The Side Channel

12:24 AM

2

Q: Are all homomorphic encryption schemes based on latticed-based schemes?

PALISADE offers a pool of Homomorphic Encryption schemes and it is stated that "PALISADE is a general lattice cryptography library ...". My question is rather simple: are all homomorphic encryption schemes based on lattice-based cryptography?

kelalaka

6:58 AM

1

Q: The Methodology of Quantum Key Distributions Systems

While reading an answer in Cryptography.SE I saw this As for security, that's one possible way to perform Quantum Key Distribution, another real thing. However, most current QKD systems sold today do not exchange entangled qubits (and hence can't be used for Quantum Teleportation), instead, they...

teleportation key-distribution

kelalaka

7:43 AM

I've just wondered..

Squeamish Ossifrage

3:15 PM

@kelalaka mailarchive.ietf.org/arch/msg/cfrg/-9LEdnzVrE5RORux3Oo_oDDRksU

@kelalaka tools.ietf.org/html/rfc7748

@fgrieu cs.nyu.edu/~dodis/ps/encryptment.pdf#page=10

@fgrieu On p. 10 (linked), this shows how to take advantage of the JPEG format to create an AES-GCM ciphertext that decrypts under two different keys to two different images, thereby breaking Facebook's ‘message franking’ system for abuse reporting which relied on ciphertexts to be commitments to keys.

kelalaka

@SqueamishOssifrage therefore it is a convention between the Elliptic Curve Cryptographers.

Squeamish Ossifrage

@fgrieu ‘Message franking’ was supposed to be a mechanism to enable Facebook users to verifiably report abuse involving what they call nonconsensual intimate imagery (also known colloquially as ‘revenge porn’, whether it is used for revenge or not) in end-to-end authenticated encrypted conversations—Facebook doesn't know what's in the conversation, but one participant can report abuse and Facebook can verify it.

@fgrieu Except it didn't work—because Facebook's message franking system based on AES-GCM assumed a ciphertext is a commitment to a key, an adversary could construct a ciphertext that decrypts to a malicious plaintext under one key and a benign plaintext under the other key, and thereby exhibit plausible deniability, destroying the verifiable part of the abuse reporting system.

kelalaka

Ah, open standard.

kelalaka

4:11 PM

So, It is because of the Facebook's protocol flaw for the attachments.

> Since curve25519 and
curve448 have cofactors of 8 and 4 (respectively), an input point of
small order will eliminate any contribution from the other party's
private key. This situation can be detected by checking for the all-
zero output, which implementations MAY do, as specified in Section 6.
However, a large number of existing implementations do not do this.

Why it is MAY not MUST?

@fgrieu SeQureNet is closed?

Squeamish Ossifrage

@kelalaka In realistic DH protocols, there is no security benefit to the check.

kelalaka

because of one side [a]P is dlog secure?

Squeamish Ossifrage

4:29 PM

4

A: Should Diffie-Hellman on Curve25519 be validated?

Let's be more specific about the protocol, because ‘Diffie–Hellman’ can mean a lot of things including just an abelian group action on a set. Suppose there is a set of users including Alice and Bob. Suppose each user has a public key known to everyone to be correct, by, e.g., being published in...

For non-DH protocols, e.g. blinded tokens like PrivacyPass, where you really want a prime-order group, you should use Ristretto255 instead. Merely checking for zero is not sufficient in such protocols.

kelalaka

4:41 PM

I see. all the adversary learns is that n mod 8=0 per the protocol.

Even if it is not 0, we are only giving at most 3 bits.

Squeamish Ossifrage

5:06 PM

That's why the secret key is chosen to be a multiple of 8. It's not really related to the zero check. The zero check tells you that your peer's key has order 8, which means that your peer deliberately chose a stupid key.

fgrieu

8:07 PM

@kelalaka IANAL, but yes, it looks like that SeQureNet essentially RIP as a commercial entity. Their registered activity used to be public communication advisors (otherwise said, spin doctor).

kelalaka

They are mentioned as QKE firm.

fgrieu

@kelalaka In anything official ?

kelalaka

@fgrieu I've posted paragraphs from the book. You know how to reach the book. Chapter 3. You gave me lots of links to read :)

@fgrieu no, just looked over the net with what technique they are building, but Google said closed.

Sometimes they change names...

fgrieu

@kelalaka Again IANAL, but my link seems pretty conclusive they are legally gone (plus their former domain name was repurposed), and had officially registered as public communication advisors ("Activité (code NAF) 7021Z : Conseil en relations publiques et communication").

kelalaka

@fgrieu thanks.

fgrieu

8:24 PM

@SqueamishOssifrage Thanks for the re-linking. I'm lazy+busy+procrastinating (so much that I let the deadline for Eurocrypt (ending in 36 minutes) slip for a would-be article on an unrelated subject, but I digress) and had not read the article that you kindly pointed.

Now I at least skimmed over it. If I get the big picture (pun intended), they manage that one file is parsed as JPEG, the other as a BMP. Clever. In some contexts there might be other options, like ZIP, which (for some implementations of the parser) tolerates a lot of junk. Note: at least I never doubted about what you stated!

kelalaka

8:36 PM

@fgrieu video of the article from the conference youtube.com/watch?v=3M1jIO-jLHI&t=735s

fgrieu

@kelalaka: thanks for your edit adding poncho's remark, I should have done just that!

kelalaka

@fgrieu use my comments and delete them, too?

fgrieu

Doing that!

kelalaka

@fgrieu Also poncho's other comment was good, too.

@fgrieu forget the comment links, If you really need, give thanks as a comment :)

Crypto HNQ

9:38 PM

4

Q: Parity attack on block cipher

My misunderstanding is all about the parity attack mentioned in "Cryptography Engineering by Ferguson, Schneier and Kohno". Most modern block ciphers have a 128-bit block size, but they operate on 32-bit words. They build the encryption function from many 32-bit operations.This has proved to be ...

block-cipher permutation

Squeamish Ossifrage

10:57 PM

@fgrieu Look up PoC||GTFO. Then untar it, and/or unzip it, and/or open it as a PDF, and/or execute it in qemu, and/or…

kelalaka

11:35 PM

@SqueamishOssifrage what is $x_0(B)$ where B is the public point in ECC. I know x(B)

here crypto.stackexchange.com/questions/55653/…

Squeamish Ossifrage

@kelalaka In the context of Curve25519, x_0(B) means 0 if B is the identity, or x(B) if B is not the identity (note the identity does not have affine x/y coordinates). Curve25519 was chosen so that if x_0(B) is in F_p (here p = 2^255 - 19), then x_0([n]B) is also in F_p, even if B lies in the quadratic twist of Curve25519. I don't remember why I chose to write x_0 there; it's a kind of obscure detail.

20

A: Summarize the mathematical problem at the heart of breaking a Curve25519 public key

Six-word summary: the elliptic-curve discrete log problem. $\newcommand{\F}{\mathbb{F}}\newcommand{\Z}{\mathbb{Z}}$Summary with math: Given $x(A)$ and $x(P)$ for two points $A$ and $P$ on the elliptic curve $y^2 = x^3 + 486662 x^2 + x$ over the field $\Z/(2^{255} - 19)\Z$, find an integer $a$ su...

Crypto HNQ

7

Q: What the X stands for in the front of Elliptic curve names

I have seen Curve25519 and X25519, Curve448 and X448. I've seen a small note in this answer (Historical note: Originally, X25519 was called Curve25519, but now Curve25519 just means the elliptic curve and X25519 means the cryptosystem.) Is it a standard to say CurveABC is the Elliptic Curve an...

elliptic-curves standards notation

Squeamish Ossifrage

That post goes into some more detail about the issue with affine coordinates and the quadratic twist in what I hope is slightly less obscure prose than the Curve25519 paper. I don't remember why I chose to write $x_0(B)$ in one post and say ‘by abuse of language we prescribe that $x(\mathcal O) = 0$’ in another, though.

kelalaka

I see. I know that one, that is first high voted answer :)

Transcript for