texts:
Before anyone freaks out, this is purely speculative and I am not developing a cryptosystem!
I can't see anything wrong with this protocol, but my knowledge of cryptography is rather superficial:

Decentralized nodes need to publish a piece of information (their state, e.g. available/busy) to a central server S.

Each node has an RSA key pair.

Node A and node B have already exchanged their public keys via some secure channel outside of this protocol.

Node A sends a message to the central server S. The message contains:

A's public key
The (state, timestamp) pair
The signature for the above pair, which A calculated by using its private key

This may be the first time S sees A's public key. However, S makes sure the signature checks out, and registers A's new state provided that A's previous state is either older or non-existent.

Node B asks S for A's state. In its request to S, B identifies A by means of A's public key fingerprint (SHA-256 or whatever the best practice is), which effectively acts as node ID.

S forwards to B the state message it previously received from A. B independently checks that the signature is valid (B already had A's public key on record) and registers A's new state provided that A's previous state is either older or non-existent.

Questions:

Is there a way a malicious node can fool B by making it accept fake or outdated state messages in A's name?
Given that S has no prior knowledge of A's public key before receiving A's very first state message, is this protocol able to ensure that no malicious node can convince S to persist and propagate invalid state information in A's name or somehow enact some kind of denial of service (not by intense network activity that overloads S, but by intelligently breaking the protocol) whereby A is unable to propagate its real state?
Is there any other problem you may want to mention (leaving aside the questionable utility of the protocol)?

Thank you.


texts: AES S-Box: How is value for 01 mapped to 7c?

texts:
If irreducible polynomial $m(x) = x^8+x^4+x^3+x+1$ is chosen, or even for any other value, the multiplicative inverse will not exist for $01$, as $0000 0001$ will perfectly divide $m(x) = 100011011$ leaving remainder zero.

So then how it the value for $01$ mapped to $7c$ in AES S-box?


texts: Will I be able to (ab)use a FIDO U2F compliant hardware token to decrypt data?

texts:
I have heard good things about the emerging "FIDO U2F" standard. I am especially interested in having a JavaScript API for cryptographic functions that I can access through a plug-in in a browser.

However, so far all my efforts to obtaining a physical hardware token supporting the FIDO U2F specs for testing were without success.

What I would be particularly interested in, is decrypting short messages with the app_id specific private key stored in the device through a JavaScript call.

While the "FIDO U2F" Javascript API draft doesn't mention a method for this, I wonder whether I could use a simple sign request and simply provide the data to be decrypted as websafe-base64-encoded challenge?
In my understanding, the response returned from the device would be the decrypted challenge.

Am I correct with this or do I misunderstand the way challenge/response is implemented here?


texts: Efficiently formatting data so that each byte is critical

texts:
I'm experimenting with implementing a Fair Exchange Protocol that assumes there is a trusted third party to provide a hash-checksum of the two files for each missing byte, (so that the exchange can happen byte for byte towards the end of the files) as described here: Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?

What are the known practical algorithms to transform data to and from a 'byte-critical' format, where each byte(or bit) is needed to recover the data?

The responder mentioned erasure coding, but the wiki on that is pretty theory heavy and broad, was hoping for more direction.  E.g. what coding would be useful for this application, and what are the memory/speed/security tradeoffs for different coding algorithms?


texts:
I Google around and can't find any page mentioning Diffie-Hellman with Galois field $GF(p^n)$ with $n>1$.

Is there a reason for this?
For example, wouldn't Diffie-Hellman with $GF(2^n)$ be desirable for computation?


texts: Memory required for known plaintext attack on general block cipher

texts:
Consider a block cipher on binary strings of length $k$ and keys which can be any binary string of length $n$. With $k2^n+k$ memory we can store all key/ciphertext pairs for a fixed plaintext and this allows for a quick chosen plaintext attack. What is the corresponding result for a known plaintext attack. We can do this with about $2^{n+k}$ memory by storing all key/ciphertext pairs for all plaintext.

Without considering specific properties of the cipher, is it possible to do better?


texts: Interlock Protocol for Preventing Man-in-the-Middle (MitM) Attack

texts:
Trying to turn bookish knowledge to practical:

Alice sends half of the encrypted data to eve, eve eavesdrop and tries to decrypt the data and fails as eve has only half of the encrypted block. So, Eve creates a new message and sends the data to Bob

  why do most documents say about altering the message content by the
  attacker?
  can't the hacker just keep a copy of encrypted block and send the
  encrypted original data to bob?
  Why does a MitM presence interrupt the network? for example, Wireshark captures the packets but still, the actual recipient receives the packet
  Could an interlock system be susceptible to passive attack?
  Can Eve send the original data without altering the message content, and keep a copy of it to integrate it with the remaining message blocks


texts: OTR AKE protocol implementations security

texts:
While looking at the different versions of OTR protocol I discovered a strange thing: there is no trace of the patch for the weaknesses that were noted in “Finite-State Security Analysis of OTR Version 2”.

It sounds very strange to me that authors of OTRv2 and OTRv3 did not manage to patch up the weaknesses and did not even bother to mention it as “to do” (as far, as I understood).

Maybe I'm just not experienced enough to detect an implicit patch in an article or implementation, or maybe noted vulnerabilities are pure theoretical and not considered harmful so marked as “won’t fix”?
Can anyone clarify this?


texts: Differences between hashed text and encrypted text

texts: I was wondering if it's possible to tell if the text is hashed or encrypted. For example, if someone has given you a a chain of random characters. Would you be able to tell if it's encrypted? Which you could be able to retrieve the original text by having the private key. Or it's hashed which there is no way to reverse it.


texts:
I am developing a software and I am not sure if it is completely secure.

I have 22 Mb of data to encrypt used multiple times,
random IV (generated using RAND_bytes from OpenSSL lib)
and password which is $key = SHA3_{256}(PBKDF2(salt, password, 256000, SHA2-256))$.

SHA3_256 from Qt QCryptographicHash, PBKDF2 and SHA_256 from OpenSSL, salt is also generated from RAND_BYTE and 256 bits long.

Now I would like to know your opinion if this scheme is secure:

XOR key and IV together:

$$
encryptionKey = IV \oplus key\\
$$

encrypting IV:

$$
firstBlock=E_{AES-EBC-256}(key, IV)
$$

encrypting data:

$$
secondBlock = E_{AES-GCM-256}(encryptionKey, IV, data)
$$

and then:

$$
output << firstBlock\\
output << secondBlock
$$

I am not sure especially about this part $E_{AES-GCM-256}(IV \oplus key, IV, data)$.

I would really appreciate your opinion about it.


texts: mixing round functions and key schedules

texts:
what is the security of an encryption algorithm that takes the key schedule of algorithm X and the round function of algorithm Y?
should it need a new security proof? or it relies on X and Y's security?


texts: Problem with Hash-DRBG's seedlen values (and others)

texts:
In NIST-SP-800-90Ar1, the Hash-DRBG is instantiated with hash functions using strange values for seed length (seedlen) such as 440, 888.

How are these values derived? How to derive values for other hash functions?


texts: Fully understanding bitcoin transcation verifying and secp256k1

texts:
Hello fellow cryptographers.
I have spent last few days trying to understand and find a way to generate secp256k1 private and public keys from scratch, but i failed.
I have seen tons of videos and read tons of pdfs about it but I still can't understand how to implement it even in pseudocode.
r = Random
k = PrivateKey (64bit hex string that should safely be generated from r and hashed)
K = PublicKey
G =
0479BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798483ADA7726A3C4655DA4FBF0E1108A8FD17B448A68554199C47D08FFB10D4B8

K = k * G

Now i know G has x,y and that 04 at the beginning means that its in uncompressed form.
But i am confused with the way I should multiply k and G, since whenever I tried turning them into decimal values multiplying them and then encoding them into hex afterwards I would get wrong results.
Now lets say I have K(public key).
How would I go about encrypting an message, and then proving that I can decrypt it?
I really look forward to hearing your answers :D


texts: Data integrity using steganographic methods

texts:
I am looking for a lightweight and fast (almost real time) data integrity checker for a very time critical application. Is it possible to provide data integrity using a steganographic method, lets say by inserting a tamper-proof fingerprint inside the data. If so what would be the security threats as opposed to hashing? I will appreciate your insights.

My application has the following constraints:

32-bit (embedded) architecture;
performance must be higher than 3 cycles/byte;
1500 byte data packets are transmitted every 4ms; and
hardware change is impossible.


texts: Figure 2 in the Verifiable Computation - Pinocchio

texts:
I am reading the Pinocchio paper (verifiable computation): http://research.microsoft.com/pubs/180286/pinocchio.pdf

The paper is rather hard for me. For the Figure 2, I guess $v_1(x)$ should be $(r_6-r_5)^{-1}*(x-r_5)$, and the rest can be found similarly.
Is this right? If yes, then how do we determine $r_5$ and $r_6$ when we generate the keys (evaluation and verification). Since we will have to calculate $v_k(s)$ etc.

Thanks for help me to understand it!


texts: What's the difference between Trapdoor Functions and Encryption Functions?

texts:
From Wikipedia:

  A trapdoor function is a function that is easy to compute in one
  direction, yet believed to be difficult to compute in the opposite
  direction (finding its inverse) without special information, called
  the "trapdoor".

What's the difference between this and encryption functions like AES? Are all encryption functions instances of trapdoor functions? Are there any situations in cryptography were we want a trapdoor function instead of an encryption function?


texts: Can a block cipher with fixed point permutations be a good PRP?

texts:
Let $E:\{0,1\}^n \times \{0,1\}^n \to \{0,1\}^n$ be a good PRP and consider blockcipher $\widetilde{E}$ defined as follows
$$\widetilde{E}(K,X) = \begin{cases}K & \text{if } X=K \\ E(K,K ) & \text{if } X = E^{-1}(K,K)\\ E(K,X) & \text{otherwise}\end{cases}$$
Black used this to show that Matyas-Meyer-Oseas construction which is proven in the ideal-cipher-model can fail in the standard model, i.e. it will fail if we instantiate it with $\widetilde{E}$;

So $\widetilde{E}$ is the same block cipher as $E$  with one change: we now have the invariant  that $E(K, K)= K$ for all $K \in \{0, 1\}^n$. Clearly   $\widetilde{E}$
  is a good PRP since have $E$ was:  for a randomly chosen key $K, \widetilde{E}(K,\cdot)$
 is computationally indistinguishable from a random permutation.

Is the claim computationally indistinguishable from a random permutation true?
We can say that for a fixed key $K$, $\widetilde{E}$ we will always output $K$ if $ K = X$
The probability of getting a single point is fixed from all permutations of $k$ elements is $\frac{(k-1)!}{k!} = \dfrac{1}{k}$.
If we turn this into permutations generated by the $n$-bit block cipher. Then we have $\dfrac{1}{2^n}$. Therefore the permutations of $\widetilde{E}$ is distinguishable and $\widetilde{E}$ cannot be a good PRP.
Any missing point?
Could one provide a formal proof for this an example?


texts: Why can't decrypt with OpenSSL if salt changed (for CBC and ECB)

texts:
A file encrypted with OpenSSL (with, for example, AES 256-bit mode CBC) using the Linux command

openssl enc -aes-256-cbc -in texte -out encrypted_texte -k password

has a salt in the first 16 bytes — with the bytes 8-15 being the salt itself. When the file is decrypted, if the salt is modified, OpenSSL will throw a

bad decrypt 140338977786624:error:0606506D:digital envelope routines:EVP_DecryptFinal_ex:wrong final block length:evp_enc.c:520:

error, while if the file was encrypted in mode CFB doesn't give you that error.

Why does this happen? What is different about CFB so that it does not produce an error when the salt is modified, compared to the other blockcipher modes of encryption which bluntly fail? Has it something to do with the padding (CBC and ECB do use padding)?

Here's an example of what I'm trying to do: With dd, just one byte is changed in the salt. When trying to decrypt, openssl with throw the error.

echo 'spam' > food.txt
openssl enc -aes-256-cbc -in food.txt -out food.enc -k IDONTLIKENOSPAM!
printf '?' | dd of=food.enc bs=1 seek=12 count=1 conv=notrunc &> /dev/null
openssl enc -d -aes-256-cbc -in food.enc -out food.bad -k IDONTLIKENOSPAM!


texts: Need Help Reversing my Encryption Algorithm

texts:
So I wrote a simple encryption algorithm (Not very secure, just a starting point. I don't want criticism on it.) and I have been having trouble finding a way to decrypt the text. The algorithm is here (You may need an ASCII table to understand it):

Key = key
DecimalKey: k + e + y = 107 + 101 + 121 = 329 / 3(Length of actual key) = 110
Each Char: (charDec * keyLength) - DecimalKey

Example: p (112 * 3 = 336) - 110 = 226

Then I would subtract 127 from 226 so it will correspond to ASCII (this will be checked each time with an if statement).

My Java implementation of this is below (Hopefully code is allowed?):

public static String encrypt(String str, String key) {
    String encrypted = "";
    char[] strChars = new char[str.length()];
    char[] keyChars = new char[key.length()];
    int[] strDecs = new int[strChars.length];
    int[] keyDecs = new int[keyChars.length];
    int[] strPDecs = new int[strDecs.length];
    int keyNum = 0;
    for(int i = 0; i < str.length(); i++) {
        strChars[i] = str.charAt(i);
    }
    for(int i = 0; i < key.length(); i++) {
        keyChars[i] = key.charAt(i);
    }
    for(int i = 0; i < strDecs.length; i++) {
        strDecs[i] = Integer.valueOf((char)strChars[i]);
    }
    for(int i = 0; i < keyDecs.length; i++) {
        keyDecs[i] = Integer.valueOf((char)keyChars[i]);
    }
    for(int i : keyDecs) {
        keyNum += i;
    }
    float fTempKeyNum = keyNum;
    fTempKeyNum /= keyChars.length;
    keyNum = Math.round(fTempKeyNum);
    for(int i = 0; i < strDecs.length; i++) {
        strPDecs[i] = (strDecs[i] * keyChars.length) - keyNum;
        while(strPDecs[i] > 126) {
            strPDecs[i] -= 127;
        }
        while(strPDecs[i] < 0) {
            strPDecs[i] = 127 - Math.abs(strPDecs[i]);
        }
        if(strPDecs[i] < 32) {
            strPDecs[i] = 126 - Math.abs(strPDecs[i]);
        }
    }
    for(int i : strPDecs) {
        encrypted += Character.toString((char) i);
    }
    return encrypted;
}

So can someone help me find a way to reverse this algorithm? Sorry if I got some terms wrong, as I am quite new to Cryptography. If more explanation is required I can probably post a bit more.


texts: Why is EdDSA collision-resilient with SHA-512?

texts:
In the Bernstein et al. paper about EdDSA, the authors claim EdDSA is resilient against collisions (i.e. it can still be secure even if the hash function used isn't collision-resistant), drawing on a result from Neven et al. that says that Schnorr signatures are secure when used with a hash function that is random-prefix preimage resistant and random-prefix second-preimage resistant. Bernstein says that

  Neven, Smart, and Warinschi in [60] proposed taking advantage of collision resilience by choosing $H$ to output only $b/2$ bits, reducing the size of compressed signatures by 25%

and then makes the following claim:

  Our verification equation is the same as Schnorr's verification equation with
  double-size hashing instead of half-size hashing, with $\underline{A}$ inserted as an extra hash input, and without Schnorr's compression of $\underline{R}$. These modifications obviously do not compromise security.

However: In Neven, one mention of halving the hash length occurs at page 8, where they note that the herding attack from Kelsey and Kohno allows one to use a lack of collision-resistance for a Merkle–Damgård hash functions to break the random-prefix preimage and second-preimage resistance requirements, and so recommend not using a Merkle–Damgård hash function as-is, and instead truncating it. They present this not as a convenience thing, but a security thing (so that even if collision-resistance is compromised, the two properties needed for Schnorr signatures to be secure aren't necessarily compromised by the herding attack). SHA-512, of course, is a Merkle–Damgård hash function.

Here's my question: I'm pretty sure I didn't catch something the authors of the EdDSA paper somehow missed. There's probably something I'm missing here. What is it?


texts: Is there any patent free EC point compression available? If not, should I GPL/LGPL my code?

texts:
I'm currently using the BouncyCastle implementation in uncompressed mode, and considering releasing an optimized version of EC code that uses point compression.

It appears the only thing limiting me is licensing for EC point compression, since the math seems straightforward.

I'm waiting for a response from the BouncyCastle mailing lists, but would like to solicit feedback from anyone who is more knowledgable and experienced in this area.


texts: Are there any Implementations of Secure Indexes?

texts:
There are several papers about Secure Indexes, for Example "Searchable Symmetric Encryption:
Improved Definitions and Efficient Constructions" and "Secure Indexes".

I'm trying to build a system, that uses secure indexes to store and search data. Are there any existing solutions out there which implement these types of schemes?


texts: Can multiplication of two primes be seen as a strong cipher?

texts:
If we were define such a cipher:

A reversible function that would accept a message $M$ and an initialization vector $\text{IV}_1$ $\operatorname{map}(\text{IV}_1, M)$ which can map an input $M$ to a random prime $p_1$
A key derivation function $\operatorname{kdf}$ with a similar blueprint, with key $k$ and initialization vector $\text{IV}_2$ where $\operatorname{kdf}(\text{IV}_2, k) = p_2$
The encryption can then be defined simply as $p_1 . p_2 = C$
Decryption would then be $C / \operatorname{kdf}(\text{IV}_2, k) = C / p_2 = p_1$ and $M = \operatorname{map}^{'}(\text{IV}_1, p_1)$

I see this would be very similar to OTP; and can it be seen secure considering the idea is almost the same (and assuming factorization is hard)

Intuitively I can speculate, it might pave some way for some commutative and homomorphic properties as well...


texts: Prime factorization of 700 decimal digits number

texts:
I'm a newbie to encryption. If I create a number 'n' as a product of two prime numbers 'p' and 'q' with the following specifications:

'p' is a fully random prime with 300 decimal digits in length.
'q' is a fully random prime with 400 decimal digits in length.

My question is: If I make 'n' public, will anyone be able to get 'p' and 'q' within a month? Tanks in advance!


texts: How to test the speed of an Authenticated Encryption algorithm?

texts:
I am trying to implement Authenticated Encryption algorithms using CUDA.
Most of Authenticated Encryption algorithms have  short message length like 64, 254..., 4094 (Byte).
these message lengths are very short and their Enc/Dec times are very small.

consider an Intel-corei5-3337U ~1.80GHz CPU , and an algorithm that its Encryption speed for a 4096 Byte message is 0.48 cycle/byte. how many bytes this CPU Encrypts per second?

how should i test speed of the algorithm whether that is parallel or serial?


texts: What happens if we choose the random secret keys in Diffie-Hellman greater than prime?

texts:
Diffie-Hellman works as follows:

Given public parameters $p$ (a large prime) and $g$ (always referred to as a generator of $(\mathbb{Z}^∗_p)$. Then:

Alice randomly chooses $a<p$ and sends $A\leftarrow g^a \mod p$ to Bob;
Bob randomly chooses $b<p$ and sends $B\leftarrow g^b \mod p $ to Alice;
Alice computes $S\leftarrow B^a \mod p$;
Bob computes $S\leftarrow A^b \mod p$.

What happens if we choose $a$ and $b$ grater than $p$?


texts: Constructing a commitment scheme from two (possibly defective) commitment schemes

texts:
If we have two commitment schemes Com1 and Com2, which are possibly defective (in the sense of not satisfying hiding or binding properties), is it possible to construct a commitment scheme which does satisfy those properties?
Specifically, in the following scenarios:

Both Com1 and Com2 satisfy the hiding property, and one of them satisfies the binding property (but you do not know which). In this case, I think that we could construct a commitment scheme by letting Com(m,s) = Com1(m,s)||Com2(m,s), but I am not sure if I am right or not.

Both Com1 and Com2 satisfy the binding property, and one of them satisfies the hiding property (but you do not know which). In this case I do not think we could create a good commitment scheme. Suppose that Com1 is the scheme which does not satisfy the hiding property- we cannot be sure to avoid using Com1 in our construction since we do not know which of the two schemes satisfies the hiding property, and using Com1 in our construction in any way would seem to preclude our construction from satisfying the hiding property as well, unless I am mistaken?

Any help would be greatly appreciated, thank you!


texts:
What is the probability of the first N hash digits colliding? for example i made a script that appends the first  5 digits of the file's sha1 hash to the name of the file.

So will the probability of a collision be 16^5=1048576? Am i properly calculating the probability of a collision.


texts: Why do we use pseudo random PRNG in cryptographic applications instead of true random number TRNG

texts:
Cryptographic applications use deterministic algorithm for random number generation that are not statistically random but they appears to be random.

Why do cryptographic applications use PRNGa instead of TRNGa?


texts: Fooling Proof-of-Storage Protocols. What's the difference with Length-Extension attack?

texts:
I've searched a bit for this question, but I haven't found anything, so I've decided to post it here.

Lately I've been reading "Serious Cryptography: A Practical Introduction to Modern Encryption" by Aumasson. In chapter 6 he talks about Hash Functions and as examples, of what can go wrong, he explains the "length extension attack" and "fooling proof-of-storage protocols". He explains that, for example BLAKE2 isn't vulnerable to the first attack because it includes a flag that if it's the last block, it does some things different, so the output cannot be used as the entry for next blocks.

Then he explains the proof-of-storage protocols, namely:

The client picks a random value, C, as a challenge.
The server computes Hash(M || C) as a response and sends the result to the client.
The client also computes Hash(M || C) and checks that it matches the value received from the server.

And why it should be Hash(C || M) instead:

  The premise of the paper is that the server shouldn’t be able to fool the client because if the server doesn’t know M, it can’t guess Hash(M || C). But there’s a catch: in reality, Hash will be an iterated hash that processes its input block by block, computing intermediate chaining values between each block. For example, if Hash is SHA-256 and M is 512 bits long (the size of a block in SHA-256), the server can cheat. How? The first time the server receives M, it computes H1 = Compress(H0, M1), the chaining value obtained from SHA-256’s initial value, H0, and from the 512-bit M. It then records H1 in memory and discards M, at which point it no longer stores M.
  Now when the client sends a random value, C, the server computes Compress(H1, C), after adding the padding to C to fill a complete block, and returns the result as Hash(M || C). The client then believes that, because the server returned the correct value of Hash(M || C), it holds the complete message—except that it may not, as you’ve seen.

My first question, maybe a stupid one, is: Why would the server do that? Why "fool" the client?

And the second one, how is that different from a length extension attack? to which BLAKE2 is not vulnerable, but it is for this one?

Thanks a lot! :)


texts: In TLS, both client and server send nonces int heir hello messages. How the server identify whether the client hello is replayed or not? does the server maintain cach of previous nonce? for how long? can you clarify the mechanism to me as I do not find these details in the standard documentation.


texts: Why is release of unverified plaintext so Bad?

texts: Lately I came across of release of unverified plaintext. I was told that this is a bad thing, but I don't really get why. Isn't unverified plaintext released just nonsense? How can this be attacked in the context of authenticated encryption?


texts: How secure are public hashed passwords (with a salt)?

texts:
I'm working on a blockchain-based distributed application which stores Client information. I'm thinking of alternate ways to authenticate Clients on the network. One idea I got was to associate a Username and Password with the Client data structure -- where Password is a Hash(salt+password) where salt is securely stored only with us (the blockchain operator).

The clear security concern is that all participating members in the network can now view the hashed version of these passwords -- so how secure is this? Are there any other approaches I should be thinking about?


texts: How do substution-permutation networks work?

texts:
I understand what is going on in higher level. But I don't understand what's really going on in page 3 and 4 of this slide.

Specifically,

How $S_0$ and $S_1$ is used? What goes in what goes out?
How exactly do key bits determine which s-box is to be used at each position? Position refers to what?
Is the function $f$ on page 4 exactly the same SP network on page 3?
Why split plain text into left $L$ and right $R$?
Why XOR $L$ with $R$ after applying $f$?
Why rotate after applying last $f$?
Why is XOR used? Why not some other bitwise operation?

Here are the preceding slides for reference.


texts: Key Exchange & key Distribution in symmetric key cryptography

texts:
I want to know whether there is a difference between key exchange & key distribution in private key cryptography as well as public key cryptography?
or is it the same term?


texts:
I saw a post here which I think states that for P256, a is equal to -3.

Why is elliptic curve parameter $a=-3$ somehow special

I am not sure if this is correct, or maybe I am misunderstanding something about elliptic curves?

I thought that a=0 for secp256r1 and some big number for secp256k1?

If we change the value to a=-3, then we no longer have secp256r1 and secp256k1 right?


texts: Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

texts:
An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA.
Given that the hash function H, is indeed collision-resistant, would using S = r + H(A, M)*s be a secure variant?
In the original EdDSA paper, the authors mention the need for R to protect the signature scheme in case the hash function is not collision-resistant. To me, it indicates that the scheme could possibly be secure even when R is left out from the hash function input.
The reason I ask (in case it is of interest) is that using H(A, M) would be more threshold-friendly. Threshold signatures with that modification in place could be done using 1 round instead of 2 rounds.


texts:
I have an (offline) shared secret key (symmetric) which is used to encrypt/decrypt data.
Now this data belongs to a specific user which is known on the backend and frontend. My idea was to use the username/id as salt. But for AES we only have the iv.
Doing this would make sure that the data on the frontend can only be encrypted if the correct user is logged in, because without the correct salt/iv. The data would be nonsense.
But this iv would not be random anymore.
So do you have a suggestion for me on how to deal with the problem? Also, the secret key and the username/id is the only thing both endpoints know.


texts:
Are precomputation attacks - such as outlined in RFC 3610 chapter 5 - possible on RSA PKCS#1 v1.5 signature generation? If yes, are such attacks taken into account when calculating the cryptographic key strength of RSA? Do they have the same impact on the security strength of RSA as on block ciphers (i.e. halving the cryptographic strength of the block cipher)?

I presume this kind of attack - if applicable - is thwarted by the PSS padding scheme?


texts: How HomNAND has been computed in Leo Ducas and Daniele Micciancio's FHEW?

texts:
In section 4.1 of Leo Ducas and Daniele Micciancio's paper FHE Bootstrapping in less than a second, HomNAND has been computed as follows:
$$
(\textbf{a}, b) = HomNAND((\textbf{a}_0, b_0),(\textbf{a}_1, b_1)) = (-\textbf{a}_0 - \textbf{a}_1, \frac{5q}{8} - b_0 -b_1),\ using \ 2t = 8
$$
Can anyone please elaborate how this equation was derived?


texts: Zero knowledge proof that ElGamal ciphertext encrypts the opening of Pedersen commitment

texts: Given ElGamal ciphertext for a message $m$ with a random $r$ as $(c_1,c_2) \gets (g^r, g^my^r)$ for a public key $y$, and a Pedersen commitment $C \gets g^xh^r$, I have been able to create a proof that $c_2$ and $C$ have equal discrete logs using Chaum-Pedersen proof of equal dlogs, but I'm stuck on how to prove that $c_1$ uses the same $r$ used in $c_2$ or $C$?


texts: Is it possible to obtain the value committed to by Pedersen commitment given the blinding key?

texts:
I know that the purpose of the blinding key is to make it difficult to obtain the hidden value.
More formally: the Pedersen commitment is comprised of the blinding key $\alpha$, two generators $H$ and $G$ and the value we wish to commit to $v$.

I am familiar with two versions of the Pedersen commitment, the "regular" version where the commitment is $P=G^\alpha+H^v$, and the Eliptic curve version where $P = \alpha\cdot G + v\cdot H$.
In both versions, assuming I obtained the blinding key $\alpha$, can I obtain $v$ ($H$ and $G$ are publicly known) in an efficient way?

For the regular commitment I can see that it is a hard problem (under the CDH assumption) so I assume there is no efficient way.
However, for the version over eliptic curve, it seems that it is possible to obtain $v$ efficiently, but I am uncertain about it.


texts:
I have buffer of 16 bytes that encrypt with AES 128 cbc with IV =000000......(all IV is 0)

I have the encrypted buffer, and I know 7 bytes from 16 bytes before the encryption , I dont know the key .

I want to find out the key.

Is that help to find out the key? Less option than 2^128?


texts:
I am doing some research on the Logjam attack, and I need help in learning some terms that are new for me.

What does "export grade" cryptography mean? And how is this related to the Logjam attack?


texts: Why xor the message into the state for sponge hashes?

texts:
Sponge hashes like Keccak(SHA-3) and CubeHash, xor a message block into part of the internal state. Why use a reversible operation like xor for that, instead of replacing that part of the state with the message block?

It clearly has no effect on pre-image and collision resistance. It's trivial to transform collisions/pre-images between the different mixing schemes.
It causes some weirdness if the attacker learns the internal state of the hash. This shouldn't happen, but makes me slightly uncomfortable.
Perhaps it increases security in a universal hashing scenario. Might make it impossible to construct key independent collisions. But my understanding of this is pretty foggy.
When replacing it's not necessary to store that part of the state between permutations. Reduces the memory usage in some scenarios.
When replacing instead of xor-ing the truncated permutation seems like a pretty normal compression function, with the sponge becoming a standard MD style construction with a tagged last block.


texts: How the counter of AES-CTR in SSH is used

texts:
I am currently trying to decrypt an SSH session using memory derived keys and IVs.
My current problem is that the counter value seems to be the IV plus some value < 256.
My question is now why the value is not always the IV? It seems to be totally random which value is added to the IV.
Maybe someone of you can tell me why this IV is not used as the counter but some value is added to it.
When I know the value added to the IV the decryption works without problems (but I would like to do this without testing for the value).

I am tracing the OpenSSH/OpenSSH-portable implementation. And for decrypting I use pycryptodome.


texts: Construct IND-CPA secure encryption scheme by combining two given schemes

texts:
I have two encryption schemes $\Pi_0, \Pi_1$, at least one of them is IND-CPA secure but I don't know which one. The task is to construct a scheme $\Pi$ that is guaranteed to be CPA secure and to provide a proof for this.

Despite reading q1, q2 I still don't understand the best way to construct the scheme and how to fully prove its security.

Any ideas or hints into the right direction are appreciated!


texts: Recombination thresholds in degree reduction of multiplied Shamir shares

texts:
Shamir's secret sharing can be considered multiplicatively homomorphic, if one is aware of the fact that multiplying two shares of a (n,t)-threshold shared secret yields a share of the same secret, but over a (n, 2t)-threshold sharing.

To overcome this, there is a secure degree reduction protocol, which is already explained in this question. My follow-up question tackles an unexplained point in that question's accepted answer:

The subsharings ($\sigma_3(x)$ to $\sigma_5(x)$ in the referenced answer) are polynomials of degree 1, i.e. 2 shares are needed for proper recombination.

However, trying this using two arbitrary shares for interpolation fails.
At the end of this question I paste a short Python script using VIFF that shows the misbehavior. When using a threshold of 2 (needing 3 shares) for
recombining the subshares, then the final shares can be arbitrarily recombined using only two shares, as expected from the secure degree reduction protocol.

How comes that you need a larger number of subshares than the degree of the corresponding polynomials for proper recombination?

In the following the Python snippet (note that there is a 1/11 chance that the lower threshold accidentially works):

from viff import shamir
from viff.field import GF

# Zp(x) gives an object that corresponds to x mod 11 and allows for multiplication
# I.e., Zp(3) * Zp(5) == Zp(15) == Zp(4)
Zp = GF(11)

# Share 5 and 2 among 3 players with threshold 1 (>= 2 shares needed)
t = 1
sh1 = (shamir.share(Zp(5), t, 3))
sh2 = (shamir.share(Zp(2), t, 3))

# Multiply shares, implies shares for 5*2 = 10, but threshold is 2
multiplied_shares = [ (Zp(i+1), sh1[i][1] * sh2[i][1]) for i in xrange(0, 3) ]
print('Recombination ' + ('works' if shamir.recombine(multiplied_shares[0:2*t+1]) == Zp(10) else 'does not work'))

# Create subshares of the multiplied shares, using threshold 1 (*)
sh3 = shamir.share(multiplied_shares[0][1], t, 3)
sh4 = shamir.share(multiplied_shares[1][1], t, 3)
sh5 = shamir.share(multiplied_shares[2][1], t, 3)

# Distribute the subshares
p1_shares = [ (Zp(1), sh3[0][1]), (Zp(2), sh4[0][1]), (Zp(3), sh5[0][1]) ]
p2_shares = [ (Zp(1), sh3[1][1]), (Zp(2), sh4[1][1]), (Zp(3), sh5[1][1]) ]
p3_shares = [ (Zp(1), sh3[2][1]), (Zp(2), sh4[2][1]), (Zp(3), sh5[2][1]) ]

# Try to recombine subshares using threshold 1 fails despite sharing (*) above
p1_final1 = shamir.recombine(p1_shares[0:t+1])
p2_final1 = shamir.recombine(p2_shares[0:t+1])
p3_final1 = shamir.recombine(p3_shares[0:t+1])
final_shares1 = [ (Zp(1), p1_final1), (Zp(2), p2_final1), (Zp(3), p3_final1) ]
final1 = shamir.recombine(final_shares1[0:t+1])
print(str(final1) + ' is ' + ('' if final1 == Zp(10) else 'NOT ') + 'correct')

# However, recombining subshares using threshold 2 works
p1_final2 = shamir.recombine(p1_shares[0:2*t+1])
p2_final2 = shamir.recombine(p2_shares[0:2*t+1])
p3_final2 = shamir.recombine(p3_shares[0:2*t+1])
final_shares2 = [ (Zp(1), p1_final2), (Zp(2), p2_final2), (Zp(3), p3_final2) ]
final2 = shamir.recombine(final_shares2[0:t+1])
print(str(final2) + ' is ' + ('' if final2 == Zp(10) else 'NOT ') + 'correct')


texts: How does this happen in RSA malleability?

texts:
I don't understand how the $E(m)$ turns into $E(mt)$. I mean, I don't know how does that transformation happen and how does the equation occur.

$$E(m) \cdot t^e \bmod n = (mt)^e \bmod n = E(mt)$$

See, $E(m)$ is $m^e \bmod n$, so if you plug in real values, it won't work.

For example:

$c_1 = 17^{23} \bmod 35 = 33$
$c_2 = 2^{23} \bmod 35 = 18$

Now, $c_1 \cdot c_2$ should result in $33 \cdot 18 = 594$, i.e. $E(mt)$.
But if you plug in the values in $(mt)^e \bmod n$, you get $34$ instead of $594$.

How are these equal?


texts: Secure entropy extractor for thermal noise collected from camera input?

texts:
I have read this paper (pdf) which talks about measuring the entropy of thermal noise collected from camera input. They estimate the minimum entropy at about 4 bits per pixel. Probably estimating 1 bit per color looks to be the safest option from looking at the X500's camera:

The paper mentions some future research work on how to extract the random data. Edit: I have found that paper by the same authors which discusses some methods which I will read up on some more.

What I would like to know is how I can extract the entropy from each pixel in an information-theoretic way ie. to get true randomness. Hash functions will not be suitable for this purpose. It should also be simple to understand an implement in software.

One idea was to take the least significant bit for each color of a pixel. XOR the 3 bits together. Output 1 bit. After all the pixels have been processed and all the bits have been output, then run them through the Von Neumann extractor and this is the final output.

Another is to take an accumulator S, initialize to zero. XOR the next byte onto it, and rotate one bit. Repeat with 8 bytes or as many as needed. In theory it takes known regularities in the input and eliminates them one by one. The bits in the byte are biased, hence the rotations. We might also expect RGB values being biased, so we want to make sure equal amount of R, G and B goes into every bit.

Are any of these methods information-theoretically secure? I am open to any proper methods (or references to any prior papers) on how to do this properly in a conservative manner from any reputable cryptographers on here.


texts: Which one is faster GCM AES-128 or Curve25519?

texts:
As I know the symmetric encryption algorithms are faster than asymmetric encryption algorithms. But when I test GCM AES-128 and Curve25519 encryption time, I find Curve25519 is faster than GCM AES-128.
Is that normal?
Is GCM AES-128 slow?

By the way, I use these python libraries for the comparison:

PyNaCl for Curve25519 (using the box)
Cryptography.io for AES-GCM

I performed the tests with Ubuntu 16.04 64-bit on an Intel Core i7-2640M and ran the tests multiple times with differing input lengths.

The speeds for curve25519 are (1 kB):
Encryption 6.29425048828e-05 sec
Decryption 2.31266021729e-05 sec

The speeds for GCM are (1 kB):
Encryption 0.000115156173706 sec
Decryption 0.000576972961426 sec


texts: Can we retrieve his private key using his public key in ECC?

texts:
A paper wallet is the name given to an obsolete and unsafe method of storing bitcoin which was popular between 2011 and 2016. It works by having a single private key and bitcoin address, being printed out onto paper. Assume you have found the paper wallet of Satoshi Nakamoto. However, some of the paper is torn, specifically the last 72 bits are missing.

Is there any better solution than brute force?
If you get access to his wallet, how will you transfer money from his wallet to yours without raising suspicion?


texts: Is this correct way to generate stream cipher using AES CTR mode?

texts:
We are implementing searchable encryption techniques proposed by Song et al in Java for a paper[1]. The schemes need a Stream Cipher for achieving search over encrypted data.
The stream of random bits should be reproducible later while decryption given the same "Seed".

Now we plan to generate the stream of random bits using AES in CTR mode. What we don't understand is what is considered as "seed". Is "seed" the random 64 bits prefix part of the IV / Nonce ?

What would be the plain text  CTR mode while generating random stream ? Can we give some hard coded string as plain text as we don't really care what we are encrypting, all we want is random stream of bits that could be reproduced later

Or what is considered a secure way to generate random stream of bits ?

[1] Song, Dawn Xiaoding, David Wagner, and Adrian Perrig. "Practical techniques for searches on encrypted data." Security and Privacy, 2000. S&P 2000. Proceedings. 2000 IEEE Symposium on. IEEE, 2000.


texts:
It seems to me that it's theoretically possible to exfiltrate a salt against a hashing algorithm that isn't constant time using specially crafted inputs.

Are there any examples of this being done in a reasonable time?


texts: What are the differences between X9.31 RSA operation and PKCS#1 RSA operation?

texts:
NIST and other - mainly older - standards often don't just mention PKCS#1 RSA algorithms but also X9.31 RSA algorithms.

What are the differences between X9.31 and PKCS#1 (v2.1) with regards to

key pair generation;
signature generation;
encryption (if applicable)?


texts: Is it safe to prefix the a key with a known value?

texts: Almost every encryption algorithm is based on a secret key. I wonder when the algorithm is considered safe, does that also imply that I can prefix (or suffix) the key with a known value, as long as the unique part is of sufficient size? Just disregarding the fact wether would be wise in the first place.


texts: Understanding the wide trail design strategy

texts: I am trying to understand the wide trail design strategy. I have read the paper (paywall-free preprint) which describes it from the point of view of AES. From what I understand, it is a technique to increase diffusion in a particular way to resist differential and linear cryptanalysis. My background is in information security but not cryptography, so my understanding of some of the more math-heavy descriptions is limited. Can anyone explain the basics of the wide trail design strategy, and why and how it works?


texts: Is it feasible to get a hash collision for CRC32, MD-5 and SHA-1 on one file?

texts: I'm aware that individually, each has its weaknesses (especially CRC32), but is it feasible that a file could be created to falsely match all three?


texts: Crypto++ : Hash generation hangs on windows 10

texts:
I have the following simple program :
#include <cryptlib.h>
#include "sha.h"
#include <sha3.h>
#include <filters.h>
#include <hex.h>
#include <beast/core/detail/base64.hpp>

using namespace CryptoPP;
using namespace boost::beast::detail::base64;

int main(int argc, char** argv) {

    if (argc < 2) {
        std::cout << "missing argument 1 : password";
        return 0;
    }
    std::string password = std::string(argv[1]);
    byte digest[SHA3_256::DIGESTSIZE];

    SHA3 digestAlgo = SHA3_256();
    std::cout << "going to calculate the digest\n";
    digestAlgo.Update((const byte*) password.data(), password.size());
    std::cout << "updated...\n";
    digestAlgo.Final(digest);
    std::cout << "calculated the digest\n";

    char* b64encodedHash = (char*)malloc(sizeof(byte)*1000);
    encode(b64encodedHash, digest, sizeof(byte)*1000);

    std::cout << "password hashed : " << b64encodedHash << "\n";

    return 1;
}

When I run it the text : "going to calculate the digest" is output on the command line and the program does not continue. It hangs.
Does anyone know why ? I am trying to follow the examples on the Crypto++ wiki, and this is very similar to theirs.
After the Final call I want to base64 encode the digest, you can remove that part, it uses a boost header file.
Thanks,
Regards


texts:
I'm studying how LUKS/dm-crypt works, and I've learnt that:

the user supplies a (possibly weak) passphrase
the passphrase is turned into a Key Encryption Key (KEK) by a Key Derivative Function (KFD), making it harder to crack via a brute-force attack
the KEK is used to encrypt and decrypt the Master Key
the encrypted Master Key is stored in plaintext in the LUKS header, and the decrypted Master Key is used to encrypt and decrypt the disk sectors using a cipher (e.g. AES)

However, I couldn't find how the Master Key is actually encrypted using the KEK. Is it encrypted using the same cipher that is used to encrypt the disk sectors?


texts: Is truncated hash collision resistant if original hash is collision resistant?

texts:
Let's say I have a collision resistant hash function $H: \{0,1\}^* \rightarrow \{0,1\}^n$ and I want to create another collision resistant hash function $H': \{0,1\}^* \rightarrow \{0,1\}^n$ using $H$ that leaks a bit of input. Would this still constitute a collision resistant hash function?
$$H'(x\mathbin\Vert b) = H(x)_{[1\ldots n-1]} \mathbin\| b$$
(Here, $b$ is a single bit)


texts: Can a One way function also be its inverse?

texts:
This is from my homework:

Prove that if there exists a one-way function, then there exists a one-way function f such that

$f(0^n ) = 0^n$ for every $n$.

Note that now for infinitely many values $y$, it is trivial to compute $f^{−1}(y)$.

While I don't expect someone to spell the answer out for me, setting f as the inverse function, we can say the inverse exists. As a result, it is not a one-way function.


texts: How to test implementation of primality tests like Miller–Rabin?

texts: The Miller-Rabin primality test is an algorithm for checking if number is a prime. What would be best way to test implementation of such algorithm (or any primality test in general)?


texts: How common are SEED certificates outside of Korea? When is support required?

texts:
I'm looking at the SEED algorithm and would like to know if this is still in common usage.

Can anyone tell me when I would need to implement this standard, either as a client or a server?


texts:
If a message is encoded with 2048 bit RSA. The ciphertext is $M^e mod N$. In some cases, the message is short, $ M \approx 10^{20} $. With a high probability, $M$ can be written as $M = ab$ with $a, b \leq 4\sqrt{M}$.

Can you explain to me how I can find the initial message $M$ given $N, e,$ and the ciphertext using a computation with no more than $\approx$ $4*10^{20}$ total operations?

I heard that there was some relation between small a's and b's and being able to do a trick.


texts:
Suppose Alice is using a password prompt that only accepts up to 32 characters for any particular password.

Memorization of long strings of random characters is not one of Alice's strengths, so she opts instead for a memorable passphrase consisting of a permutation of 7 of the 2000 most common English words. Unfortunately this passphrase exceeds the maximum password length allowed by the prompt (i.e. the passphrase is easily longer than 32 characters).

This is a common problem faced by the average user, who often is required to enter passwords to sites or server with maximum password length limits. What I wonder is whether this solution is relatively secure:

Alice hashes her passphrase: passphrase --> MD5(passphrase) --> new_passhash

MD5 digests have a length of 128 bits or 32 hexadecimal digits.

Alice takes new_passhash, which has a length of 32 characters, and uses it as her new password.

On the surface, it appears as if her password is in fact strengthened. Assuming an attacker is performing a brute-force attack:

Permutations for passphrase = 2000^7    (set of 2000 words, 7 choices)
Permutations for MD5 string = 16^32     (set of 16 alphanum characters, 32 choosen)

(2000^7) is strictly less than (16^32)

However, if the attacker does know that the passphrase is hashed using MD5, would the fact that MD5 is susceptible to collision attacks render the new_passhash less secure than the original passphrase?


texts: In laymans terms, what exactly is a "One time pad"?

texts:
Background

I am an undergraduate novice learning about cryptography. Recently my professor introduced us to the concept of a "One time pad".

According to my professor:

  A one time pad is a cipher that exists when one unique key is used
  once to encipher/decipher one message. It is also the only genuinely
  unbreakable cipher.

However, this simple definition seems a bit anti-climatic for describing the world's "best possible cipher" - and has left me with some lingering questions.

Questions

1) Does that mean that if I encrypt the message Hello World with the key Password123 - that this would be considered a one-time-pad?

2) What if I encrypt two different messages Hello World 1 and Hello World 2 with the same key Password123 - is this no longer a one-time-pad?

3) What if I repeat the previous scenario with a small twist. Still encrypt two different messages with the same key, but introduce a salt Password123 + [SALT] - are we now back to being a one-time-pad? (keep in mind, I am assuming the salt is sent alongside the encrypted text).

4) Does the strength of the cipher even matter as long as one unique key is used once to encipher/decipher one message. Would a one-time-pad using AES have the same strength as a one-time-pad using ROT?

So in terminology that a novice or layman like me can understand. What exactly does it mean for a cipher to be a "One time pad"?


texts: AES-ECB known ciphertext/plaintext attack

texts:
i'm new to crypto and am working on a little exercise to understand the weakness of ECB mode encryption. Here is the scenario.

I have the plain text

I am not tall

and the associated cipher-text generated using an unknown key with AES-ECB.

Is there any way, apart from brute force, I can change generate the ciphertext for the string

I am yes tall

using the information that's available to me?


texts: Authenticating code securely and generating a certificate

texts:
I'm working on a product with strong security. Essentially there is an App, downloaded from the iTunes App Store. When the App starts up, it generates a strong RSA keypair and stores it in the Keychain. This key pair is the foundation for a lot of things in the overall system. The next step is for the App to use this keypair to generate a CSR (Certificate Signing Request) and present it to a CA (Certificate Authority) and request an SSL Client Certificate for the App key pair. The CA then records the UUID of the App. This process needs to be secured so that only the validated App can submit the CSR.

My question is how do I authenticate my App to the CA, to prevent something else to request these Client Certificates? I understand that we cannot rely on the certificate alone for security. Its only purpose is to prevent a layer of security between the App and the backend system and a "anchor" for User Security (outside the scope of this question).

Logic dictates that we should "give" the App something that only the App knows (i.e. a secret, encrypted and obfuscated in code). But this can be extracted with enough time and effort, thereby unlocking access to the CA.

Essentially I want to know how I can authenticate a piece of code.

Currently, our thinking is to generate a unique key pair at build time, embed the public key in the code (obfuscated) and use the public key to encrypt the CSR. The private key is in the backend. This ensures that only entities with the public key can submit the CRs.

Note - this process has no user intervention. It is not about the user, only about securely generating an identity unique for an instance of an App and issuing a certificate


texts:
The project I'm working on requires me to find a way to create a unique key based on data stored in a table. The table in question consists of x columns and y rows.

In order to create the key I want to hash the data using md5 in the following way:

"|" || md5[(x_1,y_1)]  || "|" || md5[(x_2,y_1)]  || "|" || md5[(x_n,y_1)]  || "|"

My question is: How can I calculate the chance of duplicate keys for different data using this method?

Given: I know the amount of columns (x), I know the size of the data in the columns, I know the amount of rows (y).

The idea comes from this video: https://www.youtube.com/watch?v=fNrs7C86nkI

In the video he says he will do "the math" later but this is not in the video.


texts:
Imagine Alice is applying for a new job. Alice has an idea of the minimum salary that she is willing to accept—let's call this value A. Bob, the hiring manager for a company that Alice is applying to, also has a number in mind: the maximum acceptable salary that he is willing to pay to fill the position—let's call this value B.

Bob wants be sure that at least B >= A is true before spending the time to interview Alice.
Bob does not want Alice to know the exact value of B, because then she would be in a superior position to negotiate a salary as close to B as possible.
Alice would also like to know if B >= A is true, for the same reasons as Bob.
Likewise, Alice does not want Bob to know the exact value of A, because then Bob would be in a superior position to negotiate a salary as close to A as possible.

I'm curious if there is a known cryptographic protocol that would allow Alice and Bob to exchange some information and conclusively determine the result of B >= A, without revealing any information about the actual value of B to Alice or the value of A to Bob.

Caveats:

The use of a third party is not allowed.
Ignore the fact that the repeated use of such an algorithm with different values of A would allow Alice could learn the approximate value of B. Assume that neither party is allowed to change their value.

Does such an algorithm exist? If not, is such a solution even possible?


texts: trying to identify the key of a vigenere cipher via brute force

texts: I'm working on a bit of an ARG game type thing that uses the vigenere cipher. what im wondering is the chance a player could brute force said cipher by simply checking all possible key sequences of the right length, that being 41 characters, for deciphering a sequence of about 1000 characters. its also using more character types than the usual 26, it has 77 unique characters. so what are the chances they could stumble across the correct key by almost (or entirely) complete luck? additionally, could i possibly make the cipher more secure by applying a secondary layer of defense (like converting to a different base or something) and thus making it harder to tell what the alphabet of the cipher is. assume the players already know that it somehow relates to a vigenere cipher and they already know the character length of the key.


texts: Is there a problem with this specific RSA protocol?

texts:
So a protocol uses two random primes $P$ and $Q$ with the equivalent bit length of around 2048 bits, multiplies to form $N$. The encryption function in detail is:
$m^e \bmod\ N$
$(\text{512-bit-random-key})^{65537}\bmod\ \text{4096-bit-modulus}$
Now there are a few attacks that can be performed if the message length is too short. For that reason, the message length is a fixed 512 bit. Are there any other theoretical/practical weaknesses from the information shown?


texts: What scalars produce the wrong values with X25519's montgomery ladder?

texts:
This question is a consequence of an older one about multiplying a twisted Etwards point in Montgomery space. Turns out that this is unsafe in some circumstances.

The following Montgomery ladder as implemented in the ref10 implementation is unsafe: when the scalar is zero, the result of the multiplication is not the zero point, but a point that has a low order. This caused a critical security vulnerability in my crypto library.

Because of this, I have decided not to use the Montgomery ladder for signature verification. The Double scalar multiplication (with merged doublings and sliding windows) is faster and doesn't take much code. I would still like however to use the Montgomery ladder for signing and public key generation.

My question is, is it safe?

Public key generation multiplies the base point by a random, trimmed scalar. The trimming process is the same as for X25519: set bit 254, clear bits 0, 1, 2, and 255. I guess the Montgomery ladder unconditionally produces good results in this case, because the X25519 public key generation does the same. Is that right?

Signatures still multiply the base point, but they do not trim the scalar before performing the scalar multiplication.  Instead, they start from a hash, which is different from zero, and that hash is reduced modulo L (the order of the curve). Basically, we multiply by a random number between 0 (yikes) and L-1.

I believe we have a negligible chance of multiplying by zero by accident (something like 2⁻²⁵²).  We could check for an all zero input, but this looks overkill.  What I'm worried about is other exceptional values.  Does the Montgomery ladder fail on any other value than zero? Are any of those values lower than L?


texts:
CDH problem roughly says that choose $U=g^u, V=g^v$ uniformly at random from  cyclic group $G$, it's hard to compute $\operatorname{CDH}(U,V)=g^{uv}$.

Square-DH problem roughly says choose $U=g^u$ uniformly at random from  cyclic group $G$, it's hard to compute $Z=g^{u^2}$

If I can solve the CDH problem, then it's very clear that Square-DH problem can also be solved easily: $\operatorname{CDH}(U,U)=g^{u^2}$. While, if Square-DH problem can be solved, then we can solve CDH problem of $UV$:
 $$g^{{(u+v)^2}}=g^{u^2+v^2+2uv}=g^{u^2}g^{v^2}\operatorname{CDH}(U,V)^2,$$ while Square-DH problem of $U$ and $V$ can be solved.  So by dividing $g^{u^2}$ and $g^{v^2}$, we get $\operatorname{CDH}(U,V)^2$，and at last, compute the square root of $\operatorname{CDH}(U,V)^2$, we get $\operatorname{CDH}(U,V)$

So, can I say that they are equal to each other?


texts:
In the introduction of NIST Special Publication 800-38D is said that:

  GCM provides assurance of the confidentiality of data using a variation of the Counter mode of operation  for  encryption. GCM  provides  assurance  of  the  authenticity  of  the  confidential  data  (up to about 64 gigabytes per invocation) using a universal hash function that is defined over a binary  Galois  (i.e.,  finite)  field.    GCM  can  also  provide  authentication  assurance  for  additional data (of practically unlimited length per invocation) that is not encrypted.

As a block cipher GCM guarantees the confidentiality of data, but what does it mean that it assures its authenticity?
And what is exactly the authentication assurance for the unencrypted additional data?

I believe that data authenticity may correspond to its integrity, i.e. the absence of tamperings, while I'm not sure of the meaning of the authentication for the additional data.


texts: Why does PGP still use the Fermat primality test? What if it hits one of the Carmichael numbers？

texts:
Since the Fermat primality test is not very reliable, most applications use it for pretesting only. Wikipedia says that PGP still uses it:

Another well known program that relies only on the Fermat test is PGP where it is only used for testing of self-generated large random values (an open source counterpart, GNU Privacy Guard, uses a Fermat pretest followed by Miller–Rabin tests).

I do not understand why PGP still uses it without being followed by the Miller–Rabin test. What if it hits Carmichael numbers?


texts: Do I need to use a CSPRNG when creating salts for user accounts?

texts:
I'm not sure about the need of using CSPRNG to create salts for each user account.

I found “Cryptographically Secure Pseudo-Random Number Generator in Qt/C++ (Cross platform)” (at StackOverflow) with some useful information, but I can't fully understand the reasoning behind it.

If an attacker have access to a copy of my users database table containing each salt and the related salted password, I can't understand how a CSPRNG would be more secure than a SHA12 hashed UUID. Can someone elaborate?


texts:
I understand that if the same message is sent to 3 people with $e=3$ that even with different public keys, the message can be decoded using the Chinese Remainder Theorem.
I have tried to figure out the steps to do so, but I am unable to actually lay it out even using small numbers. How would one decrypt a message $m$ = 10, for example with $n_1=6$, $n_2=35$, and $n_3=143$, with $e=3$?


texts:
Say you have a plain text:

  How are you today?

and you encrypt it so it becomes:

  LKD03Loel03skj1Q03

Now you have multiple people that need to know the plain text of this cipher text but you do not want them to have the same key. It might be they each come up with their own password or they all have a key which identifies that individual.

Now one way of doing this would be adapting this answer so every user encrypts the one key with their own key so you'd get ten encrypted files (for ten people) of the same key. (I don't know if this is good practice but I think it's a secure option.)

Are there any other ways of having different people using different keys to get the same plain text from the same cipher text (and vice versa)? Is there a special algorithm for this?


texts: Doesn't d6 to binary for 256-bit bitcoin private key generation produce biased results?

texts:
If the mapping table looks like:

1: 000

2: 001

3: 010

4: 011

5: 100

6: 101

Then you are guaranteed that your key will never have a chain of 4 or more 1s, much fewer chains of 3 ones than would be expected from truly random number generation, and no chains of 8 or more 0s. Unless you're using an unintuitive mapping from d6 to binary (e.g. alternating 0 and 1), your dice would have to be $2^n$ (2, 4, 8, 16, etc.) sided in order to produce unpredictable binary results. On https://www.swansontec.com/bitcoin-dice.html suggests using d6 as an alternative to Hex dice, is this insecure? Wouldn't a deck of cards (1-10) have the same problem?


texts: How to deal with a cipher with addition and XORs combined together?

texts:
I am trying to cryptanalyze a cipher where bitwise XOR and addition mod $2^n$ are combined together. I've been working on it for a long time but with no result - the main difficulty, which I am unable to overcome, is that even though XOR and addition are linear in their own groups, addition mod $2^n$ is non-linear over $\mathbb{F}_2^n$ and vice versa.

Are there any standard methods of dealing with it which I should know about or some fancy theorems that would make things easier?


texts: Statistical properties of hash functions when calculating modulo

texts:
When using SHA-1 to hash an input, the result is a pseudo-random number in the numeric ID space $\{0\dots2^{160}-1\}$. Do I loose any statistical property in the result if I use modulo to restrict the key space? Obviously, the probability of collisions increases but is the randomness affected?

As an example, if I hash a string 'something', the result is pseudo-random:
$\operatorname{SHA-1}(\mathtt{"something"}) = \operatorname{pseudoRandom}$

So what happens when calculating modulo? Do the statistical properties still hold?
$\operatorname{SHA-1}(\mathtt{"something"})\bmod 2^{80} = \operatorname{pseudoRandom}$

Edit: What I actually want to achieve is a uniform distribution of the resulting, restricted ID space when feeding the $\operatorname{SHA-1}$ function with pseudo-random strings.


texts: How to Check Strength of RSA Public Private Key

texts: How to measure strength of RSA public private key pair. is it enough to only measure the length of primes used to generate N? how to check that primes p,q used to make N were selected truly randomly from a given RSA public private key pair data? Any reliable method of generating public private key pairs and certificates which uses good randomness to for selecting p and q?


texts: How to analyse traces of a hardware AES implementation?

texts:
I am trying to implement the correlation power analysis attack. I have a hardware AES for which I found a trigger which defines the start of the AES calculations. After that I performed an EM curves acquisition.

It is the first time that I have some traces so I have some questions about :

According to my trace, the x-axis is the time and the y-axis is the energy consumption. Is there any software that helps me to plot my trace more clearly and make them more comprehensive?
It is clear that I have some noise in my trace. So how to avoid that noise? which type of filter must do? Must I use a low pass filter or a high pass filter, I need to see my 10 rounds clearly to analyse? What are the steps that I must take?
Why there are an important  possibility to make our attack in the first and last round of the AES?
Some explanation about CPA:'We can use the Hamming Distance model in our CPA attacks. If we can find a point in the encryption algorithm where the victim changes a variable from x to y, then we can estimate that the power consumption is proportional to Hamming Distance(x, y)'
I really don't understand the relation between the CPA and the hamming distance. Can anybody explain?
Is there any software that helps me to make my CPA, given my curves?


texts: Algorithm to securely exchange identities

texts:
Say four people each have a public/private key pair that they can use to encrypt or sign messages. They have an anonymous way to post messages such that the others can see them. Malicious entities can post messages as well, but they can't forge the signatures these four can make.

I'm looking for an algorithm so that the four can, by exchanging posted messages, agree on a new set of four public keys such that each of them knows exactly one corresponding private key. But here's the hard part: None of the four of them can know which private key any of the other three parties know.

If they had a trusted intermediary, they could do it this way: Each of them submits the full set of four public keys to the intermediary, signed with their key. The intermediary confirms the key sets are identical and one set is signed with each key in the set. Each of them submits a new public key, signed with their existing public key, encrypted with the intermediary's public key. The intermediary decrypts these messages and publishes only the list of new public keys in random order, signed with his key.

Of course, I need to do it without a trusted intermediary.

It is okay if observers know the new set of public keys (they're public after all) so long as they don't know which new public key belongs to the same entity as each public key from the start.

It is critical that an attacker who can post messages not be able to slip his public key in. This is a challenging requirement because any message that contains a new key can't be signed with an old key or you can tell which old key corresponds with which new key.


texts: Machine learning to break imperfect randomness

texts: I have a shared randomness between two user. But to make situation worse Eve can listen to exchanges and guess noisy or error prone version of shared randomness, whose correlation varies depending on it's proximity from either party. Are there works to help leak secret based on Eve's observation using machine learning?


texts: Is the padding wrong on the "Length Extension Attack" Wikipedia page example?

texts:
In the Length extension attack of Wikipedia
The following information summarizes the relevant information provided on the page at the time of posting this question.
The provided parameters are

secret length: 14
message: count=10&lat=37.351&user_id=1&long=-119.827&waffle=eggo
the original signature is 6d5f807e23db210bc254a28be2d6759a0f5f5d99
the page does not explicitly state it, but we can infer that the hash algorithm used in the example is SHA-1 (using SHA-1 yields the new signature provided in the example, 0e41270260895979317fff3898ab85668953aaa2)

The extended message (referred to on the page as "New data", reformatted here to remove the line breaks and spaces) is listed as:
count=10&lat=37.351&user_id=1&long=-119.827&waffle=eggo\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x28&waffle=liege
The padding should yield a message length in bits (excluding the extension) that is a multiple of 512.
Counting the bits in "New data" (excluding the extension):

message length in bits = 55 * 8 = 440
secret length in bits = 14 * 8 = 112
padding in bits: 58 * 8 = 464
total length in bits (excluding the extension) = 1016

Based on the above calculation, there are 8 bits missing, so "New data" should include another \x00.
Is my calculation/reasoning/understanding wrong?


texts:
Assuming I had to distribute salt+ciphertext together over an insecure channel, isn't it better to store the salt encrypted?

By encrypted I mean with a block cipher and with key and IV derived from the same passphrase used to encrypt the original text.

I've been told that leaving salt unencrypted is the way to go. Why? Why not encrypt? Isn't it always better?


texts:
What is the best practice on choosing how many key derivation function (KDF) rounds/iterations when generating an SSH key pair with ssh-keygen?

Am I correct in saying that it is unnecessary if the passphrase is strong enough? Is there some kind of formula for how long it would take to crack a private key given the passphrase length and KDF rounds?

My guess is that the default value of 16 for when generating an Ed25519 key is small enough to be almost imperceptible for normal use (logging into a server from the command line), but adds significant expense to any brute-force attempts. I'm wondering if it's worth increasing it.


texts: How to generate initial vectors during DPA attack on stream cipher in real life?

texts:
I was trying to understand the procedure of the DPA attack on Stream cipher (like Mickey-128).

I learned that, the attacker need to build hypothetical power consumption matrix with different initial vectors. For example: using hamming-distance model to describe the power consumption based on R & S registers. But by doing this, different initial vectors have to be known to the attacker.

So my question is, in real life, how the attacker get these large amount of different initial vectors to build the hypothetical power consumption matrix?


texts:
I'm reading about LoRaWAN (specification). This network protocol has a particular way to encrypt data, detailed in the part 4.3.3.1. Here is a recap of how the encryption work, as I understood it.

First, a sequence A with blocks with a size of 16 bytes each A1..An is created. The length of A depends of the length of the payload  so that len(payload) <= 16*n = len(A) < len(payload) + 16. Here are the values used for the block Ai:

0x01 | 0x00 | 0x00 | 0x00 | 0x00 | Dir | DevAddr | Counter | 0x00 | i

One block is 16-bytes long. The Counter is incremented for each payload; i is incremented for each block created (1 <= i <= n). Dir is 0 or 1 depending if it's upward or downward, and the DevAddr is fixed with the address of the end-device.

Now that the blocks are created, they are encrypted to get a sequence S of blocks Si:

Si = aes128_encrypt(K, Ai) for i = 1..n
S = S1 | S2 | .. | Sn

And finally the payload is encrypted:

(pld | pad16) xor S
truncation of the first len(payload) bytes

The message sent is created by concatenating a header (containing among other things the values of DevAddr and Counter), the encrypted payload and a MIC (Message Integrity Check) generated with another AES key. The receiving device knows the key, so it can:

check the MIC
create the blocks A1..An by using the values indicated in the header
encrypt them to get the sequence S
decipher the payload

Here are my questions

I find this implementation basic. More specifically, I'm under the impression that a specific bit of the payload is in the same position after the encryption. But I don't know if an attacker can use that to gain information?

Also, an attacker can know pretty much everything by intercepting messages, so he can probably know the sequence A. Is there a way he can decrypt the payload or gain information about the key?


texts:
First, let me clarify what I mean with a Key Derivation Function (KDF). I'm interested in KDFs that take an $n$-bit symmetric master key and some diversification data of arbitrary length as input and produce an $n$-bit symmetric key as output that can be used in subsequent cryptographic operations.

It seems to me that such KDFs have much in common with MACs:

A key and data as input and an output that has the same length as the input key;
The output should be unforgeable for an attacker who does not have access to the input key;
The probability of producing equal outputs for unequal inputs should be negligible.

Hence my question: is it secure to use any secure MAC algorithm as a KDF?


texts: Are there any well-known examples of SHA-256 collisions?

texts:
The popularity of SHA-256 as a hashing algorithm, along with the fact that it has 2256 buckets to choose from leads me to believe that collisions do exist but are quite rare.

Are there any well-documented SHA-256 collisions? Or any well-known collisions at all? I am curious to know.

I find that showing collisions to people I'm explaining hashing to is a great way to show them what non-invertibility means when they have a hard time seeing how the modulo_x operation relates to the SHA-256 operation.


texts: How is the generator used in Feldman's Verifiable Secret Sharing scheme determined?

texts:
According to the Wikipedia description of Feldman's VSS scheme

  First, a cyclic group G of prime order p, along with a generator g of G, is chosen publicly as a system parameter. (Typically, one takes a subgroup of (Zq)*, where q is a prime such that p divides q-1.)

Why is it necessary to use a generator g in this process?
What is the procedure to be followed to implement a method which produces this generator for a given prime order group Zp?


texts: Mechanism to get 10 pseudo-random positive numbers up to maximum from a seed (32-byte hash)?

texts:
I have learned new crypto words, so I rewrote the question:

I have quite random 32-byte hash which I want to use as a seed for generation of 10 pseudo-random positive numbers up to some maximum number, the generation must be reproducible. I would prefer, if those 10 numbers would differ from each other.

There is an example:

hash=Pkq5skE7tp=j#{y"+R$6~mg!z"4g/Utwand I need to reproducibly generate count=10 pseudo-random positive numbers up to say max=500.

So approaches that came to my mind:
1) I can take first 8 bytes Pkq5skE7 and cast them to 64-bit integer, then use modulo 500 on the result and have first number, then take other 8 bytes starting 1 byte right kq5skE7t, cast it, modulo it and get second number and I can get all 10 number like that.
Would those numbers seem pretty random or would they have some pattern?
There is not preferable effect of having 2 numbers the same.
2) I can take first 8 bytes Pkq5skE7 and cast them to 64-bit integer, then use modulo 500 on the result and have first number, then calculate other numbers with adding 500/10=50 to the result. So if the result of the cast would be 475, then other numbers would be 25, 75, .., 425.
I know that there is randomness only for the first number, but that would be good enough if method 1) would have some inconvinient pattern problem (like numbers distributed close to each other or something).
Compared to 1), numbers would be unique and that is an advantage.
3) If methods 1) and 2) won't be very good, I can again cast some bytes to 64-bit integer, do modulo, get number and take 9 numbers from following positions.
But that loses the random-like factor and I would prefer if the 10 numbers' would seem random and not much related to each other, the same problem can be said for 2), but it's preferable to have the numbers distributed over the whole spectrum.
4) Some other approach?

Basically I prefer 1), but maybe there is something better that can't yield the same number twice, maybe numbers from 1) can have a lot in common, because it's just shifting 1 byte right, I don't know.

I can tell it's used for something like drawing in a lottery. It is preferable that the numbers don't have relationship between each other, but I am not sure, if it's possible and maybe it's ok for those numbers to just look like pseudo-random and only the first being pseudo-random and other having not-obvious relationship to it.

Suggestions?


texts: Has there been any research on entropy efficient information-theoretically secure PRNGs?

texts:
I have an idea for an research project, but I am first wondering if it has been researched or implemented before.

I think I have a way to come up with a set of PRNG algorithms which have the following properties:

Information theoretic security (or perhaps even perfect security) of the output is guaranteed if it is guaranteed for the seed.
The algorithm "re-seeds" using additional information from the seed only whenever it is absolutely necessary to guarantee the first property.

It is easy to satisfy these properties: just make an algorithm that outputs the "seed" bits. That's not what I'm interested in. I'm interested in one that could convert between symbol spaces. More generally, this algorithm would present itself as a random number generation function which accepts a natural range n for each function call, and returns as the result a random integer in the range [1, n] which is chosen from a perfectly uniform distribution over that range. The seed would probably just be a bit sequence, but it could be any sequence of pairs (a, b), where a is the information in the form of a natural number, and b is the inclusive upper limit for a. As such it could convert between bases, even mid-sequence.

Meeting the first property is possible by using rejection sampling, but rejection sampling wastes information. My goal is to prove that an algorithm can satisfy both properties in an entropy-optimal way that wastes only a negligible amount of information so as not to burden an entropy source.


texts: Is it safe to use a counter as IV for AES256-GCM

texts: What if I will use 96-bit integer counter starting from 0 as IV for AES256-GCM cipher. Is it safe? Is there any other ways to ensure uniqueness of IV for GCM cipher?


texts: How do I pick variable length passwords uniformly at random?

texts:
How do I pick passwords uniformly at random when given a min and max length?

It seems that if I first pick a random length, then choose random characters, this procedure will choose shorter length strings preferentially when you consider the number of different strings of a fixed length that are possible.


texts: In which public key encryption algorithms are the private and public key not reversible?

texts:
The RSA public key encryption system has the characteristic that the public key and the private key can be reversed. That is, information encrypted with the public key can be decrypted with the private key, but the keys are themselves symmetric, such that it's also possible to use them the other way around and information encrypted with the private key can be decrypted with the public key.

This is not inherent with public key cryptography, however. The  Paillier cryptosystem, for example, does not have this feature: the private key cannot be used to encrypt data that can then be decrypted with the public key.

Are there other public key systems that do not have this property?


texts: Is it worth applying a MAC on data in a HSM?

texts:
I'm building a basic HSM out of an Arduino, and am using the following scheme to store data:

Master symmetric key $k_m$ stored in firmware (secure bit set to prevent trivial extraction).
Secondary symmetric keys $k_s$ stored as plaintext in web application database, one per user.
HSM record key $k_r$ generated by xor'ing the two keys together computing $AES(k_s, k_m)$, using AES-128-ECB. This means that both the HSM and application server would have to be compromised in order to reveal the key.
AES-128-CBC used to encrypt the data, using a unique pseudo-random IV and the record key.
Each record on the HSM consists of a plaintext record ID, the IV, and a data block.

Is it worth applying a HMAC-SHA1 hash over this data to provide integrity and authenticity checking? If so, what should I use as key material?


texts: Can Pohlig-Hellman encryption be done over elliptic curves?

texts:
Following a bunch of questions on the topic of Pohlig-Hellman encryption. I was wondering if this could be trivially adapted to be done over elliptic curves just like we create EC-DH instead of DH.
surprisingly  my google searches came up with no references for this, or in fact any symmetric encryption based on elliptic curves.
It seems to me elliptic curves should provide the same properties of Pohlig-Hellman but allow same security with smaller keys.


texts: Is XChaCha20-Poly1305 nonce misuse-resistant?

texts:
In the Libsodium v1.0.12 and v1.0.13 Security Assessment one can read

  The ChaCha20-Poly1305 implementation combines a stream cipher and is
  resistant to timing attacks by design. In addition, this particular
  construction has two additional variants implemented in libsodium: an
  IETF version [7] and one with an extended nonce (XChaCha20-Poly1305)
  [4]. One benefit of the XChaCha20Poly1305 construction is that it
  enables nonce misuse-resistant schemes.

However, I don't understand how XChaCha20-Poly1305 construction is nonce misuse-resistant.

From my understanding, XChaCha20 works as follows:

Generates a 192-bit random nonce (6 32-bit words $nonce_0,...,nonce_5$)
Build the initial block $B \leftarrow
\begin{matrix}
c_0 & c_1 & c_2 & c_3\\
k_0 & k_1 & k_2 &k_3\\
k_4 & k_5 & k_6 &k_7\\
nonce_0 & nonce_1 & nonce_2 & nonce_3
\end{matrix}$ where $c_i$ are constants and $k_i$ are key words
Runs ChaCha without the final block addition $B' \leftarrow \mathtt{HChaCha20}(B)$
Build the subblock $B'' \leftarrow
\begin{matrix}
c_0 & c_1 & c_2 & c_3\\
B'_0 & B'_1 & B'_2 &B'_3\\
B'_{12} & B'_{13} & B'_{14} &B'_{15}\\
counter_0 & counter_1 & nonce_4 & nonce_5
\end{matrix}$
Runs ChaCha20 using $B''$.

In this way, using the same nonce will output the same keystream.
However, as I understand, nonce-misuse resistance schemes ensure that a repeated random nonce doesn't result in plaintext compromise.

So it seems that when using XChaCha20-Poly1305 with random nonce, one can ensure that the probablity of a repeated nonce is negligible. But this is not the definition of a nonce miseuse-resistant scheme.

How to build a nonce misuse-resistant schemes using XChaCha20Poly1305?


texts: Rigorous practical pseudorandom generators

texts:
It is known that existence of pseudorandom generators (PRGs) is equivalent to the existence of one-way functions. In turn, the latter is an open problem.
I am curious if someone developed kind of "practical" PRGs, which are weaker than PRGs in terms of computational indistinguishably to uniform random number generators.
I know of some statistical tests for randomness, but is there any rigorous theory on the subject?
This is a repost from MO, and I intend to remove the original question.


texts: Steganographic embedding of an RSA-encrypted message into an image

texts: The goal is to combine the RSA encryption system with the LSB steganography system in a BMP image. Since every pixel of the image is an integer between 0 and 255, if we choose $p$ and $q$ such that $N = p \cdot q > 255$, how could a message encrypted with $RSA$ be embedded in the image?


texts: Should we use modulus switching when dealing with ciphertexts encrypted in different rings?

texts:
Having a homomorphic encryption scheme like BGV or LTV-FHE at some point it is possible in the homomorphic evaluation to deal with ciphertexts that are encrypted with respect to different moduli.

For the chosen scheme we have a ladder of decreasing moduli $q_0 > ... > q_{t-1}$. If there is a ciphertext $c_1$ w.r.t $R_{q_2}$ and another ciphertext $c_2$ w.r.t to $R_{q_4}$, the first ciphertext should be "switched" into the ring $R_{q_4}$ and only then the homomorphic computation could be done ?

Or maybe this situation should be avoided ? Then, if this is the case, how about computation represented as an unbalanced tree of multiplications? At some point there will be a need to multiply two ciphertexts encrypted in different subrings.


texts: Implications of reversing CBC encryption

texts:
What would be the security implications if we reverse CBC encyption?
Here is a picture of CBC encryption:

Here is a picture of CBC decryption:

My guess is that the encryption would work if we ran the decryption process for encryption and encryption process for decryption. However, the effect from the IV is not spread to other blocks other than cipherblock 1. Are there any other potential effects?


texts: Given N and e in RSA and the ability to get signature s for any message m, can you find the value of the private key d?

texts: Given N and e in RSA and the ability to get signature s for any message m ($s=m^d \mod{n}$), can you find the value of the private key d?


texts: Why does GnuPG save an array of remainders when generating prime numbers?

texts: In looking at GPG's gen_prime() function, found within the cyphers/primegen.c file of libgcrypt, I noticed that the functions saves a list of the remainders from dividing the initial, randomly generated large number by the first 669 or so small prime numbers. What is the purpose of doing that? I don't see any reasoning behind doing so within the file.


texts: What distribution is required to ensure the security of the RLWE?

texts: In LWE, the error should be sampled from a discrete Gaussian distribution. Then, in RLWE, the error is a polynomial in $\mathbb{Z}_q[x]/(x^N+1)$, it could be sampled coefficient wise. However, when we multiply two RLWE ciphertexts, the error in the new ciphertext doesn't seem to be Gaussian distribution, is it still secure?


texts: Cracking Viginere Ciphers using same-length key used twice

texts:
Assuming I had two ciphertexts which were encrypted using the same key that has the same length with the ciphertexts. (However the keys didn't have any repetitions or features that would assist in frequency analysis).
Apart from the crib dragging technique (which I didn't have much success in), are there any other techniques I can use to possibly crack these ciphertexts?


texts: Intuition for Cramer Shoup Encryption Scheme?

texts:
I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows.

Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, hk is hash key of a universal one-way hash function.

Secret key = $(x_1, y_1, x_2, y_2, z)$

Encryption(pk, m; r) = $(u_1, u_2, e, v)$, where $u_1 = g_1^r, u_2 = g_2^r, e = h^r.m, \alpha = \mathsf{Hash}(hk, (u_1, u_2, e)), v = c^r.d^{r\alpha}$.

In elgamal scheme, the ciphertext consists of only $u_1, e$ terms. I didn't fully understand the intuition behind the additional terms in the public key and  ciphertext. What purpose is each term serving? What terms are eradicating CCA1 attack and what terms are eradicating CCA2 attack?

I came up with this simpler scheme, and couldn't find a CCA attack on this. Is this scheme secure?

Public key = $(g_1, c, d, h, hk)$, where $c = g_1^x$, $d = g_1^y$, $h = g_1^z$, $hk$ is hash key of a universal one-way hash function.

Secret key = $x, y, z$

Encryption(pk, m; r) = $(u_1, e, v)$, where $u_1 = g_1^r, e = h^r.m, \alpha = \mathsf{Hash}(hk, (u_1, e)), v = c^r.d^{r\alpha}$.


texts: Does Openssl 1.1.1 library supports sending multiple identities as part of PSK?

texts: Does Openssl 1.1.1 supports sending multiple ticket identities as part of PSK? i have gone through the openssl code and i don't see that openssl supports it. could someone please confirm it if i missing something there?


texts:
In the RSASSA-PKCS-v1_5 signature scheme, the first step is to perform an encoding on the hashed data. (0x00||0x01||PS||0x00||T).
Is this encoding important for security ? What happens if the hash is directly encrypted without encoding ?


texts:
Assume my prime generation is as follows:

Pick a number $p$ between 1000 and 9999. $p=abcd$.
Make sure $p$ is prime
Construct $q$ such by taking the last 2 digits of $p$ and the first 2 digits of $p$, i.e. $q=cdab$
Make sure $q$ is prime.

Is the resulting $n = p·q$ more easily factorable?

My gut feeling says yes but I can't see why? I thought about Coppersmith but in this case, we don't have any common bit between $p$ and $q$ that are also at the same place. Is there a weakness?


texts: Security strength of RSA in relation with the modulus size

texts:
NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits:

Strength  RSA modulus size
  80        1024
 112        2048
 128        3072
 192        7680
 256       15360

This works out to approximately $s \approx 4 n^{0.43}$ (but I have no idea whether my extrapolation means anything; strengths up to 112 are indexed on DES while strengths 128 and above are indexed on AES, i.e. the strength is the difficulty of brute-forcing the corresponding symmetric algorithm with the specified key size).

What are these numbers based on? Do they come from the expected complexity of the best known factorization methods? Or are they extrapolation from the amount of computation in specific factorization efforts such as for RSA-768 (which “required more than $10^{20}$ operations”)?

(I'm asking for more precise information than Difficulty of breaking RSA for a given key size. How big an RSA key is considered secure today? has a nice history of RSA factorizations, but doesn't answer my question — is that what the strength estimates are based on?)


texts: Understanding Unique-SVP and Kannan's Embedding

texts:
I am trying to understand the Kannan embedding technique. But I am confused about the formation of the B' and the finding of the short vector inside that basis. How does this basis matrix in the algorithm produce a lattice? Or more specifically why a uSVP instance consist of a vector(e^T) and an integer(M)?
Thanks.


texts: Proving Sigma Protocol on a Schnorr Protocol Variant

texts:
Let p, q be chosen as in Schnorr's protocol, and let $g_1, g_2, h$ be elements in $Z^*_P$ of order q.

Assume that the prover P gets as input $w_1,w_2$ where $h = (g_1^{w_1}g_2^{w_2}) \mod q$.

Consider the following protocol:

a) P chooses $r_1,r_2$ at random in $Z_q$ and sends $a = (g_1^{r_1}g_2^{r_2}) \mod q$ to V .

b) V chooses a challenge e at random in $[0,2^t-1]$ and sends it to P.
Here, t is fixed such that $2^t < q$.

c) P sends $z_1 = (r_1 + e*w_1) \mod q$, and $z_2 = (r_2 + e*w_2) \mod q$ to V , who checks that $g_1^{z_1}g_2^{z_2} = (a*h^e) \mod q$, that p and q are prime and that $g_1, g_2$ and h have order q, and accepts iff this is the case.

I need to prove that this is a Sigma-protocol for the relation $h = g_1^{w_1}g_2^{w_2}$
(in the description of the relation, it is understood that it should also be satisfied that p
and q are prime, $w_1,w_2$ are in $Z_q$, and that $g_1, g_2$ and $h$ are in $Z^*_p$ and have order q).


texts:
As far as my understanding goes, MACs are used to determine whether the received message comes from a source with access to a MAC-key, which both parties know.
Some crypto protocols reveal their used MAC keys after using them for message-exchange (e.g., OTR). Explanations (I read) often say that revealing MAC-keys after using them creates the possibility of a third-party attacker gaining access to these keys and thus being able to also calculate the MAC. This leads to me not being able to prove to anyone who actually sent the received message since now everyone can calculate the MAC of it (including myself).
Now let's say Mallory can record my conversation with Alice. Mallory can also record the timestamps of when I sent a message to Alice and when Alice sent a message to me.
After the conversation, she wants to prove to me that I have been talking to Alice and shows me the timeline record of our conversation + MAC key. Since I revealed the used MAC keys after the conversation, I can't prove to her whom the messages were coming from since now everybody can calculate the MACs for the messages. But Mallory can prove to me the exact timely order of the message exchange + which MAC key was revealed at which time.
Does this eliminate the fact of gaining deniability through revealing MAC keys?
Furthermore, by revealing the MAC keys, is Mallory now able to prove for sure that the messages were coming from either Alice or me, since revealing the key only takes place after sending a message to the other party?
In particular, I am thinking about my country where ISPs are bound by law to data preservation and so can prove to you the timely order of a message exchange.


texts: How any attack on a cipher carried out? Are these practical or only theoretical?

texts:
I have been reading about successful attacks on AES and other ciphers. One such mention is here (see excerpt below):

  AES was published under the name Rijndael in 1998. Refereed
  cryptanalytic papers in the next three years culminated in attacks
  taking time "only" $2^{140}$ to break 7 rounds of 256-bit AES and "only"
  $2^{204}$ (with a huge amount of memory) to break 8 rounds of 256-bit AES.
  Subsequent work made very little progress. (Related-key attacks can
  break more rounds but are not of concern in any properly designed
  cryptographic protocol.)

I want to know:

If any paper mentions attack as $2^{140}$, how the researchers determine this number of operations?
Are these attacks only on paper or practically proven?
Considering super-computers owned by the government, which researchers don't have access, this figure may vary? Are these attacks taking into account super-computers computing power also?


texts: Recovering 3 private keys if Eve knows that the keys are shared prime numbers and knows their public keys, How would this be done?

texts:
okay so here is the original question:

Alice Bob and Carl are generating public keys for RSA, but they are lazy and decide to
share some of the work of generating prime numbers. They find 3 large prime numbers
p,q and r, then Alice uses the modulus $n_A = pq$, Bob uses the modulus $n_B = pr$ and Carl
uses the modulus $n_C = qr$. The prime numbers used are much to large factoring to be
feasible, but Eve learns that they shared prime numbers (and knows their public keys)
how does she obtain p, q and r?

My thinking or possible reasoning for this question.
Since Eve knows the public keys and that the keys share prime numbers she can compute the GCD of n or factorize n in order to calculate or find the private keys. In this case she would first use Euclid's algorithm for $n_A = pq$ & $n_B= pr $ which we know is p because both n's share a common prime $p$. She would use the same process for computing $q$ which is $n_A = pq$ & $n_C = qr$. Shes does it a third time for $r$ which $n_B = pr$ & $n_C = qr$.

I want to know If I am thinking about this the right way or if I have the right idea. If I am on the right track, how do I mathematically represent this?


texts: Can you travel out of the U.S. with Oracle's JCE Unlimited Strength installed on your laptop?

texts:
Just curious if this "export" restriction applies to general travel outside the U.S. with Oracle's JCE Unlimited Strength installed on a laptop.

pertinent text from Oracle's "Java SE BCL License Agreement"

  EXPORT REGULATIONS. You agree that U.S. export control laws and other applicable export and import laws govern your use of the Software, including technical data; additional information can be found on Oracle's Global Trade Compliance web site (www.oracle.com/us/products/export). You agree that neither the Software nor any direct product thereof will be exported, directly, or indirectly, in violation of these laws, or will be used for any purpose prohibited by these laws including, without limitation, nuclear, chemical, or biological weapons proliferation.

This crypto Q&A discusses the issue in general:
Why there are limitations on using encryption with keys beyond certain length?