private? It seems that if obfuscation works, then Kerckhoffs's principle represents an extreme viewpoint and should not be applied generally.


texts: Safe initialization vector when using openssl_encrypt

texts:
Is php's bin2hex(random_bytes(8)) safe for an initialization vector when using openssl_encrypt()?

$cipherText = openssl_encrypt(
    'Secret message.',
    'AES-256-CBC',
    'some key',
    OPENSSL_RAW_DATA,
    bin2hex(random_bytes(8))
);


texts: Minimal implementation of GPS identification algorithm from NESSIE project?

texts:
I'm studying GPS, asymmetric identification scheme from the NESSIE project. I found a bunch of helpful information about it in the original submission, they even mention minimal implementation examples (in C/GPS-C.pdf of submission archive). But they only mention them and provide instructions on how to compile them, source files themselves aren't present in submission. I was wondering does someone know where I can find these files (or other implementations)? I tried googling, but it seems extremely a few documents are mentioning GPS, and none of them have any source code.
Sadly, I'm not good enough in math&cryptography to implement them myself. It's a lot easier for me to understand algorithm reading implementation code than papers. Examples in Python/JavaScript/Java/C(++) will be extremely helpful, but any other language will be fine too.
Also, I was wondering does it somehow related to Global Positioning System or it's just a coincidence?


texts: Avoid storing the whole message when signing with SPHINCS+

texts:
Unlike pretty much every other signature scheme that I am aware of (excluding Picnic, the original SPHINCS, and SPHINCS-gravity) SPHINCS+ requires that the whole message be available during the signing operation. This is because it uses a "message randomization value" which if I am not mistaken it is used in order to avoid multi-target attacks. From the SPHINCS+ reference implementation:
/* Compute the digest randomization value. */
gen_message_random(sig, sk_prf, optrand, m, mlen);

/* Derive the message digest and leaf index from R, PK and M. */
hash_message(mhash, &tree, &idx_leaf, sig, pk, m, mlen);

In order to bypass that requirement one could first hash the whole message and then sign the result but this means that the whole scheme will be broken if said hash function is not collision resistant (SPHINCS+ by itself only depends on the [second?] preimage resistance of the hash function).
My question is as follows: Is it possible to use "tree signing" (kinda like a merkle tree but for signatures) in order to avoid storing the whole message in memory and at the same time have the whole scheme depend only on the preimage resistance of the hash function?
The scheme that I have in mind would work as such (assuming that each node has exactly 2 children):
$$
\begin{align}
N_{i, 0} &= S_{sk}(0\| 0 \| i \| m_i) \\
N_{i, j + 1} &= S_{sk}(0\| j + 1 \| i \| N_{2i, j} \|N_{2i+1, j} ) \\
Sig &= S_{sk}(1 \| N_{0, J} \|N_{1, J})
\end{align}
$$


texts:
I am in need of a deterministic encryption algorithm I can use on social security numbers (9 character string, numbers only) that I will store encrypted in a MongoDB and need to be able to search for them and recall them (ruling out one way hashes).

For example, 11122333 is encrypted and then stored in the db.  The user then wants to know if 111223333 is in the db so i encrypt it and then search for the cipher text in the db.

db.patient.find({"PatientDemographics.SocialSecurityNumber" : "N9DF63vmf0fedH/YW5Et6g=="})

What I came up with is to use AES (in CBC-Mode) but purposefully gimp it using a un-changing IV.  I have it working with this change. I just want to make sure I am not completely ruining the encryption and only doing what I need to do to enable searching.

To summarize, If you got a dump of the db with the SSNs encrypted as described above, would you able to get the cleartext via some sort of attack without knowing the IV and Key? Would it help if i passed in the IV (instead of hard coding it) which would act as a second key?

Another option (that I havn't tried yet), suggested here, says to hash the ssn and use that as a IV.  I would then have to prepend the IV to the ciphertext and store it in the db.  Is this cryptographicly better?  My approach is having a secret static IV (requires key and IV to decrypt) vs this one having a deterministic IV prepended to the ciphertext (requires only key to decrypt).

If this is the wrong approach, can you recommend another that fulfills the searching requirement (implemented in C#)?

Hoping to get more constructive feedback than i got from the main site


texts:
So this is my first post on this forum, so bear with me if I sound stupid. I am creating my own web application with JavaScript and MongoDB. I am storing all user information in a Mongo table, and currently this is the hashing algorithm I used to store the passwords:
function generatePassword(input) {
     return Buffer.from(crypto.createHash('sha256').update(input).digest('base32')).toString('hex').toUpperCase();
}

So, from what I recall from previous Cyber Security classes, sha256 has been long cracked, therefore deeming it insecure for storing passwords. I understand this being my web application I will not be experiencing security breaches, but I want to show that I have the awareness and knowledge to correctly and securely store the passwords. Therefore, I thought that if I changed up the code a little bit by using this:
function generatePass(input) {
     input = input + "455kjnr2902rug5348934";
     return Buffer.from(crypto.createHash('sha256').update(input).digest('base32')).toString('hex').toUpperCase();
}

I guess my questions are, is this
a. An effective salting method? If not, how would I go about salting the password?
b. Is there a more secure way of doing this? Is this basically useless, or useful?
Thanks in advance to anyone who can help!


texts: Paillier Homomoprhic addition overflows after a certain value

texts:
I'm new to encryption and am trying to implement Paillier encryption from the wikipedia page here: https://en.wikipedia.org/wiki/Paillier_cryptosystem

I managed to implement the encryption and am successfully able to decrypt as well to get the same message - so thats working which is good.

Then I wanted to check homomorphism and followed this formula for homomorphic addition:

$D(E(m_{1},r_{1})\cdot E(m_{2},r_{2}){\bmod  n}^{2})=m_{1}+m_{2}{\bmod  n}$

And it works as it should until the number goes larger than a certain value.

For example if msg1 = 50 and msg2 = 100, then using the above formula I can multiply their ciphertexts and it will decrypt to added = 150.

But if the addition of the two numbers go higher than 390 the decryption overflows (?). For example:

msg1 = 100 and msg2 = 100, would give added = 200 once decrypted.

msg1 = 290 and msg2 = 100, would give added = 390 once decrypted.

msg1 = 291 and msg2 = 100, would give added = 0 once decrypted.

msg1 = 292 and msg2 = 100, would give added = 1 once decrypted.

msg1 = 293 and msg2 = 100, would give added = 2 once decrypted.

and so on.

Is this expected behaviour? I must be doing something wrong, but going over the implementation I seem to have every step implemented correctly.

Some guidance here would be appreciated.

I am using Matlab as my tool and I am using the variable precision toolbox for my inputs so overflows should not happen from Matlab, the problem must be at my understanding of the system


texts: Asymmetry between public key and private key: digital signatures use the private key for “encryption”?

texts:
I have a misunderstanding concerning public key cryptography...would be very helpful if you answer the questions...

Digital signatures: You use your private key for "encryption" and they use your public for "decryption". I thought that you can only decrypt with a private key and encrypt with a public key.. and that's why it is called asymmetric cryptography and this is where all the maths comes in with trapdoor functions and so on....
That's obviously wrong so please explain what I got wrong.
So obviously what I thought in 1) is wrong... so I have read a bit further.
Now I have the impression that private and public key are symmetric in a sense that you can choose one for encryption and then the other one is for decryption but you could also do it the other way round. Then the term "private" and "public" would only refer to which key you publish and which key you keep in secret. What I dont understand here is: Where is the math with trapdoor function used here if it is in a sense completely symmetric?
Is it possible to easily derive the public key from a private key? I have heard that in theory NO but in practice YES...

So I'm a bit confused at the moment, maybe you can help me out here.


texts: Could one make an asymmetric encryption scheme based on Sudoku?

texts: I was reading about a Polly Cracker encryption scheme based on the graph 3-coloring problem.  Aren't Latin squares just a form of the same problem?  If so, does this mean Sudoku can be used for public/private key encryption?


texts: Are there simple, cryptographically safe one-way hashing functions?

texts:
I'm trying to understand what is required to construct one-way hash functions. I know about many algorithms used in practice, such as SHA256, Blake2, MD5, which are of high quality, but they're complex and studying them doesn't really answer my question. I also know about "simpler" algorithms such as multiplication modulus - but those are often not one-way, so they also don't help with the question.

Are there one-way, cryptographically safe hashing algorithms that are very, very simple to describe? When I say simple, I mean really, really simple. As in, a cellular automata, or something that could be implemented in 4 or 5 lines of code.


texts:
According to the above protocol(Efficient Secure Two-Pary Protocols-Hazay-Lindell-page 27), the authors proved the security of this protocol according to the two paragraphs below:

  We separately consider the case where P1 is corrupted and the case where P2 is corrupted. If P1 is corrupted, then the simulator S receives from A the bit that it sends to P2 in the protocol. This bit fully determines the input of P1 to the function and so S just sends it to the trusted party, thereby completing the simulation. In the case where P2 is corrupted, S sends input 1 to the trusted party and receives back an output bit b. By the observation above, b is the input of the honest P1 in the ideal model. Thus, the simulator S just hands A the bit x = b as the value that A expects to receive from the honest P1 in a real execution. It is immediate that the simulation here is perfect.

  We stress that the above works because P2 is the only party to receive output. If P1 also were to receive output, then S ’s simulation in the case of a corrupted P2 would not work. In order to see this, consider an adversary who corrupts P2, uses input y = 0 and outputs its view in the protocol, including the bit x that it receives from P1. In this case, S cannot send y = 1 to the trusted party because P1’s output would not be correctly distributed. Thus, it must end y = 0, in which case the view that it generates for A cannot always be correct because it does not know the input bit x of P1.

According to the above definition, I understand why it is important that the outputs in the real and ideal model should be indistinguishable, but I do not know why it is important that simulator S should know the input bit x of P1!!!
As I highlighted in the above authors' proof, why the simulator should know the input bit x; If it should know this, please explain to me how the above definition 2.3.1(in the mentioned book) tells us that the simulator should simulate the inputs of the party(P1 in the above protocol).

To sum up, is it important that the simulator simulates the inputs of the corrupted party? would you please explain it to me, according to the definition 2.3.1?

According to the definition 2.3.1, I know that the outputs pair's distribution of the honest and corrupted party in the ideal and real model should be indistinguishable, but it does not make sense to me that the simulation of parties' inputs is mandatory.


texts: Constructing a mac scheme secure to regular definition but insecure to special case

texts:
The mac-forge security game for mac schemes looks like this:

$k \leftarrow \operatorname{Gen}(1^n)$;
$(m,t) \leftarrow A^{\operatorname{MAC}_k(⋅)}(1^n)$;
Let $Q$ denote the set of all queries that $A$ asked to its oracle;
The output of the experiment is defined to be $1$ if and only if $\operatorname{Verif}_k(m,t)=1$ and $m \notin Q$.

So, in this experiment the adversary has acces to a $MAC(.)$ oracle. But let's consider another experiment that where the adversary also has acces to a verify oracle, but otherwise the experiment is the exact same. Let's call the experiment mac-forge*.
If we consider a mac scheme that is secure with respect to both these definitions, can we then make a new scheme from it, that is secure for mac-forge, but not mac-forge*?
I suspect something strange should be done to the verify function, but I really don't know what.
Edit
If I construct vrfy* like:
vrfy*k(m,t) = if tag has correct length, just Mac(m), and if Mac(m) = t

, output true, elif if Mac(m) != t output false
if tag is smaller than it should be, and has length i, output the i'th bit of the key


texts:
I have been looking for a concrete example of GMW protocol for two parties. I was trying with the following example for computing $XOR$ of two parties:

A's secret bit is $a = 0$, B's secret bit is $b = 1$.
A chooses a random string of length 2, namely $a_1a_2 = 00$, so that $a = a_1 \oplus a_2 = 0 \oplus 0 = 0$. B does the same, his secret string is $b_1b_2 = 01$, so that $b = b_1 \oplus b_2 = 1$.
A sends the second bit of her secret string, $a_2$ to B. B sends the first part of his secret string $b_1$ to A.
A now has $a = 0, a_1 = 0, b_1 = 0$. B has $b = 1, a_2 = 0, b_2 = 1$.
Now, GMW protocol says that A and B can locally compute $c_i = a_i \oplus b_i$ and the result should be same for both. However, as you can clearly see, in this particular example, they are not the same. A's xor is 0, B's is 1.

I think I have a misunderstanding somewhere, but I don't know where. Help, please?


texts: How is the base64 encoded signature in Craig Wright's proof constructed?

texts:
Mr. Craig S. Wright might be Satoshi Nakamoto - the inventor of bitcoin. He is currently proving the case.

But how is the base64 encoded proof, that is published by himself on his blog post constructed? Is it random or some sort of collision attack?

My following PHP code "proves" that the signature is valid. It takes the signature, decodes the base64 string and outputs the result in hex. This again is contained in the hex output of a bitcoin transaction from 2009.

$proof = bin2hex(base64_decode('MEUCIQDBKn1Uly8m0UyzETObUSL4wYdBfd4ejvtoQfVcNCIK4AIgZmMsXNQWHvo6KDd2Tu6euEl13VTC3ihl6XUlhcU+fM4='));
echo "proof: $proof
";

$tx = substr(file_get_contents('https://blockchain.info/tx/828ef3b079f9c23829c56fe86e85b4a69d9e06e5b54ea597eef5fb3ffef509fe?format=hex'),86,142);
echo "tx: $tx
";

How do you construct such a string so that this is possible? To me this looks like a very good magic trick, but I can't explain the construction of the input value.


texts: Is there any reduction from Short Integer Solution to $\textrm{SIVP}_\gamma$

texts: Short Integer Solution(SIS) is proved to be hard by reducing $\textrm{SIVP}_\gamma$ to SIS i.e., if we solve SIS, then we can solve $\textrm{SIVP}_\gamma$. Is ther any way to reduce an instance SIS to an instance of $\textrm{SIVP}_\gamma$?


texts: Can AES-GCM be broken if initialisation vector is known?

texts:
We are using AES encryption in GCM block mode in order to encrypt a number of different kinds of data at rest on a mobile device - Android.

The key used for encryption is stored in the protected key-store offered Android so I am assuming that it is pretty robustly stored. However, we are using the same nonce/IV to encrypt different data. The nonce/IV is stored in shared preferences without any encryption. So I am assuming that it is not secure given a malicious app on a rooted android device can get into the shared preferences or another app.

What am I trying to understand is - if someone indeed gets hold of the plain-text nonce/IV and a number of different encrypted messages (which are encrypted using the same key) can they be able to decrypt the messages successfully?

We have proposed to make this better by using a different nonce for encrypting each message. However, I am not sure if this will still prevent someone from decrypting the message when they can get hold of the plain-text nonce, even when there is only one message that is encrypted with that nonce.

Here is the relevant piece of code

public synchronized String encrypt(String input) throws SecurityException {
    try {
        Cipher c = getCipher(Cipher.ENCRYPT_MODE);
        byte[] encodedBytes = c.doFinal(input.getBytes("UTF-8"));
        return Base64.encodeToString(encodedBytes, Base64.DEFAULT);
    } catch (Exception e) {
        throw new SecurityException(e);
} }
public synchronized String decrypt(String encrypted) throws SecurityException {
    try {
        Cipher c = getCipher(Cipher.DECRYPT_MODE);
        byte[] decodedValue = Base64.decode(encrypted.getBytes("UTF-8"), Base64.DEFAULT);
        byte[] decryptedVal = c.doFinal(decodedValue);
        return new String(decryptedVal);
    } catch (Exception e) {
        throw new SecurityException(e);

} }


texts: Byzantine Agreement: Why does OM need f+1 rounds in a synchronous setting?

texts: To get Byzantine Fault Tolerance in a synchronous model you can use an Oral Message Algorithm. For n > 3f+1 it gets an Byzantine agreement in f+1 rounds. Why f+1?


texts: Clarification of one-way property of hash functions

texts:
One-way property: computationally infeasible to find data mapping to
  specific hash

The definition above is a little vague, if we have h(x) = floor(log(x)), finding "some" x that gives a hash value is easy, however, deterministically finding the actual x value that has led to the output is impossible. Do such hash functions have the one-way property?


texts: How can I show, that RSA with OAEP is IND-CPA secure by using G,H one way function?


texts: What is the danger if a non-prime is chosen for RSA?

texts:
I was reading this question about generating primes for RSA keys. The answers point out that most implementations of of the algorithm use probabilistic prime-ness checking algorithms. The answer by @tylerl made the most sense to me:

  That is, if the test uses a randomly-chosen value (the "witness") which serves as the basis for the test. If the test passes, then the number is probably prime, but possibly not. We can repeat the same test with a new "witness", and if the test passes again then we have increased our certainty. We can continue to re-test as many times as we want until we've reached the level of certainty that we need.

This (and the other answers) heavily imply that we're never actually 100% certain that the numbers we've chosen for a key are actually prime.

Do any implementations follow up the probabilistic prime checks with exhaustive checks? I'm guessing not, because RSA key generation has to be pretty fast (compared to the heat death of the universe) to be useful.
What "level of certainty" do we "need" for RSA keys?
Is this an actual downside? If a non-prime number is used in an RSA key, to what degree would the search space of a brute force attack be decreased?

I'm torn on this, because as I understand it, a brute force attack relies on factoring the key, which is difficult for the length of numbers we've chosen. If we're 99.99...% certain a number is prime, then the most likely thing we've done is selected a number that's a product of two or more reasonably large primes. That would imply that the brute force attack is only a few orders of magnitude easier to conduct; according to some fancy math, the RSA algorithm has orders of magnitude to spare.
Are there better attacks that will succeed in much less time that could work by assuming one or both of the secret numbers are non-prime? Even if this is one-in-a-billion chance, if the attack is fast enough, it seems like its worth it.


texts: Does shift cipher with non-uniform plain text probability have perfect secrecy?

texts:
I am having a hard time grasping the perfect secrecy concept. (I have already tried solving a couple of similar problems, so please don't think I am trying to get you guys to do my work, I really am stumped on this).

Consider a shift cipher with plaintext, key and cipher-text space is $[0..7]$ i.e.

$$
P = \{0, 1, 2, 3, 4, 5, 6, 7, 8\}\\
K = \{0, 1, 2, 3, 4, 5, 6, 7, 8\}\\
C = \{0, 1, 2, 3, 4, 5, 6, 7, 8\}
$$

plain-text's even alphabets have twice the probability of odd alphabet i.e.

$$
\forall p \in P:
\Pr_P(p) = \begin{cases} \frac{2}{12} & \textrm{ if p = 2(b) for some b $\in$ Z } \\
\frac{1}{12} & \textrm{ if p = 2(b) + 1 for some b $\in$ Z }
\end{cases}\\
\\
\forall k \in K: \Pr_K(k) = \frac{1}{8}
$$

From here I have calculated that $\Pr_C(c) = \frac{1}{8}$.

How do I calculate $\Pr(y|x)$
How do I use Baye's theorem to calculate $\Pr(x|y)$
How do I show whether $\Pr(x|y) = \Pr(x)$ or $\Pr(x|y) \neq \Pr(x)$ (thereby determining whether this cipher has perfect secrecy or not).


texts: Use MDC to provide origin authentication for public key encryption?

texts: Why can't we use an MDC (“Manipulation Detection Code”, as also handled in this Q&A) to provide origin authentication when using public-key encryption?


texts: AES: Why is it a good practice to use only the first 16 bytes of a hash for encryption?

texts:
I'd like to encrypt Text with AES/CTR and a password defined by the user in java. I already checked the internet (and stackoverflow) for answers. The most used version is to hash the user password with sha1 and take only the first 16 bytes.

But I don't think this can be a good practice.

sha1 is weak
taking only the first 16 bytes makes the hash also weak
and rise the chance for a collision (even with sha-256)

Is this really the best practice? Why? How can I do things better?

Some links to the articles I mentioned:

https://stackoverflow.com/questions/3451670/java-aes-and-using-my-own-key
https://howtodoinjava.com/security/java-aes-encryption-example/
https://blog.axxg.de/java-aes-verschluesselung-mit-beispiel/


texts:
So I am studying for finals and I am not able to solve the problem:

Let $ p = 3 * 2^{11484018}- 1 $ be a prime with 3457035 digits. Find a positive integer $x$ so that $2^x\equiv 3\pmod p$

Any guidance or tips would be great. I assumed it dealt with Fermat's Little theorem.


texts:
I would like to implement fast DES decryption using Bitslice technique.
Without bitslice DES technique, I have already done decrpytion in this source code by changing the for loop from 15 to 0.

In this source code there is no decryption function for DES. How to implement decryption function using the encyption routine? What modifications can be done?

Another source code that is written with the same approach.

s1 (r31 ^ k[47], r0 ^ k[11], r1 ^ k[26], r2 ^ k[3], r3 ^ k[13],
        r4 ^ k[41], &l8, &l16, &l22, &l30);

I think the k[] indexes should be changed. At the encryption function, in first s1 box, I didn't get why the first k is selected 47, 11, 26 3, 13 ,41 and so on. If anyone tell me why, i may do it.


texts: Zero Knowledge Proof using hash chains - Is there a flaw in the algorithm?

texts:
I came across this blog post http://blog.stratumn.com/zkp-hash-chains/ which provides a Protocol to prove in zero-knowledge that an integer (such as age or balance) is greater than a known threshold.

It is based on this paper: Verifiable Auctions for Online Ad Exchanges

The protocol is as follows:

A trusted central document authority that provides proof services. P has requested a secret S from this authority, for use in proving her age. The authority assigns a secret (256 bit) S to P. Let’s say P's (S) is:

0000000000000000000000000000000027ae41e4649b934ca495991b7852b855

The Authority then calculates a hash-chain one link greater than P's age:

EncryptedAge=HASH^{ActualAge+1} (S)

P also computes

Proof=HASH ^ {1+ActualAge−AgeToProve} (S)

P then sends to the other party:

The Authority’s signed Proving Kit (which contains her EncryptedAge )
The Proof she calculated

The party that needs to verify P's age does:

Extracts P's EncryptedAge from the Authority’s message
Computes:

VerifiedAge=HASH ^ {AgeToProve} (Proof)

Compares VerifiedAge == EncryptedAge. If equal then age is higher than age to verify.

Here is the code in JavaScript to test above protocol: https://repl.it/repls/SmartOccasionalQueries

I think there is a flaw in the protocol, it occurs in this step:

Proof=HASH ^ {1+ActualAge−AgeToProve} (S)

When 1+ActualAge is equal to AgeToProve, then hash is not applied on S.

It ends up sending the secret as Proof. S should have been maintained as secret.
It ends up computing that verified Age == encrypted age, where as it is not, example: https://repl.it/repls/OrderlyPalegreenScriptinglanguages

The below is example from the blog, with Age = 19, and AgeToProof = 20:


texts: Discrepancy in padding order between NORX specification and reference code

texts:
I have been working on implementing the NORX V3.0 authenticated encryption algorithm and I have run into a very confusing contradiction regarding the order in which padding and permutation are performed during header, encryption, and trailer operations.

According to the V3.0 specifications (https://github.com/norx/resources/blob/master/specs/norxv30.pdf) , they show that the final block is padded after the ID is absorbed into the state.

According to the authors C reference code (https://github.com/norx/norx/blob/master/norx6444/ref/norx.c) the padding is performed before absorbing the block.

When I implement it according to the V3.0 specifications, the output of my code matches the test vectors.

When I swap the order to match the reference code, the test vectors fail completely.

Based on my general knowledge of sponge functions, I would expect that padding is done before executing the permutation.  This is consistent with what I see on the reference code, but contradicts what the specifications say.

I have searched the web to see of perhaps there are errors in the V3.0 specifications that have not yet been updated into the document.

I have also noticed that when I pad after the permutation as per the spec, parallel mode (NORX64-4-4-4) matches all the test vectors except the final output tag.  Changing between the two padding orders yields different tags, but none that match the test vectors given in the specification.

Having seen reference code in multiple languages (C, GO, PYTHON, C++, etc.) all showing padding before permuting, and given that a sponge is normally padded before permutation, I am beginning to suspect that the specification is incorrect.

If anyone knows the correct ordering to use, would you please confirm it.

Related : The test vectors are very limited.  Does anyone know of a set of more comprehensive vectors (single and parallel mode) that are available?

Regards!


texts:
I have a bootloader on a small device (Cortex-M0/M3). I want to publish encrypted firmware updates, that can be installed on the device, using the bootloader. The whole point of the encryption is to probit to make a copy of the firmware or to install unauthorized software. The device provides some means of readback protection.

I store a set of 256-bit keys in the bootloader (k1, k2, k3...). That set of keys can be different from device to device (licenses) and every key is associated with some kind of feature. Now I want to define, which keys a bootloader needs to decrypt the firmware. For example: k1 and k2 or k2 and k3.

I use a random key (kr) and a random IV to encrypt and authenticate the firmware using AES/GCM. For every key combination, that can be used to decrypt the firmware, I was going to store the encrypted random key kr, encrypted by a key that is built by xor'ing the required keys.

To take the example from above: If I want to have the firmware installable on all devices that know either k1 and k2 or k2 and k3, I would store E(k1 xor k2, kr) and E(k2 xor k3, kr) as plain text along the encrypted firmware.

Now, I have three questions: Does the approach above sounds reasonable? Can I use AES/ECB as E to encrypt the combined key? Could I use AES/CTR with the very same IV from the AES/GCM encryption of the firmware?


texts:
I'm doing some tests in Java, encrypting messages exchanged between two entities. I'm using a symmetric key to encrypt the messages.

Right now I've stumbled upon a question. Is it enough to encrypt then sign when using symmetric-key encryption? The signature process is based on an asymmetric key pair. I think that by encrypting the message the content will be hidden and then if I sign it it will be authenticated but I feel like something is off. I'd like to hear someone else's opinion on this topic since I'm nothing but a beginner trying to learn.


texts: Why is $g^e \mod p = g^{e \mod (p-1)} \mod p$ if p is prime. I don't get it. It follows from Fermat's little theorem.


texts:
Consider the values $a$ and $b$ are encrypted as $c_1=(a \oplus D)$ and $c_2=(b \oplus D)$.

My question is: can we derive $b+a$ from any combination of $c_1$ and $c_2$?

Note:

I admit that the $D$ should have not been used for both $a$ and $b$. For now assume we can use it.
Basically I define the values ($a$ and $b$) in $Z_p$, accordingly the result in $Z_p$.


texts: AES MixColumns using L and E lookup tables

texts:
I am trying to verify the multiplication by $\mathtt{02}$ in Galois Fields for MixColumns function using the L and E lookup tables. I could verify $\mathtt{D4}\cdot\mathtt{02}=\mathtt{B3}$ by manual calculation and using the lookup tables. However, I can't verify $\mathtt{87}\cdot\mathtt{02} = \mathtt{15}$ using the lookup table. Using the L table, $74 + 19 = 93$. Look up the E table for $93$ and it is $\mathtt{3D}$.
Where am i going wrong?

Link to lookup tables: Page 8 of this document.


texts: can permutation matrix be found in parallel processing technique?

texts:
Let us say there exists a permutation matrix $n \times n$ for some large $n$. Then, there are $n!$ possible permutations. If one to use brute-force to find the secret permutation among $n!$ possibilities, is there a parallel way to find such permutation?

thanks


texts: Help with linear approximation of DES(I don't understand some part of it )

texts:
I will make a presentation about Linear approximation (Matsui's paper 1993 Linear Cryptanalysis Method for DES Cipher ) of DES and I don't understand some parts of it.
Here my questions :

In the linear approximation of $S$ boxes we had lemma 1 and it says $NS(a,b)$  is even
I saw the topic about lemma 1 but I don't understand the explanation either :(

On the Same page as lemma 1 we have table 1. I understand the idea of the table and bias etc. but in the table, if we add the values in every row we get 0. I cannot understand the reason for it.

(I have an idea :For example when we add all rows for α=16 we have $$\mathtt{X4=8Y3\oplus8Y2\oplus8Y1\oplus8Y0}$$
and since we multiply with 8 to each bit in the right side we have 0 in the right side so probability of x4 being 0 is 1/2 therefore we had 0 bias)

For breaking 16 round DES we are using algorithm 2 but I cannot understand how we get 14 key bits?

We are saying the only nonlinear part of the DES is S boxes. By saying linear or nonlinear what we mean is like linearity in functions in mathematics?

In algorithm 2 we are applying algorithm for each key candidate. I understand the algorithm but ı don't understand how are we finding these candidate keys.If we are trying all possible candidates then this will make process very long.

And what advantages or disadvantages this nonlinearity give us?


texts: Does information theoretical security definition imply DDH, RSA, QR does not hold?

texts: Assuming we are in the information theoretical setting, whereby there is no bound on the computational power of an adversary. Does this mean that the standard definitions for DDH, RSA or QR do no hold in that setting, because the definitions assume some bounds on the computational power of the adversary?


texts: NewHope and NIST's Post-quantum standardization

texts:
Where can I find NIST's reasoning to eliminate NewHope from the 3rd round of the post-quantum competition? I see all the lattice KEMs finalists are based on modules.

Is being a ring-based KEM contributed to their elimination?
In this case, is there any recent development in cryptanalysis on ideal lattices that can pose danger in the future?
Even if this is the case, isn't Falcon also a ring-based signature scheme? I am confused by this.


texts: Do book permutations improve book ciphers?

texts:
https://drive.google.com/drive/folders/1MfK8-Fv5Y7rcRz1Cp_swsZhJcgcILmyd?usp=sharing
*
Someone out there has built a book cipher using permutations of the book.  The basic premise seems to be that a book which is half a million words long can be rearranged in 10**2000000 ways (the factorial of half a million).  A text message is enciphered using one of the permutations of the book. Even if an attacker has a copy of the book, and has the software presented in the link, they simply cannot test a cipher message against all the permutations of the book.
The example persuades me...does it persuade anyone else?


texts: What if an AES Whitebox 1024-bit (or larger key) is created? Does it increase complexity consistently?

texts:
Following the Chow et al paper and Muir's tutorial, I was able to implement the AES algorithm using tables embedding keys of 128, 192 and 256-bit sizes, later extended to 1024, 2048 and 4096-bit sizes.

The original AES-128 WBC from Chow et al or Karroumi papers have a known BGE attack consisting $2^{22}$ work-steps (Yoni et al), so this implementation also suffers from the same weakness considering that the attacker knows the key is 128-bit.

My question is: what if the key size is extended to 512/1024/2048/4096 bits following Jaeik Cho et al ($Nr = Nk + 6$); is it going to add any considerable complexity to the BGE attack? My point is: the attacker will need to know in advance the key length in order to obtain it, right?

And If the number of rounds is also unknown?

Is there some other known type of attack in the situation I'm proposing here?


texts: Are hash functions strong against quantum cryptanalysis and/or independent enough of mathematics?

texts:
I work on ethereum and other blockchain technologies. And seeing that quantum pc's are someday going to see the light I have some questions / doubts.

I was wondering if hash functions are strong enough to hold up against quantum computers (that in the future will be reality I think seeing things like IBM-Q)

Obviously, cryptosystems like ElGamal, RSA or other cryptosystems based on modular exponentiation and the impossibility of solving the discrete logarithm will fail against quantum adversaries because (as I understood) once the period of the multiplicative body generator (for DSA) or the additive body (ECDSA) is found, you can polarize the qbits in order to extract the solution (obviously I'm not an expert so I don't know if I'm right)

I read this post but I was hoping for a bit more of an insight to understand better all of this in-depth.

So my question: How well do hash functions hold up against adversaries with (large-scale) quantum computers?


texts:
I've had an idea about storing parts of SHA256 hashes and I'd like to find out how secure it is, or how much less secure it is than storing the entire hash.

For example, users can share this list of truncated hashes and each user only stores one of the entire hashes, they only need to store they're own hash, and when someone gives them a hash they don't recognize they can check it against my list.

If I have some hashes like this:

CA978112CA1BBDCAFAC231B39A23DC4DA786EFF8147C4E72B9807785AFEE48BB
3E23E8160039594A33894F6564E1B1348BBD7A0088D42C4ACB73EEAED59C009D
2E7D2C03A9507AE265ECF5B5356885A53393A2029D241394997265A1A25AEFC6
etc ...

Instead of storing all 256 bits of each hash, I'd like to store random chunks of each hash. The first step is to add a number to the end of the hash.

CA978112CA1BBDCAFAC231B39A23DC4DA786EFF8147C4E72B9807785AFEE48BB(4)
3E23E8160039594A33894F6564E1B1348BBD7A0088D42C4ACB73EEAED59C009D(7)
2E7D2C03A9507AE265ECF5B5356885A53393A2029D241394997265A1A25AEFC6(9)

And now instead of storing the entire hash, I store two bytes from each hash. The first byte is byte 4 for the first hash, 7 for the second etc ... using the number I added to the end of the hash.

The first number is the 4th byte.
The second number is (first number + half size of the entire hash) % (size of the entire hash).

So based on my first hash above:

CA978112CA1BBDCAFAC231B39A23DC4DA786EFF8147C4E72B9807785AFEE48BB(4)
byte1 = 4th byte = 12
byte2 = (4 + 32/2) % 32 = 20th byte = F8

So instead of storing:

CA978112CA1BBDCAFAC231B39A23DC4DA786EFF8147C4E72B9807785AFEE48BB(4)

I could store:

12F8(4)

So now I have my hash and if I want to compare it against the list I just check the 4th and 20th bytes equal 12 and F8, respectively.

I don't know anything about Cryptography really, so I'm wondering if this idea already exists, if it's secure and if there's a way prove mathematically how secure only storing 8 bits of the 256bit hash is as opposed to storing the entire thing.

Thanks!


texts:
I read that random numbers are being used in cryptography and security. I think I have idea how to truly generate true random, non-deterministic number. But before continuing further I'd like to ask few basic questions.

What kind of numbers are needed for cryptography/security? Are those integers?
How long should those numbers be? 10 digits, 100 digits?
I read few articles about random numbers, but did I get it right, they are used to create hashes to create stronger encryption?