texts: Is a signature scheme using a hash considered a hybrid cryptosystem?

texts:
In Wikipedia there is a page on hybrid cryptosystems. However, although cryptography contains a lot more than just encryption, only hybrid encryption using key encapsulation and data encapsulation is discussed.

So my simple question is: should I consider a signature scheme using a hash a hybrid cryptosystem? Or is the term not that well defined and is it up to the entity that uses the term?


texts:
I've read everywhere online and people say plain text RSA is very unsafe. To make it safe you pad it but no examples are shown anywhere on how to do it. It's explained that random data is added to the encryption process to change up the final encryption so it can't be guessed at random by comparison to similar looking encryptions.

So far what I understand is you have a plain text, you turn that into a hash and pad it with extra bytes then you encrypt it and send it over and then it is decrypted into a hash with bytes and turned to plain text. Where does the padding go? Do you add random 'trash' bytes to the plain text to fill it up and then hash it and encrypt? Or do you do some extra math in the encryption process? What is this process? What about figuring out what is a padding byte and what isn't?

Apart from that how do you turn it back to text from a hash? What if I turn it into SHA-512 hash with a salt? How will the person be able to decrypt the data once they decrypt the RSA to find the hash? Is my understanding wrong of the process? Does turning the plain text into hex help with anything?


texts: derangements and permutations in cryptography

texts:
Given a partial key for a mono-alphabetic substitution cipher (missing
  11 letters), calculate the number $N$ of possible keys, given that no
  plaintext letter can be mapped to itself.

Ordinarily, the number of possible keys would be the number of derangements of the missing letters $!11$. However, 5 of the plaintext letters that are missing mappings already exist as mappings in the partial key, so logically it shouldn't matter what the mapping of those plaintext letters is, because they can never map to themselves.

So, I wonder if the number of possible keys is $N = 5! * !6$. That is:

(no. permutations of 5 already mapped free letters) * (no. derangements of the remaining 6)

The problem is that 5! * !6 = 31800 which is much less than !11 = 14684570
Intuitively, the set of derangements should be the smaller subset, so surely $N>!11$.

Am I getting something wrong in my arithmetic or am I completely missing the concepts?


texts: Secure Remote Protocol - Are these 2 equations equivalent?

texts:
I'm implementing the Secure Remote Protocol that is specified to have this equation for the parameter S, the premaster secret.

 S = (B - (k * g^x)) ^ (a + (u * x)) % N

But the implementation I'm referring to, has done it this way. Is this equivalent to the author's description? Its too complex for me to understand. Can you please check it and/or explain?

 S = ((B + (N - ((k * (g^x % N)) % N))) ^ (a + u * x) %  N);

Some questions:

Why the 3 mod's instead of just 1 at the end?
Why B+ and N- instead of B-?
Can it be optimized in any way?


texts: How RSA is implemented by authentication protocols?

texts:
I am a beginner in cryptography, i recently learned about RSA algorithm : In short, my understanding for this is :
Sender needs receiver's public key to encrypt the message to a cipher so that only receiver can decrypt the cipher text to original message and vice versa.

When i try to understand the implementation in network and authentication i find this little confusing in following ways:

Sender and receiver both generate their own pair of private-public key.
Sender encrypts the message with private key and sends his/her public key and the receiver decrypts by using sender's public key and vice versa.
Now how this is RSA or AES? Because the message should be encrypted by receiver's public key so that receiver can only decrypt it. But here sender's public key is sent and receiver could decrypt the message by that public key. HOW??
If this is true, then any one in the network who can get cipher and public key can decrypt the message, because the cipher is meant to be decrypted by the same public key. RIGHT??

For example :
I was going through JWT (Json Web Token) implementation, here :

Server app signs the token with server's private key but third party app can verify the token and retrieve data by the server's public key.

I know i am missing something here, but do not know what.


texts: The length of public-key matrix in McEliece cryptosystem is $n \times k$. Then the key size is $\frac{n \times k}{8}$ bytes. But I find that the key size is $\frac{(n-k) \times k}{8}$ bytes. why ?


texts: Fuzzy Extractor constructor for sequence reconciliation

texts: The famous works on Fuzzy Extraction considers $set$ of inputs. I am interested in reconciliation for sequence of close data. Here order of elements are important unlike in previous one. Are there constructions focusing on sequence rather set reconciliation?


texts: Crack a polyalphabetic cipher given a pair of (plaintext, ciphertext) encrypted by it

texts:
The original question only states that a classical cipher is used, and I am going to articulate 1) why I think a polyalphabetic substitution cipher is used AND 2) my attempts so far.

The Question

c1 = rhlxhei rb niu ir-wbbxug "qeejv," rgj mbfo sdg
m1 = friends by the so-called "posts," but they can
c2 = fypx pd jkx teoyde nupyd wbd hhtfmo yqvlfqeu
m2 = ?

Which type of cipher is used

If it is a transposition cipher, then for each character, the number of its occurrences should be identical in both plaintext and ciphertext. (Contradiction)
It is a monoalpbetic substitution cipher, the same character in plaintext should be mapped to the same character in ciphertext. (Contradiction)

As a result, it should be a polyahplabetic substitution cipher.

My Attempts

IC (Index of Coincidence)

I googled that Index of Coincidence can be used to guess the key length, but that is based on that the length of the ciphertext is statistically long enough.

Calculate Offsets

I then realized that if Vigenère cipher is used, then for each character of m1 and c1, I can calculate the offset between them, and figure out the repeating pattern in the offsets.

To make it clear, offsets[i] = (c[i] + 26 - m[i]) % 26, and offsets is printed below

12 16 3 19 20 1 16 16 3 20 1 16 16 3 20 1 16 12 16 3 1 16 12 16 3 16 12 16 19 20 1 16 16 3 19

However, there are two difficulties.

Although there are some repeating numbers (e.g. 16, 19, 1, etc.), I failed to extract the exact pattern from the offsets.
If I directly applied those offsets (reversely) to c2, the result does not make sense (m2 = rosq qt mey jhiztq qvfkt mnt bijvph otofggux'), so I am wondering maybe the plaintext is incorporated into the key in some way.

Please correct me if the process described above is somewhat wrong and direct me if there is a certain way to take advantage of the known (c1, m1) pair. Thank you!


texts:
My question is fairly simple. I have more than two nodes which needs to communicate very efficiently from computational point of view. One of the nodes can become a coordinator between the nodes. Nodes do have certificate and private keys. To let the nodes communicate with each other efficiently I plan to use a symmetric key therefore key-exchange must be done.

The scheme to key exchange that comes to mind is to share DH's prime and primitive root among all so every one can have the shared secret key after a ring communication. Of course to prevent MITM the parameters are encrypted with each party public key.

Another scheme that comes to mind is to let coordinator generate a secret key and distribute it to nodes using their public keys.

I tend to the 2nd scheme since it's easier to implement and needs less communication in handshake phase.

Would be a compromise to distribute the secret key encrypted with public keys? Or it's always recommended to use scheme like Diffe-Hellman to avoid explicitly sending the shared secret key even encrypted.


texts: Are there UFDs where the factorization problem is difficult but finding irreducibles is cheap?

texts:
Factorization of integers is hard, but finding irreducibles is expensive. Is there a ring where factorization is assumed hard but finding irreducibles is much cheaper than over $\Bbb Z$?

It could provide an alternative ring to do RSA/Rabin over.

A suggestion is the polynomial ring over $\Bbb Z_{pq}$ where $p$ and $q$ are prime. $\Bbb Z_{pq}$ has zero divisors, so I don't know what kind of creature you get. You still have to find $p$ and $q$ to start with, but still interesting.

Another suggestion is because polynomial factorization over finite fields is tractable, you could look for infinite fields, probably of nonzero characteristic.


texts: Would SHA1 be broken by sheer brute force, even if it had no weaknesses of its own?

texts:
It is well-known that SHA1 is broken.  Collisions have already been achieved.

Current algorithms for finding collisions leave a “fingerprint” in the collision files, which can easily be detected.  It is claimed that brute-force would not be practical, since that would require $2^{80}$ time.

However, I am not so sure if $2^{80}$ time is that impractical.  My understanding is that the Bitcoin mining network together generates about $7*2^{89}$ hashes per year.  That is enough to break any system with 80 bits of security by sheer brute force.  I know that it uses dedicated hardware that cannot be repurposed.  But creating such hardware would be well within the capabilities of a nation state.  And cryptosystems are supposed to be secure against such adversaries.  Furthermore, there are other cryptosystems with 80 bits of security, and some are still being proposed today (!)

Just how feasable is this attack?


texts: Complexity of computing homomorphic encrypted matrix multiplication

texts:
Given two players  $P_1 , P_2$ .
In our setting $P_1$ poses two encrypted matrices $M_{1_{k \times k}},M_{2_{k \times k}}$ over field $F$, and the encryption has additive homomorphic property, over public-key scheme.
Where $P_2$ posses the private key to that encryption.

We can compute the matrix multiplication via a basic naive approach, as follow:

for each cell of the desire matrix , we compute a multiplication of row vector from $M_a$ and a column vector from $M_b$.

To compute that vector multiplication The players  can do the following 2-step protocol :

First, Given $Enc(a_{1i})$ , $Enc(b_{i1})$, player 1 can obtain : $Enc(a_{1i} \cdot b_{i1})$ via a folklore protocol [1]

Next, to compute the addition of the k-parts of that vector using homomorphic properties as follow:

$Enc(\sum_{k}^{i=1} a_{1i}b_{i1}) = \prod Enc(a_{1i}b_{i1})$

That solution give us a complexity of $O(k^3)$ and communication cost of $O(k^2)$, while matrix multiplication (in the plain text version) can be reduce down to ~$O(k^{2.38})$.

My question: Can we also do it better(in term of computation complexity) over the encrypted version of that problem?

[1] folklore protocol for scalar multiplication

(i) $P_1$ chooses a random vectors $r_a , r_b \in_{R} \mathbb{F}$ and compute $Enc(r_b) , Enc(r_b)$, then continue to compute and send the values: $Enc(a) \cdot Enc(r_a) =Enc(a+r_a)$ and  $Enc(b) \cdot Enc(r_b) =Enc(b+r_b)$. (ii) $P_2$ decipher the values $a+r_a$ and $b+r_b$ and compute $Enc((a+r_a)(b+r_b))$ then sent it to $P_1$. (iii) $P_1$ receive the above value, and can compute $Enc((a+r_a)(b+r_b) - a\cdot r_b - b\cdot r_a - r_a \cdot r_b)= Enc(ab)$ by using the homomorphic properties of that public encryption scheme.


texts: How is the Lai-Massey scheme invertible?

texts: The Wikipedia page on the subject and other descriptions that I can find of it are as clear as mud. $L$ and $R$ are combined to make a number that is then added to both. That seems like a loss of information to me.


texts:
I'm trying to do Fiat Shamir but with $I = S^3 \pmod n$ where $S$ is the secret key. How will I prove that I know the cube root? I tried doing the old formula but with instead with $(RS)^3 = x*I \pmod n$ where $R$ is the random number and $x = R^2 \pmod n$, but it didn't seem to yield the correct values. Só what formula should I be using instead with the new cube.

$x = R^2 \pmod n$

$R^2 = x \pmod n$

$(RS)^2 = x*I \pmod n$

I tried changing these formulas to use cubes instead but didn't work.


texts: Is there a way to analyse xxHash and tell, either by human analysis, or with an automated tool, that this hash function is or is not cryptographic?

texts:
After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for Internet usage, due to a certain type of DDos attack becoming possible, thanks to a combination of Hash-table degeneracy into a list and predictable collisions.

The central hypothesis is that it is possible to build multiple secret-key-independant collisions, due to the fact that the inner hash loop is secret-key-independant.

The reasoning and solution is clever, however i see that it requires a manual investigation of the algorithm by cryptographic expert. This conclusion wasn't drawned from automated tools. I guess the near-perfect distribution and avalanche of MurmurHash would have defeated such automated analysis. But i may be wrong.

I would like to apply this learning to xxHash.
xxHash seems to avoid the problem described into the SipHash paper by integrating the secret-key right at the beginning of the parallel calculations. It seems that this method prevents the existence of secret-key independant collisions. Once again, i may be wrong.

Currently, xxHash is not cryptographic mostly because its output is 32-bits. However, creating 64-bits & 128-bits variants from it is pretty straighforward.
So let's pretend that the 32-bits output is not a problem (no brute-force solution). Is there a way to analyse xxHash and tell, either by human analysis, or with an automated tool, that this hash function is or is not cryptographic ?

PS : as an obvious source of information, let's check Wikipedia on what is a cryptographic hash function. Apparently, pre-image and collision resistance is all it takes to make a good Hash function become a cryptographic hash function ?


texts: Can an RSA (private) modulus contain (hex) zeroes?

texts:
Consider a public modulus that is supposedly 4096 bits. But since it contains two hex pairs of zeroes, i.e. ...:00:...:00... such that the bit length of the decimal value instead becomes 4093 bits, is it actually a 4096 bit key or not?

I hope my question is vaguely intelligible.

Edit:
modulus is here https://pastebin.com/adYe0F7g
The reason for my (stupid) question is that I was told it would have the size of 4096 bits, but when I do what I see many do in for example Python to calculate the bit length -> int(hexN, 16).bit_length() it turns out to be 4093.


texts:
I am testing a theoretical hash function, $f()$, which produces n-bits of output.

By the pigeon hole principle, if I run $f(x)$ over a search space of $1+2^n$ values, I will get at least one collision. According to the birthday problem I should get many more collisions than that.

Is there a similar principle that I can determine how many values of $x$ will be needed to ensure with high probability  that I have produced all possible $2^n$ values of $f(x)$?

I'm relatively certain that there is no 100% guarantee of obtaining all values, but at least an approximation within a degree of confidence should be possible. Are these approximations only practical when considering specific hashing algorithms?


texts: Example: pre-image resistance to second pre-image resistance

texts:
It is possible to convert a pre-image resistant function $f:\{0,1\}^{n}\rightarrow \{0,1\}^{n}$ to a second-preimage resistant function? I am thinking to use a pseudo-random generator and construct that second pre-image resistant function in this way:

$$F(x)=f(x)+\text{PRNG}(x).$$

What kind of tests I need to make to verify this function is second-preimage resistant?


texts: Are there other digital certificate formats than X.509?

texts:
Hi I am a little new to security, but in researching digital certificates it seems the only format people describe is X.509.

Are there other formats? If so what are they and where can I find information on them?


texts: Why do we use XTS over CTR for disk encryption?

texts:
I'm taking Prof. Boneh's crypto class from Coursera, and am unsure on the requirement for XTS mode for disk encryption.

It seems that CTR mode would do exactly what XTS can do, but is simpler to implement? In either mode, I will use the disk sector # to provide randomness to ensure that 2 sectors of same data will end up with different cipher texts. What subtlety have I missed?


texts: Paillier cryptosystem preserve ordering of sums for two integer sequences

texts:
According to Paillier cryptosystem the product of two ciphertexts will decrypt to the sum of their corresponding plaintexts.

I have two separate integer sequences X and Y that have same number of values. I want to calculate the 1-1 combination that minimizes the sum (e.g, x1+y1 IF and ONLY IF x1+y1 <= x2+y2 AND x1+y1 <= x3+y3)

Original Data:

X: {x1,x2,x3}
Y: {y1,y2,y3}

I then Paillier encrypt the X sequence with public key r1 and the Y sequence with public key r2.

Encrypted Data:

X: {E(x1),E(x2),E(x3)} (with public key r1)
Y: {E(y1),E(y2),E(y3)} (with public key r2)

If E(x) the cyphertext for message x, then I can calculate E(x1)E(y1), E(x2)E(y2),E(x3)E(y3), decrypt them and then get the correct minimum result x1+x2.

If indeed x1+y1 <= x2+y2 AND x1+y1 <= x3+y3 does the Pailler encryption guarantees that also E(x1)E(y1) <= E(x2)E(y2) AND E(x1)E(y1) <= E(x3)E(y3). My intuition is that NO, because that would also mean that if x<y then E(x)<E(y) for the same r.

Is my understanding correct, that Paillier cryptosystem despite its homomorphic properties cannot preserve ordering of sums for the two sets X and Y when X set is encrypted by r1 and Y set is encrypted by r2? Is there any other cryptosystem that can support this?


texts: Are there any state of the art crypanalysis tools for stream cipher

texts:
I am new to cryptanalysis and interested in knowing cryptanalysis tools (black boxing or white boxing) for (not any specific) stream ciphers in general sense.

Scenario: I am given an assignment to evaluate a stream cipher which is implementing techniques like NLFSR and LFSR etc.


texts: How are the names of cryptographic algorithms (like RSA, AES, SHA-256, Curve25519, etc.) pronounced?

texts: I'll have to give a spoken presentation on cryptography and I don't want to make any pronunciation mistakes. Therefore I'm asking how I should pronounce acronyms like RSA, AES, SHA-1, SHA-256, IGE and CBC, Curve25519, ECDH, MAC, HMAC, etc., both in English and in other languages. (The presentation is in Italian, so I'd prefer it.)


texts: Encryption for IOT devices with minimal overhead

texts:
I have several IOT devices that transmits nearly 200 bytes of data every 10 seconds. I want to make the data secured but i also want to keep the data size nearly same. Ofcourse for IOT devices computations should be lightweight. I have been considering AES 128 for this job and RSA for key exchange. I am wondering if i am on the right track or there are better options.

i saw NIST have called for lightweight encryption algorithm for IOT devices. until that is standardized which encryption should i use.

in summary, i want to get the overview of different encryption scheme with minimal overheads and computations. I looked around but there seems to be no this type of comparisons.

I am very much new in this field so forgive me if i have done any silly mistake.


texts: How to steganographically embed data in cropped/resized images?

texts:
The problem:

An artist posts an image of their work online with a creative commons attribution licence (on site A), someone reposts the image with attribution on another site (site B), the internet happens and the image has been cropped resized and the attribution notice is lost.

The (tentative) solution:

The artists name, web site and attribution licence is steganographically embedded into the image. So consumers of the image or web sites who host these images can pull out the data (and display it).

The question:

How would I go about steganographly embedding data into an image, that will be resilient to resizing and cropping?

Things not to worry about:

Tampering of the data
Just using exif metadata (as that is often lost)
Convincing all the artists they should do this


texts: How to find the time complexity of modular multiplication?

texts: There are two number of length m bits. How do I prove that the complexity of modular multiplication of these two numbers is $O(m^2)$.


texts: How TAU function of SM4ni cipher is implemented?

texts:
I am trying to understand the SIMD implementation of TAU function of SM4 which is as follows:

#define SM4_TAU_L1 { \
    y = _mm_and_si128(x, c0f);              \
    y = _mm_shuffle_epi8(m1l, y);           \
    x = _mm_srli_epi64(x, 4);               \
    x = _mm_and_si128(x, c0f);              \
    x = _mm_shuffle_epi8(m1h, x) ^ y;       \
    x = _mm_shuffle_epi8(x, shr);           \
    x = _mm_aesenclast_si128(x, c0f);       \
    y = _mm_andnot_si128(x, c0f);           \
    y = _mm_shuffle_epi8(m2l, y);           \
    x = _mm_srli_epi64(x, 4);               \
    x = _mm_and_si128(x, c0f);              \
    x = _mm_shuffle_epi8(m2h, x) ^ y;       \
    y = x ^ _mm_shuffle_epi8(x, r08) ^      \
        _mm_shuffle_epi8(x, r16);           \
    y = _mm_slli_epi32(y, 2) ^              \
        _mm_srli_epi32(y, 30);              \
    x = x ^ y ^ _mm_shuffle_epi8(x, r24);   \
}

it looks as if the SM4 S-box is an affine equivalent of the Rijndael S-box using this formula:

$$SM4= B(raj(A(x\oplus a))\oplus b$$ where (using a search tool):

$$A=\begin{bmatrix}
1& 1& 1& 1& 1& 0& 0& 1\\
 1& 1& 1& 0& 1& 1& 0& 1\\
 1& 1& 1& 1& 1& 0& 1& 1\\
 1& 0& 0& 0& 1& 1& 1& 1\\
 1& 1& 0& 1& 0& 1& 0& 1\\
 1& 1& 1& 1& 1& 1& 0& 0\\
 1& 1& 1& 1& 0& 1& 1& 0\\
 0& 0& 0& 0& 0& 1& 0& 0
\end{bmatrix}$$

$$B=\begin{bmatrix}
0& 1& 0& 0& 1& 0& 0& 1\\
 0& 0& 0& 1& 1& 0& 1& 1\\
 1& 0& 0& 0& 1& 0& 0& 1\\
 1& 0& 0& 0& 1& 1& 0& 0\\
 1& 0& 0& 0& 0& 1& 1& 0\\
 0& 0& 0& 1& 0& 0& 1& 1\\
 0& 0& 1& 1& 0& 0& 1& 0\\
 0& 1& 0& 1& 1& 0& 0& 1
\end{bmatrix}$$

$$a=0x75 \space\space , \space\space b=0xfb$$

I applied the decomposition concept used in SCREAM
Side-Channel Resistant Authenticated Encryption with Masking to obtain four 4-bit lookup tables of each matrix ( it worked); however, my values are different for m1l, m1h, m2l, m2h.

  // Affine transform 1 (low and high hibbles)
    const __m128i m1l __attribute__((aligned(0x10))) =
        { 0x9197E2E474720701, 0xC7C1B4B222245157 };
    const __m128i m1h __attribute__((aligned(0x10))) =
        { 0xE240AB09EB49A200, 0xF052B91BF95BB012 };

    // Affine transform 2 (low and high hibbles)
    const __m128i m2l __attribute__((aligned(0x10))) =
        { 0x5B67F2CEA19D0834, 0xEDD14478172BBE82 };
    const __m128i m2h __attribute__((aligned(0x10))) =
        { 0xAE7201DD73AFDC00, 0x11CDBE62CC1063BF };

In my understanding, the author used a 4-to-8 bit lookup table, and now my question:

How did the author derive the values of m1l, m1h, m2l, and m2h?


texts: Operation sequence authentication shared storage

texts:
Let's say there is a shared storage: USB flash drive, external HDD, or whatever you like. I'll refer to it as disk. Also, there are multiple parties, let's say Alice and Bob (may be thousands of them) who periodically access that disk exclusively. So, for instance, one day Alice takes disk from the table, reads and writes to that disk and puts it back on the table. Next day Bob takes disk from the table, reads and writes to that disk and puts it back on the table. Than Bob again, than Alice again. Access sequence is random and unpredictable.

If we'll assume that Bob's PC is compromised and Eva sees everything written on Bob's PC, everything written on disk from Bob's PC, etc. It there any way for Alice to detect that disk was modified by Eva?

Here is Example. Let's say we store some number on the disk and all parties have assigned public and private keys and we write "Number", "Author" and "Number encrypted by private key" on the disk.

So, Bob writes

"3", "Bob", RSA("3", BobsPrivateKey)

Alice can decrypt 3rd value with Bob's public key and see if it equals to "3". But if Eva had stolen Bob's private key she can write

"5", "Bob", RSA("5", BobsPrivateKey)

So Alice validation will fail. I need some other validation, not so simple, to detect if disk was modified by Eva. I've thought about HMAC with operation sequence numbers and list of sequence numbers used, but I'm not sure.


texts: Differential cryptanalysis filtering process

texts:
This question is a little more implementation based. I am writing my masters thesis on differential cryptanalysis and I wrote a program to evaluate some things about differential cryptanalysis. I implemented the attack for different cipher and to give you some more details, in this question we talk about a cipher which is could CipherFour from the book "The Block Cipher Companion" (picture with scheme following:).

So far so good. My implementation works. I get some characteristics and differentials and can recovery the subkeys successfully. While currently doing some more evaluation that checking if the implementation works in general, I got some problems with the filter procedure.

I implemented the filtering process like in the book "The Block Cipher Companion". There are two things they do:

Check the cipher text difference and evaluate the difference on the last sboxes: for all inactive sboxes, there must the the difference 0 (if not, discard the pair).
Process the expected difference through the last sbox and note the possible output difference in the ciphertext. If the Pair does not match one of the possible output diffs, discard the pair.

The filtering works in general, there stay some pairs after the filter. But there seems to be some problem and I don't know what it is or if it could be some case of random.

If I apply the recovery process to the filtered pair list it gets the same result if I apply it to the unfiltered pair list. See my following screenshot:

It should be self explaining what is there going on. I generated 5000 pairs with the wanted input difference. Then I do filtering and there stay 73 pairs. Then I do key recovery and get the right sub-bits from the subway.

Then I do the key recovery with the 5000 pairs (right and wrong pairs). It produces the same output.

In the literature it is written, that the filtering will make it easier to recover the right key and wrong pairs will give some more false hit to wrong subkeys.

Is there anybody who could help me? Could there be a problem with the implementation or I don't know what...


texts:
I looked everywhere on the web and I did find a lot of information about full disk encryption, but nothing really answered my question.

When formatting a partition to use LUKS, the two most common ciphers are

aes-xts-plain64
aes-cbc-essiv:sha256.

Now I know that ESSIV is simply a way to prevent the watermarking attacks possible against CBC. Still, a cipher like "aes-xts-essiv:sha256" is accepted by cryptsetup, and it is the setting I have been using on my laptop for quite a while.

My question is then, why are people not using ESSIV with XTS instead of plain IVs? Every bit of entropy in the encryption procedure should make the result more resistant, right? Is doing this actually harmful to the security of the data, or does it just use slightly more processing power?


texts: Encryption scheme for social-network-like data sharing data via untrusted server?

texts:
I am thinking quite a lot lately abut the problem of secure, privacy-preserving social networking. Distributing the network among trusted, preferably self-hosted servers (like Diaspora, GNU Social etc. attempt to do) is obviously not a good solution for the the large majority of non-technical users, so my thoughts currently focus on cryptography-based approaches that allow the secure sharing of data even if it hosted on "unstrusted" servers. However, I am stuck with the following problem:

Suppose that Alice has three picture albums - A, B and C - and likes to share them with Bob and Carol. Album A  should be accessible with both Bob and Carol, while albums B and C are for Bob only. For several reasons, she needs to do this with webspace hosted by a suspicious friend of a friend named Chuck, which Alice doesn't trust at all and thus wants to protect the pictures from.

Now, Alice could do the most obvious thing and encrypt the data before storing it on Chuck's server. Now she could give Bob and Carol the encryption key and configure her webspace to serve album A to both and albums B and C to Bob only (distinguishing both by e.g. password-based authentication). That way, Chuck couldn't view the pictures, and Bob and Carol can view the appropiate sets of pictures.

However, there are serious problems with this approach: If Chuck decides to be stupid and send picture albums B and C to Carol for the fun of it, she is able to view them because all albums are encrypted with the same key.

The only solution to this problem I can see is to give Bob and Carol two different keys and encrypt B and C with Bob's key. However this means that there need to be two versions of album A, one encrypted with Bob's key and one with Carol's. This wastes space, though, especially if more peers come into play; a combinatorial explosion of copies could be the consequence.

Is there any encryption scheme that can remove these problems?


texts: Are Edon-R 512 and Blue Midnight Wish 512 safe/recommendable?

texts:
Looking for a faster cryptographic hash function for embedded devices, I found Edon-R 512 and Blue Midnight Wish 512, both impressively fast. Are they safe for general purpose hashing in hostile environments?

I am especially interested in Edon-R 512, which is faster, but knowing that it came from the same authors as Blue Midnight Wish 512, which was created as a more secure alternative, I expect it to be weaker. Is Edon-R 512 strong enough?

Currently I am using SHA-256, so anything as strong will do. I do not need a hash function at the SHA-3 security level.


texts: Why ``adversary'' and ``challenger'' and what are typical roles of those?

texts:
I'm confused with words adversary and challenger, that are used in proof of security of some cryptosystems.
For example, adversary and challenger appear in the formal definitions of IND-CPA, IND-CCA, etc.

What are typical roles of adversary and challenger?

From my understanding, adversary refers to a player who tries to break the system while challenger refers to a player who provides something but does not try to break the system.

Are these correct?

Also, I'm wondering why challenger is not called as helper since it does not try to break the system. Rather, it is there to help the proof.
The word challenger seems like an attacker.


texts: Can future Bitcoin hashes be considered a good source to generate random numbers?

texts:
There are a lot of miners trying to calculate the next valid SHA-256 hash using random strings, so can I consider that generated hashes have good randomness? How can I prove it?

For example, use the bitcoin hash as a entropy or seed to generate random numbers. How would you solve this problem? What algorithm would you use to generate random numbers with the bitcoin hash as a input seed? but the algorithm should be secure and have a good entropy


texts: What effect does adding noise to a substitution cipher have?

texts:
Assume I assigned the letters A-Z to random numbers in the range of 0-100. The mapping of plaintext characters to ciphertext values constitutes my cipher alphabet(and key).

I encrypt a message using a normal substitution cipher. I then create a sequence of random values the same length as my initial ciphertext using numbers in the range of 0-100 that were not used in my cipher alphabet. I then randomly weave my initial cipher text and my random sequence together.

Specifically, I would start with the first ciphertext character and randomly decide wether or not to add noise. If I decide to add noise I will insert the first unused element from my random sequence either before or after the current ciphertext character (again chosen randomly). When I reach the end of the cipher text there may still be unused values from the random sequence. If there are I go back to the first character of ciphertext (which could be an encrypted value or noise added in a previous pass) and continue inserting values randomly until all of the values from the random sequence have been used.

The final result is the message that would be transmitted. If you know the key description is trivial since you can just ignore the "noise". But if you don't know the key how would you go about decrypting this? specifically what are the techniques for separating noise from meaningful data or is there some other attack scheme?

Note: I am asking because of hobbyist curiosity. I know modern encryption algorithms are secure and don't need to be meddled with. And I know the scenario I described results in a larger transmission, etc. I just want to know how you break it.


texts: Can a deck of cards be used as a practical source of cryptographic randomness?

texts:
This is not a duplicate of Entropy measurement from shuffled cards, as this concerns use of cards as a cryptographic entropy source, rather than calculating entropy from some number of cards.

The Solitaire cipher from Cryptonomicon makes use of a deck of cards to encipher messages. However, it is considered insecure, and is likely impractical for actual cryptographic uses.

However, a deck of cards does have a large amount of entropy, and unlike electronically generated randomness, the randomness of a properly shuffled deck is nearly infalliable*. The entropy of a deck of cards is $\log_2(52!)$, or 225.58 bits, which approaches the Landauer limit and is well beyond anything we will ever be able to brute force. On the other hand, the order of a deck of cards is not a stream of bits, and is not easy to quickly process with a computer (a specialized deck reader and shuffler machine will be needed.)

My question is: How can random bits be extracted from a shuffled deck of cards?   Does this have any practical value at all?

So far, I've come up with the following procedure:

  -OCR the deck, producing a string like JH3CAS0D... to represent "Jack of Hearts, 3 of Clubs, Ace of Spades, 10 of Diamonds... and so on".

  -Take the SHA-512 hash of this string. For the sake of the example, I came up with:
  bfda311f6e9f6ad06825c9dc07fbbffb98ff86556a8e6fd7ac835b58f0c5eee04155db4e63f748a6c2b0b7c15e558b0e6c7e8222760283869904a2e485ef2d04

  -Take the SHA-512 hash of the last 256 bits of the first hash, and append that to the first hash.

  -Repeat step 3 as many times as needed to create an infinite stream.

*Barring cases such as improper shuffling or shuffling a default/stacked/known deck only once.


texts: What Digital Signature Scheme should we use?

texts:
My team wants to implement the ElectionGuard as the main part of an e-voting scheme (even if it is known that e-voting protocols are malleable; for the purposes of the voting scheme it is enough). Note that ElectionGuard security is based on the discrete logarithm problem.

We want to use a Digital Signature Scheme in order to apply a re-voting protocol (to avoid coercion). So we are wondering which one to use. We have been thinking about Schnorr signature (for simplicity).

Is a Schnor signature a good option?

Another question is about how to properly implement a re-voting system in the e-voting protocol.

In the context of re-voting, you end up with a ballot $b$ which contains the encryption of the votes and some zero knowledge proofs that the ballot is well formed. The idea is to generate a pair signing key/verification key $(sk,vk)$ using the generator of the Schnorr signature scheme, sign the ballot $\sigma = Sign(sk,b)$ and then introduce a number $num$ which will indicate the number of times that this $sk$ has been used (and which be associated uniquely with a particular voter). So the result will be a tuple $(b,\sigma,num)$.

Is this a good procedure? It is secure? At which level?

.


texts: How do I multiply two points on an elliptic curve?

texts:
Tell me if there is a way to multiply two points on an elliptic curve?
For example, as in secp256k1
Pcurve = 115792089237316195423570985008687907853269984665640564039457584007908834671663 # The proven prime
GPoint = (Gx, Gy) # Generator Point
N = 115792089237316195423570985008687907852837564279074904382605163141518161494337 # Number of points in the field
Acurve = 0; Bcurve = 7 # This defines the curve.

y ^ 2 = x ^ 3 + Acurve * x + Bcurve

(Gx1, Gy1) * (Gx2, Gy2) = (Gx3, Gy3)

Unfortunately I do not know their private key from which they were generated, but I really need to get a common point (Gx3, Gy3)
What algorithm is used to multiply two points on the secp256k1 elliptic curve?


texts: How to enforce data privacy, integrity and authenticity of distributed firmware images for an embedded device?

texts:
I'm developing a bootloader for an embedded device, with which it should be possible for customers (i.e. device owners) to update the device's firmware.
It is required that:

the firmware is distributed encrypted
the firmware's integrity is protected
the firmware is authentic, meaning that it was released by us (the manufacturer).

Based on my limited knowledge about cryptographic schemes, I came up with the following potential solution (see below for explanation):

For enryption and data integrity the firmware would be encrypted using AES256 in EAX mode using a key, which is shared between the manufacturer and the bootloader on the device, in addition to a nonce (i.e. initialization vector), which is encrypted (signed) using a private RSA key
The AES encrypted firmware and the RSA encrypted nonce are then distributed to the customer
The bootloader on the customer's device would then decrypt the nonce with the "public" RSA key (to ensure authenticity), and decrypt the firmware using the AES key and the nonce

Does this constitute a valid scheme for a secure bootloader (in terms of data privacy, integrity and authenticity)?

I am aware that using AES in EAX mode already provides data authenticity, however I would like to make sure that authenticity is still ensured in case the AES key is compromised.


texts: Exponentiation with fully homomorphic encryption

texts:
I have often heard that because a fully homomorphic encryption scheme allows for both additions and multiplications on encrypted data, most other operations can be simulated. I don't understand how exponentiation can be done, i.e., how to build $E(x^y)=E(x)^{E(y)}$ ?

If it can't be done, is there a FHE that support $E(x) . E(y) = E(x^y)$ where the operation on encrypted data is not necessarily exponentiation?


texts: Quadratic residue problem on composite integers

texts:
Its believed that the quadratic residue modulo $n=p·q$ for large primes $p$ and $q$ is intractable, which forms the basis of some cryptosystems.

However, it is solvable if the factors of $n$ are know, such that the problem modulo a prime is easy (we use the Chinese reminder theorem) to simultaneously solve the problem for each prime factor.

The question is, is there any proof of why the same method for prime number should not work for composites?

Or, what if the same technique for the prime number case is applied to the composite number? What flaw might we see in the result?

Obviously the output won't be correct, is there a specific thing that can be said on the result? For example, let us say we wanted to solve the problem for some integer $i$ which we think is a prime (but without our knowledge, it is a composite), is there any thing in the result that can be detected, so that we know the integer in which we thought is prime happens to be not?


texts:
We are creating a device with a small microcontroller (20 MHz CPU 16 KiB RAM).

We need some way to securely send signed files to device (only signature, no encryption necessary). An external company has come up with an elliptic curve solution but it needs about a minute to verify a signature, without counting the file hash time.

Could you suggest some other moderately secure algorithms that can run faster in such small CPU? (a few seconds would be OK, hundreds of milliseconds would be fantastic)


texts: Extending the size of input for SHA-2 function

texts:
In the question Does a hash function necessarily need to allow arbitrary length input? many answers talk about the theoretical limit of the SHA-2 functions being $2^{64} - 1$ bit due to padding. I was wondering, is there a secure way to extend this? From the description, it seems that the $2^{64} -1$ bits is not a security restriction, but more a padding issue.
Would it still be considered safe to have an SHA-2 function that chunks the input data into $2^{64} - 1$ bits of hash size and use the hash of the previous chunk as a salt for the next chunk? Are there other options to extend the size of the input of those hash functions to arbitrary length?


texts: What is the lightweight key exchange protocol of choice?

texts:
Assume I have to implement a secure channel protocol by myself. Assume further that for some obscure reasons (library restrictions?) I can't use any of the pre-made libraries for SSH, TLS and such. Assume even further that there are only few algorithms available namely the neccessary ones, such as AES, GCM, ECDH, ECDSA and SHA-256. And of course I'd like to avoid patent issues if anyhow possible.

Now I know that it's hard to implement TLS right, as can be observed at those many vulnerabilities on the common libraries (LibreSSL, OpenSSL,...). And I strongly suspect the same to be true for SSH and IPSec (=IKEv2).

Let's ignore the record layer (in TLS terms) of the secure channel and focus on the key exchange - for this question.

What is the simplest key exchange protocol with proven security against as many as possible attacks?

What the protocol should do is clear: Do some operations and as few as possible message exchanges and output a strong random shared secret at the end that may only be known by the two authenticated parties. This common shared secret should (of course) enjoy the forward secrecy property and it may not be completely chosen by one party.

The complexity requirements are also clear: The protocol should be a lot simpler than TLS with its myriad of extensions and it shouldn't be much more computationally intense than TLS either.

As far as the research goes, I know about STS suiting most security notions but also being vulnerable to some attacks. I know that there is MQV but it also had issues and seems to be covered by patents.


texts: Proof of membership in an aggregated BLS signature

texts:
Is it possible to prove that a given signature is a part of an aggregated BLS signature? Specifically, given:

$m_1...m_n$ are $n$ distinct messages
$p_1...p_n$ are private keys with $P_1...P_n$ being the corresponding public keys
$S_1...S_n$ are BLS signatures such that $S_i = sig(m_i, p_i)$
$A = S_1 + S_2 + ... + S_n$ is the aggravated BLS signature

Is it possible to prove that a signature $S_i$ is contained within $A$ using only publicly available data: $A$, $S_i$,  $P_i$, and $m_i$?


texts: Can or can not D-Wave's quantum computers use Shor's and Grover's Algorithm to find encryption keys? Why?

texts:
I read that a company called D-Wave Systems has and is manufacturing quantum computers of 128 qubits.

Can they or can they not use Shor's and Grover's algorithms for finding RSA-keys? If they can't then why not?

And how come it was so hard for the team at MIT to create and maintain a stable 5-qubit quantum computer ion trap if D-Wave has already succeeded in creating Q-computers with more qubits?

It feels like something with this D-Wave computer is off..? Would be extremly grateful if anyone could enlighten me.


texts:
I'm reading the book "Serious Cryptography A Practical Introduction to Modern Encryption" from Jean-Philippe Aumasson, and in the first chapter, it is written this :

  We can try to abstract out the workings of a cipher, first by identifying its two main components: a permutation and a mode of operation. A permutation is a function that transforms an item (in cryptography, a letter or a group of bits) such that each item has a unique inverse (for example, the Caesar cipher’s three-letter shift). A mode of operation is an algorithm that uses a permutation to process messages of arbitrary size.

But when I search about "mode of operation", I only found "block ciphers" using it.

Do all ciphers (for instance stream ciphers) have modes of operation?

And do all ciphers use permutation?

Thanks !


texts:
Recently I started studying Elliptic Curve Cryptography and I just loved it. I want to transfer some big data (like 3KB), What is the best method, ECDSA, ECIES, or ECDH (and why)?

I am confused, how should I choose between ECDSA, ECIES and ECDH?


texts:
I'm programming a file encryption software based on blowfish (which uses 64bit blocks). I will need a mechanism for padding, but I'm not sure how to implement that properly. All of the approaches I've seen so far could only be applied to text, where characters like 0x00 cannot contain data and thus can be used for special purposes. Since I'm planning on encrypting all file types I cannot rely on special characters which could be easily confused with real data.

Consider ANSI X.923 padding for example, how would the decryptor know that the
sequence 00 00 00 04 is not some special data but padding?

I came up with two of my own solutions, but since I'm not a cryptoanalyst I don't know how strong they are...

1) The very first byte of the encrypted file will be the padding number (the number of actual data bytes in the last block). Yes, I'm giving it away and anyone with a hex editor will be able to see it. The last block is padded with random bytes. I feel like this is a big weakness since I'm not encrypting my padding number. Is this really a weakness and why?

2) The very first block of the encrypted file will contain the padding number and a bunch of random bytes. The decryptor will know exactly where to find the padding number (first byte of the first block). Once again, the last block is padded with random bytes. Is this a good approach?

3) Any other methods I can use?

Thanks in advance.


texts: Can you use repeating numbers like $\pi$, and $e$, as the Key to OTP ciphers?

texts:
Since $\pi$ and other numbers repeat could you use them as a OPT key. Ex: a 5 character message is sent and the first 5 digits of $\pi$ are used. after that the next $X$ number of digits are used and so on. from what I understand of Cryptography (its my hyper fixation for the week) and potential 3rd party readers would have to know the number of messages sent and their length to try and decode the messages. if i understand it, it would be near impossible to brute force and would require digital forensics (data remanence can be an issue).
Obviously the community knows more than me, any insight would be much appreciated.


texts: The most common S-boxes that I've seen are 4-bit and 8-bit (I've seen a 3-bit S-box in PRINTcipher, but I'm pretty sure they only did so due to significant hardware constraints). I understand that anything larger would be difficult to hold in a lookup table, and that 4-bit S-boxes are small enough to exhaustively search for ideal properties (for an 8-bit S-box, that would require checking 256! S-boxes), but what exactly are the tradeoffs made when choosing between the two, or choosing other sizes? I can intuitively understand why small S-boxes are not ideal, but I don't understand much more about the choice of the size.


texts: Is the same message with repeated AES-GCM leaking plain text over time?

texts: The same message results in different cipher text every time AES-GCM is applied. If an attacker collects repeated messages over time, will he be able to extract the plain text if enough cipher text is collected?


texts: NTRUEncrypt - Choose the initial random polynomial

texts:
I'm trying to implement NTRUEncrypt but encounter some problems. I've finished all the basic functions that are needed for the scheme base on this Document, but I can't find an algorithm to check the validity of the initial polynomial f.

If f is not qualified (inverse mod p or inverse mod q doesn't exist) then the function to calculate the inverse modulo would end up in an infinite loop.

I've found some documentation about ntru con the ntru's website but there are too many of them and I don't have the time to go through them all. If anyone can help me with the algorithm or point out the document that I should read, that'd be helpful.


texts:
I don't understand the 'Wiedemann algorithm' works.
Can someone explain the factoring of RSA-704 in an easy way?


texts:
I'm reading through Bernstein's The Poly1305-AES message-authentication code.

The MAC is predicated on 16-byte block ciphers like AES and produces 16-byte authentication tags. However, Bernstein does not really discuss the block cipher's key sizes, other than to state its a 32-byte key comprised of a 16-byte key and a second 16-byte string r.

I presume Bernstein selected AES-128 because it met security requirements with the most efficiency (i.e., AES-128 is faster than AES-256 because it uses fewer rounds, among other stated criteria). (Bernstein talks about the selection of other parameters, like r, in the section Design Decisions).

If one desired, could Poly1305-AES be used with AES-256? In this case, a 48-byte key would be used.


texts: One-time pad: Using Cribdrag for Decipherment and Key Recovery


texts: How to envision entropy concentration in HKDF "extract" stage?

texts:
RFC 5869:

  Thus, the goal of the "extract" stage is to "concentrate" the possibly dispersed entropy of the input keying material into a short, but cryptographically strong, pseudorandom key.

The implementation:

HKDF-Extract(salt, IKM) -> PRK

PRK = HMAC-Hash(salt, IKM)

Here salt may be 0. In this case, it feeds IKM into HMAC with a fixed key:

PRK = H(opad || H(ipad || IKM))

How to envision this as a concentration of entropy? How is this different than simply hash the IKM:

PRK = H(H(IKM))

Or:

PRK = H(IKM)


texts: Looking for a partially blind multisignature scheme?

texts:
I am working in a project inspired in digital cash where we would like to use partially-blind signatures. This is so that the Bank signs a check with a hidden serial number (S), but a plainly visible denomination value (V). Because we may not wholly trust the signer (the Bank), we'd also like this to be threshold or multisig, so that we can have the independent signature of several signers and make signer corruption more difficult.

We have an onboarding process to enrol and remove signers, so there is a central authority that keeps track of their public keys. I read the analysis of the Bellare-Neven 06  paper on the KOSK vs Plain Public-key model, and it seems to me that with this setup, we can actually use the KOSK setting. NIZK proofs have advanced since the time of the paper and they are not necessarily prohibitive anymore. Furthermore, if what we want to prove is Proof of Knowledge of a DL secret key, that seems to be doable with Sigma-Protocols and not even require SNARKs.

If we can indeed rely on these and use the KOSK model, we can make a simple Multisig by using a linear signature scheme and aggregating signatures and public keys. If I understsand correctly, we would not need to worry about distributing shares of randomness during the signing process, as is done in 3-round MuSig.

But I've been doing the research on the existing literature on this topic and I haven't found anything out there that ticks all our boxes. I think I can cobble enough pieces together in an acceptable way, but would appreciate some feedback on it.

Our main goal is security, but we also want performance as good as possible, both in terms of computation (effort to create a signature) and on communication complexity (signature size and verifying  key information). For this reason I've been focusing on Schnorr-based schemes, instead of Bilinear-Pairings- (eg Boldyreva 03) or RSA-based schemes.

As for threshold- vs multi-signatures, I'm favouring multisigs at the moment because they seem to be lighter in construction: there is no need to distribute a key or a secret with a secret sharing kind of scheme and my intuition tells me that should make a faster scheme. And although I will have to send some information about the keys that have been aggregated, because we have a registry of signers we only need to send indices to the keys which is much shorter.

I analysed the Blind Signature by Okamoto in the version described in [Pointcheval and Stern 2000] and the Abe-Okamoto Partially Blind Signature.

Now, my problem is which base scheme to use. Ideally, I'd use Abe-Okamoto for its partial blindness. But it takes one extra element than the Schnorr-Okamoto and is more intensive to compute. Moreover, I don't know how paranoid I should be regarding concurrency.

The User will interact with each signer. Each of them will use their own randomness. The user also has to create some randomness, which will never be sent to the signers and is only used for blinding. Does this mean the User can employ the same blinding factors with every signer?

If we can reuse the randomness, then I believe Abe-Okamoto is linear and I could create a Multisig by just adding the shares and letting the verifier check that the aggregated key has been computed from a subset of centrally registered keys.

Do you think this is feasible? Can I use a Multisig Abe-Okamoto in this way? Or is there a better way to get the same behaviour?


texts: Alice sends the garbled circuit for a function to Bob in the offline stage. In the online stage, Alice sends affine transformations for the circuit to Bob. Then, Bob employs the garbled circuit and the affine transformations to re-randomize the circuit, and evaluates the re-randomized circuit on his input (using OT). The adversary chooses the input after seeing the garbled circuit. Is the garbled circuit adaptive?


texts: Any stream cipher with avalanche effect?

texts:
As far as I know, all stream ciphers work by generating a stream of pseudo random bytes, and XOR it with the plain text to get the cipher text. It has the property that one bit change in the cipher text results only the corresponding bit change in the decrypted message.

Is there any stream cipher that has the avalanche effect, where one bit change in the cipher text will result about half of the bits changed in the decrypted message after the corresponding bit?


texts: R-LWE instantiation with non-power of 2 polynomial

texts:
In almost all RLWE papers, the polynomials are chosen from a ring $\mathbb{Z}[x]/f(x)$ where $f(x)$ is a polynomial of the form $f(x)=x^{2^n}+1$. That leaves us the choice of polynomials like $x^{256}+1$, $x^{512}+1$ or $x^{1024}+1$ etc. Apart from irreducibility, I understand that using this polynomial has few other advantages like fast polynomial multiplication. One disadvantage of this is that it makes the sizes of keys or ciphertexts or signatures bigger. Just for example in the NewHope key-exchange scheme, their proposed parameter uses a polynomial of degree $1024$ which provides much more than $128$ bit security, whereas the less secure version (JARJAR) uses a polynomial of degree $512$ but provides security less than $128$ bits. Evidently, the former version sends much more data over the wire than the latter one.  But, what if I want to use a polynomial of degree that is between the above two, for example, $768$, it will provide sufficient security and will use a lesser amount of data.

Now my questions are

Can I use cyclotomic polynomial $\phi_{3*768}= x^{768} - x^{384} + 1$ as a modulus?
If yes, does the error distribution change? By what degree? (I understand there are some issues described in this paper (How (Not) to Instantiate Ring-LWE) but it is little difficult for me)

Thank you for your help.


texts:
I'm looking into multiplication-homomorphic schemes now and basically I see that there are 3 options: RSA, Boneh-Goh-Nissim and ElGamal.

RSA was proved to be insecure unless message is randomly padded, which action breaks the homomorphic property of the scheme.

Boneh-Goh-Nissim allows for one multiplication, but the decryption process is done through Pollard's lambda algorithm, which is basically guessing, i.e., there's no upper boundary on decryption time - looks dodgy for serious use.

ElGamal is great but the message expansion ratio is just crazy. If we use a 1024 bit key (512 was already broken), a 4 byte integer blows up to 256 bytes when encrypted. 64 times is harsh if we intend to encrypt GBs of plaintext data. Haven't yet tested the performance myself, but I guess that would suffer a lot too.

So the question is - are there other options I might take a look at?


texts: Padding Oracle Attack with AES-128-CTR and MAC

texts:
Assume Alice and Bob are communicating using 'MAC then Encrypt' paradigm.
Specifically, they are using HMAC with SHA256 as the hash function and the output is truncated to 40 bits. They are using AES-128 in CTR mode as the blockcipher. Specifically,  they do the following:

C=<IV, ENC(M II MAC(M, IV PAD) II PAD)>

I understand this. If we consider the message is 200 bits long. So the first block has 128 bits, the second block has 72 bits of the message, 40 bits of MAC and 16 bits padding. Padding scheme: 16 bits is 2 bytes (0X02). (0X0Z) for all Z bytes.

What I want to know is that if Eve has no idea that the original message is 200 bit long, but Eve knows it's 2 blocks long after 40 bit MAC was added and it is padded.

How will Eve know the length of the message? Will it be done by flipping the last bit and looking for padding error and using the padding algorithm? Or will we try padding oracle attack??


texts: Initialize the eight working variables SHA256

texts:
I have a little confusion in understanding explanation of SHA256 by FIPS

a, b, c, d, e, f, g, h

are being initialized as (this is what i don't understand)

  2 . Initialize the eight working variables, $a,b,c,d,e,f,g,$ and $h$, with the $(i-1)^{st}$ hash value:

  $\ \ \ \ a = H_0^{(i-1)}$
   $\ \ \ \ b = H_1^{(i-1)}$
   $\ \ \ \ c = H_2^{(i-1)}$
   $\ \ \ \ d = H_3^{(i-1)}$
   $\ \ \ \ e = H_4^{(i-1)}$
   $\ \ \ \ f = H_5^{(i-1)}$
   $\ \ \ \ g = H_6^{(i-1)}$
   $\ \ \ \ h = H_7^{(i-1)}$

cause with this, in stage 1 of iteration, variables

a, b, c, d, e, f, g, h

would have (pre-defined) Initial Values of H. But in Calculation Stage of these variables there is no use of next stage Intermediate Hash Values H.

  3 . $For\ t=0\ to\ 63:$
  $\ \ \ \ \{$
  $\ \ \ \ \ \ \ \ T_1=h+\sum_1^{\{256\}}(e)+Ch(e,f,g)+K_t^{\{256\}}+W_t$
  $\ \ \ \ \ \ \ \ T_2=\sum_0^{\{256\}}(a)+Maj(a,b,c)$
  $\ \ \ \ \ \ \ \ h=g$
  $\ \ \ \ \ \ \ \ g=f$
  $\ \ \ \ \ \ \ \ f=e$
  $\ \ \ \ \ \ \ \ e=d+T_1$
  $\ \ \ \ \ \ \ \ d=c$
  $\ \ \ \ \ \ \ \ c=b$
  $\ \ \ \ \ \ \ \ b=a$
  $\ \ \ \ \ \ \ \ a=T_1+T_2$
  $\ \ \ \ \}$

and what I see Intermediate Values are calculated with Variables not the other way around.

  4 . Compute the $i^{th}$ intermediate hashvalue $H^{(i)}$:

  $\ \ \ \ H_0^{(i)}=a+H_0^{(i-1)}$
   $\ \ \ \ H_1^{(i)}=b+H_1^{(i-1)}$
   $\ \ \ \ H_2^{(i)}=c+H_2^{(i-1)}$
   $\ \ \ \ H_3^{(i)}=d+H_3^{(i-1)}$
   $\ \ \ \ H_4^{(i)}=e+H_4^{(i-1)}$
   $\ \ \ \ H_5^{(i)}=f+H_5^{(i-1)}$
   $\ \ \ \ H_6^{(i)}=g+H_6^{(i-1)}$
   $\ \ \ \ H_7^{(i)}=h+H_7^{(i-1)}$

Can you please explain to me how 2. Stage (Initialization) fit in Iteration Process of SHA256.


texts: The non-interactive proof of verifiable computation: Pinocchio

texts:
I am reading the Pinocchio paper. The paper says, in paragraph "polynomial asymptotics" of section 4.2.1, a worker, in order to include $h(s)$ into the proof, has to interpolate $p(x)$, and then divide it with $t(x)$ to get $h(x)$, then calculate $h(s)$.

As a worker, I would calculate $p(s)$, then $t(s)$, and let $h(s)=p(s)*(t(s))^{-1}$. Suppose this $h(s)$ is good, this approach is much less complicated, compared to the approach described in the paper, which dictates at least $O(n (log(n))^2)$ complexity.

I am wondering why this simpler approach to get $h(s)$ for the worker does not work. Any help is appreciated.


texts: Does secure multiplication makes sense in the case of 2 inputs?

texts:
I am looking at a protocol to securely multiply numbers, so as to preserve privacy of inputs.

In particular, suppose there are three parties $P_1$, $P_2$ and $P_3$ and 2 numbers to multiply, $a \in \mathbb{F}$ and $b \in \mathbb{F}$ such that $\mathbb{F}$ is a finite field of prime order $p$. More precisely, $a$ is the $P_1$'s input, $b$ is $P_2$'s input and $P_3$ has no input. $P_1$ and $P_2$ shares their input among the parties using 2-out-of-3 secret sharing and, in this way, each party can compute a share of the product. Then, shares of the product are securely summed and all the parties can compute the result.

In this aim, I am wondering whether does it make sense when we have only two parties?

If $p$ is big enough (such that $a \cdot b < p$) , once $P_1$ knows $a \cdot b \mod p$, by knowing $a$, it could easily compute the secret value $b$.

For this reason, I do not see the point of using secure multiplication in this case. Could somebody help me understand this?


texts: Is it feasible to find n hashes that sum up to a given hash?

texts:
Consider two sets $A=\{a_1,a_2,\cdots,a_n\}, B=\{b_1,b_2,\cdots,b_m\}$;

We can calculate the hash sum of those sets:

$$HASHSUM()=(ℎℎ(a_1)+ ℎℎ(_2)+\cdots +ℎℎ(_))$$ and
$$HASHSUM()=(ℎℎ(_1) + ℎℎ(_2)+ \cdots + ℎℎ(_)).$$

Is it possible that set $$ does not equal the set $$, yet $$HASHSUM()=HASHSUM()?$$
Specifically, if $n$ (not necessarily $m$) is a small number ($<20$).


texts: Should I include the ciphertext length in an AAD when using Chacha20+Poly1205 AEAD?

texts:
I want to construct a time-limited authorization token using ChaCha20 and Poly1305 as defined by RFC7539. I chose the following simple layout:

version || nonce || ciphertext || Poly1305 tag
1B         12B      *B            16B

where the concatenation of version and nonce is used as the Poly1305's AAD.

However, this scheme does not explicitly specify the length of the ciphertext to follow, so an attacker may want to try to truncate or expand the ciphertext section of the token. If I add the ctlength value between version and nonce, will it improve security?


texts:
Is there a way to prevent the shared secret to be a small value (eg 4) to avoid easily succeeding brute force attacks?

In $g^a \bmod p$, I understand that choosing $p$ not a multiple of $g^a$ is a first step.
But other than that, are there fast ways to achieve that goal?

Thanks


texts: Does EdDSA share Schnorr signature secure linearity property?

texts:
EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source).
Schnorr signatures have a remarkable property: linearity. This allows multiple parties to collaborate to produce a valid signature for the sum of their public keys.

Does EdDSA provide the same security guarantees when aggregating signatures or deriving a new signature?
Can we apply the same blind signature schema of Schnorr for EdDSA?
If yes, what are the secure EdDSA aggregation constructions?

I found the following constructions for EdDSA, but I'm not sure if they have been analysed enough:

Aggregated Ed25519 Signatures
Compact Multi-Signatures for SmallerBlockchains


texts: Why is it difficult to encrypt large amounts of information using quantum key distribution?

texts:
An article last month claimed that Toshiba Corp. and Tohoku University recently broke the record for the amount of data encrypted using quantum key distribution by transmitting "a few hundred gigabytes".

But QKD is merely a protocol for transmitting symmetric keys - the actual encrypted data is later sent over an insecure channel where presumably bandwidth is not a limitation (or at least any limitations are completely separate from the encryption protocol). Moreover, my understanding is that once you've transmitted a single symmetric key, the amount of data that you can encrypt with it is effectively unlimited:

The answer at https://crypto.stackexchange.com/a/2473/76433 claims that for AES-128 the risk of compromise is "very likely" after $2^{64}$ blocks of encrypted data are transmitted, but the answer at https://crypto.stackexchange.com/a/5101/76433 says that for AES-256, after $2^{50}$ blocks of data transmission the probability of data leakage is still only $2^{-29}$. The answer at https://crypto.stackexchange.com/a/66261/76433 is more conservative and recommends only encrypting 64 GiB of data per symmetric key in order to keep the collision risk down to $2^{-64}$.

So it seems that after you've transmitted a mere 256 bits of symmetric key data via QKD, the amount of data you can encrypt is effectively unlimited. (If you want to be extremely conservative and you want the risk all the way down to $2^{-64}$, then maybe you'd need to transmit a few keys in order to transmit "a few hundred gigabytes" of data.) And modern QKD technology can easily transmit millions of bits per second (although whether or not they are actually secure is a separate question). So why is it impressive that large amounts of data were transmitted?

More broadly, is there any real advantage to having a QKD system that can transmit more than ~256 bits? (Again, I'm putting aside any practical security risks of QKD and assuming for the sake of argument that it is indeed secure.)


texts: Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

texts:
I presented our mathematician with an idea:

  If you have a black box that encrypts or decrypts AES with the same 128 bit key (you don't have any direct access to the key), and you control the input and the direction (enc/dec) and can see the output,
  can you mathematically derive the key? How many tests will you have to run to be able to derive the key?

He said he remembers there was a paper that said it will take only $2^{16}$ tries to derive the key. Does this paper exist? Dan anybody point me in the right direction?


texts: Is any encryption system that changes keys for each session "forward secure"?

texts:
As far as i understand, a encryption system is forward secure if new session keys are generated for each session, which is also part of what wikipedia says about forward secrecy:

By generating a unique session key for every session a user initiates, the compromise of a single session key will not affect any data other than that exchanged in the specific session protected by that particular key.

So far, so good, but it is the definition that bugs me:

An encryption system has the property of forward secrecy if plain-text (decrypted) inspection of the data exchange that occurs during key agreement phase of session initiation does not reveal the key that was used to encrypt the remainder of the session.

1. In this way, shouldn't e.g. asymmetric encryption be forward secure even if we do NOT alter keys between sessions?
For asymmetric encryption, the data exchange during key agreement does NOT include the private key and also not necessarily the public key, hence a plain-text inspection of it does not reveal the key(s) that are used to encrypt the session...
If i interpret it as both keys shouldn't be send as plaintext, then an assumed asymmetric encryption that changes the private-public key pair for each session is also NOT forward secure, because the public key is always public.
2. Is the definition wrong or insufficient?
3. Is it sufficient to think that any encryption system that changes keys for each session is forward secure?


texts:
I am considering a setting similar to the one of the Paillier cryptosystem, where we sample two distinct odd primes $p,q$, we set $n=pq$, we generate $a \leftarrow \mathbb{Z}_{n^2}^*$ and finally we set $g = (n+1) a^n \mod{n^2}$.

My question now is if the discrete log with the parameters $(g, \mathbb{Z}_{n^2}^*)$ is known to be hard, i.e. if given $(g, g^x)$, one can simply recover $x$, where let's say $x \in \mathbb{Z}_n$.

I know that we can apply Chinese Remainder Theorem in this case, but is this alone sufficient for breaking the Discrete Log?

Thank you very much!


texts: What are the constraints on using GCM with a tag size of 96 and 128 bits?

texts:
Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default).

NIST SP 800-SP 38D, Appendix C: "Requirements and Guidelines for Using Short Tags" specifies the amount of AAD and plaintext together with the number of invocations for 32 and 64 bit short tags, but not for the larger tag sizes. NIST specifies these properties using a table with the following columns set off to each other:

Maximum Combined Length of the Ciphertext and AAD  In a Single Packet (bytes)
Maximum Invocations of the  Authenticated Decryption Function

Here are the constraints for a 64 bit tag size:

Furthermore, the paper "The Galois/Counter Mode of Operation (GCM)" contains the following equation right at the end (chapter 7: "Security"):

  The results of this analysis show that GCM is secure whenever the block cipher is indistinguishable from random and the condition $q^2l^22^{−142} + q^2l^32^{−147} \ll 1$ is met, where $q$ is the number of invocations of the authentication encryption operation and $l$ is the maximum number of bits in the ﬁelds $P$, $A$, and $IV$.

The Wikipedia page on GCM also has a lot of information and references (but not this information, obviously).

I'm not sure if any subsequent analysis has put a dent into the numbers of NIST or the paper though.


texts: Alice answering Bob without knowing the question

texts:
I'm a student and I don't know how to solve the following problem :

Alice is proposing a 10 questions list to Bob.
Bob choose only 1 question and wants to know the answer without Alice knowing the question.
Alice wants that Bob can only have 1 correct answer.

Is it possible ? If yes how ?

In my mind it should begin like this :

Bob & Alice knows the 10 questions
Alice encrypts each answer with a different key
Alice sends the 10 encrypted answers to Bob
Bob chose a question (ex : question 2)

Here comes the intricate part in my mind :

Bob should crypt the question (How?)
Bob sends the encrypted question to Alice
Alice answer to bob with the encrypted decrypting key (How?)
Bob can decrypt his answer, Alice doesn't know what key she gave

Thanks :)


texts: How to encode bivariate polynomial in Predicate Encryption and Inner Product?

texts:
From the paper Predicate Encryption Supporting Disjunctions, Polynomial Equations, and Inner Products, the vector of the secret key is generated from a polynomial $p(x)$. I understand the univariate polynomial, but what does the vector of a bivariate polynomial look like? For example:

univariate polynomial

$$p(x) = (x - a) \cdot (x - b) = x^2 -(a+b)x + ab$$

Secret vector $p = (1, -(a+b), ab)$
Vector $w$ (with attribute $a$) = $(a^2, a, 1)$ (I am not sure if I understand it correctly)
Inner product: $\left<p,w\right> = a^2 - a^2 - ab + ab = 0$

bivariate polynomial

$$p(x) = (x_1 - a) \cdot (x_2 - b)$$

Secret vector $p = ?$
Vector $w$ with attribute $a = ?$

Many thanks.


texts: ElGamal signature - exploiting fallacious implementation

texts:
This question is related to ElGamal signature scheme as defined here
ElGamal signature without calculating the inverse

Show how one could exploit an implementation ElGamal signature scheme in which it is not checked that $0 \leq \gamma \leq p-1.$

As far as I can see, we have to find a $\gamma$ such that $\alpha^{a\gamma-x}\gamma^\delta \equiv 1 \pmod{p}$ for a message $x$.

Anyone happens to see a good choice of $\gamma$?


texts: Elliptic curves - operations in larger groups - performance

texts:
According to my measurements and to this work, it seems that operations, for example scalar multiplication, are more expensive in larger groups. If I have, for example, an 80-bit elliptic curve and an 384-bit elliptic curve, then the difference is very big:

80-bit curve: 10ms per 1 multiplication on average
384-bit curve: 501ms per 1 multiplication on average

I don't know if it's related, but the method for multiplication is probably wNAF.

Question: Why basic operations are more expensive on larger groups?


texts:
I am wondering if there exist some special rings $R$ that gives us, under the canonical embedding, some special lattices, like the root lattices, Barnes-Wall lattices, Leech lattices, ...
In more details, is there some rings $R$ such that $\sigma(R)=D_n, \,  A_n, \, BW^n ...$?


texts: ECDSA with SHA256 and sepc192r1 curve: Impossible, or how to calculate $e$?

texts:
I need to use ECDSA as the signing algorithm and SHA256 for hashing the message. I'm running into troubles verifying the signature calculated on two different platform (one is BouncyCastle, another one a C library for a microprocessor).

I figured out that BouncyCastle, in its ECDSASigner class, reduces the input message (which is supposed to be already the hash), in both, generateSignature() and verifySignature() using a helper function called calculateE(). In essence, this functions truncates the input message/hash to the bitlength of the curve's order $N$.

protected BigInteger calculateE(BigInteger n, byte[] message)
{
    int log2n = n.bitLength();
    int messageBitLength = message.length * 8;

    BigInteger e = new BigInteger(1, message);
    if (log2n < messageBitLength)
    {
        e = e.shiftRight(messageBitLength - log2n);
    }
    return e;
}

This reduction results from the fact that a SHA256 hash has 32 Bytes, whereas the size of $N$ is (for secp192r1) 192/8 = 24 Bytes.

What I don't understand:

Do I have to use a curve with greater size of bitlength(N) for SHA256 hashes to be signed (e.g., secp256r1 or secp521r1)?
Is the implementation in BouncyCastle wrong/imcomplete, or only applies to SHA-1 (160 b = 20 B <= 24 B)?
Where is it documented/specified, how to “reduce” a hash of greater bitlength than that of the curve domain?


texts: How can a node establish pairwise shared key with other nodes using its own polynomial share together with other's public values?

texts:
A server has a symmetric bivariate polynomial  $ F(x, y) = \sum_{{i,j}=0}^{t-1}a_{i,j}x^iy^j$  $\in GF(p)[X, Y] $ of degree $t-1$. For simpliciy, $ F(x, y) = a_{0,0}+a_{1,0} x+a_{0,1}y+ a_{1,1}xy$ mod $p$, where  $a_{0, 1} = a_{1,0}$ and $p$ is a large prime number.

From the origional polynomial  $ F(x, y)$, the server generates $n$ univariate polynomial shares  as  $f_{x_i}(y)=F(x_i,y)$ , where  1 ≤ $i$ ≤ $n$, and $x_i$ is private (noboday knows it except the server) and distinct number  for each node $i$.
Each node $i$  has a distinct public number $r_i$, where  1 ≤ $i$ ≤ $n$ and every node else knows this number as it's public

Now, Let's say $node$ $i$  has got its own share $f_{x_i}(y)$ and $node$ $j$ has got $f_{x_j}(y)$ , where $x_i \neq x_j$, as said earlier.

The question is:

Utilizing the symmetric property of the original bivariate polynomial and Using their own polynomial shares together with other's public numbers, how can $node$ $i$  and $node$ $j$ ,$i \neq j$, establish a pairwise shared key/value such that: $ k = f_{x_i}(r_j)$ =$f_{x_j}(r_i)$ holds???

$Hint$: node $i$ evaluates its own polynomial share using node $j$'s public number and node $j$ evaluates its own polynomial share using node $i$'s public number. Is there any trick to make them get the same value? and How?

I appreciate your help


texts: How to use salt if I am sending hashed password?

texts: If have application that is sending username and hashed password to server for authentication, how would I use salt for this scenario ?


texts: Fast cryptographic hash function for short inputs

texts:
I am looking for a cryptographic hash function optimized for speed on short inputs, in order to implement a pseudorandom generator with expansion factor 2 (e.g. takes 16 bytes of input and outputs 32 pseudorandom bytes).
Here are some natural candidates I tried:

SHA256: good baseline
Blake2: designed for speed on large inputs, does not perform as well on short inputs
AES-CTR: faster than SHA256 when the hardware supports AES-NI. The input is used as a key for AES to encrypt a predefined byte array of the desired output length. However, re-initializing the cipher for each call to the hash function is costly.

I also found this interesting construction: STHash. It is a keyed cryptographic hash function optimized for speed on large inputs. I don't mind having a keyed hash function instead of a general-purpose one.
Is there any analogous construction for short inputs, or a more efficient way to leverage AES-NI than AES-CTR?
Some informal benchmarks
For each hash function, I hash an array of 16 bytes into a 32 bytes array, and I repeat 10 million times. For stream ciphers like AES and ChaCha, I create a new cipher at each iteration with the input as key on a public fixed plaintext and nonce. If the cipher needs a 32-bit key, I just pad the input with 0. If the hash function does not produce enough bits (e.g. SipHash outputs only 128 bits), I run it several times.
I am running Rust Nightly on an Intel® Core™ i7-1065G7 CPU @ 1.30GHz × 8, the experiments run on a single thread.

SipHash 1-3: 476.9ms
Chacha8: 590.4ms
SipHash: 670.3ms
AES-128: 665.3ms
SHA256: 780.4ms
Blake2s: 1413.9ms

For information, some results about Haraka (using a not well-known optimized implementation):

Haraka-v2 256-5: 55.2ms
Haraka-v2 256-6: 69.9ms


texts:
Two of the properties that lead to the design of DES S-Boxes are:

For any non-zero 6-bit difference between inputs, no more than 8 of the 32 pairs of
inputs exhibiting that difference may result in the same output difference.
This is a criterion similar to the previous one, but for the case of three S-boxes.

The book i am reading (Understanding Cryptography from Christof Paar and Jan Pelzl) translates the second one to: A collision (zero output difference) at the 32-bit output of the eight S-boxes is only possible for three adjacent S-boxes.

Can anyone explain me the first property? I have searched for that property on google but the statement is always the same and i can't understand it. At first i thought that the non-zero 6-bi difference was between two different inputs to an s-box. But then it talks about 8 pairs of the 32 pairs (the only 32-bit input is the one before the expansion) that exhibit the 6-bit difference. Am i the only one finding this explanation confuse as hell?

As for the second criterion and assuming the book explanation i assume that you can't have something like (O = output of s box):

O(s1) = O(s2) = O(s3) = O(s4) = O(s5) = O(s6) = O(s7) = O(s8)

but you can have:

O(s1) = O(s2) = O(s3) && O(s4) = O(s5) = O(s6) or some combination of three adjacent s-boxes.

I hope you understand my questions and you can help because i would like to clarify this.


texts: Side-channel attacks for ARM conditional instructions

texts: I'm implementing some cryptographic functions on an ARM Cortex-M4 and would like to be safe against side-channel attacks, like power and timing attacks. For efficiency I'd like to use conditional versions of common single-cycle instructions such as moveq, movne, umaaleq etc. The cycle timing will be constant regardless of the flags, but is there any other problem with this approach? Are there some "safe" instructions and some "unsafe"?


texts: In many symmetric key ciphers sender and receiver have to exchange a single key. They may also do it through 3rd party who distributes it to both of them. since 3rd party can read all messages exchanged between them It can have disastrous impact on them in terms of capital, forgery etc. so In this case how is the privacy between the two ensured ?


texts: Collusion resistant computing of same function by two servers

texts: Is there a secure way of computing same hash function of replicated data by two servers. I mean that both servers host the same version of replicated data and they should output h(M) without colluding, i.e., both of them really compute the specified function.


texts: Why was the term "discrete" used in discrete logarithm?

texts:
Is there anything especially "discrete" about a discrete logarithm? This is not a question of what is a discrete logarithm or why the discrete logarithm problem is an "intractable problem" given certain circumstances. I'm just trying to determine if there's some additional meaning to the term "discrete" as it's used in name discrete logarithm?

The definition of "discrete" is "individually separate and distinct". Could it be that the term "discrete" is a reference to the least non-negative residues of a modulus or the order of points for a particular cyclic group on an elliptic curve?


texts: Interpretation of message space distribution in the definition of perfect secrecy of encryption schemes

texts: I am a beginner to cryptography, and have started reading Katz and Lindell's book titled "Introduction to Modern Cryptography". I'm unable to understand what the probability distribution over the message space $\mathcal{M}$ represents in the definition of perfect secrecy of encryption schemes (Definition 2.3 in the above textbook). Does it represent the a priori knowledge that the adversary has about the message being encrypted? Or does it actually represent the probability distribution with which the message is being selected for encryption? It would be very helpful if someone can provide me an intuitive and a rigorous interpretation of the message space distribution $\mathcal{M}$.


texts: Could using sequential plaintext uncover AES key?

texts:
I am encrypting a string in a format like this:

Byte 1: 1 (this byte is CONSTANT and KNOWN)
Byte 2-18: a random string of characters that is never the same.
Byte 18-34: unknown number that is sequentially incremented each time
            (it's a primary key from a mySQL AUTOINCREMENT column)

The entire 34 bytes is encrypted using 128 bit AES key.

Let's assume the attacker has access to several million of these strings that were generated sequentially and the attacker has them in order. This means the attacker knows that Bytes 18-34 are several million integers, each exactly 1 apart (eg, 100, 101, 102, 103, etc).

Could the attacker:

Figure out the AES key if the IV used to encrypt all the strings is the same?
Figure out the AES key if the IV used to encrypt all the strings is NOT the same (one IV per string), but known?
WITHOUT figuring out the full key, would it be possible for the attacker to compose their own string that allows them to set their own known value for bytes 18-34, and simply put garbage in the rest of the bytes?

AES is supposed to be immune from known plaintext attacks, but I am having trouble wrapping my head around how far that extends in practice.

Many thanks in advance.


texts: Using C_Sign to create a PKCS7 signature

texts: I am using the PKCS#11 function C_Sign to sign some data. The output I get is just a signature. How do I get it in PKCS#7 format - i.e. ASN1 with signature and certificate (for detached) or ASN1 with signature, certificate & unsigned string (for attached).


texts:
I am trying to implement the algorithm described in this paper. It uses blocked Gibbs sampling to perform a ciphertext-only attack on text encrypted with a running key cipher. However, I am confused by what it means when it says 'Sample ___ according to ___'.

I have not used Gibbs sampling before so I have watched a few videos explaining it. From the algorithm given in the paper, I am thinking I need to sample the positions of the spaces from the distribution $\Pr(P)$, but I am not sure how I am supposed to sample from it. The same goes for sampling the words.

(Note that it says later on in the paper that $\Pr(P) = \lambda\Pr(P\mid\text{word LM}) + (1−\lambda) \Pr(P\mid\text{letter LM})$ and they fix $\lambda=0.7$. I believe that LM means 'language model'.)

Does anyone know how to sample from these distributions, or am I misinterpreting it?


texts: How do I preform the inverse key expansion of aes decryption?

texts:
I’m working on an aes encryption and decryption project in 8086 assembly!
I managed to code an encryption algorithm and it worked perfectly.
No I’m working on the decryption algorithm.
I’ve managed to code all the inverse transformations.
But how about the inverse key expansion??
How is the aes key expansion preformed during the decryption process??
Thanks,
Ilay


texts: Using cryptographic hash to match AES key size

texts:
I am making a tool for myself where I intend to store cipher text. I wish to use AES together with arbitrary sized keys to create these cipher text strings. The idea is to use a cryptographic hash like SHA256 to compensate for the key length issue.

Is this a sound way of doing things?

Also, since the output domain of SHA256 is much larger than any key a "normal" person can remember, does this add security if an attacker gets hold of the password digest from for example a computer?


texts: Is using the same key for different message HMACs insecure?

texts: When using the MAC-then-Encrypt composition, would using the same key for the HMAC in each different message be insecure?


texts: Send content to owner of gpg public key, nested content symmetric encryption

texts:
If I want to encrypt a text content file using a symmetric algorithm like AES,
is there a standard format gpg will expect, where it can detect a symmetric key (encrypted with recipient gpg public key RSA) in my output?  E.g. should the encrypted key be a fixed length field at the beginning of my output?

I am not able to use a suite gpg tools or command line.  I am restricted to manually using a subset of cryptography APIs supported in a legacy system.

From reading up at e.g.
 https://futureboy.us/pgp.html#Symmetric,
 https://www.gnupg.org/gph/en/manual/x110.html,
 https://tools.ietf.org/html/rfc4880
I see that this approach seems to be in use.

But I am struggling to find any reference that would help me manually construct an appropriately structured "package".


texts: How long would it take to calculate the hash of a password by hand?

texts:
Suppose one had no computer (or rainbow tables), but had access a pen and paper as well as all the necessary documentation for modern (best practice, not outdated) hashing algorithms and mathematical formulae.
How long would it take to compute the hash of a password?
Define password

a random 8 character string of characters (numbers, letters, allowable symbols)

Define best practice

bcrypt (or similar) with calculation performed n=10 (so 1024 times total)


texts:
I have this set: {0,1,2,3,...,15}.

I would like to create a pseudo-random permutation from elements of this set, for example {10,2,15,0,7,5,9,4,3,13,11,1,6,12,8,14}.

Which method could I use to obtain the permutation?


texts: Encryption/Decryption on multiple users using RSA?

texts:
Supposing I have Alice that is the RA, Bob (who is a user) and Kate (who is also a user). For now I use RSA. Alice sends a message to Bob. Alice also sends a message to Kate. Bob and Kate exchange their messages as they took them from Alice (without decrypting them and encrypting them) using the public key of Alice. My question is how can Bob and Kate decrypt the messages using the public key of Alice? Is there any other protocol that should I use when I have 1 RA, and many users, and I want the users to decrypt the messages they got from the RA (without decrypting and encrypting in the mean time)? What I am trying to do here is Bob to get the message of Kate and do some checking, and also Kate get the message of Bob and do some checking.

Thank you


texts: Getting Sha256 values in any arbitrary range with almost equal probability

texts: I went through this post SHA256 output to 1-6 number range?, this post, SHA256 output to 0-99 number range? and I felt like the exact way mentioned in the first one is really helpful. I am looking for help to generalize the way for any arbitrary integer, in other words, if we want the output values in range of 0 to n where any output may get any value in the range with equal probability, how would I apply the exact way mentioned in the first post? Or is there any other way which helps?


texts: Sequential delayed release of chained HMAC keys for use as asymmetric signature

texts:
Iterative hashing of a private random seed can yield keys for use in HMAC, which if revealed publicly in reverse order and on predetermined schedule, can be used in a manner similar to other asymmetric key signing protocols, where released intermediate key authenticity is verifiable in terms of its relationship to the first released (last in chain) key. The seed is like a private key, and the last of the chain (first released) is like the public key. Useful elaborations are possible, e.g. converting the chain into a branched hierarchy for delegation purposes.

This can't be a new idea. Is it? Does anyone know of existing work on this, either in the journals or in the wild?

This link restates the above with more detail, some diagrams, and a few elaborations:
http://ben.mord.io/p/delayed-chained-key-revelation-dckr.html


texts:
I want to split a message using Shamir's Secret Sharing by splitting each byte of it so the field I'm using is $2^8$.
Assume $(2,2)$ scheme, i.e., splitting it into $2$ shares and both of them are needed for reconstruction.
By having one share, can I guess the second (I have max $256$ options) and try to build the polynomial to reveal the secret? am I missing something here? so larger $k$ is important here?
Thanks!


texts: How to reduce Computational Diffie–Hellman problem and Decisional Diffie–Hellman problem to Discrete logarithm problem

texts: I'm supposed make some reductions but don't even know where to start. Any help would or explanation on how to do this would be much appreciated.


texts: How to encrypt letters less than block n using Hill Cipher

texts:
I am learning about Hill Cipher and know that it is a block cipher where each block of n letters (considered as an $n$-component vector) is multiplied by an invertible $n \times n$ matrix, again modulus $26$.

The article did not touch on what happens if the the block of letters is less than length $n$.

Eg: Assume I am supposed to encrypt 100 letters – how do I encrypt the last 22 letters?

I was thinking of padding similar to MD5, or are there other methods to resolve this issue? If so, what are those methods?


texts: Updating the seed key of a PRNG while maintaining initial entropy?

texts: Consider a seed key ($n$-bit long) is completely random and entropy of random variable is $n$ and PRNG is using deterministic algorithm and that that deterministic algorithm does not add any entropy to the random variable. Moreover, the PRNG length is $2^n-1$. So, how can we update the seed key of that PRNG to avoid repetitive output while maintaining the same initial entropy of the seed key?


texts: Encrypted Data length in a CBC Block Cipher

texts:
The RFC5246 states the following:

The encrypted data length (TLSCiphertext.length) is one more than the
sum of SecurityParameters.block_length, TLSCompressed.length,
SecurityParameters.mac_length, and padding_length.
Example: If the block length is 8 bytes, the content length
(TLSCompressed.length) is 61 bytes, and the MAC length is 20 bytes,
then the length before padding is 82 bytes

What is the extra byte and what should it be?
Also, the maths doesn't quite seem to add up. The first section says the length is the sum of the block length, the contenct length, the MAC length and the padding length. So why in the example is the 8 byte block length ignored in the calculation?


texts: Secure Deduplication and Encryption in a data store

texts:
Assume:

We have a centralized data store that can store whatever we need
Every user is online
Function $f : File \to Key$ gets access to the store, and is the same for all users.
$g : Key \to File$ should retrieve the file so that $g \circ f = id$.
Eve can't break modern algorithms.

Then:

Eve wants to know who inserts file $A$, and has a copy of file $A$ as well as read access to the whole store and connection sniffing on all other users
Alice inserts file $A$ with function $f(A)$
Bob inserts file $A$ with function $f(A)$

Is there a suitable definition for $f$ and $g$ that:

Doesn't store $A$ multiple times
Doesn't let Eve know that Alice and Bob inserted file A.

What if we let $f$ store $A$ multiple times but then after:

Joe gets Alice and Bob's output from $f$ as well as access to the store

Can Joe deduplicate the two copies of $A$:

Without Eve knowing who has $A$?
Without causing future retrievals of $A$ by Alice or Bob reveal that they have $A$.


texts: Decrypting first byte of plain-text for AES CBC Padding Oracle Attack

texts:
I'm working on padding oracle attack and I have a 16 byte cipher on which I need to perform the attack. I've been able to successfully decrypt all the bytes of the plain-text except first byte and I'm now out of ideas as to why I'm not getting any response for the first byte of plain text and any idea or help would be appreciated.
Since it is known that the message was encrypted using AES CBC mode, I do understand the block size is 16 bytes and hence the padding can be between 0x01 to 0x10 and upto 0x0f everything works well but I'm unable to find the plain-text for 0x10. Do I need to do something special for the first byte?
I have also tried adding a full block i.e. 16 byte padding of 0x10 at the end of cipher text block when decrypting for the first byte of plain-text but that didn't help.

hex_lst = []
for i in range(0, 256):
    hex_lst.append('0' + hex(i)[2:] if len(hex(i)[2:]) == 1 else hex(i)[2:])

for each_hex in hex_lst:
    c_1 =  each_hex + 'ef7999a200e306ab2c413d855a2b1c'
    c_2 =  cipher[1]
    response = requests.get("http://dev/api/test/%s%s" % (c_1, c_2))
    if response.status_code != 500:
         print(each_hex)

In above code, the hexadecimal string in $c_1$ is computed using the following formula for each byte:
$c_1[16] = 10 ⊕ I[16]$
$c_1[15] = 10 ⊕ I[15]$
And so on.. $I[i]$ represents the intermediate value for $i^{th}$ byte of the $c_2$ cipher block! I have calculated these values by hand as well through script multiple times and it returned same value.


texts: How succeptible to accidental collision is the construct sha256(uuid4 + now) in Python?

texts:
I need 32 byte pseudorandom sequences that denote unique filenames and am currently using this Python code:

import base64
import hashlib
from django.utils import timezone
from uuid import uuid4

def get_name():
    data = str(uuid4()) + str(timezone.now())
    hash = base64.b64encode(hashlib.sha256(
                  data.encode()).digest(), '-_'.encode()).decode()[:-1]

Do you think it's necessary to check if the generated sequence doesn't collide with any previously generated sequences or can I just skip the overhead of checking, trusting the function?


texts: Partially synchronous model in broadcast

texts: I am confused by the different definitions attributed to partially synchronous model: for e.g., in a paper by Hevia and Micciancio (PODC 2005), they state that messages sent in one round are guaranteed to be delivered in the next round, but this is completely different from the (original) definition put forth by Dwork, Lynch and Stockmeyer (JACM 1988) (has multiple, equivalent definitions: GST model and unkown $\Delta$ model).


texts:
Im reading about FHE and the libraries implementing it (SEAL, HELib).
I saw that SEAL doesn't support bitwise operations but I wondered if its theoretically feasible.
For example, bitwise-ing XOR an encrypted value with itself, gets us an encrypted 0. Bitwise it with the not of itself to get an encrypted 1. Using shifts with the computed two I would then be able to extract the encrypted number.
Shift right/left can be made using multiplication or division by (powers of) 2.
But XOR-ing is the main problem.
Is it theoretically possible under any FHE/HE scheme? What are the limitations?
Thanks


texts: What is the difference of having to use a ca.crt to verify a signed file vs the .crt used to sign it?

texts:
This seemed like the most appropriate place to ask this question so here it goes:
I used to run a process that automatically generated a shim.key and shim.crt along with a ca.crt for safe boot signing.  Using the shim versions I signd a file like this:

sbsign --key path/to/shim.key --cert path/to/shim.crt filetosign

to verify the file I used the ca.crt file like this:

sbverify --cert path/to/ca.crt filetosign.signed

All worked okay.  But trying to verify using shim.crt, as shown below, would would fail:

sbverify --cert path/to/shim.crt filetosign.signed

The updated process no longer generates the shim.key, shim.crt or ca.crt files automatically, I have to provide it the shim.crt.  Looking at the script file I created last year, it appears that I first tried using efikeygen but it must not have worked because it's commented out; I don't recall what the problem was and there are no notes in the script. Instead I set it up to create the new shim.key  and shim.crt file using openssl:

openssl req -newkey rsa:2048 -x509 -sha256 -days 3650 -nodes -out shim.crt -keyout shim.key -subj "/CN=Acme UEFI SB 2020/O=Acme Inc/L=New York/ST=New York/C=US"
openssl pkcs12 -export -out shim.pfx -inkey shim.key -in shim.crt
openssl x509 -outform der -in shim.crt -out shim.cer

That gave me a shim.key and shim.crt file, but no ca.crt file.
I can successfully sign and verify a file as follows:

sbsign --key path/to/shim.key --cert path/to/shim.crt filetosign
sbverify --cert path/to/shim.crt filetosign.signed

It gets confusing with all the different formats and terms used.
So a couple of questions:

Why would the original method, that created a ca.crt, not verify using the shim.crt, but the new one without the ca.crt did?

How could I create a shim.key, shim.crt and ca.crt that would work like it originally did?

TIA!!


texts: Length of prime number used in Pedersen Commitment

texts: I am writing a program using a Pedersen commitment scheme and all I'm missing is an appropriate length for my prime $p$. I have heard that a length of $2^{80}$ is ok, is that correct?