texts: What exactly is the difference between "Key Distribution" and "Key Management"?


texts:
I recently asked a question on security.stackexchange.com about whether Shadowsocks is MITM-able and the answer was helpful yet I would like to understand symmetric crypto / the crypto used in Shadowsocks to be able to answer the following questions :

How long should key lifetime be assuming a 28 character random password (base64 char set)
What is the maximum shared key size (assuming AES-256-CFB) and what is the relationship between shared key size and the "strength of security".
Shadowsocks supports chacha and salsa ciphers yet they recommend aes-256-cfb as default - why is this when Dan Bernstein's crypto seems to be the direction we are heading.
Does symmetric crypto use session keys derived from the secret keys?
How much data needs to be transferred before an attacker can have enough ciphertext to affect security or is this not a consideration?
How can I learn more about Crypto to answer these questions easier myself?

See  Shadowsocks website


texts:
Hello I am facing a problem trying to solve this question in the picture. Does anyone know how to produce the mentioned 32-bits of the key stream? The plaintext in this case is 0001  0001 0000 0000 1001 0111 0110 1001. The LFSR is also included as a picture below.

Thanks in advance


texts: What prevents continued hashing of a key from being used as a cipher when xored with plaintext?

texts:
This is just an idea I had while looking through some threads so take it as you will.

Given a plaintext of any length and a key that a specific hash function is capable of taking as input(I mention this as I know bcrypt has issues with extremely large inputs), what would be the potential issues/attacks of hashing the key and then xoring the resulting key with a plaintext block of the same length? For the next block you would hash the previous hash created via the key and xor that with the next plaintext block. Repeat till you reach the end of the plaintext, pad it to the needed length, and commit the last xoring

I would imagine that it would make for a high speed stream cipher that is reasonably capable as long as the initial key is sufficiently strong.

Thanks.


texts: How to select parameters for elliptic curves not found in standards (Hessian, Jacobi Intersection, Jacobi Quartic, etc)?

texts:
I am currently in the process of researching different forms of elliptic curves defined over prime fields. In many curve standards, such as NIST, Brainpool, etc, there exist a list of curve equations for Weierstrass, Montgomery, and (twisted) Edwards curves.
However, I wish to also investigate various other curve forms, such as Hessian, Doche-Icart-Kohel, Jacobi intersections, Jacobi quartics, etc, but unfortunately I have been unable to find any such standards covering the selection of these curves. I'd like to know if any such papers / websites exist that detail some curve equations for each form. A list of curve equations with different parameters for these forms would be ideal.


texts: Using Alberti Disks to Create a Strong Cipher

texts:
Could one use three different disks set at different positions and encrypt a strong message?

For example:

Wheel 1: A = J
Wheel 2: A = E
Wheel 3: A = B

First letter is encrypted using 1 and then that wheel is rotated (possibly according to a key). Then letter 2 is encrypted using wheel 2 and is then rotated (possibly according to a different key than in the first wheel), and so forth.


texts: Paillier Encryption: problems with double encryption

texts:
Given have two public keys $k1$ and $k2$, $E_{k1}(E_{k2}(m_1))$ and $m_2$.

Is it possible to calculate $E_{k1}(E_{k2}(m_1 + m2))$? (or with multiplication instead of addition)

At a first glance, I thought that it is possible:

Calculate $E_{k2}(m_2)$.
Calculate $E_{k1}(E_{k2}(m_1))^{E_{k2}(m_2)}$.
From the power property of Paillier encryption, this should be the same as: $E_{k1}(E_{k2}(m_1)\cdot E_{k2}(m_2))$.
From the homomorphic property, this is $E_{k1}(E_{k2}(m_1 + m_2))$.
I thought that decryption of the above expression, first with the corresponding private key of $k_1$ and then with that of $k_2$ should give $m_1 + m_2$.

First of all, if you see any problem in my construction, or if you can see another way to do it - please explain.

I tried to run this procedure using two implementations I found on the Web, but I got wrong results.

What am I doing wrong?
Is it possible at all?


texts: Where can I read about DER certificate structure - fields and its registered values?

texts:
Where is an official documentation for ASN1 structure and values of x509 certs?
Using OpenSSL command like openssl asn1parse -in server.der -inform DER I can see how the cert is structured, but, for example, value OBJECT :sha256WithRSAEncryption is HEX 2A 86 48 86 F7 0D 01 01 0B, or countryName identifier is 55 04 06 - where are all this values documented?


texts:
I'm reading the proof of the implication "Def 2.1 $\Rightarrow$ Def 2.4" in these slides about Adversarial Indistinguishability and Perfectly-Secret Encryption. I have a doubt in the slide 10. Here it says:

  Construct an adversary $A$ who outputs $m_0$, $m_1$ in the ﬁrst step of
   $\mathsf{PRIV_{EAV}}(\Pi,A,n)$. Then if $A$ receives any ciphertext
  $c' \neq \tilde{c}$ it outputs a random bit $b_0$; if it receives
  the ciphertext $\tilde{c}$, it outputs $b_0 = 0$.

How is $A$ able to "receive any ciphertext $c'$". Perhaps the adversary not receives only the ciphertext $Enc(m_b)$?


texts:
Let's say someone has $K$, and I want to prove to them that I know $k$ such $K = k*g$ (where $g$ is some sort of group element). I can use a Schnorr signature.

Is there some protocol for mergable proofs of the above kind. Namely, that given a proof for $k_1$ and $k_2$, you get a proof for $k' = k_1 + k_2$. (Note that you don't necessarily know $k_1$ and $k_2$. You have just seen proofs for them.)

Note that the proof is much weaker, of course. You are not proving that you know $k'$. You are only proving that you have seen proofs of $k_x$ that add to $k'$.

It should also take $\mathcal O (1)$ space in the number of $k_x$ (this would be a corollary if the number of $k_x$ where a secret). Otherwise, the proof would be easy. Simply list the proofs for all the $k_x$. ($\mathcal O(\log x)$ is also acceptable.)

(This is open problem two of the mimble wimble white paper.)

EDIT: Another nice property would that for a proof of $k$, finding a proof for $-k$ should be hard.


texts: Simple multiplication as an encryption method

texts:
There was a time when I wondered about multiplication as an encryption operation. That was when I was thinking in terms of modular multiplication. But how about based around simple multiplication.

Pretend $M$ is a message represented as a number. $K$ is the secret key. Encryption is $C=M \times K$ and decryption is $M=C \div K$. Pretty simple and probably untouched. Has anyone ever suggested this?


texts: Is there an algorithm that gives a reasonable chance of decoding the entire ciphertext of this encryption scheme?

texts:
Suppose Alice and Bob share two $n$-bit shared keys, $k_1$ and $k_2$, and decide to send multiple $n$-bit messages to each other. The encryption scheme they use simply sends $c_i = (k_1 + i k_2) \oplus m_i$, where $m_i$ is the $i$th plaintext. Here, the addition and multiplication are both done modulo $2^n$.
Clearly, they can send at least two $n$-bit messages with perfect secrecy, since $k_1 + k_2$ and $k_1 + 2 k_2$ will be independent and have equal probability being each possible $n$-length bitstring. Once they send three, though, we can start learning some information about the plaintexts. For example, $k_1 + k_2$ and $k_1 + 3 k_2$ will always have the last bit, so $c_1$ and $c_3$ will share the same last bit if and only if $m_1$ and $m_3$ did. Still, though, even in this case we still wouldn't know what the last bit of the messages was.
My question is, at what point does it become feasible to figure out the entire message (i.e. how many messages do Alice and Bob need to send before an adversary with relative ease can figure out large portions of the message)? And at this point, what is an algorithm that would recover the plaintexts? We can assume that the messages are patterned, e.g. in the English language, so if we can reduce this problem to one where crib-dragging/frequency analysis/etc. can be applied, that would work!


texts: Moni Noar One Way Function: What does input is partioned mean?

texts:
I am trying to understand An Implementation of Efficient Pseudo-Random Functions.

There, the following hash function is defined:

  We define $\hat{h}=\hat{h}_{r}: {\{0,1\}}^* \rightarrow {\bf Z}_R$
  as follows:
  $$ \hat{h}_r(m) = ({\sum_{i=1}^{k} m_i \cdot r^{i-1}}) \bmod R $$
  where $R$ is a 161-bit prime, $r$ (the key of $\hat{h}$) is a uniformly distributed
  element in ${\bf Z}_{R}^*$ and the input $m$ is partitioned into a sequence,
  $\langle m_1 \dots m_k\rangle$, of elements in ${\bf Z}_{R}$.

I am having trouble understanding what "$m$ is partioned into a sequence,  of elements in $\textbf{Z}_R$ means. Does this mean we understand $m$ as a bitstring, iterate through it from left to right as long as the resulting number is $<R$ and repeat this process until we covered the whole $m$ bitstring?


texts: When Frankensteining ciphers together, why does order matter?

texts:
In a comment on this answer, Cort Ammon states

  I have heard interesting solutions to these issues involving encrypting something with a proper tested algorithm first (not second), and then encrypting it with your home brew solution with an unrelated key. It seems legit, but I can't actually claim I've analyzed that particular configuration to see if it actually works or not.

Why does order matter?  What makes encrypting with AES and then re-encrypting with the Caesar Cipher better than encrypting with the Caesar Cipher and then re-encrypting with AES?


texts: Is RSA of a random nonce with no padding safe?

texts:
Consider the following protocol: Bob has a private RSA key $B_{priv}$, and Alice knows the public key $B_{pub}$. Alice wants to send confidential messages to Bob (no integrity intended). To send a message, Alice randomly generates a single-use symmetric key (say, an AES key) $K$, encrypts the message with this symmetric key, and sends this encrypted message alongside with $K$ encrypted with RSA with Bob's public key.

Suppose we use no padding for $\textrm{RSA}_{B_{pub}}(K)$ (in other words, to pad with zero bytes). The obvious (to me) problems with a lack of padding are that an attacker can guess the plaintext (not possible here, it's random) and that encrypting the same plaintext twice gives the same result (again, not happening here). What are the known weaknesses of this scheme (or is it safe)?


texts: Proving anonymous credential presentation

texts:
In a CL-based or CKS-based anonymous credential system, how can a verifier $V$ prove that a credential holder $H$ has presented it a credential that has been issued by an issuer $I$ without identifying $H$? I could not come up with a simple solution using the anonymous credential.

I think that an additional mechanism different from anonymous credentials is necessary in order to make the verifier able to prove that some holder made it a proof presentation. Since the holders proof presentation must be "unrepeatable" by verifier, the holder must provide some additional data (data is just a very basic definition) to verifier so that verifier must be able to prove that this presentation happened to someone else with that data somehow. And in a multi-use credential system (such as CL-based or CKS-based) we can not apply this situation with the facilities of anonymous credentials as far as I know. I dont have a problem with applying this scenario by using additional mechanisms/cryptographic primitives. But I am wondering if it is possible to implement using the facilities of aforementioned anonymous credential systems.


texts:
I am trying to implement simple El-Gamal cryptosystem.

And I can't understand how to represent message as an integer between $1$ and $n-1$.
The only thing that comes to my mind is:
 if $n$ bit length is $k$, then divide input message m on $t | t < k$ bits and each piece of bits use as integer number.

I think It is wrong.

So how to represent message as an integer between $1$ and $n-1$?


texts: Significance of repetition in XOR cipher text

texts:
I'm attempting to recover plain-text ($P_1, P_2$) from two uneven cipher-text strings ($C_1, C_2$) that I suspect used the same key ($K$).

When I XOR $C_1$ and $C_2$ together to obtain ($P_1 + P_2$), there is repetition of a string of characters several times within the XOR string e.g:

.81afg.81afg.81afg.81afg.81afg.81afggyuwokjjkdjkkljlklkaiiuwqnnmc,mkhjaioqn

What is the significance of the repetition? Does it mean that a 6 character key was used and repeated across the same characters within $P_1$ and $P_2$?


texts:
In a project we are working on, we have two applications within our datacenter that exchange messages. The messages are protected by an HMAC, and the secret key is stored on a SafeNet device.

Update

This is not a hardware token - it is a hardened network storage device called "StorageSecure". The secret key is stored in a SafeNet "cryptainer" on the SafeNet appliance.

The secret key is retrieved by Application #1 from SafeNet to compute the HMAC on the messages that are exchanged with Application #2.  App #2 also has read access to the same SafeNet device, and retrieves the same secret to validate the HMAC of the messages received from App #1.

To protect the process against the SafeNet secret being compromised and the potential injection of a bogus message by a bad actor, I would like to investigate adding an additional “factor” in the process.  Would there be any benefit in adding a 2nd round of HMAC in the formula in both App #1 and App #2 using perhaps a static key value in code used for the key in a 2nd HMAC such as:

HMAC(HMAC(Message,SafeNetSecretKey),StaticKey)

Or would it be better to use the static key as a salt added to the message:

HMAC(Message+StaticKey,SafeNetSecretKey)

Update

Or since these messages are sent by App1 to App2 via web services, could we consider having App1 compute a nonce and use the nonce in the computation of  the HMAC such as HMAC(SafeNet_K1 || Nonce, Message) and pass the nonce to app2 in the body of the Https request?

Any advice is much appreciated!


texts: Why are HOTP and TOTP implementations all using 6 digits and not more?

texts:
I was checking the RFC's after wondering for some time. In RFC 4226 - HOTP: An HMAC-Based One-Time Password Algorithm, it states on the appendix:

  A simple enhancement in terms of security would be to extract more
  digits from the HMAC-SHA-1 value.

  For instance, calculating the HOTP value modulo 10^8 to build an 8-
  digit HOTP value would reduce the probability of success of the
  adversary from sv/10^6 to sv/10^8.

  This could give the opportunity to improve usability, e.g., by
  increasing T and/or s, while still achieving a better security
  overall.  For instance, s = 10 and 10v/10^8 = v/10^7 < v/10^6 which is
  the theoretical optimum for 6-digit code when s = 1.

While checking implementations, I don't realize what's the problem with extracting 8 (or more) digits from the HMAC-SHA1 result.

Is this merely a matter of improving the user experience by saving the user from writing 10 digits instead of 4? or is there a mathematical reason that I'm missing?


texts:
I was trying to figure out how HOTP kept from wrapping over, when I saw this explanation of how it works, by Thomas Pornin [source]:

  The intended scenario is the following: the client has a handheld device which outputs the
  successive passwords, one new password per button-press. The client may press the button a
  few times between two login attempts. The server "bets" that the client will not press the
  button more than, say, 100 times before attempting to log in again: so the server uses $w \leq100$. If you let your 3-year-old nephew play with your HOTP device a whole afternoon, chances are that it will be too much desynchronized, and login will not work any longer.

Assuming the user didn't have to input the OTP value or counter number(lets assume its something akin to a yubikey), what would be the downside of having the device feed the site with what the counter number is on, before giving the resulting OTP to check against?


texts:
This site contains various discussions of one-way functions and their relation to P versus NP.

Some of these discussions use a language
$L=\{(x',y) ~\mid~ x'\le x \text{ and } f(x)=y \}$, where $f:\Sigma^*\to\Sigma^*$ is the one-way function and $x'\le x$ is the prefix relation.
Now one central claim is that this language $L$ is contained in NP, since the word $x$ is a YES-certificate for $(x',y)\in L$.

I do not see why this claim is justified.
Why is the length of the certificate $x$ polynomially bounded in the length of $(x',y)$?

Couldn't it be possible that $x$ is exponentially long in $y$ and $x'$, but $f(x)$ is short and quickly computable from $x$?


texts: In A5/1 stream cipher, why are the specific bits in each register chosen for the majority rule and for the XORing step?

texts:
My two part question is:

1) How are bit positions 8, 10, and 10 chosen for the majority rule for the respective registers?

2) How are bits {13, 16, 17, 18}, {20, 21}, {7,20, 21, 22} chosen for the XORing step for the respective registers, and why the different number of bits for each register?

Were they arbitrarily selected when designing the protocol or is there some advantage to using these bits specifically and this number of bits from each register?


texts: Is the reverse of the “discrete logarithm problem” equally dificult?

texts:
It is not easy to understand why this becomes a hard problem.

The discrete logarithm problem as defined here:
“any integer k that solves $b^k = \{g\mod{n}\}$ is termed a discrete logarithm”
i.e.: Finding an integer $k$ for $b$ and $g$ known in $b^k=\{g\mod{n}\}$

I wonder. Is the reverse, that is:
Finding an integer $b$ for $k$ and $g$ known in $b^k=\{g\mod{n}\}$
equally difficult (equivalent), or there are easy ways to solve the later, and if so, how?

Edit: Here is a detailed analysis of “roots”. And here a related answer for n composite.

Edit:
A special case of the discrete logarithm problem is:
“Discrete logarithms are perhaps simplest to understand in the group $( \mathbb{Z}_p)^x$. This is the group of multiplication modulo the prime p.”

That was the initial intent of the question. But I realize that a general answer may be more apropiate.


texts: Which ECB ciphertext stealing scheme is this?

texts:
I am stuck with identifying ciphertext stealing method with the following properties:

mode of operation is ECB;
recommended padding scheme for this application is PKCS#7, but apparently it is not used;
all blocks except the last one are encrypted / decrypted as usual;
the last block is not padded, but still encrypted / decrypted somehow.

For example, with Blowfish cipher and key 72E9DD9D29:

encrypted: A4 3F 83 8D CE D2 54 2E | 4F
decrypted: 82 DD 00 00 00 01 03 FF | 1E

I cannot figure out how that last (incomplete) block is encrypted / decrypted, so that if it is ignored and not processed, the penultimate block would be the same, — that does not look similar to ECB ciphertext stealing method described in Wikipedia, as block contents is not exchanged. This may seem obvious to an expert, but I already ran out of ideas.


texts: Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BLS verification?

texts:
I asked this in the Ethereum StackExchange yesterday but I figured it would be more appropriate to ask it here.

I am looking into implementing some operations for the BLS signature scheme in Solidity, using the new precompiled contracts for pairing operations released with Ethereum Byzantium, but I am not sure whether it is possible.

According to the BLS paper, page 310, to verify a BLS signature $s \in F_q$ corresponding to public key $V \in G_2$ and message $M$:

Find $y \in F_q$ with $\sigma = (s, y)$.
Compute $R \leftarrow MapToGroup(M) \in G_1$.
Test if either $e(\sigma, Q) = e(R, V)$ or $e(\sigma, Q)^{-1} = e(R, V)$.

Ethereum has added a few precompiled contracts for operations on the bn128 curve:

Addition
Scalar multiplication
Pairing check: Given an input $(a_1, b_1, a_2, b_2, \cdots, a_k, b_k) \in (G_1 \times G_2)^k$, returns whether $log_{P_1}(a_1) \cdot log_{P_2}(b_1) + \cdots + log_{P_1}(a_k) \cdot log_{P_2}(b_k) = 0$ (in $F_q$)

Supposing we have $R$ and $\sigma$, is step 3 possible using the precompiled contracts (with other Solidity functionality)? I am not sure I can find a formulation since there is no implementation for evaluating the pairing function $e$ itself.


texts: Secret sharing scheme WITHOUT Shamir Secrete Sharing

texts:
I am planning to use the following XOR scheme to divide a secret into only 2 shares (I do not want to use Shamir Secret Sharing for different reasons that are beyond the scope of this post).

Here's an example of the XOR scheme I have in mind.

SECRET (128 bits)  =  0 1 0 1 0 0 1 0 0 0 0 1  (…)  0 0 1 1 0

SHARE 1 =  TRUNC128 (SHA512 (SECRET))

     =  0 0 0 0 1 1 1 0 0 0 1 1  (…)  1 1 0 0 1

SHARE 2 =  SECRET ^ SHARE1

     =  0 1 0 1 0 0 1 0 0 0 0 1  (…)  0 0 1 1 0

     ^  0 0 0 0 1 1 1 0 0 0 1 1  (…)  1 1 0 0 1

    =  0 1 0 1 1 1 0 0 0 0 1 0  1 1 1 1 1

SECRET   =  SHARE1 ^ SHARE 2

   =  0 0 0 0 1 1 1 0 0 0 1 1  (…)  1 1 0 0 1

    ^  0 1 0 1 1 1 0 0 0 0 1 0  (…)  1 1 1 1 1

   =  0 1 0 1 0 0 1 0 0 0 0 1  (…)  0 0 1 1 0

I have a few questions about that XOR scheme as I am building a case for using it.

1) How resistant would such a scheme be to common attack vectors (brute force...)?

2) Are there any ways to evaluate what it (or how much it) would take to break that scheme?

3) Is that scheme already used in "notably safe applications"? If that is the case, which ones?


texts: Message space when using the group of QR's for El Gamal Encryption

texts:
My textbook states, that the DDH-assumption is not satisfied when we use the group
$\mathbb{Z}/p \mathbb{Z}$ and demonstrates an attack using Eulers Criterion. After that, it states that one should use the group of quadratic residues ($\operatorname{QR}$) over $\mathbb{Z}/p \mathbb{Z}$, where $p=2q+1$ is a safe prime.

I had a look at the El Gamal encryption scheme (which uses the DDH-assumption) and saw, that the message that we want to encrypt has to lie in the group that we choose. If this group is $\mathbb{Z}/p \mathbb{Z} = \{1,2,3,\ldots ,p-1\}$ we can encrypt every message, that is not greater than $p-1$. However, if we use the group of $\operatorname{QR}$'s over $\mathbb{Z}/p \mathbb{Z}$, I think that some messages (namely $(p-1)/2$ many) cannot be encrypted.

If this is true, how would one solve this in practice?


texts: Exhausting the entropy of a hash function

texts:
In the case of password storage, consider the following:

I have an idea that one can exhaust the entropy of input to the MD5 function by using a 128 bit random value as the password (indeed, any hash function, using the output length as input). Is this a correct assumption, or is the entropy exhausted at 123.4 bit, this being the best attack to date? Or does this only apply to hash functions that for every value in the interval $[0, 2^{L}]$ provide another unique value in the same interval?

I hope you understand what I'm trying to ask here - I see that I have a hard time explaining it clearly. What I want to do with this idea is argue that in the case of MD5 stored passwords, there is no reason to use passwords with a higher entropy than the hash itself.


texts:
I know that because of the multplicative property of RSA

$s =(s_1s_2) \bmod n = (m_1m_2)^d \bmod n$

If Oscar wants to sign now an own message $m$ he chooses another message $m_1$ with $\gcd(m_1,n)=1$ and he calculates $m_2 = m\cdot m_1^{-1} \bmod n$

After this part I don't understand the attack...

How is he able to sign now his own message $m$ ?


texts: Example describing Baek and Zheng’s threshold identity-based decryption scheme


texts:
There are two versions of Winternitz-One time signature scheme, $W-OTS$ and $W-OTS^+$

Security of both is as following

  $W-OTS$ is strongly unforgeable under chosen message attacks if $F$ is a collision resistant, undetectable one-way function family

  $W-OTS^+$is strongly unforgeable under chosen message attacks if $F$ is a $2nd$-preimage resistant, undetectable one-way function family

My question is which version is more secure $W-OTS$ or $W-OTS^+$?

According to my understanding $W-OTS$ is more secure than $W-OTS^+$ because for attacker it is comparatively easy to find collision resistant as compared to $2nd-$preimage resistant.

If so is it secure to use $2nd-$ preimage resistant Winternitz one time signature scheme?

Ideally scheme should be collision resistant or $2nd-$preimage resistant.


texts: Would It Be Technically Possible To Delete Old Blocks From A Blockchain Cryptocurrency?

texts:
From what I understand, a cryptocurrency mine needs to store a copy of the entire blockchain in order to be able verify transactions, which is why most wallet owners are not miners. The more centralized a decentralized consensus is, the more likely it is that its participants will 'defect' and screw over other participants, as in 51% attacks. And since these mines are physical locations, they will be able to be blackmailed by defenders of the legacy fiat monetary system. Therefore, the goal should be to create a cryptocurrency that is radically decentralized. It should be mined on every smartphone, maybe even on every internet browser while the CPU capacity is not used. And this requires the blockchain to be radically small, small enough to fit on a few GB of flash memory, and with the potential to stay that small if there are millions of transactions per day due to worldwide adoption.
That's why one solution seems to be to simply not store transactions forever but delete old blocks.
[Q] Much like this Reddit user suggests, would it be technically feasible to delete old blocks from a blockchain in order to keep the data storage requirement for becoming a miner small? A cryptocurrency could, for instance, only keep the last year of transactions, and everything older gets deleted. The discussion seems to imply that this is technically possible, but maybe not desirable because funds are lost if they are not retransferred within the time window. So my question is: does a blockchain need to have all blocks down to the genesis block to verify transactions, or can it's participants agree to just use the oldest blocks available?
Private blockchains like Monero can't be pruned based on what coins are spendable, because that data is not available and every coin is potentially spendable. So it would just grow forever until mining becomes centralized in a few data centers. And that makes it vulnerable to attack. In order to stay honest, a blockchain needs to be radically decentralized. Then hash wars would not be a weapons race between the super computers of fraudulent actors and the super computers of honest participants, but between the super computers of fraudulent actors and the combined computing power of the entire world. Mining should be on by default in every wallet, and every browser should mine (for you) while you're not using the CPU power for something else! (It does not have to waste energy, the mining could only be applied when there is a dispute, but it has to be available in case there is a dispute.) But for this to happen, these devices have to be full nodes. In other words the entire blockchain can only be a few dozen GB or so.
I'm thinking maybe this blockchain would only be for short-term transactions, and people would not have large amounts of money on it. The spending blockchain with only a year of storage could be really small and fast, while the long-term blockchain that stores things forever would not have that many transactions because people only transfer large sums now and them. It's doesn't have to be all in the same cryptocurrency/chain. Specialize it! People usually have their pension funds on the same bank account as their beer money either. So when you go to prison and can't renew your wallet, only a relatively small amount of money is lost. Or automatic devices could be built that retransfer your holdings before the time limit.) Or would that lead to loss of value in one of these currencies?


texts:
I have been working with the following SDES Encryption templates and got the following as my ciphertext. I believe the ciphertext is correct because when I decrypted it I got my original plaintext.

If someone could inform me if the "encoded binary value is the ciphertext, and how do you convert this back to ASCII using the binary - ASCII table below?

Based on my results, I now have to answer the following questions, which I have answered in bold.

Plaintext binary value of e: 01100101

THE SUBKEYS WERE GENERATED USING THE KEY: 0101010110

Key 1:10011001

Key 2: 01101010

Encoded Binary Value: 11000001 (Is this regarded as the ciphertext?)

Finally convert, the encoded binary value back to ASCII: ? (Could someone please explain how this is done?)


texts: Yao's theorem says that for a distribution, next bit unpredictability is equivalent to pseudo-randomness. This link proves Yao's theorem, but the proof relies on non-uniform probabilistic polynomial time algorithms. Is there a proof of Yao's theorem that instead only uses uniform probabilistic polynomial time algorithms?


texts:
This is my current understanding of how Quantum Cryptography works: (The first bit is Quantum Key Distribution)
Alice sends a beam of photons to Bob through a quantum channel such as an optical fiber. Each of these photons represent a bit of information (0 or 1), and have been polarised in some way (rectilinear or diagonal). Bob uses a set of polarising filters (are these called bases?) combined with photon detectors to pick up these photons. If the polarised photon from Alice passes through its corresponding filter on Bob's end, he will receive the associated bit of the photon (0 or 1). If the photon passes through a wrong filter, it has a 50% probability of getting a 0 or 1. All the photons from Alice are passed through Bob's filters, and Bob obtains a string of 0s and 1s. He then communicates over the public channel to Alice what polarisers (the filters) he used, and Alice tells him which filters are correct. As a result, both parties have a sifted key.
[This is the "BB84" protocol of C. H. Bennett and G. Brassard: Quantum cryptography: Public key distribution and coin tossing, originally in proceedings of IEEE ICCSSP; 1984]

Image source: UNS Nice (France), Department of Physics
This next part I am not too sure about. It is my understanding that this new string of 0s and 1s (the sifted key) becomes a new parameter for the encryption and decryption algorithms, allowing communication between Alice and Bob. It is my understanding that in classical cryptography, Eve intercepts the encrypted message and using their computational power, tries to figure out the key.
So in this quantum version, what makes it more secure than the classical version? As in, why can't Eve intercept this encrypted message and as usual try to figure out the key (which is a string of 0s and 1s) like in classical cryptography?
If there is a problem in my understanding, or the question is ambiguously written, please notify me. I am looking for an answer as soon as possible.


texts: Are there parts of a SHA-512 hash that occur more often then others?

texts:
Suppose I have a 'begin' password that I can remember.

I calculate it's SHA-512 hash, transform it to base-64 and check if it has a least 1 lowercase, 1 number, 1 capital, and 1 sign.

If this is not the case I repeat this procedure (but now use the previous hash as input) until I have a hash that fills these requirements.

I will now use this final hash as the 'final' real password.

Will every possible combination of bits be (approximately) equally likely?
(If I ignore the first lowercase, number, capital and sign in the password and only look at the other chars)

In short: Will every possible 'final' password be equally likely?


texts: How many parties are needed to compute multiplication with BGW?

texts:
Let's say we have 3 parties and each one of them has a different secret number. Every party wants to learn the product of all the 3 numbers without learning about the other inputs.

With the BGW protocol: Can we do this with 3 parties, or do we need 5 parties to do this? I am confused because BGW states that we need $2t+1$ parties to reconstruct the solution, which would be 5.


texts: How to authenticate indivisual value after applying homomorphic encryption using Paillier homomorphic

texts:
Assuming I have three parties in a system: Alice, Bob, and a Server. Alice and Bob needs to aggregate some messages $m1$ for Alice, and $m2$ for Bob. And send the aggregate $m1+m2$ to the Server.

I used Paillier homomorphic encryption as follows:
$D\left(E(m_1,r_1) \cdot E(m_2,r_2) \mod n^2\right) = m_1+m_2 \mod n$

Assuming that $m1,m2\in \mathbb{Z_{100,000}}$

This provides privacy in which the server cannot link any of the measurements to the server (assuming that aggregation is performed in a secure way without leaking any single encryption to the server)

My question is twofold:

1) What I am trying to achieve now is to authenticate the aggregate $m1+m2$ on the server side, in a way that Alice and Bob can prove they are the only parties that can generate this aggregate.

2) Alice and Bob are trusted by the server. Hence, I tried to use Pedersen commitment: in which Alice creates a commitment on her message using new random number $r_A$ to be $Commit_{Alice}(m1,r_A)$. And the commitment for Bob will be $Commit_{Bob}(m2,r_B)$. The aggregate of these commitments will get Commit_{Total}(m1+m2,r_A+r_B). The server will get the total commit. For the server to reveal/verify the commitment he needs (a) $m1+m2$: This is easily delivered using the homomorphic encryption above. and also needs, (b) $r_A+r_B$, the problem is how to deliver this, I though of the following ways:

2.1) Assuming that Alice will aggregate the commitments, when she receives $Commit_{Bob}(m2,r_B)$ from Bob, he will also send $r_B$. but the problem with this that Alice can simply crack it by trying different messages for $m2$. This is because $m1,m2 \in [1,100,000]$

2.2) Alice and Bob  each indivisually sends $r_A$ and $r_B$ to the server in which it combines them to reveal the total commitment. This is not efficient because it will cause communication overhead.

Is there another secure way. We can assume that Alice and Bob each can communicate securely with the server. And each can share secure identifier (signature) with the server.

Thank you,


texts: Why "encipher" instead of "encrypt" and "decipher" instead of "decrypt"?

texts:
According to a book I am reading, Applied Cryptography by Bruce Schneier, the ISO 7498-2 standard uses the terms “encipher” instead of "encrypt" and “decipher” instead of "decrypt" because some cultures find the terms “encrypt” and “decrypt” offensive, as they refer to dead bodies.
I am curious to know which cultures exactly the author is talking about as I can not find information about the topic online.
Moreover, when you search for ISO 7489-2 on Google, the first link you get is this one: https://www.iso.org/standard/14256.html, a downloadable document but its not for free, you have to pay and I don't know why the standard is for sale.
Is there concrete evidence that in cryptography the standard words to use are "encipher" and "decipher" and that we do not use "encrypt" or "decrypt" because they are offensive words?


texts: Simple explanation of sliding-window and wNAF methods of elliptic curve point multiplication

texts:
I'm trying to understand the implementation of elliptic curve point multiplication.  I can easily understand the naive double-and-add algorithm, but I'm struggling to find a good explanation / example of the window method, or indeed of the wNAF method.
The canonical reference seems to be this Wikipedia page, in which is outlined all the various algorithms on a high level.
Does anyone know of any accessible explanations / examples of either the window method / wNAF method for point multiplication?  Alternatively, can anyone easily explain how these algorithms work?

To give you an example of how I'm confused by the Wikipedia article, the windowed method is listed as:
Q ← 0
  for i from m to 0 do
      Q ← point_double_repeat(Q, w)
      if di > 0 then
          Q ← point_add(Q, diP) # using pre-computed value of diP
  return Q

But it references the "point_double_repeat(Q, w)". method call.  But what is this method? What does this actually do?
With regards to the "w-ary non-adjacent form (wNAF) method", the algorithm seems simple to follow, but it's hard to be confident that I understand it properly without a simple example.
I understand that this is probably quite rudimentary to many people on this forum, but I would nonetheless greatly appreciate any help.

Update 10 Aug:
Reading Sam's answer below makes sense, and I was able to implement the wNAF method, but I'm still having trouble understanding how to implement the window method.
This is how I've tried to understand it:
Lets start with an example of a normal double-and-add for the scalar 2329.
2329 in binary is 100100011001, so going from right to left:
1   0   0   1   0   0   0   1   1   0   0   1
DBL DBL DBL DBL DBL DBL DBL DBL DBL DBL DBL START
ADD         ADD             ADD ADD         ADD
2048        256             16  8           1

As you can see there are 12 doubles and five additions.  Now I'm going to try to convert this to a window method so that there are less additions. Lets use a window size of 4:
1   0   0   1       0   0   0   1       1   0   0   1
DBL DBL DBL DBL     DBL DBL DBL DBL     DBL DBL DBL START
2048   +    256                 16      8     +     1
---------------     ---------------     ---------------
      2304       +        16         +        9

This means only three additions, a reduction of 40%, excellent.
Now for the algorithm itself, as per the description in Wikipedia:

One selects a window size $w$ and computes all $2^w$ values of $dP$ for $d = 0,1,2,...2^w - 1$. The algorithm now uses the representation $d = d_0 + 2^wd_1 + 2^{2w}d_2 + ... + 2^{mw}d_m$

In the example of using the scalar 2329 with a window size of 4, this means pre-computing a collection of 16 points, ($0 ... 2^4 - 1$ or $0 ... 15$).
For the scalar value, the algorithm then uses the representation $(9 \cdot 2^0) + (1 \cdot 2^4) + (9 \cdot 2^8)$. Simplifying: $(9 + 16 + 2304)$.  So in the algorithm below, this means that $d1 = 9, d2 = 16, d3 = 2304$, and "m" is 3.
This is the window method of the algorithm as per Wikipedia:
Q ← 0
  for i from m to 0 do
      Q ← point_double_repeat(Q, w)
      if di > 0 then
          Q ← point_add(Q, diP) # using pre-computed value of diP
  return Q

In this case, when it comes to adding the pre-computed point $d_iP$ There are three iterations, in which $d_i$ is either $9P, 16P, or 2304P$.  But our pre-computes are $0,1,2,...2^w-1$.  In order words, there is no "$9P$" in our pre-computes.  There is only $P,2P,4P,8P,16P,32P,64P....$
Obviously I have misunderstood either the algorithm itself or how I am supposed to compute the pre-computes that algorithm uses, either way I'm at a bit of a loss.


texts: How exactly does key whitening manage to increase security?

texts:
Wikipedia states that key whitening increases security:

In cryptography, key whitening is a technique intended to increase the security of an iterated block cipher. It consists of steps that combine the data with portions of the key.
The most common form of key whitening is xor-encrypt-xor -- using a simple XOR before the first round and after the last round of encryption.

But Wikipedia does not explain in what way exactly key whitening manages to increase security.
Reducing it to a minimum, it seems as if the most used form of key whitening is a triple-encryption using a XOR-cipher + Other-Encryption-Algorithm + XOR-cipher combination. A XOR can be reversed rather easy (which is why XOR-ciphers aren’t all too secure), so how does key whitening manage to increase security using two simple XOR steps like that? Does it really make the cipher stronger in some special way, or is key whitening just an obfuscation-step to give attackers a hard time?


texts: Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?

texts:
I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32GiB of ciphertext) by the method devised by Paul C. van Oorschot and Michael J. Wiener: A Known-Plaintext Attack on Two-Key Triple Encryption (in proceedings of Eurocrypt 1990), or another published method not requiring significantly more DES computations.
As a synthetic information for decision makers, I am looking for an independent estimate of how much time this is expected to require, assuming all the RAM ever built by mankind to that day (of April 2012) was put to full use.
Note: I'm purposely not asking when the attack could become feasible using all the RAM ever built by mankind, because estimates on the amount of RAM mankind will build, and when, are less falsifiable.
Update: I am not considering cost; neither of RAM, power, logic including DES engines (as long as the number of DES operations remains within $2^{90}$). I am willing to assume that the amount of RAM used, and its effective speed, are the only factors to account for in determining the expected duration of the attack. This is similar to the hypothesis made by the authors of the linked paper, that their attack is limited by the amount (or cost) of RAM used, with all other factors of secondary importance.
Update: sadly, nobody dared answer the question and the bounty period is over. Thus here is a first order answer to criticize.


texts: OpenSSL RSA same plaintext but different ciphertext

texts:
how OpenSSL RSA work ?

I generate public (n,e) and private key (n,d) then I encypted a file by :

openssl rsautl -encrypt -in plaintextFile -inkey privkey.pem -out cipher00

let's note the result C

and I tried to decrypt it by doing C^d (modulo n) but it doesn't work.

I think this is because OpenSSL adds some random value to my plaintext before the encryption. If I run the previous command once again on the same plaintext I have a different ciphertext.

How can I remove this random during the decryption?


texts: Is it just as difficult to find a desired output in a hash digest, for MSB vs LSB?

texts:
This question comes to mind after seeing "custom" Bitcoin addresses with some special string at the beginning of the address. They are generated in the same way Bitcoins are "mined", continually hashing with a nonce + password to get some desired output.

My question is, is it just as hard to find [HLOWRLD]M9VveeBLcY4UC4vjpPs6rZtFBQE as it is to find 1FpUYCpM9V[HLOWRLD]4UC4vjpPs6rZtFBQE as it is to find 1FpUYCpM9VveeBLcY4UC4vjpPs6[HLOWRLD]? *Note the values in the digest not in brackets can be any value

The reverse to the question, given you have some insane computer, would it be easier to try to find the input for [HLOWRLD]M9VveeBLcY4UC4vjpPs6rZtFBQE versus 1FpUYCpM9V[HLOWRLD]4UC4vjpPs6rZtFBQE versus 1FpUYCpM9VveeBLcY4UC4vjpPs6[HLOWRLD]?


texts: Difficulty of finding collisions for two different CRHF

texts:
Suppose that $\mathcal{H}$ is a family of collision resistant hash functions. Given $h$, which was chosen uniformly at random from $\mathcal{H}$, it is infeasible for a polynomial-time adversary to find collisions for $h$.

Now suppose that $h_1$ and $h_2$ are chosen uniformly at random from $\mathcal{H}$. Is it still infeasible for an adversary to find two elements $x_1$ and $x_2$ such that $$h_1(x_1)=h_2(x_2)?$$

Why?

Thanks!


texts: DES 48-bit round keys replaced with 48-bit block keys

texts:
In a variant of DES with a 48*16 = 768-bit key, the sixteen 48-bit round keys scheduled for successive rounds in the encryption process for DES are replaced in this variant by successive 48-bit blocks of the 768-bit key.

What are the weak keys for this variant of DES, i.e. the keys for which encryption and decryption give the same transformation on input blocks?
What are the semi-weak key pairs, i.e. the pairs $k_1, k_2$ of keys for which encryption with $k_1$ is the same transformation as decryption with $k_2$?


texts:
Quite a simple question though I can't wrap my head around it:

The key size is: $n$

Because it's brute force it tries each possible key once from $0$ to $n$, but in my head that just makes the run time $O(n)$, though it's surely meant to be a polynomial or exponential. The decryption message is of size $x$ though I'm not sure it is relevant. Would it be because the key is of size $n$, but they must also try all keys from $0$ to $n$ make it $2^n$?


texts: Double Ratchet Algorithm - What if the receiving wants to send the second message before the initiator?

texts:
I'm studying about Signal Protocol and I had a doubt in Double Ratchet Algorithm. This section describes how to derive the receiving and sending key messages. But in this scenario, only Alice can send the second message.

The X3DH Protocol establishes a shared key between Alice and Bob where Alice is the initiator and she send the first message through this protocol. Double Ratchet only allow Alice send the second message because Bob doesn't have the public ratchet key from Alice (She will send him with the second message).

I don't know if I understand the Double Ratchet Algorithm well, my question is How Bob can send the second message to Alice after they establish a shared key (Alice is the initiator)?


texts: Is public-key cryptography the only option in this scenario?

texts:
Two parties: a client and a server are to a agree on a symmetric key. Both the client and the server are aware of a master password. The way this is currently done is:

Both parties hash the master password using SHA-256 to create a password hash.
The password hash is used by the client to encrypt a message which includes, amongst other things 128 pseudo-random bits. This encrypted message is then sent to the server.
The server checks if the message is valid since it knows the master password and in turn the password hash. If the message is indeed valid, the server also generates a message (of similar structure to the client's message) and in the same way encrypts it using the password hash. The server then responds to the client using the encrypted message.
The client decrypts the encrypted response using the password hash.
At this point both parties have agreed on 256 random bits (128 bits from the client's request and 128 bits from the server's response).

The aim is to make sure that:

It is infeasible to recover the unencrypted contents of either the client request or the server response.
It is infeasible to recover the master password or the password hash from either the client request or the server response.

The problem is that this technique leaves room for offline attacks to guess the master password (online attacks can be dealt with) and there may be other attacks that I haven't thought of yet. This gives rise to the question:

Are there any other possible attacks?

I considered that I could use PKC (RSA specifically) to add another layer of encryption (PKC on top of SKC) on both the client request and the server response so that an attacker cannot brute-force the low entropy master password without having the RSA private key.

Now, additional questions arise:

Is this a valid method for achieving the goals mentioned above?
In either case are there better solutions?
Are there solutions which do not involve PKC?
Which alternative solutions are the most secure?


texts: Can hashes be used to generate larger random numbers?

texts: As far as I understand a hash transforms data into a fixed length representation. For example, a random function returns 8-byte numbers and a hash function has a block size of 32-bytes. If I now generate the hash of each random number, would the resulting hashes be an evenly distributed set of random numbers with a length of 32-bytes? I know one could simply multiply the random number by 4, but this would result in the same random entropy as before.


texts: Can I jettison MAC if I already have SHA1(M)?

texts:
I'm currently using SSL with AES-CBC and HMAC for a file transfer containing string M.  Now suppose Alice already knows SHA1(M) (and the adversary does not), and she downloads M from Bob using only AES-CBC without a MAC.

Normally this would be ill-advised, but since she can check SHA1(M) after the download completes, isn't this still secure?


texts: We have a python program that encrypts/decrypts plaintext given in hex to a cipher using AES CBC. We know that the IV is the same and is not going to change (it is stored in a file). How can we possibly find the IV, if found this will be the flag.


texts: How implement doubling point using VHDL language

texts:
I have a problem with my implementation. I want to make a multiplication in finite field. I don't know If my scheme is correct, but I made code on this base. I want to calculate:
D= XY
D=DX

Some Code
https://drive.google.com/open?id=186i8K6PMduY2UsBdpPmdm3WmrjBWYQtj


texts:
I need to authenticate a message sent to an embedded device (which limits my options in terms of just using an existing convention).  I can run ECDH/ECDSA on the device and can use SHA-256 as a hash function but pretty much anything else is beyond the resources of the device.  Also I can pre-share a public key on the device.

If I simply create a hash from the message, sign the hash using ECDSA with the private key, then append the signature to the message, send it to the device, then on the device verify the signature on the device using the public key against the message hash, is this secure?

Any traps to be aware of?

Edit:

The resource I was looking for is here Authenticate encryption, but I now realize I don't understand secure communication well enough to know what questions to ask.

As per @fgrieu's suggestion I investigate RSA rather than ECDSA, and found that for a NIST-256 curve signature verification takes 0.740s on the device whereas RSA-1024 signature verification takes 0.230s.  Code sizes are about the same (3.5k) but the stack usage for the RSA was too high (3.5k) for the amount of RAM I have available.  Going down to secp160r1 EC gets the verification time down to about the same as the RSA.


texts: Understand LWE(Learning With Error) negligible error probability

texts:
According to Regev's paper, p15

  Correctness. Note that if not for the error in the LWE samples, $b-⟨a, s⟩$ would be either 0 or ⌊ q ⌋ depending on the encrypted bit, and decryption would always be correct. Hence we see that a decryption error occurs only if the sum of the error terms over all S is greater than q/4. Since
  we are summing at most m normal error terms, each with standard deviation αq, the standard deviation of the sum is at most $\sqrt{m}\alpha q < q \log{n}$; a standard calculation shows that the probability that such a normal variable is greater than q/4 is negligible.

I did a little experiment with mathematica and the resulting probability of decryption error is around 0.28. Can you point out where I was wrong?

Firstly I build the the following variables as in the paper:

In[1]:= n=10
        q=RandomPrime[{n^2,2n^2}]
        m=1.1*n*Log[q]
        α=1/(Sqrt[n]*Log[n]^2)
        σ=α * q
        Floor[q/2]
        q/4
Out[1]= 10
Out[2]= 131
Out[3]= 53.6272
Out[4]= 1/(Sqrt[10]*Log[10]^2)
Out[5]= 131/(Sqrt[10]*Log[10]^2)
Out[6]= 65
Out[7]= 131/4

Then I calculate the maximum probability that the error terms sum is greater than q/4 by calculating the value of the Cumulative Probability function when x is -q/4:

In[323]:= (*Probability that sum is greater than q/4*)
          CDF[NormalDistribution[0,Sqrt[m]*α*q],-q/4]
Out[323]= 0.279785

As you can see, it's too large for "negligible" so I think there's something wrong with my calculation.

Here are the PDF for a single error $e$ and the sum of errors:

Single error

Sum of errors


texts: Machine Learning is sometimes associated with cryptography. Many of such cross field studies have been majorly done in use of machine learning for cryptanalysis/decryption. I am interested in knowing that can machine learning be used in anyway for encryption. Googling it did not give any relevant results. Are there any references or resources on this domain? Or is this idea impractical without much future scope?


texts: What is the branch number of this matrix?

texts:
We have the following matrix:
$$\begin{pmatrix}0&1&1&1\\
1&0&1&1\\
1&1&0&1\\
1&1&1&0\end{pmatrix}$$

What is the branch number?

Is this a MDS marix?


texts:
Let vector ${\bf d} \in \{ \pm 1 \}^n$ be the message we want to send. In my system, ${\bf d}$ is multiplied by an $n \times n$ Fourier matrix ${\bf F}$, as follows
$$ {\bf x} = {\bf F} {\bf d}  $$
where
$$ {\bf F} =
 \begin{pmatrix}
  1 & 1 & 1 & \cdots & 1 \\
  1 & e^{jw} & e^{j2w}&\cdots & e^{j(n-1)w} \\
  \vdots  & \vdots  & \vdots & \ddots & \vdots \\
  1 & e^{j(n-1)w} &e^{j2(n-1)w}& \cdots & e^{j(n-1)(n-1)w}
 \end{pmatrix}$$
We perform secret permutation $P$ for ${\bf x}$ provided that only the legitimate parties know the permutation and $P$ changes for every transmission.

Does multiplying by ${\bf F}$ help to diffuse?

Is this actually breakable?

If so, what kind of cryptanalysis can be used?


texts: Indistinguishability in the presence of an eavesdropper attack scenario

texts:
The property of Indistinguishability in the presence of an eavesdropper
as described in the following experiment:

(tract from: Introduction to Modern Cryptography)

It must be interpreted as a scenario of  Ciphertext-only attack or Known-plaintext attack?
Thanks


texts:
I am building the distributed system, where each user sends signed messages. I dont want to have a certificates system for public keys, like it is done in SSL, so I thought to use public keys themselves as user id.
Like:

a message from My public key to Your public key: hello!
and here goes a signature of "hello!", made with sender's secret key.
and anyone can validate the message by sender's id,
which also happens to be his public key, making the message self-contained

One thing I am not sure about...
Ed25519 public keys are so short, isn't it risky to use it as unique user id? What's the odds of system generating same user ID for more than one users? given that when public key is generated - system is unable to check if this user ID already exist (because of the distributed nature of the system)


texts: Calculate number of required pairs for differential cryptanalysis

texts:
I am currently doing some study on differential cryptanalysis.

However, I have two open questions in the field.

The first question is: How can I calculate the number of messages necessary for a successful attack?

I have read that if you have found a concrete characteristic by the cipher with probability $p$ that the number depends directly on $p$, which is understandable. However, I don't know how to calculate the number and more importantly, I can't find any literature (book or paper). If someone has a concrete tip, I would like to read it.

My second question is: Is there a measure for evaluating a probability $p$ of a characteristic? How high (or good) should a probability be for the attack to be successful? Are there any literature recommendations here?


texts: Are there any more ways to validate a security proof except peer review?

texts:
Are there any ways better than peer review to validate a security proof? Are there any ways to make your security proof easier to validate; using a simulator based proof instead of a game based proof?

Can we "reduce" a security proof to something validate-able in code?


texts: Is it safe to include the public certificate in xml digital signatures?

texts:
My understanding of XML Digital Signatures:

Let's use a SAML token as an example.

  Note - for the sake of simplicity I'm omitting some details like CanonicalizationMethod, base64 encoding, etc.

In order for me to sign the <saml:Assertion> node I use a private/public key pair:

Create a hash of the <saml:Assertion> block and store it in a <ds:Reference> inside the <ds:SignedInfo> node.
Use the private key to encrypt the <ds:SignedInfo> node and store it in the <ds:SignatureValue> node.
Pass the public certificate in the <ds:KeyInfo> block.

To verify the signature I then:

decrypt the <ds:SignatureValue> node using the public certificate found in <ds:KeyInfo> and ensure that it is equal to the <ds:SignedInfo> block
ensure that the hash of the <saml:Assertion> node is equal to the digest stored in the <ds:Reference> node.

My question:

What I don't understand is that in my opinion this doesn't verify the sender, it simply verifies that the private key component of the public certificate sent in the <ds:KeyInfo> node was used to sign the token. An attacker could create his own certificate pair and sign the token with that.

This risk is probably resolved by ensuring that the certificate is either signed by a certificate authority, but if the sender uses self-signed certificates the verifying party should NOT use the public certificate sent in the <ds:KeyInfo>, but rather obtain the public certificate from another trusted source.

Could someone please verify or point out how I'm misunderstanding XML Digital Signatures?


texts: Is it secure to repeatedly rehash a digest to extend the digest length?

texts:
Upon reading through the source code of Rainbow, a post-quantum signature algorithm, I found a hashing function that, using SHA-512, produced a variable length digest.
This was achieved was by initially hashing the message to obtain a 64 byte digest, and then hashing that digest, and again, each time hashing the N - 1 digest. It's essentially being used as a deterministic CSPRNG.
Is this secure? Can SHA-512's digest be stretched out indefinitely like this? And why didn't Rainbow simply use a well-studied CSPRNG like ChaCha20?


texts: Question on nCPA Security and Uniform Permutations

texts:
I feel I am misunderstanding the idea of nCPA security and its relation to uniform permutations. In particular I've been reading the paper "Hoang, Morris Rogaway; An Enciphering Scheme Based on a Card Shuffle".

My understanding of the definition of nCPA security is the following.
Suppose that $E : \mathcal M \to \mathcal M$ is a permutation, ie $E(m) \neq E(m')$ for all $m \neq m'$.
Suppose also that $\pi$ is a permutation chosen uniformly at random.

The adversary $A$ is then given an oracle, which is either $E$ or $\pi$ -- but she does not know which; her aim is to find out which one it is. She is allowed to ask $q$ queries of her oracle, and then must make her decision as to which she thinks it is. (This is non-adaptive, in the sense that she must decide in advance which questions to ask.)

The nCPA advantage of $A$ is then defined as
$$ \bigl|
P(A \text{ says } E \mid E) - P(A \text{ says } E \mid \pi)
\bigr|.$$
(Note that this is the same as replacing "$\text{says } E$" by "$\text{says } \pi$", the probabilities sum to 1.)
This part I may not be understanding correctly.

For two distributions $\mu$ and $\nu$ on a space $\Omega$, the total variation distance is defined as
$$ \| \mu - \nu \|
=
\max_{A \subseteq \Omega} \bigl\| \mu(A) - \nu(A) \bigr\|. $$

In a related paper "Morris, Rogaway, Stegers; How to Encipher Messages on a Small Domain", the authors say

  Total variation distance is identical to the advantage with repsect to a (deterministic) nCPA (non-adaptive, chosen-plaintext attack).

I sort of see why this might be the case, but not exactly. (There is no proof given, just the statement.)

My main source of confusion, though, is the following.
In both the aforementioned papers, an enciphering scheme is given. Let's consider the first paper, for concreteness.
This requires random integers $K_1, ..., K_r$ from $\{1,...,N\}$ and random bits $\{b_{i,j} \mid i = 1,...,r, \, j = 1,...,N/2\}$. Here $r$ is order $\log N$.

One of the advantages, though, is that in order to encrypt some $m \in \mathcal M = \{1,...,N\}$, one only needs to know the keys $K_1, ..., K_r$ and $r$ of the bits. However, if one wishes to generate the whole permutation $E$, the entire key is required.

It seems to me that one could just draw a uniform permutation naively: draw $\pi_1 \sim U(\{1,...,N\})$, then $\pi_2 \sim U(\{1,...,n\}\setminus\{\pi_1\})$, and so on. This takes time order $N$ (by Fisher-Yates); each round of the algorithm draws $N/2$ independent uniform bits, which I presume takes time order $N$. So if one wants the whole permutation, just draw it uniformly, rather than using an approximate method.

Alternatively, one wishes to just encrypt one, or a small number, of messages. Then just draw this part of the cipher. After all, one could just use the random integers $K_1, ..., K_r$. (Since $r \asymp \log n \ll \sqrt n$, with high probability all the $K_i$ will be different.)

Can someone explain to me what the purpose of a cipher, such as those described in the two linked papers, is?


texts: PBC library: group of composite order for pairing operation

texts:
How to generate composite order group using PBC library? With PBC library, element_init_G1(g,pairing) statement creates element $g$ for group of prime order.
I want to know how element of composite order group is created.


texts: How can I calculate the security level provided by a supersingular Elliptic Curve?

texts:
I want to know what security level is provided by an elliptic curve used in Supersingular isogeny Diffie–Hellman key exchange (SIDH). Is there any mathematical convention to follow or by looking at different parameters we can find the security level?

For instance, what security is provided by the type a and type d curves which are included in the Charm crypto library?

I know the type a curve SS512 and SS1024 have a prime field of 512 and 1024 bits respectively. Can anyone tell me what security is provided by them?


texts: S-AES RC[i] Generation. Can someone explain how to generate the RC[i]s for these two problems I have?

texts:
I don't know exactly how to find the RC[ 1 ] of 80, or the RC[2] of 30.
Can someone explain how to find them?

Here is a picture of the problem I am having with two questions.


texts:
There are plenty of questions here about the details and how-to's of "garbled circuits", but I have not seen anything that defines what garbled circuits are.

What exactly is a garbled circuit? What are they intended to be used for? What are their limitations?

The tag for garbled circuits just says that they are used in secure multiparty computation. However, this answer states that they're only appropriate for two-party computation?

This question seeks the definition of a "circuit". What is the difference between a circuit and a garbled circuit?


texts: How to Solve Discret Log Computation Problem

texts: Given $g^a$ in $Z_p$, it is hard to get the solution $a$. Everyone says yes, I wonder why it is hard. Could anyone give a specific mathematical way to show it is indeed hard?


texts: How do client and server agree on the values of p and g during DHE exchange?

texts:
How do the communicating parties using Finite Field DHE agree on the values of the $p$ and $g$ variables? Are their values fixed for each DHE group?
Reading through the TLS 1.3 RFC (8446), the client and server (using the key_share extension) only exchange:

DHE named group and

The value of $Y=(g^X \bmod p)$

But there is no mention of how the parties agree on the values of $p$ and $g$ and I cannot find any resource that explicitly says that $p$ and $g$ are fixed per group.


texts: I have a very basic understanding of encryption and the encapsulation process, but for the life of me I can't grasp how public keys and private keys work, how they're made, and how they're exchanged. Can anyone break it down to a basic level, or point me in the direction of material that explains it Barney style. Thanks in advance.


texts: Securely "forwarding" a Large message in a hybrid encryption system without sending the actual message

texts:
Alice has symmetrically encrypted the large (100Mb) MessageA with a random key K1, and then asymmetrically encrypted K1 with Bobs public key. She then stores the encrypted large message in a central and public repository and sends Bob's key to him.

Can Bob then decrypt the key K1 with his private key and then encrypt the key K1 again with Charles' public key, and send the resulting key to Charles - Giving Charles the ability to decrypt MessageA in the central repository?

I'm looking for a cryptographic approach to giving multiple users access to the same data without having to massage the actual data. (A gives to B, B gives to C and E, etc). Are there mechanisms for revocation?


texts:
In a cryptographic application, two types of (pseudo)random bit streams are needed:

a stream $A= a_{1}a_{2}a_{3}\ldots$ in which $\Pr[a_{i}=0]=\Pr[a_{i}=1]= 1/2\ \forall i$ and
a stream $B= b_{1}b_{2}b_{3}\ldots$ in which $\Pr[b_{i}=0]=2/3; \Pr[b_{i}=1]=1/3\ \forall i$.

Propose the following constructions:

Given a generator $G_{A}$ for $A$, propose an efficient construction that uses $G_{A}$ to generate $B$.
Given a generator $G_{B}$ for $B$, propose an efficient construction that uses $G_{B}$ to generate $A$.

I don't need the solution to this question. I want to know, how to think about this problem to get a solution. I know basic definition of Pseudorandom generator.


texts: How to generate a random number so server cannot cheat?

texts:
Here is the protocol:

Bunch of players connected to server.
Server creates nonce and hashes it - send hash to clients as bit commitment.
Clients make nonces and send hashes to server as their bit commitment.
Unknown to clients one of the clients is the server itself. Server runs through candidate nonces from that client until IT wins game.
Server sends hashes of nonces to all clients. (Clients do not know each other's IP.)
Game is resolved and desired client wins.
Server sends all nonces to clients who verify them, none the wiser.

How do we prevent the server from cheating here, please?


texts: Is it absurd to estimate entropy from a sample?

texts:
To tell the exact entropy of a source, all I need to do is to use Shannon's formula $\sum -p(i) \lg p(i)$, where $i$ is the $i$-th element of the alphabet emitted by the source.  Therefore, the only thing that keeps me from telling the exact entropy is not knowing $p$.  So, the problem of estimating entropy reduces to the problem of estimating $p$.
I have studied Reid's answer to this question.  Reid seems to say that you get the sample 1011 you could have 0 to 4 bits of entropy.  Why would it be absurd to estimate the probability distribution from this sample?  It turns out we get three ones and one zero.  Is it absurd to guess that $p(1) = 3/4$ and $p(0) = 1/4$, therefore an estimate for the entropy of the source is $0.8111 = 1/4 \times (-\lg(1/4)) + (3/4 \times (-\lg(3/4)))$, and the amount of information in the sample is $3.244$ bits.


texts: Is there a security problem with this prime generation algorithm?

texts:
I am facing the following algorithm to generate an RSA public key:

e = 0x10001

def generate_p():
    r := random odd 128-bit number
    p := (3*r^4 + 1)/4
    if is_prime(p) and gcd(p-1, e) = 1:
        return p
    else:
        return generate_p()

def generate_q():
    r := random odd 128-bit number
    q := (11*r^4 + 1)/4
    if is_prime(q) and gcd(q-1, e) = 1:
        return q
    else:
        return generate_q()

p = generate_p()
q = generate_q()
N = p*q
d = modinv(e, (p-1)*(q-1))

So essentially $s$ and $t$ are random 128-bit integers, $4p = 3s^4 + 1$ and $4q = 11t^4 + 1$ with $p$ and $q$ prime. Does the way $p$ and $q$ are generated give us information that helps factor $N$ (which is 1024 bits in size)?

I considered Coppersmith's attack to compute $s$ and $t$ as small roots mod p/q, but they are not small enough for the algorithm to be applicable.


texts: Constructing public key encryption schemes with desired ciphertext expansion

texts:
I would like to know if

given a public-key encryption scheme (PKES) with ciphertext expansion close to 1, and an integer N greater than or equal to 2

there exists a method for constructing a PKES with ciphertext expansion:

size(ciphertext) = size(plaintext) x N

Preferably, the constructed PKES would be similar to the given PKES in terms of security and efficiency.

Thank you.

Edit [about padding][@poncho]: I work with two different entities represented as bitstrings. Let's call them large and small.

size(large) = size(small) x N

Let encryption and decryption functions of the PKES be (E,D).

I receive many large bitstrings, and there is a need to store the small bitstrings which are derived as follows:

smallInstance = D(largeInstance)

At a later point, largeInstance should be recoverable using the public key:

E(smallInstance) = largeInstance

The problem I see with padding here is that it is not possible to use a constant padding for all the associated small bitstrings, and it is not desirable to store all the different paddings $pad_i$ obtained from:

smallInstance_i || pad_i = D(largeInstance_i)


texts: Why is Blakley secret sharing in finite space?

texts:
The paper says it requires a finite space. I wonder what the reason is, since from my understanding it should be perfectly fine to use the "normal" infinite space.

So why does Blakley use a finite space? Is there a possible attack in infinite space?


texts:
As far as I know, FIPS requires a set of self tests (POST) to verify the cryptographic algorithms permitted and the integrity of the module.
These tests are performed at run-time, so OpenSSL does a HMAC-SHA1 of the code loaded in memory and compares its output with the HMAC-SHA1 computed at build time.
I think that an attacker could modify the source code compile it and then both hashes would match too. Also, HMAC secret key is disclosed as OpenSSL is open-source software.
Where is the security here? Keeping the HMAC key secret? Which is the most-common approach to fulfill this FIPS requirement?


texts: What's the safest TrueCrypt algorithm and hash?

texts:
I have an encrypted file container inside my NTFS pendrive. The root folder Write permission is blocked for everyone. A folder inside it has all permissions unblocked. The dummy file of TrueCrypt is inside the "full access" folder. It has a 64 characters password, containing… you know… everything and I made a backup to create another file container.

Now, what would be regarded to the potentially "best" (in terms of security) algorithm and hash? Any algorithm and/or hash that I should definitely be avoiding? Or is the choice of algorithm and hash more a matter of personal opinion/preference because there aren’t any real differences between the available choices from a security point of view?

EDIT

In the end, I used the algorithm AES(Twofish(Serpent)) with as hash Whirpool. To me, SHA-512 is a 2nd place loser. I didn’t choose RIPEMD160 as it’s a DOS-days cipher and – if I’m not mistaken – someone might have found a way to break it? I just didn’t want to take a risk.


texts: What is the difference of the CDH problem in different groups? In particular, given a group $\mathbb{G}_1$ of order $q$ that is a subgroup of $\mathbb{Z}_q^*$, $q$ prime, and another group $\mathbb{G}_2$ of order $p$ that is a subgroup of $\mathbb{Z}_p^*$, $p = 2^n$, is solving the discrete log problem easier or harder in one or the other?


texts: What is the purpose of hashing the identifier in the secure remote password (SRP) protocol?

texts:
In the secure remote password protocol version 6a, the identifier for the user, I, is hashed along with the salt and the password on the client.
While I understand the identifier is used to locate the verifier on the server, what is the purpose of including the identifier in the client side hash?
Does it serve a cryptographic purpose?
Is SRP weakened if I always use an empty string for I on the client?


texts: Can entropy being used as data removal verification in data wiping ? How we can implement the entropy calculation in a data wiping tool? The wiping tool will used overwriting method using single pass.


texts: Are common cryptographic hashes bijective when hashing a single block of the same size as the output?

texts:
It's been said that CRC-64 is bijective for a 64-bit block.

It the corresponding statement true for typical cryptographic hashes, like MD5, SHA-1, SHA-2 or SHA-3?

For example, would SHA-512 be bijective when hashing a single 512 bit block?


texts:
Ciphertext has the property to appear random. As a matter of fact, randomness is the first test, an encryption algorithm must pass. However, there are various setups, which monitor the incoming/ outgoing traffic and can easily identify Random Bits (ciphetext). Is there any technique/ research paper in literature which can disguise the randomness of ciphertext, making it less susceptible to identification? In other words, can a system be designed to introduced undetectable form of encryption?

Note:- I am fully aware of steganography, but I want to explore the chances of hiding randomness in the domain of Encryption.


texts:
Do all $2^{\ell}$ (where $\ell$ is the bit length of the shift register) states always occur in a LFSR or can I choose my taps badly so some states are skipped and the period is shortened?

If so is there a way to prove the number of states that can occur in a LFSR?


texts: How do I generate decryption keys for the IDEA algorithm from the 128 bit key?

texts:
I am trying to implement IDEA algorithm in C#, just to learn how it works. I have taken a 128 bit binary key and generated the 52 encryption keys using the following code:

static ushort[] getKeys(string binaryKey)
{
        ushort[] keys = new ushort[52];
        int index = 0;
        while (true)
        {
            int bitPos = 0;
            keys[index++] = Convert.ToUInt16(binaryKey.Substring(bitPos, 16), 2);
            bitPos += 16;
            keys[index++] = Convert.ToUInt16(binaryKey.Substring(bitPos, 16), 2);
            bitPos += 16;
            keys[index++] = Convert.ToUInt16(binaryKey.Substring(bitPos, 16), 2);
            bitPos += 16;
            keys[index++] = Convert.ToUInt16(binaryKey.Substring(bitPos, 16), 2);
            bitPos += 16;
            if (index == 52)
                break;
            keys[index++] = Convert.ToUInt16(binaryKey.Substring(bitPos, 16), 2);
            bitPos += 16;
            keys[index++] = Convert.ToUInt16(binaryKey.Substring(bitPos, 16), 2);
            bitPos += 16;
            keys[index++] = Convert.ToUInt16(binaryKey.Substring(bitPos, 16), 2);
            bitPos += 16;
            keys[index++] = Convert.ToUInt16(binaryKey.Substring(bitPos, 16), 2);
            bitPos += 16;
            binaryKey = binaryKey.Substring(25) + binaryKey.Substring(0, 25);
        }
        return keys;
}

but now I cannot understand how to get those decryption keys. I couldn't find enough text on the matter too.


texts: Truncated 60 bit SHA1 collision detection?

texts:
So, I have managed to get a 52 bit collision for a SHA1 but after three days of brute forcing, I am unable to get a 60 bit collision.

My question is simple, how should I approach this?

I am currently using a random hex code of about 15 bits and randomly alternating between these digits. I then get the 60bit SHA1 for this and then check if its in my array. If it is I display the matching SHA1 values and the hex strings which generated them.

Frustrating isn't the word at the moment so any guidance or help will be greatly received.


texts: What happens for factoring algorithms if P=NP?

texts: If someone ever demonstrates that P=NP, will it give us a polynomial factoring algorithm, or will it only tell us that such an algorithm exists, but we still have to find it?


texts: Finding $f^{-1}$ in the YASHE keygen algorithm

texts:
In the YASHE (Yet Another Somewhat Homomorphic Encryption) algorithm, the beggining of the key generation step specifies:

Sample $\ f',g ← χ_{key}$ and let $\ f = [tf' + 1]_q$.
If $\ f$ is not invertible
modulo $q$, choose a new $\ f'$.
Compute the inverse $\ f^{−1} ∈ R$ of $\ f$ modulo $q$ and set $h = [t\ g\ f^{−1}]_q$.

The previous section of the algorithm descibres what each of these parameters are

Given the security parameter $λ$, fix a positive integer $d$ that determines
$R$, moduli $q$ and $t$ with $1 < t < q$, distributions $χ_{key}$, $χ_{err}$ on
$R$, and an integer base $w > 1$.

How can you tell if:

$f$ is invertible?

and if so

what $\ f^{-1}$ is?


texts:
I have come across 2 versions of otp while reading it and want to confirm it.

they have taken a plain text consisting of alphabets where they are
shifted and replaced by alphabets itself.
XORing of binary I/P streams with binary key.

Are they both valid forms? When I/P is in alphabets, shouldn't we convert it into binary form and then perform XORing with key?


texts: Probability of an adversary attacks mix networks encryption communication

texts:
Assume Alice and Bob communicate through a mix-net consisting of 3 intermediate routers. Assume
each intermediate router waits to receive k packets before decrypting (or re-encrypting) each, permuting the resulting packets and routing each packet to the next intermediate router.
What is the probability of an attacker Malory to link Alice's packet to Bob? Assume that Malory does not control any intermediate router.
If Malory controls the first router (but not the other two), what is his probability to link Alice's packet to Bob?


texts: How do high hash rates affect hashed password security?

texts:
Given the increase in hash rate since the rise of numerous block chains, I wonder how this affects the security of many hashed password systems.

Is a standard linux /etc/shadow file still regarded safe or does it somehow need to be updated with another algorithm or bigger salt or in some other way?
Are hashed passwords using hmac with sha256 safe given a 20 character long secret key? Can someone give some rough calculations to give an idea how long it takes to find a password?
Is it advisable to use hmac with a slower algorithm like bcrypt, scrypt or PBKDF2?

By "safe" I mean can modern hardware like ASIC reproduce a given hash in a reasonable amount of time. Some background context to my question. User input will be one way encrypted (hmac sha256) stored in a database. Suppose the database is hacked, how hard is it for an attacker to find original user input. If it turns out this type of encryption is too easy for asic machines, should I switch to some other one way encryption like bcrypt or pbkdf2?


texts: What current authenticated key exchange standards exist?

texts:
If neither of the 'big two' of TLS Handshake and IKE are appropriate in a given situation, what alternative Authenticated Key Exchange (AKE) standards exist and are recommended?

Many protocols have been proposed in the literature over the past 20+ years, though only a small subset have made it into standards of some form that are also still considered secure.


texts: Why are the bit lengths of keys and digests equal in Lamport signatures?

texts:
In Lamport's one time signature scheme:

One way function to convert a pseudo random number private key to a public key takes $\{0,1\}^n$ and returns $\{0,1\}^n$.
Cryptographic hash function to convert message into message digest takes $\{0,1\}^*$ and returns $\{0,1\}^n$.

Why are these two not independent? Why do they need the same number of bits $n$?


texts:
As per my understanding, LWE is quantum secure because there is no known quantum algorithm to solve LWE in polynomial time. Due to the reductions given by Regev et al., if there is any algorithm that solves LWE in polynomial time, it will imply that one can solve worst-case lattice problems easily.

My question is: if someone discovers a poly-LWE solver tomorrow, what will be its implication on complexity theory? Is there any analog in classical complexity theory to the quantum setting? To elaborate further, we don't know yet where the factorization problem belongs in complexity classes. So, even if someone discovers a poly-fact algorithm tomorrow, it won't affect our current understanding of complexity classes.

Does this mean we can expect that a poly-fact algorithm is possible which will be true for LWE problems too?


texts: Is HTTPS secure if someone snoops the initial handshake?

texts: Let's say I'm on an open wireless network that's being actively sniffed and I connect to an HTTPS site.  Even though my subsequent traffic is encrypted, couldn't the sniffer use the data from the initial (non-secure) handshake  to decrypt my subsequent data?


texts: Feldman's VSSS: Showing the Correctness of shares that are Consistent

texts:
This is something with which I am struggling to get my head around.

In Feldman's VSSS, I am aware that the Dealer broadcasts exponentials $a_{1},...,a_{t-1}$ of the secret $K$ and the coefficients in the secret polynomial of Shamir's SSS. The users can then combine this information with their knowledge of the public key values $x_{i}$ to verify the consistency of their key share.

What if we are in the presence of a fraudulent Dealer who, in addition to altering the key shares in such a way that the secret cannot be recovered, also attempts to alter the secret in such a way that the participants believe that they are in possession of consistent shares following Feldman's scheme?

In this case the shares of the participant will be Consistent but not Correct.

If $y_{i}$, $x_{i}$, $a_{i}$ and $K$ were the values before the change of values by the Dealer and $y'_{i}$, $x'_{i}$, $a'_{i}$ and $K'$ the values following the change. Then what if:

$g^{y_{i}}$ $\equiv$ $g^{K} (g^{a_{1}})^{x_{i}}\dots(g^{a_{t - 1}})^{x_{i}^{t - 1}}$ $mod$ $p$

and  $g^{y'_{i}}$ $\equiv$ $g^{K'} (g^{a'_{1}})^{x'_{i}}\dots(g^{a'_{t - 1}})^{x' \hspace{0.5mm} ^{t - 1}_{i}}$ $mod$ $p$ $\hspace{2mm}$ ?

My question is that in this case, are the participants in the scheme aware that the secret they can collaborate to form is incorrect? If so why?


texts: Why does DSA require that a new $k$ be chosen and the algorithm restarted if $s=0$?

texts:
DSA is an algorithm used to generate a digital signature, which consists of a pair of values $(r,s)$. The algorithm computes $r$ first and then $s$. However, if we calculate $s=0$, it says to restart the algorithm choosing a different pseudorandom integer $k$ as our starting point.

What is the purpose of this? Is a digital signature $(r,s)$ invalid if $s=0$? If so, why?


texts:
I can't seem to verify the signature scheme described below.

Key Generation

Public Key:
$$y_1=g^{a_1}y^{a_2} \pmod p$$
$$y_2=g^{b_1}y^{b_2} \pmod p$$
$g$ denotes a generator of $Z_p^*$ and $y$ is a random element from $Z_p^*$. The private key is $(a_1,a_2,b_1,b_2)$.

Signing
$$\sigma_1=a_1m+b_1  \pmod q$$
$$\sigma_2=a_2m+b_2  \pmod q$$
where $q\mid p-1$. The signature on $m$ is $(\sigma_1,\sigma_2)$.

Verification. To verify $(m,\sigma_1,\sigma_2)$ one does the following.
$$y_1^my_2   \overset{?}{=}   g^{\sigma_1}y^{\sigma_2}\pmod p$$

Taking this as an example:
$p = 23$, $g = 7$, Private Key : $(12$, $20$, $3$, $18)$, $y = 16$ and $q = 2$

This will give me:

$$y_1 = 7^{12} \cdot 16^{20} = 13 \pmod{23}$$
$$y_2 = 7^{3}\cdot 16^{18} = 10 \pmod{23}$$

Now signing a message $m = 13$:

$$\text{output}_1 = 12(13) + 3 = 1 \pmod 2$$
$$\text{output}_2 = 20(13) + 18 = 0 \pmod 2$$

Verifying gives me:

Equation 1 = $13^{13} \cdot 10 = 11 \pmod {23}$

Equation 2 = $7^1\cdot 16^0   = 7 \pmod {23}$

As you can see from the above equation, 11 is not equal to 7 and I cannot verify it.

I suspect the problem lies with using the wrong $q$. Should the value of q exclude 1 and 2?

Any idea at which step I go wrong?


texts: How to store and use a Cryptographic Seed in a database

texts:
Companies such as Barclays use cryptographic seeds (for their PINsentry system), RSA do the same for RSA SecurID, but how do they safely secure the seeds in the database.
With passwords you just hash it at and add a salt, but the server must know the original seed to verify the users code, the one-time password generated from the seed.


texts: Proof for collision resistance on a block-based hash

texts:
I am designing an unkeyed hash based on the SIMON cipher.  This is a follow up to “this” question.  A quick summary:  I have an ECC engine and the SIMON cipher in hardware, and it’s in an extremely power constrained environment.  I want a hash generator for two reasons: 1) the ECC shared secret, and 2) if I want to verify a stream.  I cannot use any of the other hash engines due to hardware constraints, which is mainly that they are huge and ruin my power budget, but because I already have a SIMON encryption block, I can modify that any way that I want.

I started by reading “chap9.pdf”, and a bunch of papers; however, I would like to blow holes in what I designed.  I need to justify my use of this to myself because hardware is such and expensive proposition.

I took the SIMON 128/256 architecture that has a key expansion on 4, 64-bit words and then used that to create something that takes 128-bit in and puts 128-bits out.  Just to make the problem tractable for this explanation, I will use SIMON 32/64 from here on as it has 4, 8-bit words.

The basic architecture is here:

I just keep feeding things into the lower two words via an XOR, which follows that Davies-Meyer and the Merkle style architectures.

In order to visualize this, I’ve generated the key expansion for a 64-bit input of all 0s for two runs through the hash engine:

In the image above, the result of feeding a stream of 0s into the hash for two hash rounds results in 0x5753c0fe.  This means that 32-bits eventually results in 32-bits, and in the system I plan to implement 128-bit blocks eventually results in a 128-bit number.

Now, I can say everything that is wrong with this that I know of:

I cannot specify the length because this needs to be used as a stream, and I cannot guarantee how many blocks will go through it.  For 2 blocks through it, I can find collisions. .  This seems to be less of a problem as I make the stream inputs longer, but I could not find a formal proof for this.
I have a counter that exists to run the encryption hardware, and I could XOR against that on either the high or low word, but for 2 blocks, I can still find collisions.

Question:  Is there a formal proof for length of stream input and collisions somewhere for a block-based, unkeyed cipher?


texts: Input Hash Size of ECDSA Signature over Curve secp521r1

texts:
For encryption authentication, I am using ECDSA signatures over the curve secp521r1. There is a hash function parameter, and as the curve is 521-bit, the hash output length should be > 512 bits, which is the highest offered output of the Standard SHA-2 hashes available.

However, in the SHA-3 specification, the cSHAKE function allows for variable length outputs, so is it recommended to use cSHAKE with an output length of something like 521 < n < 1024. If so, what is the recommended hash length to use?


texts: Why do one-time pads not provide message authentication?

texts:
It is often said that one-time pads do not provide message authentication. But, if you and I have a one-time symmetric key, and I send you a message, and it is not complete gibberish, is that itself not message authentication? The probability of you getting a non-gibberish message is, I would have to spam you a noticeable quantity of messages to get one that decodes to something resembling what you expect to get.

Update: I was mostly considering attacks where ciphertext is not known, but the recipient is known. In that case, to try and guess what to send them is impossible, and the message seems like it is inherently authenticated. An attacker intercepting the ciphertext could, like the answers say, alter a bit here or there, maybe it could be good to have a message authentication hash as well.


texts: Discrete log problem exponential runtime

texts:
I am trying to understand the runtime complexity of the discrete log problem (in the most basic sense).

So, if we have $\langle g \rangle = G$ and are trying to find $g^x = a, a \in G, 0 < x < ord(G)$, why can we not just iterate through all elements of $G$ and find an answer in linear time? Even if we have to compute $g^x$ by repeated multiplication, wouldn't that just be quadratic time?


texts:
what is the smallest possible modulus for RSA2048? I generate a random data with I want to encrypt by a textbook RSA2048 and I'm not sure where the first 1-bit should be.

According to OpenSSL source code and used padding function, the first byte seems to be 0, 2 follows and than there could be anything. Seems I need first 14bits to be 0 to ensure my plaintext fits the RSA modulus.


texts: Implementing ESignature and digital certificate

texts:
I'm having some issue understanding the mechanism of electronic signature and how implementing it

Here what I understood, correct me if I'm wrong:

(Client is here an android or ios device. Server is a web server.
AWS S3 is used to store the document)

A - Init:

Client :

generate signing RSA private/public keys
generate an encryption RSA private/public keys
(take a picture of user's handwritten signature)
send the 2 public keys (and the picture of signature) through HTTPS to the server

Server:

validate user
create a digital certificate with fullname, email address and client signing public key
(server encrypt the signature file with the encryption public key and store it on S3)
send the digital cert to the client

B - A wild new document to sign appears:

Client:

fetch the document
take the md5 of base64 of document and sign it with its signing private key
send it to the server through HTTPS with the digital cert

Server:

verify the cert
verity the document with the public signing key and compare it with the md5 of base64 of original document
encrypt the original document with the public encryption key and store it on s3

C - Retrieval of documents & Keys lost:

Client can retrieve a signed document by using its encryption private key to decrypt it
If the client lost its signing private key, it can ask the server for a new digital cert,
If the client lost its encryption private key, he cannot retrieve its stored documents..

-> (1) Should the encrypt key pair be generated by the server ?

(2) Can any server be used as the trusted certificated authority to generate the digital certificate ?

(3) It is mandatory for the server to keep a handwritten digital copy of the user ? Should it have a proper role in the e sign mechanism ?

(4) For legal cases, what constitute the proof of the person really signed the document ? Is it the signed hash of the document (create with the client signing private key) or the document encrypted with the encryption public key ?


texts: After 20 years of AES, what are the retrospective changes that should have been made?

texts:
I realize that this could be very opinion based, but I feel that there should be some solid information on AES at this point that could be referenced.  After 20 years, I expect that there should be a "woulda, coulda, shoulda" list somewhere.   For instance, I suspect that one could have gotten away with two fewer rounds, which would still have an acceptable security margin, but would this increase the speed of the cipher significantly.
Is there a comprehensive retrospective on AES in literature now that it has been used for 20 years?


texts: Why would anyone choose 3DES over AES in software?

texts:
I'm well aware of what NIST and PCI say about the usage of 3DES and its deprecation/disallowance and I also know that AES is the actual recommended standard for software and hardware encryptions.

I'm seeing many companies still choosing 3DES when they could simply go with the most obvious choice: AES. Why do you think that is? Is there any technical reason why someone could choose 3DES over AES?


texts: Is it possible to reverse Diffie-Hellman key exchange?

texts: Is it possible to reverse Diffie-Hellman key exchange to get the private key of one of the parties, given a large prime number 'p' .


texts: Encrypt a file in a way that decryption requires every recipient's cooperation

texts:
The best related concept I can think of is the two-man rule. https://en.wikipedia.org/wiki/Two-man_rule.

To put it simply, n people are required to give their authorization before a system / secret can be used.

If I have a file (say an encrypted password or private key) that allows me to access a server with sensitive information. I will require a key from the data privacy officer and the lead engineer.

Does anyone know a way I could implement this using existing tools and maybe some systems language (read: go) to tie it all together?

I'd imagine there are multiple systems involved in making this work, but what I'm mostly curious about the cryptography.

Thanks in advance!


texts: garbled circuit vs fully homomorphic encryption

texts:
Consider an outsourced database to an untrusted cloud (think CryptDb), the question is how to compute a function $f(.)$ on the data.

I think I understand how (fully or partially) homomorphic encryption works in this situation:

Encrypt the input.
Outsource both the ciphertexts and the (public) function.
The cloud evaluates the functions on ciphertexts, results are also in ciphertexts.

How would garbled circuit (GC) be used in this case? Is it:

Garble the circuit and upload to the cloud.
Garble the inputs and upload to the cloud (ciphertexts).
The cloud evaluates the circuit. Results are in plaintext.

What are the trade-offs between these two approaches, supposing I don't care whether the results are in the clear or encrypted? It looks like both can be used to compute arbitrary functions over ciphertexts.

But if GC can be used only once (true?), is it possible to use the same garbled inputs for more than one GC, or one needs to construct a (GC,garbled input) pair for every single evaluation of the function $f(.)$?


texts: Issues with Elliptic Curve Point Addition

texts:
I'm trying to implement elliptic curve point addition in hardware. I've managed to create a working module using Affine coordinates however I've been reading about how points can be added by using Jacobian coordinates more efficently due to needing less modular inversions. I then found this repeated point doubling algorithm which I've attempted to implement in C.

I take the Jacobian coordinates returned from this algorithm and convert them into Affine coordinates using the modular inversions $x = X/Z^2$ and $y = Y/Z^3$. I get the correct point on the curve when calculating $2P$ with $m = 1$ however if I set $m > 1$ to calculate $4P$, $8P$ etc. I get the wrong points.

I'm wondering if I'm doing something obviously wrong? I've included my c code below. I'm fairly new to all this so I'm sorry if there is some obvious errors.

int extendedEuclid(int *c, int phi, int e) {

    int a[2] = {1,0};
    int b[2] = {0,1};
    int q;

    while(1) {
        q = phi / e;
        phi = phi % e;
        a[0] = a[0] - q*a[1];
        b[0] = b[0] - q*b[1];
        if(phi == 0) {
            c[0] = e;
            c[1] = a[1];
            c[2] = b[1];
            return;
        };
        q = e / phi;
        e = e % phi;
        a[1] = a[1] - q*a[0];
        b[1] = b[1] - q*b[0];
        if(e == 0) {
            c[0] = phi;
            c[1] = a[0];
            c[2] = b[0];
            return;
        };
    };
}

int jacobianDouble(int* x, int* y, int* z)
{

    int a, b, w, m = 1;

    *y = 2*(*y);
    w = pow(*z, 4);

    while(m > 0)
    {
        a = 3*(pow(*x, 2) - w);
        b = *x*pow(*y, 2);
        *x = pow(a, 2) - 2*b;
        *z = *z*(*y);
        m = m - 1;
        if(m > 0)
        {
            w = w*pow(*y, 4);
        }
        *y = 2*a*(b - *x) - pow(*y, 4);
    }
    *y = *y/2;
}

int main() {

    int x = 5, y = 4, z = 1, p = 97;
    int ans[2];

    jacobianDouble(&x, &y, &z);

    extendedEuclid(ans, pow(z, 2), p);
    x = fmod(x*ans[1], p);
    if(x < 0)
    {
        x = p + x;
    }

    extendedEuclid(ans, pow(z, 3), p);
    y = fmod(y*ans[1], p);
    if(y < 0)
    {
        y = p + y;
    }

    printf("x = %d\n", x);
    printf("y = %d\n", y);

    return 0;
}


texts: Why are computations (isogeny) in SIDH done in an extended prime field?

texts: While reading the SIDH key exchange protocol, I noticed that all the isogeny computations and curves are defined over the extended prime field $\mathbb{F}_{p^2}$. Does it make the problem computationally hard for the attacker or what is the reasoning?


texts: Is there a symmetric cipher that is explicitly designed to be slow?

texts:
I am trying to find a symmetric cipher that is explicitly designed to be slow.  I realize that this is generally not desirable, but I'd like many cycles and lots of electronic action.  I could modify a cipher make a Fiestel network have a million rounds, but I'm trying to find something "provably slow" that is akin to a memory-hard function but without the memory.

The motivation for this is that I want a structured way to create test vectors for an asynchronous IC library that are "random-looking" but repeatable for simulation.  It's an easy way for me to keep track and cut up the problem on the cluster.  The reason that I don't want to use a hash function is architectural. I want to structure of a key schedule and data schedule with a dependency.

Has anyone ever come across a symmetric cipher design to be slow?