texts: J-PAKE : About Schnorr NIZK proof for ephemeral private keys

texts:
Reading J-PAKE Authenticated Key Exchange Without PKI document :
J-PAKE

  Round 1 : Alice sends out g^x1 and knowledge proof for x1, e.g :
      To prove the knowledge of the exponent for X = g^x1

My question is : Is then the recipient (the verifier) of g^x1 + NIZK of x1
    able to get the x1 value ?


texts: One-way function with combination sets as output / image

texts:
One-way functions generally operate on bit strings, for the input and the output.

Are there any examples of one-way functions that produce a combination set in output? Let's call this function $f$. The function would take one bit string in input, of size $p$, and would produce a combination ($k$ elements among $n$). $n$ is a power of $2$.

Concrete example of combinations set: 64 elements among 256. The size of this set is 1.9E+61 (204 bits)

I have an algorithm to generate a combination through a hash function: the hash function is used to generate a pseudo random bit string, then the bit string is split into sub-strings of size $\log_2(n)$ whose value represents the position of the element in the set of size $n$. If the value was already selected, to check the next value. If the hash function has good properties the loop will stop after some iterations.

I would like to know whether there are constructions considered as primitives for this problem.


texts: A Lightweight Matrix Suggestion for MixColumns State of AES

texts:
We know that the matrix in the MixColumns state of AES is the circulant  MDS matrix $C=circ(2,3,1,1)$ which is defined over $GF(2^8)$ with the  irreducible polynomial $f=x^{8}+x^{4}+x^{3}+x+1$. Let we show the elements of $GF(2^8)$ with positive integer numbers. For example, when we assume that the elements $2$, $3$ and $4$, we mean $\alpha$, $\alpha+1$and $\alpha^2$ where $\alpha$ is a root of $f$.  Consider the following matrix over $GF(2^8)$
$$
A= \left(
 \begin {array}{cccc}
 2&1&1&1\\
1&1&3&2\\
1&3&4&1\\
1&2&1&3
\end {array}
 \right)
$$
All squarer sub-matrices of $A$ are non-singular or in the other words $A$ is an MDS(super-regular) matrix over  $GF(2^8)$.

My question: Is matrix $A$ is  suitable for software Implementation rather than $C$?

Edit:(Motivated by @Richie Frame comment)
The inverse of $A$, denoted with $A^{-1}$, looks like to semi-circulant matrix as shown
$$
A^{-1}=
 \left(
 \begin {array}{cccc}
 11&194&120&173\\
194&57&173&11\\
120&173&111&50\\
173&11&50&120
\end {array} \right)
$$
Although  $A^{-1}$ is consist of seven elements $(11, 50,57,111, 120, 173, 194)$, from two elements $11$ and $50$ we can obtain other elements as follows
$$
 \left\{
 \begin {array}{lcr}
11+50&=&57, \\
11+50^2 &=& 120, \\
11^2+50^5 &=& 173, \\
11^8+50^8 &=& 194 ,\\
173+194&=&111.
\end {array} \right.
$$

Edit:(Motivated by @e-sushi comment)
After Definition 5 of the second paper, we have

For an efficient implementation of the perfect diffusion layer, it is desirable to have maximum number of 1’s and minimum number of different entries in the MDS matrix.

Although based on the this  terminology $C$ has an efficient implementation rather than $A$, I want to see this one by terminology of XOR and xtime.

After Proposition 3 of the second paper, the authors proved that multiplication
by the matrix of AES  can be implemented using $15$ XORs, $4$ xtimes (or $4$ table lookups) and $3$ temporary variables.

Unfortunately I do not know how to obtain XOR and xtime when the matrix $A$ is applied in MixColumns state of AES.

In addition,
I used software Implementation expression in the question since the matrix of AES($C$) is a circulant matrix, but the matrix $A$ is not  circulant and in 31th paper of FSE 2018, it is claimed that

using a circulant matrix gives adequate flexibility to
do a trade-off between the area requirement and clock cycle, whereas most of the other matrix types are suitable for either one but not both circumstances.


texts: Galois Field ($2^{16}$) for encryption in place of $GF(2^8)$ in AES

texts: AES algorithm is using $GF(2^8)$ Galois Field. What if we use $GF(2^{16})$ in place of $GF(2^8)$? Will this improve the algorithm or not?


texts: password generation: random length or max length

texts:
In short:

Is it cryptographically stronger to have a known length password of the maximum length allowed, or a random length password somewhere in the range of the longest length possible?

Does the answer change depending on the max length?  For instance my credit union (still!) forces a maximum length of 10 characters.  Would it be better to utilize all 10 if an attacker knew that that was the length I used, or would it be better to randomly use a length of either 9 or 10.  What if my credit union allowed a length of 16?  Or a length of 255?


texts: Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?

texts:
I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://tools.ietf.org/html/rfc8032) as well as for curves 414 and 521 from this (https://eprint.iacr.org/2015/677.pdf
) and with respect to the rules for pruning a scaler before multiplying the base point, I noticed two things of particular interest:

The value of N for the highest scaler bit to be set is different in RFC8032 for EDDSA 448 than in the paper "EdDSA for more curves" (https://eprint.iacr.org/2015/677.pdf.  In the RFC it gives N = 447 and in the paper it gives N = 448.  A search through popular public reference code shows the value of N = 447 as per the RFC is the one being used. Can anyone confirm which of these two values is "correct" in the sense of its impact on security? Is this simply an error in the paper?
After pruning as per the rules for each curve, the final maximum possible scaler value can be larger than L - 1, where L is the sub-group order, a prime. As I understand things, multiplying a base point by L yields neutral and multiplying by L + 1 is equivalent to multiplying by 1 (ie: it is cyclic and the points restart from the base point).  Assuming my understanding of this is correct, is there a particular advantage to multiplying by a value larger than L-1 that I am not aware of?

To guarantee a neutral point value can never be generated (although virtually impossible if a good random number generator is used to get the initial scaler multiplier), would it not make more sense to take the initial random bits and perform R mod L, masking the lower bits as per pruning rules to stay in the same sub-group, checking for a zero result and choosing another random value if zero?
Or does the defined pruning method somehow guarantee that the result will never be a multiple of L in a way that is not obvious to a non-expert?  If it does, I would see this as a way to avoid doing a modular reduction by L and everything would make sense.


texts: Help to understand the chameleon hash function?

texts:
Recently, I'm reading Non-Interactive Key Exchange, in the section 4.2(Towards a factoring-based scheme in the standard model,Page 10), the authors uses

$$t\gets ChamH_{hk}(Z||ID;r);\\
Y\gets  u_0u_1^tu_2^{t^2};X=Y^x$$
this way, I don't understand why the authors use the chameleon hash function like this, who can tell me why? And I also don't understand the corresponding proof in the appendix D(Proof of Theorem 4,Page 22)


texts: Is it a good or bad idea to include a password's salt in the calculation of a MAC?

texts:
Say there's a cryptosystem where encryption and authentication of data is done using a key derived from a user-given password using something like PBKDF2. Is it a good or bad idea to include the PBKDF2 salt in the MAC?

In other words, which of these two systems is better?

$$Packet = Salt + IV + Enc(Data)$$
$$Output = Packet + MAC(Packet)$$

Or

$$Packet = IV + Enc(Data)$$
$$Output = Salt + Packet + MAC(Packet)$$

Assuming $Output$ is the value being transmitted.

A real system like this would obviously be more complicated. This is just to give a rough idea of what I mean.

One argument for this is that it prevents the salt from being modified without notice. But you already get this from the salt deriving the MAC key.

One argument against this is that it allows for a piece of the MAC'd data to have influence on the derived key to calculate said MAC. But this shouldn't be feasible to attack given good KDF and MAC functions.

Which is better? Is there a difference?


texts: Does the following Diffie-Hellman problem hold in bilinear groups $G\times G \rightarrow G_T$

texts:
For every PPT distinguisher A there exists a negligible function $neg(·)$ such that for all $\lambda$

$|\Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^{ab}) = 1] - \Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^z) = 1]| \leq \textsf{negl}(\lambda)$

where $g$ is a generator of group $G$ of order $p$ where $p$ is a prime of length approximately $\lambda$, $g_1 = g^r \in G$, and $r,a,b,z$ are randomly chosen from $Z_p$


texts: Can "X3DH" instead of HMQV be used for OPAQUE?

texts:
So I recently re-read the OPAQUE paper and while reading it I found HMQV to be a bit "unnatural" / "unintuitive", which may just be because I didn't (yet) read the HMQV paper, so I wondered whether one could replace the instantiation of the key-exchange with the X3DH primitive*.

So this is my question:
In OPAQUE, can we replace the instatiation of "KE" with the below X3DH primitve?

Or asked differently (but equivalently!) per the requirements in the paper:
Is X3DH AKE-KCI secure (and if not can this be easily fixed)?

*: ie we compute $\operatorname{KE}(x_u,p_u,X_s,P_s)=H(X_s^{x_u}\parallel X_s^{p_u}\parallel P_s^{x_u})$ with the $x$ being ephemeral private / public DH keys and the $p$ being static private / public DH keys.


texts: Why we cannot brute force Elliptic Curve private key?

texts:
I am learning ECC, I am confused a bit how it works for now. To my understanding, G is the starting point, k is how many times you apply the dot operation. And Q is the public key, which is the final point after you apply k times dot operations, like this

Q = kG

And then Q is the public key, and k is the private key. We assume it's really hard to find k given Q and G are known. The thing I don't understand (or I misunderstood) is, if the creator of this pair of key, can calculate k times of G to get Q easily in a reasonable amount of time, why can't attacker do the same? I can start from 1 dot operation, then 2 dot operations .... and eventually, I will hit a point that's the same as Q, and because the creator already did this in a reasonable amount of time, so I guess I can do it too (as they need to do k times of operation for thing like Diffie–Hellman)? And if k is super huge, doesn't it take the creator to take a super long time to generate and use it for key exchange? But I don't think it will be that easy, otherwise, it will be useless, just not sure which part I missed.


texts: ECC cryptography with shorter signature when not needing high security?

texts:
I am new here and fairly new to cryptography, so if I say something wrong, let me know.

I am trying to set up a system where a user can receive a temporary license key over the phone, put it into the system, and get the privileges and expiration date which was encoded into the license key.

The limitation for this key is about 100 bits. About 27 will hold the properties of the key, and the rest will be a signature verifying someone didn't make their own license key.

I think we can get away with having a smaller signature size than usual because we are using a cryptography IC which can hold private keys and hash data using SHA-256, and it takes some time to do this (maybe 100ms). If we used this in the verification of a signature, it would keep a hacker from using their supercomputer to crack keys quickly.

For the crypto calculations done in software and not on the crypto IC, we want to use public key crpytography, and ECC seems like the best option right now due to the already relatively short signatures.

Assuming the random component can be calculated based on the 27 data bits (and will always be different for a different license key), can I make the other half of the ECC signature only take up 73 bits? How would this be done?


texts: While doing the affine mapping after calculating the inverse of my polynomial using the EEA, I am not getting the value of the inverse as it should be

texts:
This is the image of matrix multiplication. It is the affine mapping step in the s box layer of AES. My value is not what it should be, therefore I just wanted it to be confirmed by someone else.

I'm getting $(11001000)$ as answer while it should be $(10000011)$; the value of my input is $(11111110)$.


texts: Looking for title of encryption machines book

texts:
I am looking for a title of book in the field of stream crypography.

I vaguely remember, that I saw this book at online shop (maybe amazon) near 5-10 years ago. This book is devoted to electronic machines cryptography (LFSR). Electronic encryption machine (perhaps, military) and LFSR in a "magnifying glass" (shows that LFSRs are used inside this machine) is drawn on the book cover.

Now I can't find this book on ebay, amazon, springer, etc. Please help to recall this book.

Note that this is not book recommendation request. My question covers an actual problem that I faced, and it has unique correct answer (book title). I think cryptography community is a best place where this question can be asked.


texts: What is different below two Ciphersuites?

texts:
I have two questions;

I need an explanation for the differences of below two cipher suites.
How do they work with SSL/TLS protocol? (my main concern first one doesn't have 'ecdhe_rsa' part )

tls_aes_128_gcm_sha256

tls_ecdhe_rsa_with_aes_128_gcm_sha256


texts: Is there an English translation of Vigeneré's "Traicté des Chiffres"?

texts:
I Googled Vigeneré's "Traicté des Chiffres": no English translations,  not even a reference to one. Perhaps someone's Google-wu is better than mine; I can't find it.

I'm slogging my way through a PDF of the 1586 edition of "Traicté Des Chiffres, ou Secretes Manieres D'escrire" by Blaise de Vigenere. The language is early Modern French and doesn't translate easily in Google Translate (the words for 'right' and 'left' back then were droict and gaulche, etc).

I'd love to read it in English. Is an English translation available?


texts: What telltale signs would indicate that quantum computers are about to become dangerous to classical cryptography?

texts:
What would be telltale signs that quantum computers become imminent and sizable danger to classical cryptography in commercial applications ?

Make classical cryptography consist of symmetric algorithms (block ciphers, hashes), and asymmetric algorithms assuming hardness of factorization or discrete logarithm in $\Bbb Z_p$ or Elliptic Curve, with parameters large enough to reach security against classical algorithms run on world-class classical computers. Perhaps, assume access to all results in the field of quantum computing (even secret ones: you are CIA analyst with eyes everywhere).

I suggest "imminent" to be 2 years and "sizable" to be something worth betting for if winnings are 100 times the bet; but feel free to parametrize or change that.

Please develop rational arguments (preferably quantitative) e.g. based on categorizing what's achievable using various breeds of quantum computers, what inherently limits progress in the field, and comparison to other technical advances.

Motivation: this May 18, 2018 article quotes the director of a research lab involved in the development of quantum computers:

  "Anyone that wants to make sure that their data is protected for longer than 10 years should move to alternate forms of encryption now"

and based on that source, the journalist writes:

  Quantum computers will be able to instantly break the encryption of sensitive data protected by today's strongest security (..) This could happen in a little more than five years because of advances in quantum computer technologies.


texts: Can the hash of the ciphertext be derived from the hash of the plaintext

texts:
Let $C$ be a symmetric cipher $H$ a hash function.
Alice uses $C$ with a key $k$ to encrypt plaintext message $m$ yielding ciphertext $c$. She then calculates the hash of the message $h_m = H(m)$ and the hash of the ciphertext $h_c = H(c)$.
Alice then sends $k$, $h_m$, and $h_c$ to Bob.
Is there any combination of $C$ and $H$ for which Bob can prove -- just from the hashes and the key alone -- that there is indeed some message $m$ for which $h_m = H(m)$ and $h_c = H(C(m,k)$.
Note that Bob does not actually have to discover $m$ and that there can be multiple $m$ that have the same hashes.
In short: find the function $magic$ in this diagram
m  --------- H --------> h_m

|                         |
C(_, k)                 magic(_, k)
|                         |
V                         V

c ---------- H --------> h_c

where $magic(h_m, k)$ calculates the hash of the ciphertext from the hash of the plaintext (but the other way around would also work).


texts: Why does NIST SP 800 `KDF in Counter Mode' specification require a PRF rather than a PRP?

texts:
This is the NIST SP 800 KDF in Counter Mode specification.

Where $K_I$ is the input key, $[i]_2$ is the counter value, Label and Context are fixed-length strings and $[L]_2$ is the output size, the input to the PRF for each block $i\in n$ is as follows

$$K(i) := \operatorname{PRF} (K_I, [i]_2 \mathbin\Vert \mathit{Label} \mathbin\Vert \mathrm{0x00} \mathbin\Vert \mathit{Context} \mathbin\Vert [L]_2)$$

I'm trying to understand why

  this Recommendation approves the use of either the keyed-hash Message Authentication Code (HMAC) specified in [8] or the cipher-based Message Authentication Code (CMAC) specified in [7] as the pseudorandom function.

Why not just use a straightforward PRP like AES here? Provided the fixed input data is of the correct width, I don't see why the complexity of using i.e. a CMAC PRF is being added to the construction.

Moreover, looking at the NIST CMAC specification and adapting it for one-block fixed-length inputs it seems the only difference would be XORing a second key with the input to the PRP.


texts: Would this program be useful in cryptography?

texts:
I know nothing of encrypting. I'm not even sure how to tag this.
I wrote a program that can calculate this pretty quickly on my macbook pro 2.3GHz IntelCore i7. The two exponents are Mersenne primes, and no I did not use floats.

It calculated ((2^756839)-1) * ((2^1257787)-1) = a number 606,463 digits long. The exponentiation, multiplication, and all took about a minute? Would it be good for encrypting? Maybe not those numbers specifically, but in general because it wouldn't require me to use a supercomputer. And yes, that is 606,463 digits long. So prime*prime=N, where N, aside from 1 and itself, is only divisible by the two primes. Don't know if it'd be useful at all, but I did it for fun, for something else. I'm going to try working on the reverse(factoring N).


texts: Paillier paper: Number Theoretic Lemma doesn't seem to work

texts:
I'm reading the original Paillier paper.

I've reached Lemma 3: If the order of $g$ is a nonzero multiple of $n$, then $\varepsilon_g(x,y) = g^x y^n \mod n^2$ is a bijection, where $x \in \mathbb{Z}_n$ and $y \in \mathbb{Z}_n^*$.

Take for example $n=6$, $n^2=36, \mathbb{Z}_6^* = \{1, 5\}$.

Let $g=5$. The order of $5$ modulo $36$ is $6$ (see WolframAlpha), which is a multiple of $6$, so $\varepsilon_g$ should be a bijection.

Let $(x_1, y_1) = (1, 1)$ and $(x_2, y_2) = (1, 5)$. Then:

$y_1, y_2 \in \mathbb{Z}_6^*$ as required.
$\varepsilon(x_1, y_1) = 5^1 \cdot 1^6 = 5$
$\varepsilon(x_2, y_2) = 5^1 \cdot 5^6 = 5$ (assuming operations are modulo $36$.)

So... It's not a bijection. Am I missing something?


texts: Proof of the basic differential privacy composition theorem

texts:
The basic composition theorem in differential privacy states, that if I have mechanisms $M_1$, which is $(\epsilon_1, \delta_1)$-differential private, and $M_2$, which is $(\epsilon_2, \delta_2)$-differential private, then $M=(M_1,M_2)$ is $(\epsilon_1+\epsilon_2, \delta_1+\delta_2)$-differential private. (It works for more than two mechanisms, but 2 is enough to illustrate my questions.)

For the proof of this theorem, most papers refer to Dwork et al. "Our Data, Ourselves: Privacy Via DistributedNoise Generation" (section 2.2 thm 1, see pictures below) and I have 2 questions on this proof.

The theorem is most of the time stated like above, without any restrictions on the mechanims. But am I right when I say: To be correct, we always(!) need to assume some form of independence? I.e. that the randomness in the mechanisms must be independent? It looks like that, when reading the proof, but it is never stated in the theorem statement (in all other publications I read), that got me worried...
There is one step in the proof that I can't follow: After they use the differential privacy-inequations for each single mechanism, they say:

  If we look at the additive contribution of each of the δ terms, of
  which there are T, we notice that they are only ever multiplied by
  probabilities, which are atmost one. Therefore, each contributes at
  most an additive δ.

I don't understand this part. The $\delta$ terms are not just multiplied by probabilities, but also by the $exp(\epsilon)$ factor. And this factor is not always smaller than 1. It would be helpful if someone can explain that step in the proof to me in more detail.

Thanks in advance for any help.

Here is the proof copied from the paper:


texts: How do we reduce the multiplications in the AES mix column layer using $x^4 +1$

texts:
I recently learned AES uses $x^4 +1$ to reduce the multiplications in the MixCol layer. However, I used $p(x) = x^8 + x^4 + x^3 + x + 1$ not knowing it was the wrong polynomial and got the correct answer. For example, here is what I did:

\begin{equation*}
\begin{pmatrix}
02 & 03 & 01 & 01 \\
01 & 02 & 03 & 01 \\
01 & 01 & 02 & 03 \\
03 & 01 & 01 & 02
\end{pmatrix}\
\begin{pmatrix}
D4 \\
BF \\
5D \\
30
\end{pmatrix}
\end{equation*}

If, for example,  we consider the last equation $$03 \cdot D4 \oplus 01 \cdot BF \oplus 01 \cdot 5D \oplus 02 \cdot 30 $$
and write it in terms of $x$
we get (after cancelling):
$$x^8 + x^7 + x^6 + x^5 + x^4 + x^3 + x^2 + x$$
Reducing this using $p(x) = x^8 + x^4 + x^3 + x + 1$ I get: $$x^7 + x^6 + x^5 + x^2 + 1 = E5$$.

As far as I know this is the correct answer but I did not use $x^4 +1$ at any point. And when I try to reduce $x^8 + x^7 + x^6 + x^5 + x^4 + x^3 + x^2 + x$ using $x^4 + 1$ I get the wrong answer.

At what point do I use $x^4 + 1$ to reduce the polynomial?
Was my answer just lucky or can we use $p(x) = x^8 + x^4 + x^3 + x + 1$ as I did as an alternative?


texts: How can I validate generated session keys in SRP-6a protocol

texts:
I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys.

On the client I generated a SHA1 hash with equation p = SHA1(A | B | S) where A and B are public keys of client and server and S is the SHA1 hash of the session key. Then I sent this hash without any encryption to the server.

Server then calculates p with its own hash of session key and compare with the incoming one.

Is that the supposed way of validating keys in SRP ?

And while client is connecting to other server in cluster, what is the best way to authenticate connection ?


texts: Technological based solution needed for a real world problem of transferring a physical object between two untrusted parties

texts: Suppose I have a physical object A. Another person also has some rights over the object A. After some litigations, a schedule has been made under which object A will be passed for some time to the other person (e.g. if I possess A then I must give it to the person at a specific time and then after some agreed upon time he will return it to me). Now, the problem is that I cannot trust the other person and he cannot trust me. At any time when we can cheat each other we will definitely cheat. In this situation, what could be a technologically viable solution for handing over the physical object between untrusting parties? (For example GPS based system or anything of that sort). Thanks in advance.


texts: How does DHE-RSA work and why is PFS guaranteed?

texts: How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.


texts:
I build the computer appliance system that consist of software server and multiple controllers. The system I want to build must be pluggable in the sense that when I connect a controller C to the network, the server S will immediately finds it after initial message exchange(Step 1). After an initiation phase both C and S start TCP servers and able to send and receive messages to each other during multiple sessions (Step 2) without need for repeating Step 1 between sessions.

And now several challenges that I should to resolve

Prevent spoofing of C and/or S on Step 1
Prevent spoofing of C and/or S on Step 2
Prevent replay attack on Step 2
Ensure message confidentiality on Step 2

And here are some thougts about it:

I should authenticate both sides on Step 1 to solve the first problem.
I should perform the key exchange on Step 1
I should encrypt all messages on Step 2 with symmetric key that have been received while Step 1 key exchange to solve the fourth problem.
I should use nonces or timestamps on Step 2 to solve the second and third problems

Finally I want to ask some questions:

Are my thoughts about solving the problems right?
What is the best protocol for performing both authentication and key exchange at the same-time?

EDIT: The messages sended infrequently, so I need a lightweight protocol on Step 2. The protocol must be stateful of course to store symmetric key and possibly other auth info between sessions.


texts: Are there any hash functions that are commutative yet secure for ordered lists?

texts:
I'm looking for a hashing function that can combine random numbers together in any order yet still find the same value. But it needs to be secure against hackers.

The idea is if I'm hashing together: $A, B, C$, and $D$

Where hash of $x = h(x)$:

I'm looking for a hash function that allows:
$$h(A+B+C+D) = h(A)+h(B)+H(C+D) = h(A+B) + h(C) + h(D)$$

The $+$ symbol could be the same hash, could be something different.

I want something that is highly compressed, as in no matter how many additional items you add, the length doesn't grow.

The idea is that I can pop out any item from a long list of hashed items and prove that the items before X plus X plus the items after X can be proved to be part of a set.

I don't want Merkle tree or accumulator because both have relatively long proofs or the total size of the 'key' though that's kind of what I'm looking for. For my application, unfortunately, memory is very important.


texts:
Say I can generate many 1024-bit RSA public keys $(N,e)$ with fixed public exponent $e = 65537$. They turn out to be heavily biased when computing $N \bmod x$ for small primes $x$. These congruences always seem to hold:

$N \equiv 1 \pmod 2$
$N \equiv 1 \pmod 3$
$N \equiv 1 \pmod 5$
$N \equiv 1 \pmod{11}$
$N \equiv 1 \pmod{89}$

So $N = 29370 * k + 1$. What does this mean for $p$ and $q$? Can a ROCA-style attack be carried out? How does one use this information to factor $N$?


texts:
I was just looking at some NIST PRNG recommendations, specifically at Hash_DRBG. I read briefly through the algorithm, and even though it is not overly complex, it still seems unnecessary to me. I asked myself how I would implement a (cryptographically secure) PRNG on top of a Hash algorithm (SHA256 or SHA512), what came up is:

Idea one:

Obviously this can only provide half the "strength" of the hash

Initialization: state = hash(seed);
Iteration: output = first_half_of(state); state = hash(state);
Reseeding: state = hash(state || new_seed)

Idea Two:

Maybe with a separate counter

Initialization: state = hash(seed);
Iteration: output = hash(state); ++state;
Reseeding: state = hash(state || new_seed)

Now, these two "schemes" seem safe to me, I'm a complete crypto noob though. The point is that I don't think that I'm the first one to think of these very basic PRNGs, and I'd like to understand the reason for NIST not to choose something similar in their recommendations. Do these PRNGs have some (obvious?) weaknesses? (If not, is there something known about after how many iterations they should be reseeded?)


texts: If P256 ECDH shared secret contains ~128 bits of security, does using first half of the secret (= 128 bits) contain only 64 bits of security?

texts:
There's this rather popular open source project (I'd rather not name it before possible responsible disclosure) that computes a P256 ECDH shared secret (256 bits) and uses only first half of it, rams it through a KDF, and uses the result as a 128-bit AES key.
I'm wondering if that's problematic regarding its security since it looks like it's trying to offer 128-bit security, but I wonder if the result is 64-bit security because even if you take 128 bits of data that has 64 bits of security (i.e. "true randomness") and pipe it through a KDF, it still has 64 bits of security?
Here's my thinking as a drawing:

Am I right in thinking they should've piped the whole shared secret through the KDF to "compress" the 256 bits to 128 bits to retain 128-bit security?
The assumptions I am running on are that P256 ECDH shared secret contains 128 bits of security, and that if you take any single byte from the shared secret, only 4 of the bits inside the byte are truly random.


texts: S-box for byte substitution where the s-box values are multiplicative inverses of 257

texts:
The title basically says it. We have a 16 by 16 s-box, $256$ entries total. And the first value is the multiplicative inverse of $257$, so

$1 \times k \bmod 257, \space k = 1$.

$2 \times k \bmod 257, \space k = 129$.

$3 \times k \bmod 257, \space k = 86$

$\ldots$

Would this be secure? and if the value is higher then $255$, then we choose the lowest unused number.


texts: Parameter $f(x)$ in binary ECDH exchange protocol

texts:
In the binary case of Elliptic-Curve-Diffie-Hellman (ECDH) exchange protocol the domain parameters are $T = (m,f(x),a,b,G,n,h)$. What is the meaning of parameter $f(x)$?

You may find the definition of the protocol in wikipedia I've gone trough other books and materials but found nothing.


texts: How can I break REDSHIRT / REDSHIRT2 encryption?

texts:
Recently, a user on Gaming.SE asked a question about whether the user password in the video game Uplink could be modified after being initially set.  The game does not contain an option to change the password, and the password is repeatedly displayed in plain text throughout in the game.  Obviously, this is a problem if a user accidentally uses a valuable password.

The game stores the password in the save file, which could be edited, except that the save file is encrypted using Introversion's REDSHIRT encryption scheme.  How do the REDSHIRT and REDSHIRT2 encryption schemes work, and what is the decryption algorithm?

Be Aware: Details of REDSHIRT encryption have already been discovered and published:

http://www.mario-konrad.ch/index.php?page=14002
http://uplinkfan.blogspot.com/2011/10/getting-book-2-of-uplink-game-bible.html

I'm asking this question only to benefit future users.  I do plan to post my own answer, but I'll be happy to upvote and accept anyone who explains it better than I can.


texts: Is it guaranteed that all possible random numbers can be produced?

texts: As far as I know PRGs get an input (seed) and generate a larger output value than the input. Therefore is it possible that some outputs will never be generated? based on the fact that input is smaller than the output.


texts:
What are the differences between checksums (e.g. Fletcher, Adler, CRC), non-cryptographic hashes (e.g. xxHash, MurmurHash, CityHash) and cryptographic hashes (e.g. MD5, SHA1, SHA3)?

I am familiar with checksums and how they're used to detect errors in data, and how the design can influence collisions (like [0,0] [0,0,0] would give the same checksum in many simple algorithms, even Fletcher).

I also have a basic understanding of how cryptographic hash functions work. They're more taxing to compute, produce a more randomized output, and generally have a larger output size than a checksum. And somehow they're designed to be secure.

However, non-cryptographic functions are a mystery to me. None are really taken seriously or standardized. We have CRC32 being implemented in hardware, huge competitions for the new SHA3 standard, etc. But non-cryptographic functions appear to be just curiosities made independently. And Google's CityHash is apparently made specifically for strings.

If hash tables are solely the purpose of non-cryptographic hashes (and strings, as CityHash advertises), then are they not appropriate for error-detection in large binary data files that SHA1 and CRC32 are often employed for?

I have noticed striking similarities in the source code of simple algorithms such as DJB2 and Adler32, for example. They all appear to accomplish the same thing.

I've used MD5 in the past to find duplicate files, errors in file downloads, and to identify minor differences in otherwise identical files. MD5 is also supposed to be not that fast, with CRC32 achieving the same thing, although with potentially more collisions (which bothers me a bit).

As for my ideal use case, I would prefer an algorithm like MD5 (or shorter output length) that is as fast as possible (no security considerations required), with as few collisions as possible. It would be used as a fast checksum/file fingerprint. Recently, I have found the 128-bit version of MurmurHash3 (specifically the x86 version for JS implementation) to fit these requirements. But again, MurmurHash is not a checksum--it's for hash tables, so I don't know if this would be a misuse.

Can anyone explain the differences, or refer me to any books/articles on the subject?


texts: Implementing 5 modes of operation with a hash function

texts: Is it possible to implement any of the 5 modes of operation (ECB, CBC, OFB, CFB, CTR) with a hash function?


texts:
I know there are 4 known weak keys, their value and that double encryption using one of the weak keys should give back the plain text.

I implemented this in OpenSSL. I have a plain text $m$ in a file plain.txt and compute $y = DES_k(m)$ where $k$ is a weak key. Then I compute $y' = DES_k(y)$. Instead of getting $m$ I get only a portion of it and the rest is part of $y$.

Why is this happening?


texts: Common password derivation function for different encryption methods

texts:
I'm writing a simple encryption/decryption library which has the following requirements:

For key derivation functions, support:

$SHA256 \rightarrow bcrypt$ (since $bcrypt$ limits input passphrase length, hash it using SHA-256 first, then feed output of SHA-256 into bcrypt)
$PBKDF2$

For key derivation functions, allow custom iteration count.
For encryption/decryption support:

AES-256
AES-128
Triple DES

Authenticity using HMAC+SHA256 every $n$ bytes

Since I'm potentially using multiple different symmetric key algorithms for encryption and decryption, I have the following problems:

How do I deal with different output sizes from my KDFs?
How do I deal with different key input requirements from my symmetric key algorithms?


texts: 3-round DES: what bit do we find? (Regarding matsui's Paper on Linear Cryptanalysis of DES)

texts:
In Matsui's paper, Section 5 ‘Linear Approximation of DES Cipher’, Matsui gives two similar equations: Eq. (6) for the first round and Eq. (7) for the third round.
The two equations give an approximation of bit $K_1[22]$ and bit $K_3[22]$. Then he derives in Eq. (8) from Eqs. (6) and (7) an approximation of $K_1[22] \oplus K_3[22].$

From what I understand, the 3-round DES linear approximation is supposed to give an approximation of only one bit of the key, but here I see two bits from the partial key.

Which bit of the actual key does this approximation refer to?


texts: Time complexity of looking up in a rainbow table

texts:
It is mentioned in the famous paper Making a Faster Cryptanalytic Time-Memory Trade-Off (pdf) by Philippe Oechslin that:

  The total number of calculations we have to make is thus
  $\frac{t(t−1)}{2}$. This is half as much as with the classical
  method. Indeed, we need $t^2$ calculations to search the corresponding
  $t$ tables of size $m × t$.

However, my result doesn't agree with his. Here is my idea:

If we count a single application of a reduction function as 0.5 calculation, we'll have to do $0.5 + 1.5 + ... + t-0.5$ calculations in the worst case when looking up in a rainbow chart, that is, $\frac{t^2}{2}$ calculations, greater than the author's $\frac{t(t-1)}{2}$. In contrast, the original method seems to call for $t(t-\frac{1}{2})$ calculations, fewer than the author's $t^2$.

Also, the author's $\frac{t(t-1)}{2}$ and $t^2$ gives $0$ and $1$ respectively when $t=1$, which seems strange.

So who is wrong?


texts: How can I convert numbers into prime numbers?

texts:
I'm working with one-way accumulators, but I'm not knowledgable in cryptography. Is there an easy peasy way to hash numbers (or whatever) into prime numbers?
Obviously I'd like it to be collision resistant and all that, but this project is huge, I'm alone and I'm confident someone else in the field will pick up from there.
Also, primality tests are linear in n or what?
Thanks


texts:
The Problem is as follows:

sage: p=235322474717419
sage: a=0
sage: b=8856682
sage: E = EllipticCurve(GF(p), [a, b])
sage: P = E(200673830421813, 57025307876612)
sage: Q = E(40345734829479, 211738132651297)
sage: P.order() == p
True

As we can see, P.order() is equal to p, so obviously we can use Smart's attack to calculate the value of k, so i implement the Smart's attack according to the paper Weak Curves In Elliptic Curve Cryptography.

And when we use this kind of attack we will get k = 9762415993955:

sage: SmartAttack(P,Q,p,8)
9762415993955

But actually the correct value of k is 152675955744921:

sage: P*152675955744921 == Q
True

So my question is:

  Why Smart's attack doesn't work on this ECDLP?

P.S. The implement of Smart's attack is correct cuz it can calculate the correct value of k in some former CTF games.


texts: ElGamal: different message with equal length random key

texts:
This situation applies to ElGamal digital signatures: consider messages m1 and m2 which we will encipher with a random key. The random key has the same Hamming weight. Is this situation secure? Why?

I have been unable to find more information about it.  Can we extract a message?

With reference to semantic security, could someone please describe the security situation when we encrypt messages using a key whose length is about the same as that of the messages?


texts: What exactly is a quantum key distribution network for?

texts:
There are many diagrams out there explaining how quantum key distribution works on a physics /optics and mathematics level. I understand these explanations fairly well so I'm not asking about the underlying principles.  This is one of the few that actually features people on it (although they seem to be fairly incidental to the usage):-

As I understand it, the machines only transmit keys not actual business data.  I appreciate the exchange is done with one time pads, but is it like Diffie–Hellman key exchange otherwise, but only between fixed machines /servers?  Do they replace entering AES keys transmitted over the phone /fax? Since AES is hard to break, surely the keys don't need replacing every hour?  And do they then operate in pairs, because two is only a network from a marketing perspective.  They can't control the log in into my desktop computer can they? And wouldn't all the desktops have to be interconnected with fibre optics rather than Ethernet? The latter is probably a rather naive question.

This additional image clearly shows the transmission of secure encryption keys through a Toshiba quantum network:-

At a separation of 20Km, the devices are generating /exchanging keys at a rate of 10 kbits/s.  Why as that's 40 no. 256 bit AES keys each and every second?  What exactly does someone do with 140,000 unbreakable AES keys per hour? Even more ridiculously, that's a million new keys in a single business day.

I'd appreciate an answer from a operational perspective, although I realise that this is firstly a cryptography theory site.  So what's it for?

I looked at Quantum key exchange skepticism/confusion  and a simulated network, but both were unfruitful.


texts: can you suggest any applicayion for implementing threshold homomorphic encryption cryptosystem(Paillier cryptosystem)

texts: I want to implement one project in multi party homomorphic encryption using paillier. Can you suggest any application for implementation.


texts: Significance of rotation constants in SHA-512?

texts: In a single round of SHA-512, in the operations $\Sigma_0(A)$, $\Sigma_1(E)$ why are the constants $28$, $34$, and $39$ used for the number of rotations? What significance do these numbers have? What if they are changed?


texts: linear cryptanalysis: how are the subkey bits removed from the linear approximation?

texts:
I'm currently reading the tutorial on linear/differential crypta here: https://www.engr.mun.ca/~howard/PAPERS/ldc_tutorial.pdf

End of page 14/Beginning of page 15: all the bits from the subkeys are summed up to a sum(k) variable. It is then written as 0 in the equation (5) and the probability stays the same.

I don't understand this step, why is the probability not changing if sum(k) is zero, and why is it 1-p if sum(k) is 1?


texts:
Is it possible to send a single encrypted data message to multiple users so that the users receiving the message can only decrypt certain parts of the message, depending on their rights.

For example, I send a message "Hello World", User A could decrypt and receive the whole message(hello world), but user B could only decrypt a certain part and receive the message as "hello" only.


texts: 64 bits cipher and birthday boundaries in ECB

texts:
I am using a 64 bits symmetric ciphers (blowfish), to encrypt a plain block using ECB.

The plaintext is always 64 bits long, but due to some limitations I have to use the same key (448 bits long) everytime.

The plaintext is always different.

I was looking to birthday attack but I find papers related to CBC mode only.

Is my scenario affected by this kind of attack?


texts: The purpose of the final xor in Davies–Meyer scheme

texts: In Davies–Meyer hash construction scheme each block is xor'ed with the previous block cipher text. Why? The only obvious flaw I see in a scheme without this xor is the possibility to reconstruct a hash for a head of a message if the tail is known. Is it the only flaw or it also prevents other attacks?


texts:
I have a case where it may be possible for an adversary to deduce the plaintext inputs that went into creating a AES-128-GCM encrypted message (there is good IV diversity across the encrypted messages, however)
This opens up the potential to expose a GCM "oracle" to the adversary who may additionally be able to adaptively modify the inputs to the encryption function and observe the GCM encrypted outputs. I'm thinking about adding a random string of bytes of some fixed length to each encrypted message in order to prevent this (since an attacker would no be able to guess the random bytes that were appended and would therefore not know the full plaintext for a corresponding ciphertext). Some questions:
1) Can someone provide a "rule of thumb" around how much randomness should be appended to each message of a given length.
2) Does one need to take particular care around how the random byes are added an removed from the message
3) Are there any other methods one can employ in order to avoid exposing the encryption "oracle" described above?


texts: How to attack Merkle-Hellman cryptosystem if the first element in the superincreasing series is too small?

texts: In An Introduction to Mathematical Cryptography Jeffrey Hoffstein et al. claim that "It turns out that if $r_1$ is too small, then there are easy attacks, so we must insist that $r_1>2^n$." Here $r_1$ is the first element of the superincreasing series used in the Merkle-Hellman cryptosystem before it is disguised with modular arithmetic and $n$ is the number of elements in the series. Does anyone have information on how these attacks might work or a basic explanation of why too small $r_1$ is unsafe?


texts: How do I properly calculate an inverse element for curve25519 when implementing Sphinx password store protocol?

texts:
There's a new password store mechanism, called Sphinx
http://webee.technion.ac.il/~hugo/sphinx.pdf which is very nice and protects from device or user compromise. I haven't found any implementations and tried to do my own using curve25519 primitive and libsodium.

There's login phase when user and device do communication and that's where I got stuck, though it looks pretty simple.

I convert hash to a valid curve point x using elligator2.
Then scalar multiply it by some random ρ. Then "device" multiplies it by its k.

So, I have β = x * ρ * k.

I'm stuck at the point where I need to do β1/ρ

in Ref10 implementation of curve25519 there's "feInvert" function which I tried to apply to ρ and then scalar-multiply again, but that did not work.


texts:
I am reading an intro book about cryptography and the author tries to explain why using pseudo random number generators is vulnerable.

Given PRNG equation;

\begin{align}
S_0 &= \text{seed}\\
S_{i+1} &\equiv A\cdot S_i + B \mod m, i = 0,1,\ldots
\end{align}

where we choose $m$ to be 100 bits long and $S_i,A,B \in \{0,1,\ldots,m−1\}.$ Since this is a stream cipher, we can encrypt

$$y_i \equiv x_i + s_i \mod 2$$

Further in the text:

  But Oscar can easily launch an attack. Assume he knows the first 300
  bits of plaintext (this is only 300/8=37.5 byte), e.g., file header
  information, or he guesses part of the plaintext. Since he certainly
  knows the ciphertext, he can now compute the first 300 bits of key
  stream as: (Equation 1) $s_i \equiv y_i + x_i \mod m, \; i=1,2,\ldots,300$

There are several things about the paragraph above that I don't understand.

Firstly, by what mechanism could Oscar gain the first 300 bits of plaintext? It makes little sense for Alice (the person who tries to securely communicate with Bob) to send encrypted and plain text together.
Is there a situation this happens?
How exactly could Oscar predict the word and location of cyphertext?

Secondly, I don't understand how Equation 1 was derived?

I appreciate any help.


texts: When we use permutation and random long sting to hide a message

texts:
This question is modified version of this:
Can we use merely permutation to hide a message?

I have an English name $m=m_1 || m_2 ||..||m_{30}$.

I pick a random string $d=d_1 ||..||d_{70}$

I mix the values $m_i$ and $d_i$ together and permute them (using pseudorandom permutation) to get a value $v$. So $v$ will be a string of length 100 containing both $m_i$ and $d_i$ values.

We assume that the adversary knows the message's length.

We know that in order for the adversary to find the right name it needs to do $\frac{100!}{30!\cdot 70!}=29372339821610944823963760$ try.

Question: Given the value $v$ can the adversary learn the English name with a non-negligible probability? Is there any way for it to by pass that much try?


texts: CPA security of a stateless and deterministic encryption system

texts:
Why can no stateless and deterministic encryption system be IND-CPA secure?

Is there a formal proof for it?


texts: What is the maximum length of a X.509 OID?

texts:
I'm working on a feature for a project to determine if a given X.509 certificate is an EV Certificate, and if so, who is the authority behind that certificate.

To do this, I grabbed the list of EV OIDs from Wikipedia, and keep them in a hash of OID -> Authority Name. I get the certificate policy OID and convert it into a char array that I can use in my hash.

However I'm unsure about what the maximum length of a OID can be. I'm having trouble locating that information in the spec or anywhere else online.


texts: When trying to break an encoded message by trying to guess the key, how does one recognize that the key is correct?

texts:
Assume the following:

algorithm used is known
encoded message is known
key is not known

When trying a guessed key, every guessed key will result in some output. How does one recognize that the key is correct?
I'm asking this regarding the movie, in which people during WW2 in Great Britain used some mechanical computer. For this to work, they would need some mechanical recognition to signal that the resulting text is not gibberish.


texts: Authentication of data using XOR and a secure function

texts:
Suppose that:

$i$ is a zero-based index.
$K$ is a secret key.
$X$ is a stream of data.
$x_{i}$ denotes the $i$th block of data in $X$.
$s$ is the number of blocks in $X$.
$X = x_{0}\mathbin\|x_{1}\mathbin\|\dots\mathbin\|x_{s-2}\mathbin\|x_{s-1}$.
$y_{i}$ is a value derived from $x_{i}$, $i$, and $K$ in a way that incorporates some known-to-be-secure function (like a block cipher).
$\alpha = \bigoplus\limits_{i=0}^{s-1} y_{i}$.

If the authentication tag is derived from $\alpha$ and $K$ in some way that uses the same function used to in deriving $y_{i}$, then would this be a secure authentication algorithm?


texts: What Are Advantages and Disadvantages of SHA-256?

texts: I'm a newbie to Cryptography. I'm learning about SHA-256 hash function now and I wish to have an overall look on it. What are its advantages and disadvantages comparing to other hash functions, like X11, Scrypt,...?


texts: From this popular Crypto.SE thread, the general feeling is that Encrypt-Then-MAC is the most secure. From the first answer, the poster says that Encrypt-And-MAC provides integrity of the plaintext. If I'm transferring classified data between two parties, then this plaintext integrity should prevent malicious modifications, right? Assuming there are no known-plaintext attacks feasible in this scenario, is Encrypt-And-MAC secure? The thread seems to recommend against it, although I can't see why it would be considered insecure.


texts: Substitution Cipher Help: Can't figure out keyword

texts:
Given a keyword, you can encrypt a message using alphabetical substitution like this:

plain: a b c d e f g h i j k l m n o p q r s t u v w x y z
cipher: C I P H E R A B D F G J K L M N O Q S T U V W X Y Z
result: C A K S Y I B L T Z P D M U H F N V E G O W R J Q X

My problem is my professor literally never covered this topic and is putting on our upcoming exam. The example problem he gave us is as follows...

  Use your knowledge of Substitution Ciphers to find the keyword:

  UZQSOVUOHXMOPVGPOZPEVSGZWSZOPFPESXUDBMETSXAIZ
  itwasdisclosedyesterdaythatseveralinformalbut

  VUEPHZHMDZSHZOWSFPAPPDTSVPQUZWYMXUZUHSX
  directcontactshavebeenmadewithpolitical

  EPYEPOPDZSZUFPOMBZWPFUPZHMDJUDTMOHMQ
  representativesofthevietconginmoscow

I have tried using frequency analysis of the ciphertext, I found that the most common plaintext letters for the keyword are "e","t", "i", "a", and possible "o" and "c".

Is there something I am missing?

EDIT: Looking online, I learned this is something called a Playfair cipher. Still cannot solve it though :( i don't know why I am having so much trouble with this.


texts: Stretching definition of pseudo random number generator

texts:
I am wondering if someone can say if the following qualifies as a PRNG.  Input a random bit seed of length $n$ into the generator, and over $k$ steps the generator uses $k$ publicly known integers to compute the pseudo random bit sequence, outputting a stream of $kn$ pseudo random bits.

I am wondering if the use of the $k$ (predefined) integers in computation still qualifies as a pseudo random number generator; if the integers need not be private, and need not be determined by the user do they count as part of the seed?


texts: ECIES/ ECDHE/ EC-ElGamal encryption comparison

texts:
I need to choose an encryption system, so I am trying to understand the differences between the existing options. I always find that people compare ECIES (Elliptic Curve Integrated Encryption Scheme) with RSA or ElGamal. It is clear that elliptic-curve-based encryption schemes are much more robust than RSA and ElGamal. So, I have decided to use an EC-based solution.

The problem now is that there are different EC-based encryptions--ECIES, ECDHE (Elliptic Curve Diffie-Hellman Encryption), EC-ElGamal--but I have been unable to find a clear explanation of their common features and differences.

Could someone provide me with a reference/study/comparison of these EC-based encryption solutions? Or could someone explain to me their basic differences? In particular, which one is the best in terms of resources consumption?


texts: Why does RSA need p and q to be prime numbers?

texts:
Despite having read What makes RSA secure by using prime numbers?, I seek clarification because I am still struggling to really grasp the underlying concepts of RSA.
Specifically,  why can't we choose a non-prime $p$ and $q$?
I do understand the key concept: multiplying two integers, even two very large integers is relatively simple. However, factoring a large integer is extremely difficult, even for a computer using known factoring algorithms.
If this is correct, then the original question posed by the OP in this thread continues to befuddle me.
This section from Henrick's answer in this post contains the relevant information:

It also means that if you were to select $p$, $q$ just as odd integers, you
would make it harder for yourself to find $\phi(n)$, while at the same time
decreasing the relative size of the second-largest prime factor, and
thereby making it easier for everyone else to factor n. In fact, it
would be as hard for you to factor n as it would be for everyone else,
so you would completely lose the trapdoor component of your scheme
(if not making it completely infeasible to find a pair $e$, $d$).

But I do not understand why we make it harder for ourselves to find $\phi(n)$. I BELIEVE that it has to do with the fact that for any prime, $n$, all integers up to $n-1$ are relatively prime. If the integer is not prime, then we actually need to find which integers up to n are actually relatively prime.
I understand how we are decreasing the relative size of the 2nd largest prime. For example: $10403$ has prime factors of $[101,103]$ while $11000$ has prime factors of $[2, 2, 2, 5, 5, 5, 11]$.
So, if I understand things correctly, choosing a non-prime $p$ and a non-prime $q$ would theoretically work, but the issue is that we would be creating a more insecure encryption scheme since:

the product of non-prime $p$ and non-prime $q$ are more easily factored (2nd largest prime is smaller than if $p$ and $q$ were prime);
finding $\phi(n)$ becomes more difficult for the key generator step, which decreases efficiency with the aforementioned decrease in security

Sorry if this is completely obvious, but I am a newbie in higher math and programming. I really want to understand this as deeply as I can.


texts: Is there a human readable easier version to represent PGP Private keys?

texts:
I'm working on a distributed application, and we need a way to authorize clients. Every client has a PGP keypair associated with them, and we require them to enter their private key (which is not stored) through which their pubkey is derived and used to identify clients and modify their fields on the distributed database.

Now, considering user experience, entering a private key on a website whenever you need to do something is troublesome. But we also cannot maintain a central database for username/password based authentication as that creates a single failure point (not what the distributed application is meant to do)

I am hoping there is some way to get an easier to remember human readable descriptor of the private key which can be used to authenticate - if something like that exists. Any other ideas are appreciated too.

P.S. - For background, I am not a cryptographer, I am a computer developer, so I don't fully understand how PGP works - excuse me if this is a noob question.


texts: What was the problem in the SSL version 2.0?

texts: What is the main reason (attacks) the appearance of the protocol SSL version 2.0 to replace version 3.0?


texts: Number of combinations required to brute force

texts:
I am trying to encrypt a password in a program. Here is the process:

Let us assume that I have a string $p$ ($n$ characters long) which contains the password. Now the program reverse the string and stores it in string $r$. After that it takes each character of $p$ and $r$ applies the XOR operator and stores it in string $e$.

Next time the user want to access the file he/she will be asked to enter the password. The entered password will go through the process explained above and will be compared to string $e$. If both are not equal access will be denied.

I want to know the number of combinations of it will take a computer to brute force the password ("just to show if the encryption is mathematically effective or not, during the presentation"). Thanks


texts: Validating a shared secret between two parties, one bit at a time

texts:
What is the following protocol known as?
Is it considered secure? Would it work?

Background

Alice and Bob each have a secret.

They wish to determine if they both know the same secret.

If they do share the same secret, they are happy for each other to know this. If they don't share the same secret, they don't want to disclose that secret to the other person.

There is no trusted third party.

They communicate over a secure channel.

Protocol

Alice tells Bob the first bit of the secret.
Bob compares this bit to his own secret, if it matches, Bob shares the second bit of his secret with Alice, if it doesn't match, Bob shares a random bit with Alice.
Alice compares this bit to her own secret, if it matches, Alice shares the third bit of her secret with Bob, if it doesn't match, Alice shares a random bit with Bob.

They each continue step 2 and 3. If at any point, their bits don't match, all subsequent bits they share are random.

If they reach the end and every bit has matched, they know they share the same secret, if at any point a bit didn't match, they know they didn't share the same secret, and keep the rest of the secret safe.

Of course this depends on randomness, so there is a small chance you don't share the same secret, but will come to the conclusion that you do, it's dependent mostly based on the length of the secret, the longer the less likely you run into coincidence that those random bits just happen to match up.

To protect against leaking the start of the message too easily, Alice and Bob could pre-pad their true secret with a shared random pre-secret key.


texts: How to construct a hash function that maps any binary string into a multiplicative group element?

texts: Pairing based cryptography schemes such as identity-based encryption or different attribute-based encryption schemes (CP-ABE, KP-ABE etc.) often make use of a hash function defined as  $H_1:\{0,1\}^* \rightarrow \mathbb{G}_1$. Where, $\mathbb{G}_1$ is a multiplicative group of some large prime order $p$. Then, the function $e:\mathbb{G}_1 \times \mathbb{G}_2 \rightarrow \mathbb{G}_T$ is called a bilinear pairing if it has bilinearity, non-degeneracy and computability properties. Here, $\mathbb{G}_2$ and $\mathbb{G}_T$ are also groups. Now, my question is, how such a hash function $H_1$ is constructed?


texts: What is the functional role of CKY-I and CKY-R in ISAKMP (IKEv1)?

texts:
According to RFC 2409:

  CKY-I and CKY-R are the Initiator's cookie and the Responder's cookie, respectively, from the ISAKMP header.

Each CKY is a 64 bit value that is included in each ISAKMP Header in the Phase1 and Phase2 negotiation, and future ISAKMP informational exchanges.  And they are also used in the math for key generation.

Also in the ISAKMP RFC, I see that the Cookies are used to Identify the ISAKMP Security Association (SA):

  Per the base ISAKMP document, the ISAKMP SA is identified by the Initiator's cookie followed by the Responder's cookie

(although I'm not sure what "base ISAKMP document" they are referring to)

Given all these describe what the CKY-I and CKY-R values are, I am curious to understand why they exist.  Effectively, what is the functional role they play?

If they solely exist to identify the SA, why not simply use an SPI value like IPsec does?  Or, why not simply pick a random arbitrary value to use and not include it in all the key material calculation?

Bonus question:  “How” are they created? I imagine they are random values, but I couldn't find any confirmation related to that in the RFCs.


texts:
The task

Encrypt data in a way that a freely choosable quorum of n people out of a group of m participants are required to decrypt that data.

It is not necessary to have to fulfil the quorum to encrypt data.

What crypto systems and algorithms exist that solve this task?

Example: A poor solution that does the trick

A method that seems obvious but scales poorly, is to create a separate ciphertext for each permutation of n people, creating m keys and encrypting each plaintext-copy n times with n different keys.

m = 4, n = 3

ciphertext1 = m( m( m( plain, keyA ), keyB ), keyC )
ciphertext2 = m( m( m( plain, keyA ), keyB ), keyD )
ciphertext3 = m( m( m( plain, keyA ), keyC ), keyD )
ciphertext4 = m( m( m( plain, keyB ), keyC ), keyD )

Downsides:

This requires a single point of trust. Whereever the plaintext is encrypted, all keys have to be known as well.
It does not scale. The effort in storing and distributing keys and ciphertext is very high. Furthermore the encryption function needs to be called m*n times

A slightly better variant would use the scheme above and instead of encrypting the payload, an encryption key that works on actual data would be encrypted instead.
 This removes the need to perform the encryption operation on the payload multiple times and to store multiple copies of the encrypted payload.


texts: XOR of 16-bytes variables gives a result of size not equal to 16

texts:
I'm trying to write a XOR code for implementing CBC mode of operation from scratch but i seem to have some problem.The function takes two byte variables of 16bytes and the expected output should be 16bytes which we get it from the first line in main but when that string is converted to bytes the size increases. Feels like I'm misunderstanding something

from binascii import unhexlify
import os

def xor(string1,string2):
    list1=[]
    for i in range(len(string1)):
        list1.append(chr(string1[i]^string2[i]))
    return (("".join(list1)))

if __name__ == "__main__":
    print(len((xor(os.urandom(16),os.urandom(16))))) #always comes out 16 #type string
    print(len((xor(os.urandom(16),os.urandom(16))).encode("utf-8"))) #never equal to 16 #type byte


texts: Does any problem arise when the order of an elliptic curve is equal to its prime field modulus?

texts:
Regarding cryptographic schemes in elliptic curve cryptography, is there a problem with having the order of an elliptic curve being equal to its prime field modulus?

That is, an elliptic curve where $\#E(\mathbb{F}_p) =p$ for some prime $p$?

As I understand it, this seems to be an optimal curve because by the lagrange's theorem the order of an elliptic curve's subgroup must be divisible by the order of the elliptic curve. But if the order of an elliptic curve is prime, that then that means that any point in this curve is a generator that produces all of the points in $E$ and has a cofactor of $1$. For example, this curve here.

So, is there some kind of 'gotcha' with this sort of elliptic curve? Something that might allow an attacker to easily solve it by some math trick? Of course, assume for an elliptic curve some large prime $p$ but with the same properties.


texts: What are alternatives to Proof of Work for consensus of a blockchain that doesn't contain anything of value?

texts:
For example, a distributed blockchain that would keep track of the weather. Anyone could add a weather reading, and several of these would be stored in each block, just like transactions in a cryptocurrency. There is no reward for mining these blocks, so speed of mining wouldn't be a huge concern for inflation, all that would matter is that all the nodes agree.
It seems to me that Proof of Work would work for this, but it would be lots of effort for nodes to get nothing in return, also the benefit of slowing mining isn't really important. Proof of Stake seems to be the next most popular consensus mechanism, but I can't see how that could possible work in this situation, where you have nothing of value to risk.
What other methods of consensus could work for this?


texts:
I wish to agree with a 3rd party on using RSA-PSS algorithm for a implementing a Digital Signature Scheme. I want to avoid selection of RSA parameters like salt length, hash algorithm etc at my side and share the required configuration parameters.

Instead I want to refer to a standard where all the parameters are already standardized so that we both can commonly refer to the same standard. We will perform signing at his side and verification at my side.

Are these parameters stardized by FIPS or IETF or ISO/IEC so that we can avoid a big deal of overhead? If yes, which standard deals with this?


texts:
What are the principles of fingerprinting.

For example, I could take a hash of an object, which means that if exactly the same digital object re-appears I can recognize it (collisions excepted).  However, to improve robustness, I would like to recognize any slightly altered version of a photograph (say re-sized or slightly clipped or rotated).  Similarly with biometrics, such as real "fingerprints", each time we measure, we will get a different image, but we will hopefully produce a digital fingerprint signature that matches this and only this real-life fingerprint - in theory anyway!

What are the principles underlying "fingerprinting" in general?  What makes a good "fingerprinting" algorithm?


texts: What AES mode should I use to encrypt Text

texts:
I prefer using AES_256_GCM_NOPADDING for data encryption but is it the method I should use?
For instance:
I am encrypting sensitive TEXT that is shorter than 1000 characters
I need a Private Key AES mode
I have a program that constructs the key out of the 5 passwords I enter.
Thank you for the answer!


texts: When does the SIS (Short Integer Solution) Lattice-problem start becoming easy (According to the parameters size)?

texts:
SIS (Short Integer Solution) Problem : Given $m$ uniformly random vectors $a \in Z_q^n$, grouped as the columns of a matrix $A \in Z_q^{n.m}$, find a nonzero integer vector $z \in Z^m$ with $||z|| \leq \beta \lt q$, such that $Az = 0 \mod q$.

Concerning the hardness of the problem, there is a theorem that states that : for any $m = poly(n)$, $\beta \gt 0$, solving $SIS$ is at least as hard as solving other approximation problems like $GapSVP_\gamma$ (Decisional approximate Short Vector Problem) and $SIVP_\gamma$ (Short Independant Vector Problem) on arbitrary n-dimensional lattices, for some $\gamma = \beta.poly(n)$.

My question is : what are the maximum values of $\beta$ and $m$ relatively to $n$ for which the problem stays hard to solve? For example in the $GPV$ signatures they consider $m = 2n\log q$, and $\beta = 6n\log q$. But can we consider too $m = 4n\log q$? $8n\log q \dots $? $n^{100} \log q$? $\dots$ Same thing goes for $\beta$. What's the limit for these parameters for which the problem starts becoming easy?


texts: im trying to find how to add integrity confidentiality, authentication and non repudiation. I know with AES CCM i can get integrity confidentiality, authentication but every where i look i see a different answer for non repudiation. Is there a way to add this to AES? A digital signature?


texts: How does one deal with a negative "d" in RSA?

texts:
I'm trying to write my own RSA implementation using the textbook approach — which I know is not optimal — of picking primes $p$ and $q$, then computing Euler's totient $phi$, then randomly picking an 'e' which is relatively prime to $phi$, and then computing a $d$ such that ($d*e$) mod $phi$ = 1.

For that last step, I'm using the algorithm provided at http://www.pagedon.com/extended-euclidean-algorithm-in-c/my_programming/

This algorithm often yields a negative $d$, which sure enough does satisfy $d*e$ mod $phi$ = 1. But obviously I can't use a negative $d$ as the exponent during decryption.

Is there some straightforward way I can amend this algorithm, Or is it rather my understanding that needs amending?


texts: Any practical uses of machine learning for cryptography?

texts:
I am about to go study for my masters in machine learning, data mining and high performance computing, but have recently become very interested in cryptography after taking Dan Boneh's Cryptography course on coursera.com.

I was wondering if there are any practical applications for machine learning in cryptography? A quick google search didn't seem to reveal much for me so i was wondering if someone here knows something.

My first impression would be that machine learning techniques could be used to learn the inverse function for some cipher and passphrase given enough plaintext/ciphertext pairs, but i am not sure how capable things like neural networks are at learning functions which are not linearly separable.


texts: How used nonce in CTR Mode of AES-EAX Encryption?

texts:
I want to encrypt a message with AES-EAX manually. Then, i confused how ctr mode in AES-EAX processing the nonce which came from omac process. How the counter be concatenate with the nonce in their primitive ctr mode if the nonce already 128-bit length because padding in omac before. My initial nonce length is 96-bit. Should i discard the auth nonce until 96-bit again and concatenate it with 32-bit of counter?

I tried to search that answer in google and didn't find that answer. I also compared my ciphertext calculation with ciphertext from application but it have different result. So, i hope i can find the answer in here. Please help me to know.
I really appreciate your answer.


texts: What is the most secure way to encrypt certain properties in logs

texts:
I would like to encrypt certain data before logging it. Currently, I use a private key and a static IV.

Looking at generating a suitable IV I am concerned about the overhead in generating CSPRNG whilst logging. I am sure there is a different way to approach this problem but I do not have the experience to know what is safe.
I currently use a Node server on AWS.

What patterns for securing certain properties of logged data are available currently? I don't want to encrypt the whole log as I need to search for properties, but the values need to be hidden.

I would like some direction as to where to find answers or even how to ask the right questions! I am at the stage where I am realising how difficult cryptography is, so thank you for your patience.


texts:
I have an exercise for a crypto class that I'm working on and trying to understand. In the problem I have a Linear-Feedback shift register working in mod 3 with digits {0, 1, 2}.

The LFSR is using a recurrence relation of degree 2 which looks like this
$Z_{i+2}=C_0Z_i+C_1Z_{i+1}$

I also have part of the keystream $S=...11022...$

I am looking to find $C_0$ & $C_1$ along with
the three keystream numbers that follow and precede $S$

Unfortunately I have no examples to work off so I'm confused on how i'd start even with finding $C_0$ & $C_1$?


texts:
For a university project, I have to design a contact tracing protocol. In my approach, a blockchain is used. Every participant has to generate 3 nonces for every contact. They are hashed in multiple ways to guarantee anonymity. Does this approach make sense? Does it guarantee anonymity and integrity?

Here is the sequence diagram, I have in mind. Only Bob's side of the tracing protocol is displayed. h() is a cryptographic hash function. BC is the Blockchain (and therefore public). Alice and Bob should not be able to be linked together unless one reports an infection.


texts: Does semi-honest adversary eavesdrop honest parties communication?

texts:
Assume we have a multi-party computation protocol and the protocol definition, where both of them consider a semi-honest adversary, without explicitly assuming the type of channel the parties want to use.

Also, assume three parties are involved in the protocol: two clients and a server. Let a client encrypt its input under the public key of the other client and send it to the server, where the server somehow computes the result and send it to the other client.

The protocol is proven in the case where a party is corrupted at a time by a semi-honest adversary

Question: Can we say that the protocol is insecure because a corrupted client can eavesdrop the communication between the other client and server and learn some information? Or we can say that the protocol implicitly assumes the parties are using a secure channel (e.g. TLS)?


texts: Does a distinguisher for an PRF based on a hash make the hash function insecure?

texts:
I recently found a distinguisher for the PRF $f(s, i) = H(s || i)$ where $s$ is the seed and $i$ is a counter and $H$ is a cryptographic hash function, which is able to distinguish $f(s, i)$ from true random data very well with only $2^{30}$ bits of data.
I wondered whether this does affect the security of $H$. My first thought was that a cryptographic hash function should provide some level of randomness, but I'm not sure whether this goes as far as forcing $f(s, i)$ being a good PRF, so my question is whether the distinguisher to $f(s, i)$ lowers the security of $H$.


texts:
Quantum key distribution using BB84 protocol. The Secure key rate $R$, is  given by
$$ \quad R=1 - 2h(e_b) \tag{1}\label{q1}$$
where $e_b$ is the quantum bit error rate (QBER), $h(x)$ is the Shannon entropy and is $h(x)=-x  \log_{2}(x)-(1-x)\log_{2}(1-x)$.
How do we calculate the threshold for BB84 using equation $\eqref{q1}$?
What is the physical meaning of Shannon entropy?


texts: Binary verification of application image before loading it into DRAM

texts:
Working on a boot process where the application image has to be verified before loading it into DRAM.

We found 2 strategies;

RSA-1024, where the private key is secure in premises and the only public key is distributed with out boards. (Is it better if up-gradable to RSA-2048?)
AES-256 with CMAC, same key available both board and premise.

As they are symmetric and asymmetric, it is difficult to compare them directly. Like to understand, which is best suited for binary signature verification during boot process?


texts: GCM as a general purpose cryptographic hash?

texts:
Why are hash functions (e.g SHA-3) so complicated when GCM apparently provides secure hashing and has a relatively simple construction?

Is this purely about speed? I imagine that GMAC with a fixed key (GCM mode without ciphered data) is much slower, if you just need a key-less hash.


texts: Padding schemes reversal and space efficiency

texts:
My crypto course proposes the following padding schemes:

$\operatorname{pad}(m) = m \mathbin\| 0^i$
$\operatorname{pad}(m) = m \mathbin\| 10^i$
$\operatorname{pad}(m) = m \mathbin\| 0^i \mathbin\| E(\left|m\right|)_l$
$\operatorname{pad}(m) = E(\left|m\right|)_l \mathbin\| m \mathbin\| 0^i$

where $E(\left|m\right|)_l$ is the $l$-bit encoding of the length of $m$ and $l$ is the size of the block in the scheme. The question is:

How can one reverse each padding?
Which padding is more space efficient?

I'm at risk of overthinking these questions. Thus, I ask for your experience. To me, the first the more space efficient but not always applicable. It can only be reverted under certain assumptions. But these assumptions hold for 3 and 4 also, if I'm not mistaken. For 2, I don't see very well the advantage. It may help sometimes but others (say 1 has to be written in the next block) it may force to introduce another block. So, overcomplicating matters one could do an average analysis of cases.

What are, in your opinion, the correct answers to these questions?


texts: Switching between AES and a highly performant algorithm

texts:
I want to de/encrypt several binary files rather frequently on a normally battery-powered device. My goal is to use AES-256 when the device is AC-powered and a highly performant algorithm when it's battery-powered to save power. I appreciate that the level of security will be compromised.

Is there a performant algorithm that provides "decent" security? I see that Blowfish fares a bit better according to this analysis, but the difference is rather small over AES-128. Given that the paper is almost 10 years old, are there good alternatives out there today?

Is AES-128 supposed to be the standard for something decently secured and highly performant?


texts:
As per How does recovering the public key from an ECDSA signature work?, it's possible to recover public keys from ECDSA signatures.
Is this possible for EC-Schnorr signatures as well?
I'm looking specifically at https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki as a reference on EC-Schnorr, but it seems to have nothing on pubkey recovery.


texts: Recovery public key from secp256k1 signature and message

texts:
Regarding this article about a signature recovery

  However, with the signature and the message that was signed, and the knowledge of the curve, it is possible to generate two public keys

So we can derive 2 public keys for each signature and message

I try work with python library https://github.com/ludbb/secp256k1-py.
This library is a wrapper for C++ implementation of secp256k1. As I understand from this library we have special function sign_recoverable that returned signature with included information for recovery unique public keys. And regarding this https://github.com/ludbb/secp256k1-py/blob/f5e455227bf1e833128adf80de8ee0ebcebf218c/secp256k1/init.py#L135

   def ecdsa_recoverable_deserialize(self, ser_sig, rec_id):
      if not HAS_RECOVERABLE:
        raise Exception("secp256k1_recovery not enabled")
      if rec_id < 0 or rec_id > 3:
        raise Exception("invalid rec_id")
      if len(ser_sig) != 64:
        raise Exception("invalid signature length")
      recover_sig = ffi.new('secp256k1_ecdsa_recoverable_signature *')
      parsed = lib.secp256k1_ecdsa_recoverable_signature_parse_compact(

We have 4 variant of a possible public key from 1 signature.

In my code and attempts receive Public keys for  signature in DER format (i want to iterate all available)

def public_key_recovery(signature, messsage, rec_id, compressed=True, hex=True):
if isinstance(signature, str):
    signature = unhexlify(signature)
if isinstance(messsage, str):
    messsage = unhexlify(messsage)
raw_sig = ffi.new('secp256k1_ecdsa_signature *')
r = secp256k1.secp256k1_ecdsa_signature_parse_der(ECDSA_CONTEXT_VERIFY,
                                                  raw_sig,
                                                  signature,
                                                  len(signature))
if not r:
    raise RuntimeError("secp256k1 error")
compact_sig = ffi.new('unsigned char[%d]' % 64)
r = secp256k1.secp256k1_ecdsa_signature_serialize_compact(ECDSA_CONTEXT_VERIFY,
                                                          compact_sig,
                                                          raw_sig)
if not r:
    raise RuntimeError("secp256k1 error")

recover_sig = ffi.new('secp256k1_ecdsa_recoverable_signature *')
t = secp256k1.secp256k1_ecdsa_recoverable_signature_parse_compact(
                                        ECDSA_CONTEXT_ALL, recover_sig, compact_sig, rec_id)
if not r:
    raise RuntimeError("secp256k1 error")

pubkey_ptr = ffi.new('secp256k1_pubkey *')
t = secp256k1.secp256k1_ecdsa_recover(
             ECDSA_CONTEXT_ALL, pubkey_ptr, recover_sig, messsage)
len_key = 33 if compressed else 65
pubkey = ffi.new('char [%d]' % len_key)
outlen = ffi.new('size_t *', len_key)
compflag = EC_COMPRESSED if compressed else EC_UNCOMPRESSED
if bytes(ffi.buffer(pubkey_ptr.data, 64)) == b"\x00" * 64:
    return None
r = secp256k1.secp256k1_ec_pubkey_serialize(ECDSA_CONTEXT_VERIFY, pubkey, outlen, pubkey_ptr, compflag)
if not r:
    raise RuntimeError("secp256k1 error")
pub = bytes(ffi.buffer(pubkey, len_key))
return hexlify(pub).decode() if hex else pub

I got correct result for first 2 variants (0,1), and for last 2 always 64 zeros byte string

What is real count 2 or 4  public keys posible  derive  from signature?


texts: Ciphertext with uneven letter distribution

texts:
I have a ciphertext encrypted with an unknown method. It is part of a challenge (personal quest), so I can not post it.
The letter statistics is the following:

y : 10
w : 8
x : 8
t : 5
v : 5
e : 5
c : 5
d : 5
u : 4
z : 4
f : 3
b : 2

Because of the uneven letter distribution and repeating two letter sentences, I tried to approach as a monoalphabetic substitution cipher without luck. I tried manually and also with this python code.

The previous challenge was a Caesar cipher, so I do not expect any complicated method. Are there other encryption methods which produce such a letter distribution?

UPDATE: I am no more interested in this challenge. Here is the whole question, if someone is interested:

This is your first personal quest. Decipher it in order to access Level Two!
But before that, a little something to put you on rails. Easy as 1-2-3:
hotstteitmegpdnoctnooruglsmloabsnheismralgyeasjlsacshhlwssznlusmablesrafhosuprh

Don't fear the random(). Some even seek for it...
VXZDVWWWFYBWYWWCEUWWFXZXZUEYDTETXTXYZDVXVYDYBCYECTXYYDCEFUTUCXVY


texts:
Consider two types of attackers on a key exchange (KE) protocol and subsequent communication between the parties which used this KE instance to establish a secure communication key. Attacker Eve eavesdrops on their links, both over the internet and over telephone, while attacker Mallory can stage a man-in-the-middle attack over the internet and he can eavesdrop on the telephone but he cannot fake Alice’s and Bob’s voices over the telephone. In each case say whether the scheme is secure or not against each attacker type and briefly justify your answer.

(b) What if Alice uses CPA-secure public key encryption scheme to generate a (private,public) key pair, communicates her public key to Bob over email, and Bob chooses a random key k for the authenticated encryption scheme and emails it encrypted under Alice’s public key to Alice?

(d) Suppose Alice and Bob do as in (b) but they hash and read off over the telephone Bob’s chosen key k instead of Alice’s public key? Assume the hash function H' is a true random function, and in particular that for a random 128-bit key k the authenticated encryption using k remains secure even if the adversary learns the H'(k) value.

This is a homework question. I'm not really asking for the answer. It's just that I don't understand how Alice and Bob can retrieve the key k and the attacker can't since all of them see/hear the same H'(k). Suppose we don't have the attacker in this case. How do the honest parties exchange the key?
I would really appreciate any explanation.


texts: How is SSL secure from rogue Certificate Authorities?

texts:
There's one thing that I've never quite understood about SSL (which perhaps means I don't understand SSL at all): how is SSL secure from rogue Certificate Authorities?

This is probably best elaborated as an example:

Suppose company B buys a certificate C from certificate authority A.

Now, normally I would go to the website, B's servers shows me certificate C, I see it's signed by A, I trust A's root certificate, everything is dandy, and off I go to throw furious avians at malicious boars.

But suppose, for whatever reason, someone M persuades/tricks a different certificate authority N to issue them a certificate Q that looks just like certificate C but isn't.

Now if M does something to man-in-the-middle me, my understanding is that M's server shows me Q, I see Q signed by N, I trust N's root certificate, everything is dandy...except it's not because M can see all my plaintext, and is free to do with it as he wishes, including the other half of the MITM if he wants, passing the information on to B, etc.

(I know this is a classic MITM with an SSL twist, but I just wanted to be really clear with my logic just in case I missed something along the way that's relevant.)

I'm guessing that there's some other protection to mitigate against this, I presume? I hope? ...Please?


texts: Why is there no 'ECDSA' version of 'DHE-RSA-CHACHA20-POLY1305'?

texts:
So I was just checking my TLS cipherlist and noticed that there was a 'DSS' / DSA / ECDSA version of every RSA cipher available, except for DHE-RSA-CHACHA20-POLY1305.

Why is that?


texts: What are the major advantages of SPHF for PAKE?

texts:
I am working on Password Authenticated Key Exchange (PAKE). I noted some PAKE schemes were built upon the smooth projective hash function (SPHF). I am confused why SPHF can be used to design PAKE?

I can understand the definition of SPHF and I know it is a special case of designated-verifier ZK. But what are the main advantages of SPHF for PAKE?


texts: If a system hashes passwords with a 256-bit long hash, are passwords (which are not necessarily alphanumeric, can be any value per byte (0-255)) longer than 32 bytes useless under the context in which an attacker with a VERY fast machine brute forces passwords?


texts: How many attempts does it take to crack a 32-bit password hash with this scenario?

texts:
How many attempts does it take to crack (match) a 32-bit password hash from a database of 4 million password hashes?

Correct me if I'm wrong, but to crack a 32-bit password hash would take roughly 2^31 attempts, while the math for matching a 32-bit hash from 4 million hashes should take (2^31)/4M ~ 537 attempts.

However in reality, the 4 million passwords in the database are not unique, as certain combinations are used as common passwords. Thus, what would be a more accurate calculation of the above question?


texts: Why the exponent is a power of 2 in Ring-LWE?

texts: I was reading some papers on Ring-LWE. I found almost all of them talk to choose the polynomial modulo $x^n+1$ where $n$ is a power of $2$. I did not understand why this condition is necessary?


texts: Standard or guidance for entropy collection

texts:
I need to write some high-level security requirements which include a random number generator suitable for use in cryptography. I don't need something very formal, this isn't a security certification or a work order. I just want to go to the next level from “supply a proper RNG”.

A proper RNG should be built on a cryptographic PRNG seeded from an appropriate entropy source. For the cryptographic PRNG and even the seeding method, it isn't hard to find applicable standards; for example, I'd be content to write that the PRNG must use one of the algorithms listed in FIPS 140-2 annex C, or attain an equivalent security level.

What about entropy collection or seeding? Is there a similar document that I can quote? Anything easily available in English would do, it doesn't have to be (or not to be) a government standard or an RFC or similar, but it's better if it looks somewhat official or trustworthy.

Offering concrete guidance would be a plus. However this could be hard since the requirements may need to be met in very different ways (e.g. a non-deterministic oscillator in an embedded device, a server with a radioactive source, a PC with someone wiggling the mouse, …).


texts: Why are different private and public key generated in online brainwallets?

texts:
Why is that different wallet generating sites give different public and private keys when you enter the same passphrase even though they both use the same Algorithm (Sha 256)?
Thank you
P.S.
Ok...one site is bitaddress.org and the other site is walletgenerator.net. i tried getting a brainwallet and used the exact passphrase but got different keys. The passphrase was: robertarmenkery.
Obliged


texts: Why do $p$ and $q$ have to be different in RSA?

texts: When using RSA cryptography, it is possible to have the decrypted message and the initial message the same when $p$ and $q$ are the same. So why are they always different?


texts: Can the round function $F$ in a Feistel Network be practically any non-invertible function?

texts:
This question might seem silly, but how true is the fact that the round function $F$ does not have to be invertible?

I am curious to know this, because non-invertible functions can be very lossy, i.e., can lose much of the information related to the input, hash functions for example.


texts:
I have been reviewing the documentation for SHA256 and I believe the last two words (64 bits) for each chunk are not used in creating the message schedule.

From Wikipedia...

Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array:

for i from 16 to 63
    s0 := (w[i-15] rightrotate 7) xor (w[i-15] rightrotate 18) xor (w[i-15] rightshift 3)
    s1 := (w[i-2] rightrotate 17) xor (w[i-2] rightrotate 19) xor (w[i-2] rightshift 10)
    w[i] := w[i-16] + s0 + w[i-7] + s1

Notice how w[i-1] and w[i] are not used?  These two words would be the length for a 1 chunk hash but for actual data that is longer then 512 bits the last 64 bits are ignored.  This would result in the same hash for two (or more) messages.  Am I missing something or am I correct?


texts: Is OAEP needed when encrypting a session (random) key using RSA?

texts:
My question is two parts:

when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed [i'm assuming the key is generated using secure random generator.
What benefits does OAEP provide compared to simple padding with random bits up to size $n-1$ where $n$ is the size of RSA.

The answers in
How does OAEP improve the security of RSA?
are very useful but I'm still wondering about the above questions.


texts:
Terms like "trustless protocol", "trusted third party", "trusted platform", "trusted server", etc. require a notion of trust. I already wrote

  The term trust when used in the context of cryptography does not refer to personal confidence in whether a person is reliable or has good intentions but instead describes whether an entity can be assumed to always behave according to protocol within the given model.

and went looking for a source to back this claim up. Unfortunately, I wasn't able to find one, nor was I able to find one to say that my notion of what "trust" means in cryptography is wrong.

So what does this term refer to formally?


texts:
Consider the following question:
Given a $n$-bit cryptographic hash function $H$, how many messages should we expect to hash before before finding a message $x$ such that $H(x) < 2^{n-k}$, for some integer $k$.
For me, this question does not make a lot of sense. A cryptographic  hashing function has always a fixed size on the output, such as SHA1 with 160 bits. It does not really matter what $x$, the message to be hashed, is $\operatorname{len}(\operatorname{SHA1}(x)) = 160\,$bits. In this case $\operatorname{len}(H(x)) = n$. Because of this, it is sufficient to hash a unique, random message. Because the size of the hashed $x$ is always going to be $n$ bytes, and $(n\text{ bytes }< 2^{n-k})$ is always true for any positive integer $k$.
Please do not give the answer, if you do, hide it ! :) I just want to better understand the question.


texts: Does there exist a public database of RSA-2048 moduli and their factors?

texts:
Provided some modulus for RSA 2048, is there a way I could look up if

the modulus
and their factors

exists online?


texts: What is the use of REAL random number generators in cryptography?

texts:
I understand the use of pseudo-random number generators. I am not getting mixed up between these and "real" random number generators.

However, I don't understand for what a real random number generator is used.
If it is not deterministic, how can it be used in an algorithm?


texts: How does table size impact table lookup speed?

texts:
Are there good discussions of how cache pressure impacts large 64k-ish lookup tables used in erasure coding and sometimes signature verification?
I'll focus on erasure coding in small characteristic and small degree, which gives a clean extremely performance sensitive application, and avoids off-topic side-channel discussion.
There is a classical log and exp table trick for doing multiplications in small extensions of fields of small characteristic, especially GF(2^8).
let ab_log = LOG_TABLE[a] + LOG_TABLE[b];
let ab = EXP_TABLE[(ab_log & ((1 << FIELD_BITS)-1)) + (ab_log >> FIELD_BITS)];

This works well in GF(2^4) and GF(2^8) where the lookup tables have size 16 and 256, respectively.  We'd have two 128k tables of the form [u16; 1 << 16] in GF(2^16) though, which blows the L1 cache.
We therefore always build GF(2^16) as an extension field, either of (a) GF(2^4) implemented by small multiplication tables, or else (b) of GF(2^8) implemented by a few 64k multiplication table,  or perhaps another pattern.  You could employ a "carry-less multiplication" instruction PCMUL instead, but it supposedly runs slower due to being designed for larger fields.
I'm confused by the anecdotal advise and benchmarks that (b) makes sense.  Yes, 64k just fits into L1 cache, but any machine doing GF(2^16) work does many other tasks too, probably making (a) more robust under different applications.
In short, why do large tables win as many benchmarks as they do?  Are benchmarks simply being run in a vacuum and not in production?  Or is the memory bandwidth often not that starved when the CPU can pipeline everything well?


texts:
In the paper Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller by Micciancio and Peikert, they present the following theorem about the existence of trapdoor for LWE.

Theorem 5.1: There is an algorithm $\mathsf{GenTrap}(1^n,1^m,q)$ that, given any $n\geq 1, q\geq 2$ and $m=\mathcal{O}(n\log q)$, outputs a matrix $\mathbf{A}\in\mathbb{Z}^{n\times m}_q$ and a trapdoor $\mathbf{R}$ such that:

$\mathbf{A}$ is indistinguishable from a uniformly chosen matrix; and
there is an algorithm $\mathsf{Invert}$ that, given $\mathbf{b}=\mathbf{A}\mathbf{s}+\mathbf{e}$ (with $\mathbf{s}\in\mathbb{Z}^{n}_q$, $\mathbf{e}\in\mathbb{Z}^m$ and $||\mathbf{e}||<q/\mathcal{O}(\sqrt{n\log q})$) and a trapdoor $\mathbf{R}$, outputs $\mathbf{s}$ and $\mathbf{e}.$

They mention that the results in the paper can be straightforwardly adapted to the ring setting (Ring-LWE), however, they don't give details on that. What would be an equivalent result to this one in the ring setting?


texts: Practical implications of the switching lemma and the counter mode security bound

texts:
I have some trouble with determining how many times a key can be safely used when using counter mode encryption.
If we, for example, split the IV into two parts, a message counter (nonce) and a block counter. Messages are always of the same length. We make sure that under the same key, the IV is never repeated, and we use AES128 for the block cipher.
The paper ‘A concrete security treatment of symmetric encryption’ tells me that the advantage of an attacker is at most half the security strength of the underlying PRF. Then with the switching lemma, the advantage of the underlying PRF can be bounded by the advantage of the underlying PRP (with AES-128 would be about $2^{-128}$) plus $q^22^{-l-1}$.

Does this $q^22^{-l-1}$ just show that there is no attack that is better than this bound, or does it also give us an attack? And if so, what does that imply?

Is $q$ the amount of queries that is allowed by the oracle and thus, assuming no other leaks, the total amount of cypher calls by my system? Or can the attacker create it’s own oracle like with a brute force attack on the key space?

Is there no time complexity in that part of the formula?

Let’s say I take an advantage bound $2^{-30}$ (very improbable) then I can have $2^{49}$ cipher calls ($1/2^{30} = q^22^{-128-1}$). Any adversary that wants to gain a better advantage has to do an attack on the underlying permutation, something like $2^{97}$ key checks on AES-128 for example.
Does that sound about right?


texts:
I agree that for certain encryption systems or modes of operation, a MAC is indispensible.

The best example are probably stream ciphers (and therefore also block ciphers in OFB or CTR mode) that allow an attacker to arbitrarily flip bits in the ciphertext, resulting in flipped bits at the same position in the plaintext after decryption.

However, I somehow always thought that that wouldn't apply to "modern" block ciphers in some reasonable mode of operation, e.g. AES-CBC. Since there is no clear relation between a bit in the ciphertext and a bit in the plaintext, I thought that any small modification would cause a totally different plaintext.

That in mind, I thought it would be enough to simply concatenate the plaintext with some simple checksum to check for that kind of tampering; a cryptographic hash didn't even seem necessary to me.

But in reality, pretty much every reasonable application of AES-CBC also seems to be using MACs, so I'm almost certain that there is an error somewhere in my reasoning.