Cryptography

To All Employed Cryptographic Engineers in this subreddit,

I am considering joining cryptographic engineering teams at work.

Since some of you have far more experience developing crypto code at work than I do I wanted to ask:

Writing your own crypto code is discouraged. Why did you get started and how did you build your skills?

Would you do it again?

What are the biggest issues you face as a cryptographic engineer?

Are there any frequent work problems you deal with when working with others?

What is the part of being a crypto developer that you enjoyed the most?

I thank everyone who takes the time to respond!

I was reviewing fault injection tools on the Wiki article for Fault Injection.

Which would you say are the most effective tools to test for fault injection attacks targeting cryptographic code? The ones easy to use, easy to study and learn from, and that at least defend against the practical ( and therefore most realistic ) fault injection exploits. Here is a paper on which Fault Injection Attacks are most practical.

Hello,

My name is Romão Costa.

As part of my master's thesis, I am conducting a research study on the usage and security features of the Signal app, and I am looking for participants to complete a short survey.

If you are a Signal user please click on the link below to answer the survey. It will take approximately 5-10 minutes.

Survey: https://qualtricsxmk7m49cmg9.qualtrics.com/jfe/form/SV_bwrCeOJ9AjTqxWm

Your contribution is important for the research on privacy and security in communication apps and could help improve the user experience and security features of Signal.

Your participation is voluntary and anonymous. Thank you for your time and valuable input!

P.S: When i joined the subreddit this information was passed to the mods and it was authorized beacuse they accepted my invite to join this subreddit

Hello everyone,

I am struggling to research coding techniques for constant-time when programming cryptography. Of course a simple solution is study and read the source code from pre-existing crypto libraries.

Which crypto libraries would you recommend I study and learn from? The ideal crypto libraries are the ones whose source code is:

1. Easy to Understand
2. Constant-Time
3. Lab Tested to Be Secure Against Common Attacks (E.g. FIPS-validated)

The closest library I could think of so far is BearSSL since Thomas Pornin wrote decent documentation on constant-time cryptography and Multi-Precision Arithmetic.

What other such libraries do you recommend?

This is the CRS generated by Groth16 Trusted Setup.

https://preview.redd.it/6j48x6a1redd1.png?width=515&format=png&auto=webp&s=48f10d930771d9ea0147e8ccb5342d551e4942b7

As per the moonmath manual this is a circuit specific Trusted Setup & I agree with the moonmath manual on this. If the number of gates in the circuit changes, then the full CRS changes.

​

If you split this into 2 phases

- Phase 1 - you generate the Powers of Tau for A & B (i.e. Powers of Tau for G1 & G2) & discard Tau as toxic waste

- Phase 2 - you generate the remaining things

However, there is a problem here - using just the Tau powers, you can compute every part of the remaining CRS except one part - the last part which I have marked in Red - the h(tau).t(tau) part.

This cannot be generated without knowing the value of t(tau) & the value of t(tau) changes if the number of gates increases or decreases.

​

So why split into 2 parts - this is what I think is the purpose of splitting into 2 parts.

It's to enable the perpetual powers of Tau ceremony.

https://medium.com/coinmonks/announcing-the-perpetual-powers-of-tau-ceremony-to-benefit-all-zk-snark-projects-c3da86af8377

​

In the above description of the Perpetual Powers of Tau Ceremony, I see the following

> any zk-SNARK project can pick a round from the common phase 1

> any zk-SNARK project can pick any point of the ceremony to begin their circuit-specific second phase.

​

What I think this means is

- Perpetual Rounds means Phase 1 doesn't stop.

- In Round 1 of Phase 1, they generate a CRS for n gates - they generate a tau, compute the powers of tau & store it. They also compute Tn(tau) & store it along with it.

- In Round 2 of Phase 1, they generate a CRS for (n+1) gates - they generate a new tau from the older tau, compute the powers of the new tau & store the powers. They also store the newly computed Tn+1(tau) along with it.

- In Round 3 of Phase 1, they generate a CRS for (n+2) gates - they generate a new tau from the 2nd tau, compute the powers of the new tau & store the powers. They also store the newly computed Tn+2(tau) along with it.

​

And so on & so forth - anything someone has a circuit with a higher number of gates, another round of Phase 1 is done.

​

Now if a zkSNARK with n gates wants to use the Phase 1 output, they use the Round 1 output, if they have n+1 gates, they use the Phase 1 Round 2 output & so on.

And since the output contains T(tau) also along with the powers of tau, the full second phase can be computed for that tau

Can someone who understands this, let me know if what I describe is correct? If it is not, how what is the procedure used which allows Phase 2 to be done without knowing the value of T(tau)? T(tau) is required for generate the CRS which helps compute the commitment of H.T - this is that part of the CRS - (tau^i * t(tau))/delta}_{i=0 to n-2}. T depends on number of gates in the circuit - i.e. T(tau) changes if now of gates in the circuit changes.

In a previous blog post I was told to benchmark my cryptographic code to test if it is constant time.

I was considering ctgrind and other tools from this paper. How accurate are these tools at detecting constant-time flaws in code? Do you recommend I use a combination of tools if so? When I should conduct real lab experiments to test if the code is truly constant-time?

Please let me know.

Thanks!

This is another installment in a series of monthly recurring cryptography wishlist threads.

The purpose is to let people freely discuss what future developments they like to see in fields related to cryptography, including things like algorithms, cryptanalysis, software and hardware implementations, usable UX, protocols and more.

So start posting what you'd like to see below!

Hello Everyone,

I have attempted to write a blog post that guides the reader on how to program multi-precision arithmetic. I have done my best to ensure all the code and explanations are easy to follow even for a complete beginner.

This is the first article where I attempt to present constant-time code. I welcome any feedback on how to improve my code to meet this requirement.

I decided to *not* care about speed here for this article--learning how to write Multi-Precision Arithmetic in constant-time for beginners would be hard enough.

The following is an outline of the topics in the article:

Outline

1. Introduction to Constant-Time Programming Techniques
2. Branch-free Comparison Predicates
   1. Equals Comparison
   2. Not Equal to Comparison
   3. Greater Than Comparison
   4. Greater Than or Equal To Comparison
   5. Less Than Comparison
   6. Less Than or Equal To Comparison
3. Storing Big Numbers as Vectors in C++
4. Comparison Predicates with Big Numbers
5. Addition with Big Numbers
6. Subtraction with Big Numbers
7. Multiplication with Big Numbers
   1. Grade School Multiplication
   2. Karatsuba Multiplication

Happy reading and please let me know what can be improved!

Since the http://terrapin-attack.com on SSH I've noticed some people on SuperUser recommend against chacha20-poly1305 - AFAIK there is no issue with ChaCha and it's still a better choice than AES-CBC/GCM/CTR - does anyone disagree, once running a version of SSH that mitigates Terrapin ChaCha is still a great choice for symmetric cipher?

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!

How do coders of hardware implementations (e.g. SystemVerilog) of cryptographic primitives fortify their programs with proper side channel countermeasures? Do they have to deal with the issue of the compiler optimizing away side channel and fault injection countermeasures just as with software?

Hi

I want to write some code to demonstrate a length extension attack on a homemade HMAC construction. Where a signature is constructed as:

digest = hash(key+ message)

and then I want to construct a digest from the output of those two.

I read up on it a little, and figured I could do a really simple small code example in c# (if anyone can help with snippets in other similar languages it would be really cool too :D )

My approach

So I figured that if I have a secret and a message that add up to the sha1 block length of 64 bytes, then the hash of these two would simply be a single block of hashing.

Then I could simply take the signature of this message, and append whatever to it, from which I would get a new hash, which would valid

And so I made this little snippet:

using System.Security.Cryptography;

using System.Text;

// secret and message, together they are 64 bytes

string secret = "secret222222222222222222222222222222222222222222222222222222";

string msg = "data";

// the digest

var digest = StringExtensions.hash(secret+msg);

// forging digest, simply trying to append "appendeddata"

string append = "appendeddata";

// and now trying to forge a new digest:

var forgedPayload = StringExtensions.hash(digest + append);

// and then checking it

var constructed = StringExtensions.hash(secret+msg+append);

public static class StringExtensions

{

public static string hash(this string input)

{

if (input == null) throw new ArgumentNullException(nameof(input));

using (SHA1 sha256 = SHA1.Create())

{

byte[] bytes = Encoding.UTF8.GetBytes(input);

byte[] hashBytes = sha256.ComputeHash(bytes);

StringBuilder hash = new StringBuilder();

foreach (byte b in hashBytes)

{

hash.Append(b.ToString("x2"));

}

return hash.ToString();

}

}

}

However, this does'nt work. The two final hashes are always different.

What have i misunderstood, why are these values not adding up?

Hello, want to share the FAQ and Forum for the encryption application Spot-On at Reddit with you, if you like to join:

https://www.reddit.com/r/Spot_On_Encryption/

Spot-On is an open-source Encrpytion Suite for secure Chat & E-Mail, File Transfer and also Websearch in a F2F distributed URL-Database.

Means: Spot-On is a Messaging and File-Transfer Application. With RSS you can import, read, search and distribute your feeds f2f to your friends over encrypted connections.

Enhanced encryption processes have been invented and improved for implementation in Spot-On: such as McEliece-Messaging (Linux), Cryptographic Calling, Zero-Knowledge-Proofs, AutoCrypt via REPLEO and EPKS, Fiasco Forwarding, POPTASTIC-Messaging over E-Mail-Servers, Chipher-Text conversion tools like Rosetta Crypto Pad, Socialist-Millionaire-Security and many more.

Spot-On utilized the Echo-Protocol for the network, it provids end-to-end encryption (and therefore utilizes not a web-of-trust, which is only point-to-point encryption). Spot-On is in the groupchat and for servers compatible with Smoke Crypto Chat Messenger from F-Droid.org

I am aware compilers can optimize code such that it can destroy the constant-time guarantees written in source code. Why don't cryptographic engineers develop specialized compilers that compile to cryptography safe code so that the output is optimized without destroying these essential security features?

Can anyone point me to pseduocode explaining how to implement barrett reduction across multiple words? I've been trying to find a good resource on this but all the stuff I can find are either single word or not quite clear on how to implement the algorithm(if it even explains the multi word variant). Ideally the pseduocode will contain information on how to generate the integer approximation using only bitshifts.

I will update this post with a list. This includes all cryptography.

When writing Circom code, you write verification logic as a system of rank one constraints using the <== syntax. Sometimes expressing a constraint ‘in reverse’ is simpler, and there you use <— syntax followed by a === to express the relevant constraints explicitly. I’m wondering, ‘how bad are almost-proofs’. How many circuit constraints do you really need to demonstrate you know a hash-preimage for example? Are there any examples of removing one RC1S constraint and falsifying knowledge of a Keccak preimage for example?

From my understanding, in order to have maximally hard discrete logarithm instances, one needs to instantiate it over an adequately large prime modulus p such that p = 2q + 1 where q is a prime number. Doing so allows the creation of subgroups of order 2, q, and 2q.

When a generator that generates the subgroup of order q is used for discrete logarithm, you lose half the possible outputs compared to the subgroup of order 2 but you also prevent leakage regarding the output from what I recall. The converse is true when you use a generator for the 2q order group(more outputs but you leak a bit of information). This means from a cryptographic perspective, both options are effectively similar(either q possible outputs or 2q possible outputs but you can exclude one half of the outputs due to leakage).

I would like to know if there would be any reason to prefer one subgroup over another for uses of finite field discrete logarithms in this scenario.

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!

Hello. I have an Android App that stores encrypted data using a key derived from user entered password (PBKDF2). If any user forgets their password, they loose access to all their data. Hence, I am trying to implement a password recovery feature that is hacker resistant, including in cases where the phone may be rooted and the sqlite database is accessible.

Here's my solution. I randomly generate and store an internal password in the app. I then encrypt the user's password using this internal password using AES, and further encrypt the output and the user's email using my RSA public key. I store this RSA encrypted value.

If the user forgets their password, I submit the RSA encrypted value to my website. The website will decrypt the value using my private key and will email the app encrypted user password value to the email address found, as an attachment. On clicking the attachment, the user password is decrypted using the internal password, user is logged in and made to change their password.

Do you foresee any weaknesses with this approach? I guess if the user's phone is compromised, then the person holding the phone can check emails and retrieve the password. So perhaps adding a secret question and answer would help, but some people end up forgetting the answer to that as well.

Does anyone knows an article that explains dieharder tests at mathematical levels?

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!

I would like something like RSA encryption but with smaller key sizes. How secure is ECIES and why is it not widely used?

What exactly can a range proof be used for? Are there any usage examples in real world applications?