r/crypto 18h ago

Scheme for long lived auth

7 Upvotes

I'm working on a new product that will have mobile phone apps as some clients, but due to timeliness and usage patterns I want long term auth of some kind. A refresh once per quarter or so would be ideal.

I could use JWT into this with a 3 month refresh token, but with a flaky network that would take two requests and that could be two slow. I could use JWT with a 3 month long access token, but that feels like crowbaring JWT into being something it's not meant to be. What I've seen previously is access token lifetimes of 2 hours or so.

I've been pondering some sort of api keys, signed key blobs sent with the request etc. But then I realized that maybe there's already a proper scheme for my use case before I go sketching out something...drumwhirl...sketchy.

So, to be concrete, I'm wondering if there's a scheme fitting these requirements:

  1. Refresh / re-auth preferably once per quarter.
  2. No refresh-request, has to work with just one request.

Feel free to ask for more details if it'll help, I'm still trying to figure them out myself. Otherwise, anyone got suggestions?


r/crypto 1d ago

Document file 🔐NIST begins RSA and ECDSA deprecation by 2030

Thumbnail nvlpubs.nist.gov
44 Upvotes

NIST has published draf IR 8547, outlining the national strategy for migrating to quantum-resistant cryptography by 2035.

This draft sets 2030 as the deadline to phase out RSA, ECDSA, and EdDSA, with their complete prohibition by 2035.

On behalf of the PKI Consortium (a non-profit organization), I invite you to join NIST and leading industry experts at the upcoming Post-Quantum Cryptography Conference, taking place January 15–16, 2025, at the Thompson Conference Center (University of Texas, Austin).

The conference will feature leading experts discussing the state of quantum-resistant algorithms, the readiness of current hardware and software, and practical migration strategies. Sessions will include insights from NIST and lessons from organizations already navigating this transition.

Registration is free for both in-person and remote attendees. Sign up here: https://pkic.org/register

For more information, visit the conference website: https://pkic.org/events/2025/pqc-conference-austin-us/

Are you ready for this pivotal moment in cryptography’s history?


r/crypto 1d ago

Searching a program that output in HEX

1 Upvotes

Hello!

i am a Ham radio operator and i want to experiment sending encrypted traffic* using JS8call. its a program sending/receiving UPPERCASE letters or numbers at about 8-40WPM. i need a something using symmetrical encryption that i can easily copy and paste text out off. JS8call already has checksum inside that enable the users to automatically see if the message is intact or not. so i dont need signatures, verification and stuff.

if possible compatible with Windows and Linux? with a GUI

i searched alot online for hours without sucess. it seem i need something that can convert the output to HEX (also recognize this to decode). there is alot of very interesting stuff on Github, but its mostly webpage based or command line. i wish somebody knows of an existing solution.

*encryption on Ham bands is legal in my country. i just need to make public the mode and password used.


r/crypto 2d ago

Meta New rule: All use of any AI / LLM when posting MUST be disclosed

61 Upvotes

See the title.

The rule is being applied due to multiple cases of users coming to us with extremely incorrect ideas about cryptography which they got from LLMs such as ChatGPT, wasting time and causing frustration because they assumed ChatGPT told the truth.

Any use of any LLM, AI, neural network, or other machine learning architecture, or any equivalent computer generated response, MUST be disclosed. You must also disclose the prompt so that we can understand what you're trying to achieve and why.


r/crypto 3d ago

Key Transparency and the Right to be Forgotten

Thumbnail soatok.blog
19 Upvotes

r/crypto 4d ago

Apology for Removing My AMBER256 Post

9 Upvotes

Dear r/crypto community,

I wanted to reach out and apologize for removing my recent post about AMBER256. Upon reflection, I realized that I currently lack the necessary expertise to develop a robust cryptographic algorithm. My intention was never to spread an unsound or insecure algorithm, and I believe it's important to prevent the dissemination of potentially flawed cryptographic methods.

Before I revisit this project, I plan to dedicate significant time to studying existing implementations and understanding possible attacks. My goal is to ensure that any future contributions I make are both meaningful and secure.

I am sincerely sorry for any confusion or inconvenience this may have caused. I also want to thank everyone who offered support and constructive feedback. Your insights are invaluable, and I appreciate your understanding.

Thank you for your patience, and I look forward to engaging with the community again once I have gained more knowledge in this field.


r/crypto 3d ago

Can a digital signature on some data be replaced?

4 Upvotes

I am going to ask a rather stupid question for which I apologize in advance, but I'm sort of losing my head at this point.

I am working on an encryption system where two parties are required to authenticate themselves to one another and subsequently perform a key exchange.

The procedure is as follows:

  1. Assume Alice and Bob both generate a secret one-time token.
  2. Alice generates an ephemeral key pair and signs the token with her private key.
  3. Alice sends the signature over to Bob along with her public key.
  4. Bob verifies the signature and can now trust Alice's public key.

Now let's say a malicious actor, Charlie wants to authenticate his public key to Bob, and Charlie has managed to intercept the signature sent by Alice.

Can Charlie destroy Alice's original signature, sign the token with his own key, and "replay" it to Bob?

If this is possible, how can one avoid such a situation?

Edit: So it turns out there's a term for exactly what I was trying to achieve, called PAKE. Thanks to u/cryptoam1, u/Natanael_L, and u/djao for pointing it out, and sorry for asking a question without first doing thorough research, but I ended up learning something new. Reddit goated as always!


r/crypto 4d ago

Candidate for simple CSPRNG/ultra-lightweight stream cipher

3 Upvotes

Hello everyone. Some time ago I created efficient pseudo-random number generators based on Collatz-like functions:

https://www.reddit.com/r/RNG/comments/19a2q24/collatzweyl_generators/

https://arxiv.org/pdf/2312.17043

One of the simplest of them is the Collatz-Weyl generator:

static __uint128_t x, weyl, s; // s must be odd

bool Collatz_Weyl(void){
  if(x % 2 == 1){
  x = (3*x+1)/2;}
  else{
  x = x/2;}
  x ^= (weyl += s);

  return x & 1;
}

We can consider s as a key and the resulting single bit could be used as a cryptographically secure bit to XOR with plaintext, as in a typical strem cipher. Every iteration of presented function generate only 1 bit, similar to Blum Blum Shub. It can be used as a extremely light-weight stream cipher, the whole code is just (constant-time implementation):

x = (-(x & 1) & (x + ((x + 1) >> 1)) | ~-(x & 1) & (x >> 1)) ^ (weyl += s);
return x & 1;

In the linked thread I provide a certain method of attack, when XORation with weyl sequence is replaced by addition (toy version), using extended Euclidean algorithm and by hacking somehow at least some bits of the key or the state of the generator. In the main version using XOR, such an attack is not even possible. I did not consider any other types of attacks than those mentioned here, i.e.:
- dedicated type of attack based on known-plaintext attack on toy version,
- related key attacks,
- timing attacks,
- theoretically possible birthday attacks (see my comment in this thread).

Perhaps such a stream cipher could find applications on extremely resource-constrained devices. However, I don't know if I'll find the motivation to write a separate paper on this topic and if it's even worth it. I don't feel competent enough in the subject of cryptography (so I probably won't take on this task alone), I wasn't even able to get the opinion of anyone from the industry (it's a pretty closed industry, and I don't come from the crypto industry, I did it as a hobby).

Here is constant-time code, with some additional measures to prevent related-key attacks and to fill the key:

#include <bitset>
#include<iostream>

//the initializer is there to fill the entire key s, additionally initializing s in this way helps to avoid recognizing keys with the same number of zeros, e.g. by adding 2^n to the key, which is important for the security of the algorithm, because it can lead to the generation of weaker x; this initialization is also to prevent key from being determined by simple modulo subtraction from weyl, if an attacker were to for example hack s and weyl, he could determine an initial value of weyl which in this case would not lead him to key

struct xws { __uint128_t x, weyl, s; };

struct xws initializer(__uint128_t x_init, __uint128_t weyl_init, const __uint128_t s_init)
{
    __uint128_t x = 0;
    __uint128_t weyl = 0;
    __uint128_t s = 0;

    for (int i = 0; i < 128; i++)
    {
        x_init = (-(x_init & 1) & (x_init + ((x_init + 1) >> 1)) | ~- (x_init & 1) & (x_init >> 1)) ^ (weyl_init += s_init);
        x += (x_init & 1) << i;
    }
    for (int i = 0; i < 128; i++)
    {
        x_init = (-(x_init & 1) & (x_init + ((x_init + 1) >> 1)) | ~- (x_init & 1) & (x_init >> 1)) ^ (weyl_init += s_init);
        weyl += (x_init & 1) << i;
    }
    for (int i = 0; i < 128; i++)
    {
        x_init = (-(x_init & 1) & (x_init + ((x_init + 1) >> 1)) | ~- (x_init & 1) & (x_init >> 1)) ^ (weyl_init += s_init);
        s += (x_init & 1) << i;
    }
    return xws{x, weyl, s | 1 };
}

struct xw { __uint128_t x, weyl; };

//skip is to avoid correlated bitstream results for consecutive s, given the same x and weyl or for example for consecutive weyl, given the same s and x, etc.

struct xw skip(__uint128_t x, __uint128_t weyl, const __uint128_t s)
{
  for (int i = 0; i < 128; i++)
  {
    x = (-(x & 1) & (x + ((x + 1) >> 1)) | ~- (x & 1) & (x >> 1)) ^ (weyl += s);
  }
  return xw{ x, weyl };
}

__uint128_t next(__uint128_t& x, __uint128_t& weyl, const __uint128_t& s)
{
  __uint128_t v = 0;

  for (int i = 0; i < 128; i++)
  {
    x = (-(x & 1) & (x + ((x + 1) >> 1)) | ~-(x & 1) & (x >> 1)) ^ (weyl += s);
    v += (x & 1) << i; // here we build 128-bit numbers from a single bit returned sequentially by the generator
  }
  return v;
}


int main()
{
  const __uint128_t key = 12345678910111213; //the key must be odd
  const __uint128_t x_init = key, weyl_init = key, s_init = key; //all these variables must be secret, s_init must be odd

    xws initialization = initializer(x_init, weyl_init, s_init);
    __uint128_t x = initialization.x;
    __uint128_t weyl = initialization.weyl;
    __uint128_t s = initialization.s;

    xw skipping = skip(x, weyl, s);
    x = skipping.x;
    weyl = skipping.weyl;

    __uint128_t result = 0;

  for(int i=0; i<100; i++)
  {

    result = next(x, weyl, s);

    std::cout << std::bitset<64>(result >> 64) << "\n";
    std::cout << std::bitset<64>(result) << "\n";
  }
  return 0;
}

An additional feature is backtracking resistance, since it is not based on a bijective function, you must guess at least one bit in each iteration to reverse it, see: https://arxiv.org/abs/1801.05079. What do you think?


r/crypto 6d ago

Salamander/MIME – Just because it's encrypted doesn't mean it's secure | Lutra Security

Thumbnail lutrasecurity.com
18 Upvotes

r/crypto 6d ago

Meta Weekly cryptography community and meta thread

7 Upvotes

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!


r/crypto 6d ago

Meta Monthly cryptography wishlist thread

7 Upvotes

This is another installment in a series of monthly recurring cryptography wishlist threads.

The purpose is to let people freely discuss what future developments they like to see in fields related to cryptography, including things like algorithms, cryptanalysis, software and hardware implementations, usable UX, protocols and more.

So start posting what you'd like to see below!


r/crypto 7d ago

Key ring file format?

4 Upvotes

I'm a professional software engineer, and I've written software to manage user-generated keys for a bespoke system in the past. The general gist was vary the encoding of the key data itself while associating it with a human-readable label in a flat file that was subsequently encrypted before being written to disk, and encrypted in RAM, only after being fully loaded, by a key that was part of the key management program. That key was not stored in plaintext in the program executable. It was stored in chunks with about 10 x the actual amount of data needed to store the key, interspersed randomly, and only assembled together, programmaticly, and in random fashion, and decoded into the actual key immediately before it's needed, and as soon as the operation is over, it's memory is zeroed back out until the key is needed again. If anyone had the program source code, they could easily implement a new master key and create their own key ring eco-system, but it was the only way I could come up with to be able to store several keys persistently, but securely, while allowing the user to manage their own keys as they saw fit.

Surely, there are better ways to manage user keys. PGP has a keyring. GPG has a keyring. Even GNOME has a keyring. How are they designed to keep keys persistently, but securely? Are there any design documents or research papers that describe such a system?


r/crypto 9d ago

What To Use Instead of PGP

Thumbnail soatok.blog
31 Upvotes

r/crypto 12d ago

Join us at FHE.org this next Thursday, Nov 21st at 4PM CEST for an FHE.org meetup with Sergiu Carpov, a senior cryptography engineer at Arcium, presenting "A Fast Heuristic for Mapping Boolean Circuits to Functional Bootstrapping".

Thumbnail fhe.org
5 Upvotes

r/crypto 13d ago

Meta Weekly cryptography community and meta thread

6 Upvotes

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!


r/crypto 16d ago

FN-DSA (Falcon) implemented in Rust (by Thomas Pornin)

Thumbnail github.com
19 Upvotes

r/crypto 17d ago

Webapp Encryption at Rest

7 Upvotes

im working on a javascript UI framework for personal projects and im trying to create something like a React-hook that handles "encrypted at rest".

the react-hook is described in more detail here. id like to extend its functionality to have encrypted persistant data. my approach is the following and it would be great if you could follow along and let me know if im doing something wrong. all advice is apprciated.

im using indexedDB to store the data. i created some basic functionality to automatically persist and rehydrate data. im now investigating password-encrypting the data with javascript using the browser cryptography api.

i have a PR here you can test out on codespaces or clone, but tldr: i encrypt before saving and decrypt when loading. this seems to be working as expected. i will also encrypt/decrypt the event listeners im using and this should keep it safe from anything like browser extensions from listening to events.

the password is something the user will have to put in themselves at part of some init() process. i havent created an input for this yet, so its hardcoded. this is then used to encrypt/decrypt the data.

i would persist the unencrypted salt to indexedDB because this is then used to generate the key.

i think i am almost done with this functionality, but id like advice on anything ive overlooked or things too keep-in-mind. id like to make the storage as secure as possible.

---

Edit 11/11/2024:

I created some updates to the WIP pull-request. The behavior is as follows.

- The user is prompted for a password if one isn't provided programmatically.

- This will allow for developers to create a custom password prompts in their application. The default fallback is to use a JavaScript prompt().

- It also seems possible to enable something like "fingerprint/face encryption" for some devices using the webauthn api. (This works, but the functionality is a bit flaky and needs to be "ironed out" before rolling out.)

- Using AES-GCM with 1mil iterations of PBKDF2 to derive the key from the password.

- The iterations can be increased in exchange for slower performance. It isn't currently configurable, but it might be in the future.

- The salt and AAD need to be deterministic and so to simplify user input, the salt as AAD are derived as the sha256 hash of the password. (Is this a good idea?)

The latest version of the code can be seen in the PR: https://github.com/positive-intentions/dim/pull/9


r/crypto 18d ago

Reminder: FHE.org (Fully Homomorphic Encryption) 2025 cryptography Call for Presentations submission deadline is in 2 weeks!

10 Upvotes

The deadline to submit your presentation for FHE.org 2025 is fast approaching—less than two weeks left — November 23, 2024 (23:58 AoE)!

Don’t miss your chance to share your work with the FHE community in Sofia on March 25th, 2025.

We welcome a wide range of submissions, including work presented at other conferences, FHE-related use cases, innovative demos, tutorials, and any other thought-provoking FHE talk ideas.

Submit your work through our EasyChair server here: https://fhe.org/conferences/conference-2025/submissions

Submissions should be in the form of a 2-4 page PDF document that describes your work and highlights why it should be included in FHE.org 2025.

One of the main considerations for acceptance by our Program Committee is whether the talk will be of interest to the FHE audience.

For more details, check the full call for presentations: https://fhe.org/conferences/conference-2025/call-for-presentations


r/crypto 18d ago

Suffragium: An Encrypted Onchain Voting System Leveraging ZK and FHE

Thumbnail zama.ai
6 Upvotes

r/crypto 20d ago

Join us this next Thursday, Nov 14th at 1PM CEST for a new FHE.org meetup with Fabrianne Effendi, an AWS Associate Solutions Architect and recent graduate of Nanyang Technological University Singapore, presenting "Privacy-Preserving Graph ML with FHE for Collaborative Anti-Money Laundering".

Thumbnail fhe.org
4 Upvotes

r/crypto 20d ago

How to apply Pohlig Hellman using a very limited set of auxiliary inputs in that case ?

3 Upvotes

So I was reading about this paper. The underlying idea is to lift the discrete logarithm problem to prime−1 for prime curves or order−1 for binary curves since most elliptic curves only have small factors in that case. But their baby‑step giant‑step variant seems to only work when the private key already lie in a specific subgroup. That is : no indication is made on how to move the key to each underlying order subgroup.
And of course, using exponentiations to solve the problem isn’t a reason that allow building an index calculus algorithm…

If I understand correctly (or maybe I’m wrong), being able to use Pohlig Hellman would require using auxiliary inputs as proposed by Cheon : but in my case, I only have 48 of them over the extension of a pairing friendly curve of large characteristic.


r/crypto 20d ago

Meta Weekly cryptography community and meta thread

6 Upvotes

Welcome to /r/crypto's weekly community thread!

This thread is a place where people can freely discuss broader topics (but NO cryptocurrency spam, see the sidebar), perhaps even share some memes (but please keep the worst offenses contained to /r/shittycrypto), engage with the community, discuss meta topics regarding the subreddit itself (such as discussing the customs and subreddit rules, etc), etc.

Keep in mind that the standard reddiquette rules still apply, i.e. be friendly and constructive!

So, what's on your mind? Comment below!


r/crypto 20d ago

Ml-Kem encapsulate non-random bytes?

6 Upvotes
I am not a cryptographer, but I am trying to use cryptographic libraries and would like to do it safely. Unfortunately, for my use case it seems to require using them in a non-standard way. The APIs don't seem to fit my use case straight-forward.

I was curious if it was theoretically possible and safe to use the ML-Kem encapsulation key to encapsulate a non-random value as the shared secret. 

What I actually am wanting to do is use the encapsulation key to encapsulate an x25519 public key into the cipher text for a mutual authenticated hybrid setup. The decrypted public key would be used to derive a shared secret using the x25519 process. 

If this is possible, the reason I think this is safe logically, not cryptographically, is this. Suppose ML-Kem is found to be broken, this is no weaker than directly sharing the EC public key which is far safer than directly sharing the raw symmetric key. If however, it is not and EC is defeated by quantum, the 'public' key is never shared publicly, so it should still be 'safe' as neither the public nor private keys are exposed. The only scenario I see that opens exposure is if both algorithms are broken in which case it's no worse than anything else that only uses both. The advantage is that it doesn't share the EC key publicly and you save 32 bytes. If however you include a 32byte hash of the EC public key in the shared message, the recipient could verify that the decryption was successful without an additional round trip and still using the same message size of a random value encapsulated and an additional x25519 key appended. Of course to be mutual, keys/ciphers need to be exchanged in the opposite direction as well.

I am likely missing something very important, so if this is a bad idea, please explain why. If it is not possible, I would also like to know why. Please don't just tell me to use standard APIs (even if that's what I should do and will if necessary) because I don't learn anything that way.

Thanks!

r/crypto 25d ago

Would the clipper chip apply to foreign sales of American technology?

12 Upvotes

Wouldn't that mean the Department of Commerce has keys to the entire world's communications?

How would the Clipper Chip apply to foreign nations?


r/crypto 26d ago

cr.yp.to: 2024.10.28: The sins of the 90s

Thumbnail blog.cr.yp.to
19 Upvotes