标签： CIS 455

数学代写|密码学作业代写Cryptography代考|CS655

Posted on 2023年8月8日2023年8月28日 by statistics-lab

如果你也在怎样密码学与系统安全Cryptography and System Security 这个学科遇到相关的难题，请随时右上角联系我们的24/7代写客服。密码学Cryptography也不是一门新科学，尽管有些人会说，它直到最近才被正式视为一门新科学。几个世纪以来，它一直被用来保护敏感信息，尤其是在冲突时期。

密码学与系统安全Cryptography and System Security是一门与日常生活相关的学科，它经历了巨大的变化。密码学曾经通过其历史用途在公众的想象中表现出来，主要是为了保护军事通信，以及通过娱乐谜题。然而，很大程度上由于计算机网络的发展，特别是因特网，我们大多数人现在每天都在使用密码学。

statistics-lab™ 为您的留学生涯保驾护航在代写密码学Cryptography方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学Cryptography代写方面经验极为丰富，各种代写密码学Cryptography相关的作业也就用不着说。

数学代写|密码学作业代写Cryptography代考|Comparison of freshness mechanisms

Choosing an appropriate freshness mechanism is application dependent. The appropriate mechanism depends on which of the various problems can best be overcome in the environment in which they will be deployed. Table 8.2 contains a simplified summary of the main differences between the three types of freshness mechanism we have discussed.
Table 8.2: Summary of properties of freshness mechanisms.

Note that there are other differences which might be influential in selecting a suitable freshness mechanism for an application. For example, sequence numbers and nonces are not, by definition, bound to a notion of clock-based time. Hence, if using these mechanisms in an application requiring a notion of ‘timeliness’ (for example, for entity authentication), then they require a degree of management. For sequence numbers, this management involves monitoring the time periods between received sequence numbers. For nonces, it involves monitoring the delay between sending and receiving the nonce.

数学代写|密码学作业代写Cryptography代考|Fundamentals of entity authentication

Recall from Section 1.3.1 that entity authentication is the assurance a given entity is involved and currently active in a communication session. This means entity authentication really involves assurance of both:
Identity. The identity of the entity who is making a claim to be authenticated.
Freshness. The claimed entity is ‘alive’ and involved in the current session.
If we fail to assure ourselves of identity, then we cannot be certain whom we are trying to authenticate. If we fail to assure ourselves of freshness, then we could be exposed to replay attacks, where an attacker captures information used during an entity authentication session and replays it at a later date in order to falsely pass themselves off as the entity whose information they ‘stole’.

The word entity is itself problematic. We will avoid philosophical questions and not propose any formal definition, other than to comment that an ‘entity’ in the subsequent discussion could be a human user, a device, or even some data. To appreciate the problems of defining a rigorous notion of an ‘entity’, consider the following question: when someone types their password into a computer, then is the entity being authenticated the person, or their password? This essentially relates to the same ‘human-computer gap’ we commented on when discussing digital signatures in Section 7.4.3.

If entity authentication is only used to provide assurance of the identity of one entity to another (and not vice versa), then we refer to it as unilateral entity authentication. If both communicating entities provide each other with assurance of their identity, then we call this mutual entity authentication. For example, when someone presents their card and PIN at an ATM, then they are engaging in unilateral entity authentication to the bank. The bank does not authenticate itself to the customer. Indeed, this ‘weakness’ of ATM authentication has been regularly exploited by attackers who present fake ATMs to bank customers in order to harvest their card details and PINs. If the entity authentication process had been mutual, then the customer would have been able to reject the bank. In fact, ATMs attempt to weakly authenticate themselves simply by ‘looking like’ genuine ATMs, but a determined attacker can easily make something that defeats this by also ‘looking like’ a real ATM.

密码学代写

数学代写|密码学作业代写Cryptography代考|Comparison of freshness mechanisms

选择合适的新鲜度机制取决于应用程序。适当的机制取决于在部署这些问题的环境中，哪些问题能够得到最好的解决。表8.2对我们讨论过的三种新鲜度机制之间的主要区别做了一个简单的总结。
表8.2:保鲜机制的性质总结。

请注意，在为应用程序选择合适的新鲜度机制时，还有其他可能会产生影响的差异。例如，根据定义，序列号和随机数并不绑定到基于时钟的时间概念。因此，如果在需要“及时性”概念的应用程序中使用这些机制(例如，用于实体身份验证)，那么它们就需要一定程度的管理。对于序列号，这种管理包括监视接收序列号之间的时间周期。对于随机数，它涉及监视发送和接收随机数之间的延迟。

数学代写|密码学作业代写Cryptography代考|Fundamentals of entity authentication

回想一下第1.3.1节，实体身份验证是确保一个给定的实体参与到一个通信会话中并且当前处于活动状态。这意味着实体身份验证实际上涉及两个方面的保证:
的身份。提出身份验证声明的实体的身份。
新鲜。声明的实体是“活的”，并参与当前会话。
如果我们不能确定自己的身份，那么我们就不能确定我们要验证的是谁。如果我们不能保证自己的新鲜度，那么我们可能会暴露于重放攻击，攻击者捕获在实体认证会话期间使用的信息，并在稍后的日期重放它，以便错误地将自己作为他们“窃取”信息的实体。

实体这个词本身就有问题。我们将避免哲学问题，也不会提出任何正式的定义，除了在随后的讨论中评论一个“实体”可以是一个人类用户，一个设备，甚至一些数据。要理解定义“实体”的严格概念的问题，请考虑以下问题:当某人在计算机中输入密码时，被认证的实体是人，还是他们的密码?这本质上与我们在第7.4.3节讨论数字签名时评论的“人机差距”有关。

如果实体身份验证仅用于向另一个实体提供身份保证(而不是相反)，那么我们将其称为单边实体身份验证。如果两个通信实体相互提供其身份的保证，那么我们称之为相互实体身份验证。例如，当有人在自动取款机上出示他们的卡和密码时，他们就在向银行进行单方面的实体认证。银行不向客户证明自己的身份。事实上，攻击者经常利用ATM机身份验证的这个“弱点”，向银行客户提供假ATM机，以获取他们的信用卡详细信息和密码。如果实体身份验证过程是相互的，那么客户将能够拒绝银行。事实上，ATM机只是试图通过“看起来像”真正的ATM机来弱地验证自己，但是一个有决心的攻击者可以很容易地通过“看起来像”真正的ATM机来挫败这一点。

数学代写|密码学作业代写Cryptography代考请认准statistics-lab™

统计代写请认准statistics-lab™. statistics-lab™为您的留学生涯保驾护航。

金融工程代写

金融工程是使用数学技术来解决金融问题。金融工程使用计算机科学、统计学、经济学和应用数学领域的工具和知识来解决当前的金融问题，以及设计新的和创新的金融产品。

非参数统计代写

非参数统计指的是一种统计方法，其中不假设数据来自于由少数参数决定的规定模型；这种模型的例子包括正态分布模型和线性回归模型。

广义线性模型代考

广义线性模型（GLM）归属统计学领域，是一种应用灵活的线性回归模型。该模型允许因变量的偏差分布有除了正态分布之外的其它分布。

术语广义线性模型（GLM）通常是指给定连续和/或分类预测因素的连续响应变量的常规线性回归模型。它包括多元线性回归，以及方差分析和方差分析（仅含固定效应）。

有限元方法代写

有限元方法（FEM）是一种流行的方法，用于数值解决工程和数学建模中出现的微分方程。典型的问题领域包括结构分析、传热、流体流动、质量运输和电磁势等传统领域。

有限元是一种通用的数值方法，用于解决两个或三个空间变量的偏微分方程（即一些边界值问题）。为了解决一个问题，有限元将一个大系统细分为更小、更简单的部分，称为有限元。这是通过在空间维度上的特定空间离散化来实现的，它是通过构建对象的网格来实现的：用于求解的数值域，它有有限数量的点。边界值问题的有限元方法表述最终导致一个代数方程组。该方法在域上对未知函数进行逼近。[1] 然后将模拟这些有限元的简单方程组合成一个更大的方程系统，以模拟整个问题。然后，有限元通过变化微积分使相关的误差函数最小化来逼近一个解决方案。

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

随机分析代写

随机微积分是数学的一个分支，对随机过程进行操作。它允许为随机过程的积分定义一个关于随机过程的一致的积分理论。这个领域是由日本数学家伊藤清在第二次世界大战期间创建并开始的。

时间序列分析代写

随机过程，是依赖于参数的一组随机变量的全体，参数通常是时间。随机变量是随机现象的数量表现，其时间序列是一组按照时间发生先后顺序进行排列的数据点序列。通常一组时间序列的时间间隔为一恒定值（如1秒，5分钟，12小时，7天，1年），因此时间序列可以作为离散时间数据进行分析处理。研究时间序列数据的意义在于现实中，往往需要研究某个事物其随时间发展变化的规律。这就需要通过研究该事物过去发展的历史记录，以得到其自身发展的规律。

回归分析代写

多元回归分析渐进（Multiple Regression Analysis Asymptotics）属于计量经济学领域，主要是一种数学上的统计分析方法，可以分析复杂情况下各影响因素的数学关系，在自然科学、社会和经济学等多个领域内应用广泛。

MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习和应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。

R语言代写	问卷设计与分析代写
PYTHON代写	回归分析与线性模型代写
MATLAB代写	方差分析与试验设计代写
STATA代写	机器学习/统计学习代写
SPSS代写	计量经济学代写
EVIEWS代写	时间序列分析代写
EXCEL代写	深度学习代写
SQL代写	各种数据建模与可视化代写

数学代写|密码学作业代写Cryptography代考|CPSC418

Posted on 2023年8月8日2023年8月8日 by statistics-lab

数学代写|密码学作业代写Cryptography代考|Non-deterministic generators

There are two general approaches to generating randomness. First, we will look at non-deterministic generation, which relies on unpredictable sources in the physical world. This is a compelling, but often expensive, approach to producing randomness. On the other hand, there are many situations where we are willing to compromise and use a ‘cheaper’ source of randomness. In this case, deterministic generation techniques, which we examine in Section 8.1.4, can be adopted.

A non-deterministic generator is based on the randomness produced by physical phenomena and therefore provides a source of ‘true randomness’ in the sense that the source is very hard to control and replicate. Non-deterministic generators can be based on hardware or software.
HARDWARE-BASED NON-DETERMINISTIC GENERATORS
Hardware-based non-deterministic generators rely on the randomness of physical phenomena. Generators of this type require specialist hardware. Generally speaking, these are the best sources of ‘true’ randomness. Examples include:

measurement of the time intervals involved in radioactive decay of a nuclear atom;
semiconductor thermal (Johnson) noise, which is generated by the thermal motion of electrons;
instability measurements of free running oscillators;
white noise emitted by electrical appliances; and
quantum measurements of single photons reflected into a mirror.
Hardware-based generators provide a continuous supply of randomly generated output for as long as the power required to run the generator lasts, or until the process ceases to produce output. However, because specialist hardware is required, these types of generator are relatively expensive. In some cases, the randomly generated output is produced too slowly to be of much practical use.

数学代写|密码学作业代写Cryptography代考|Deterministic generators

The idea of a deterministic random generator may sound like an oxymoron, since anything which can be determined cannot be truly random. The term pseudorandom (which we introduced in Section 4.2.1) is often used to describe both a deterministic generator and its output.
BASIC MODEL OF ADETERMINISTIC GENERATOR
A deterministic generator is an algorithm which outputs a pseudorandom bit string, in other words a bit string with no apparent structure. However, as we just hinted, the output of a deterministic generator is certainly not randomly generated. In fact, anyone who knows the information that is input to the deterministic generator can completely predict the output. Each time the algorithm is run using the same input, the same output will be produced. Such predictability is, in at least one sense, the opposite of randomness.

However, if we use a secret input into the deterministic generator, then, with careful design of the generation process, we might be able to generate output that will have no apparent structure. It will thus appear to have been randomly generated to anyone who does not know the secret input. This is precisely the idea behind a deterministic generator. The basic model of a deterministic generator is shown in Figure 8.1.

密码学代写

数学代写|密码学作业代写Cryptography代考|Non-deterministic generators

产生随机性的一般方法有两种。首先，我们将看看非确定性生成，它依赖于物理世界中不可预测的来源。这是一种引人注目但代价高昂的创造随机性的方法。另一方面，在许多情况下，我们愿意妥协并使用“更便宜”的随机性来源。在这种情况下，可以采用我们将在第8.1.4节中介绍的确定性生成技术。

非确定性生成器基于物理现象产生的随机性，因此提供了“真正随机性”的来源，因为该来源很难控制和复制。非确定性生成器可以基于硬件或软件。
基于硬件的非确定性生成器
基于硬件的非确定性生成器依赖于物理现象的随机性。这种类型的生成器需要专门的硬件。一般来说，这些都是“真正的”随机性的最佳来源。例子包括:

放射性衰变:对原子核放射性衰变时间间隔的测量;

半导体热(约翰逊)噪声，由电子的热运动产生;

自由运行振荡器的不稳定性测量;

电器发出的白噪音;和

对反射到镜子中的单个光子的量子测量。
基于硬件的发电机提供随机生成的连续输出，只要运行发电机所需的功率持续，或者直到过程停止产生输出。然而，由于需要专业的硬件，这些类型的发电机相对昂贵。在某些情况下，随机生成的输出产生得太慢，没有多少实际用途。

数学代写|密码学作业代写Cryptography代考|Deterministic generators

确定性随机生成器的想法可能听起来像是一种矛盾修饰法，因为任何可以确定的东西都不可能是真正随机的。伪随机这个术语(我们在4.2.1节中介绍过)通常用来描述确定性生成器和它的输出。
确定性发电机的基本模型
确定性生成器是一种输出伪随机位串的算法，换句话说，是一个没有明显结构的位串。然而，正如我们刚才所暗示的，确定性生成器的输出肯定不是随机生成的。事实上，任何知道确定性生成器的输入信息的人都可以完全预测输出。每次使用相同的输入运行算法时，都会产生相同的输出。至少在某种意义上，这种可预测性是随机性的对立面。

然而，如果我们在确定性生成器中使用秘密输入，那么，通过仔细设计生成过程，我们可能能够生成没有明显结构的输出。因此，对于不知道秘密输入的任何人来说，它似乎是随机生成的。这正是确定性生成器背后的思想。确定性发电机的基本模型如图8.1所示。

统计代写请认准statistics-lab™. statistics-lab™为您的留学生涯保驾护航。

金融工程代写

非参数统计代写

非参数统计指的是一种统计方法，其中不假设数据来自于由少数参数决定的规定模型；这种模型的例子包括正态分布模型和线性回归模型。

广义线性模型代考

广义线性模型（GLM）归属统计学领域，是一种应用灵活的线性回归模型。该模型允许因变量的偏差分布有除了正态分布之外的其它分布。

有限元方法代写

随机分析代写

时间序列分析代写

回归分析代写

MATLAB代写

R语言代写	问卷设计与分析代写
PYTHON代写	回归分析与线性模型代写
MATLAB代写	方差分析与试验设计代写
STATA代写	机器学习/统计学习代写
SPSS代写	计量经济学代写
EVIEWS代写	时间序列分析代写
EXCEL代写	深度学习代写
SQL代写	各种数据建模与可视化代写

数学代写|密码学作业代写Cryptography代考|CSE208

Posted on 2023年7月25日2023年8月25日 by statistics-lab

数学代写|密码学作业代写Cryptography代考|Security of digital signature schemes

We assume we are using a respected digital signature scheme and the platform on which the digital signature scheme is being used is ‘trustworthy’. There are three cryptographic components of a digital signature scheme that could be exploited by an attacker.
SECURITY OF THE SIGNATURE KEY
We noted in Section 7.1.3 that in order for a user to generate a digital signature on some data, it is necessary for the user to have knowledge of a secret, which takes the form of the user’s signature key. The signature key is thus, in some sense, an implied ‘identity’ of the signer. To compute a digital signature, the signer combines this ‘identity’ with the data to be signed using the digital signature algorithm.

The two security services provided by a digital signature scheme both rely on the assumption that only the signer knows the signature key. If evidence is found that a particular signature key was used to create a digital signature (successful verification of the digital signature is sufficient evidence), then it is assumed the owner of this signature key must have created the digital signature. More precisely, this provides:

Data origin authentication of the signer, since the ability to create a valid digital signature demonstrates that the originator of the signed data must have known the signature key; and

Non-repudiation, since it is assumed the only user with knowledge of the signature key is the signer, thus allowing the digital signature to be presented to a third party as evidence the data was signed by the signer.

数学代写|密码学作业代写Cryptography代考|Using digital signature schemes with encryption

Recall from Section 6.3.6 that many applications require both confidentiality and data origin authentication, which is a topic we discussed within the context of symmetric cryptography. The case for requiring both of these security services is even stronger in environments using public-key cryptography. This is because the potentially wide availability of a public encryption key makes it easy for anyone to send an encrypted message to the public key owner, without it necessarily being clear who the originator of the message was.

In many applications, it may thus be desirable to both encrypt and digitally sign some data. The main problem with trying to combine encryption and digital signatures in an application is that the two ‘obvious’ methods based on using two separate primitives have fundamental security problems. These problems are independent of the digital signature scheme used. We will assume in the following discussion that we are using a digital signature scheme with appendix.

Sign-then-encrypt. This essentially involves Alice digitally signing the data and then encrypting the data and the digital signature using Bob’s public encryption key. However, in this case a bad recipient Bob can:

decrypt and recover the data and the digital signature;
encrypt the data and the digital signature using Charlie’s public encryption key; and
send this ciphertext to Charlie, who decrypts it and verifies Alice’s digital signature.
The problem is that Charlie has received a message that is both encrypted and digitally signed (by Alice). Charlie will want to reasonably conclude this is evidence Alice was the origin of the data (which she was), and that nobody else has been able to view the data en route from Alice to Charlie. But this, as we have just seen, is certainly not the case.

密码学代写

数学代写|密码学作业代写Cryptography代考|Security of digital signature schemes

我们假设我们正在使用一个受尊敬的数字签名方案，并且使用该数字签名方案的平台是“值得信赖的”。数字签名方案中有三个加密组件可以被攻击者利用。
签名密钥的安全性
我们在7.1.3节中注意到，为了让用户对某些数据生成数字签名，用户有必要知道一个秘密，这个秘密以用户签名密钥的形式存在。因此，在某种意义上，签名密钥是签名者的隐含“身份”。为了计算数字签名，签名者将这个“身份”与要使用数字签名算法签名的数据结合起来。

数字签名方案提供的两种安全服务都依赖于只有签名者知道签名密钥的假设。如果发现有证据表明某个特定的签名密钥被用于创建数字签名(成功验证数字签名就是充分的证据)，则假定该签名密钥的所有者一定创建了数字签名。更确切地说，这提供了:

签名者的数据源认证，因为创建有效数字签名的能力表明签名数据的发起者必须知道签名密钥;和

不可否认性，因为它假定知道签名密钥的唯一用户是签名者，因此允许将数字签名作为数据由签名者签名的证据提交给第三方。

数学代写|密码学作业代写Cryptography代考|Using digital signature schemes with encryption

回想一下第6.3.6节，许多应用程序需要保密性和数据源身份验证，这是我们在对称加密上下文中讨论的主题。在使用公钥加密的环境中，更需要这两种安全服务。这是因为公共加密密钥的潜在广泛可用性使得任何人都可以轻松地向公钥所有者发送加密消息，而不必清楚消息的发起者是谁。

因此，在许多应用程序中，可能需要对某些数据进行加密和数字签名。试图在应用程序中结合加密和数字签名的主要问题是，基于使用两个独立原语的两种“明显”方法存在基本的安全问题。这些问题与所使用的数字签名方案无关。在接下来的讨论中，我们将假设我们正在使用带有附录的数字签名方案。

Sign-then-encrypt。这本质上涉及到Alice对数据进行数字签名，然后使用Bob的公共加密密钥对数据和数字签名进行加密。然而，在这种情况下，坏接收者Bob可以:

对数据和数字签名进行解密和恢复;

使用查理的公开加密密钥对数据和数字签名进行加密;和

将这个密文发送给查理，查理将其解密并验证爱丽丝的数字签名。
问题是查理收到了一条经过加密和(由爱丽丝)数字签名的消息。查理会合理地得出结论，这是证据，证明爱丽丝是数据的来源(她确实是)，并且没有其他人能够在从爱丽丝到查理的途中查看数据。但是，正如我们刚才看到的，情况肯定不是这样。

统计代写请认准statistics-lab™. statistics-lab™为您的留学生涯保驾护航。

金融工程代写

非参数统计代写

非参数统计指的是一种统计方法，其中不假设数据来自于由少数参数决定的规定模型；这种模型的例子包括正态分布模型和线性回归模型。

广义线性模型代考

广义线性模型（GLM）归属统计学领域，是一种应用灵活的线性回归模型。该模型允许因变量的偏差分布有除了正态分布之外的其它分布。

有限元方法代写

随机分析代写

时间序列分析代写

回归分析代写

MATLAB代写

R语言代写	问卷设计与分析代写
PYTHON代写	回归分析与线性模型代写
MATLAB代写	方差分析与试验设计代写
STATA代写	机器学习/统计学习代写
SPSS代写	计量经济学代写
EVIEWS代写	时间序列分析代写
EXCEL代写	深度学习代写
SQL代写	各种数据建模与可视化代写

数学代写|密码学作业代写Cryptography代考|CS255

Posted on 2023年7月25日2023年8月25日 by statistics-lab

数学代写|密码学作业代写Cryptography代考|Basic model of a digital signature scheme

We assume anyone who wishes to be able to digitally sign data is in possession of a public-key pair. Only the signer knows their ‘private’ key, and the corresponding ‘public’ key is made available to anyone by whom the signer wishes their digital signatures to be verified. This could be by making it publicly available. It is very important, however, that we do not use this key pair for decryption/encryption and signing/verifying (see Section 10.6.1). Thus, we will refer to the ‘private’ key in this case as the signature key and the ‘public’ key as the verification key. The basic model of a digital signature scheme is shown in Figure 7.2.

The signature algorithm takes as input the data being signed and the signature key. The output is the digital signature, which is then sent to the verifier. The verifier inputs the digital signature and the verification key into the verification algorithm. The verification algorithm outputs some data, which should be the same data that was digitally signed. Using this output, the verifier makes a decision on whether the digital signature is valid.

数学代写|密码学作业代写Cryptography代考|Two different approaches

There are two different approaches to designing digital signature schemes. Recall that a digital signature is essentially a cryptographic value calculated from the data and a secret parameter known only by the signer. A verifier who wishes to verify the correctness of this digital signature will need to run the verification algorithm and, from the results of this process, will need to be able to determine whether the digital signature is valid. An important question to ask is: how will the verifier know which data this digital signature matches?

This question is particularly relevant if the data being digitally signed has no apparent recognisable structure (it could, for example, be an encrypted cryptographic key). After all, the digital signature itself will hopefully not have any apparent structure since it is the output of a cryptographic algorithm. This digital signature could well have been modified by an attacker. When the verifier runs the verification algorithm, the result that is output (assuming this resembles the underlying data) will also have no apparent structure. So how will the verifier be able to determine whether the output is the correct data?
There are two different methods used to provide the verifier with this assurance.
Send the verifier the data being digitally signed. Data being digitally signed is not, by default, confidential. In many situations, it is acceptable to send the data along with the digital signature. The verifier now verifies the digital signature and is also able to see the data that was supposed to be digitally signed. Digital signature schemes using this technique are called digital signature schemes with appendix because the data is sent with the digital signature as an ‘appendix’.

Add redundancy to the data being signed. A more subtle technique is to make the data being digitally signed ‘recognisable’ by adding redundancy before computing the digital signature. In this case, it now suffices to just send the digital signature itself. On verification, the verifier will recover some data from the digital signature. If this recovered data has the correct redundancy format, then the verifier will accept this data as being correct, otherwise they will reject it. Digital signature schemes using this technique are called digital signature schemes with message recovery because the data can be ‘recovered’ from the digital signature itself.

密码学代写

数学代写|密码学作业代写Cryptography代考|Basic model of a digital signature scheme

我们假设任何希望能够对数据进行数字签名的人都拥有公钥对。只有签名者知道他们的“私钥”，而相应的“公钥”可供签名者希望验证其数字签名的任何人使用。这可以通过将其公之于众来实现。但是，很重要的一点是，我们不使用这个密钥对进行解密/加密和签名/验证(参见第10.6.1节)。因此，在这种情况下，我们将“私钥”称为签名密钥，将“公钥”称为验证密钥。数字签名方案的基本模型如图7.2所示。

签名算法以被签名的数据和签名密钥作为输入。输出是数字签名，然后将其发送给验证者。验证者将数字签名和验证密钥输入验证算法。验证算法输出一些数据，这些数据应该与经过数字签名的数据相同。使用此输出，验证者对数字签名是否有效做出决定。

数学代写|密码学作业代写Cryptography代考|Two different approaches

设计数字签名方案有两种不同的方法。回想一下，数字签名本质上是根据数据计算出的加密值和只有签名者知道的秘密参数。希望验证该数字签名正确性的验证者需要运行验证算法，并根据该过程的结果确定该数字签名是否有效。要问的一个重要问题是:验证者如何知道这个数字签名匹配哪些数据?

如果被数字签名的数据没有明显的可识别结构(例如，它可能是一个加密的加密密钥)，那么这个问题就特别相关。毕竟，数字签名本身希望没有任何明显的结构，因为它是加密算法的输出。这个数字签名很可能被攻击者修改过。当验证者运行验证算法时，输出的结果(假设它类似于底层数据)也将没有明显的结构。那么验证者如何能够确定输出是否是正确的数据呢?
有两种不同的方法用于向验证者提供这种保证。
向验证者发送正在进行数字签名的数据。默认情况下，被数字签名的数据不是机密的。在许多情况下，将数据与数字签名一起发送是可以接受的。验证者现在验证数字签名，并且还能够看到应该进行数字签名的数据。使用这种技术的数字签名方案被称为带附录的数字签名方案，因为数据是作为“附录”与数字签名一起发送的。

为正在签名的数据添加冗余。一种更微妙的技术是在计算数字签名之前通过添加冗余来使数字签名的数据“可识别”。在这种情况下，现在只需发送数字签名本身就足够了。在验证时，验证者将从数字签名中恢复一些数据。如果恢复的数据具有正确的冗余格式，那么验证器将接受该数据，认为它是正确的，否则将拒绝它。使用这种技术的数字签名方案被称为带消息恢复的数字签名方案，因为数据可以从数字签名本身“恢复”。

统计代写请认准statistics-lab™. statistics-lab™为您的留学生涯保驾护航。

金融工程代写

非参数统计代写

非参数统计指的是一种统计方法，其中不假设数据来自于由少数参数决定的规定模型；这种模型的例子包括正态分布模型和线性回归模型。

广义线性模型代考

广义线性模型（GLM）归属统计学领域，是一种应用灵活的线性回归模型。该模型允许因变量的偏差分布有除了正态分布之外的其它分布。

有限元方法代写

随机分析代写

时间序列分析代写

回归分析代写

MATLAB代写

R语言代写	问卷设计与分析代写
PYTHON代写	回归分析与线性模型代写
MATLAB代写	方差分析与试验设计代写
STATA代写	机器学习/统计学习代写
SPSS代写	计量经济学代写
EVIEWS代写	时间序列分析代写
EXCEL代写	深度学习代写
SQL代写	各种数据建模与可视化代写

数学代写|密码学作业代写Cryptography代考|CS346

Posted on 2023年7月25日2023年8月25日 by statistics-lab

数学代写|密码学作业代写Cryptography代考|CBC-MAC

The most well-known examples of MAC algorithms are based on either using a block cipher or a hash function as a ‘building block’. We will look at one example of each technique, beginning with block ciphers.

The first MAC design we describe will hopefully look familiar. This MAC is commonly referred to as $C B C-M A C$ and is based on a block cipher. An early banking standard defined CBC-MAC using DES, so the MAC operated on blocks of 64 bits. We present the CBC-MAC construction in a more general form. Any block cipher, such as AES, could be used.
COMPUTING CBC-MAC
We assume the sender and receiver have both agreed in advance upon a symmetric key $K$. We also assume the message $M$ has been split into blocks of the same length as the block length of the block cipher (64 bits for DES or 128 bits for AES) in order to process it. In Figure 6.8, these blocks are labelled $M_1, M_2, \ldots, M_n$. If the message does not fit neatly into blocks, then we pad the last block (see Section 4.3.2).

As illustrated in Figure 6.8, the sender computes the MAC as follows:

Take the first message block $M_1$, and encrypt it (using the block cipher) with the key $K$ to obtain $C_1$.
XOR $C_1$ to the second message block $M_2$, and encrypt the result with the key $K$ to obtain $C_2$.
Repeat this process until the second-last ciphertext block $C_{n-1}$ has been XORed to the last message block $M_n$, and the result encrypted with key $K$ to obtain $C_n$.
Send the message $M_1, M_2, \ldots, M_n$ to the receiver, accompanied by the last ciphertext block $C_n$. This last ciphertext block $C_n$ is the MAC, which we denote $\operatorname{MAC}_K(M)$.

数学代写|密码学作业代写Cryptography代考|HMAC

We will now briefly look at another well-known and widely deployed MAC, this time based on a hash function. Our discussion in Section 6.3.2 should hopefully have made it clear that a very natural way to design a MAC might be to start with a hash function and then somehow build in the use of a key. This is precisely the idea behind the Hash-based Message Authentication Code (HMAC). This type of MAC can, at least in theory, be constructed from any cryptographic hash function. Thus, it is common to see HMAC more precisely being referred to as, for example, HMAC-MD5, where the suffix identifies the name of the underlying hash function.

The design of HMAC is very simple. Let $h$ be a hash function, and let $K_1$ and $K_2$ be two symmetric keys. Then the MAC on message $M$ is computed as follows:

compute the hash of $K_2$ concatenated (see Section 1.6.1) with the message; in other words compute $h\left(K_2 | M\right)$; and
compute the hash of $K_1$ concatenated with the output of step 1 ; in other words compute:
$$
h\left(K_1 | h\left(K_2 | M\right)\right) .
$$
Thus, computing the MAC involves two applications of the underlying hash function, first to $K_2$ and the message, and then to $K_1$ and the first hash output. HMAC is simple and fast to implement. So what is the catch?

In some sense there is no catch; however, it is important to recognise that the security of HMAC depends on three separate factors:

The security of the keys. HMAC employs two symmetric keys. Thus, the length of an HMAC key can be regarded as the sum of the lengths of these two keys.

The security of the hash function. HMAC’s security depends on the security of the underlying hash function. Thus, it should be deployed using hash functions which have been approved for use in HMAC by recognised experts.

The length of the MAC output. Just as we discussed in Section 6.3.3, it is possible to use just part of the HMAC output as the actual MAC, but reducing its length will reduce security.

密码学代写

数学代写|密码学作业代写Cryptography代考|CBC-MAC

MAC算法中最著名的例子是使用分组密码或哈希函数作为“构建块”。我们将从分组密码开始，查看每种技术的一个示例。

希望我们描述的第一个MAC设计看起来很熟悉。这个MAC通常被称为$C B C-M A C$，它基于分组密码。早期的银行标准使用DES定义CBC-MAC，因此MAC在64位块上运行。我们以更一般的形式提出CBC-MAC结构。任何分组密码，如AES，都可以使用。
计算cbc-mac
我们假设发送方和接收方事先就对称密钥$K$达成一致。我们还假设消息$M$已被分割成与分组密码的块长度相同的块(DES为64位，AES为128位)，以便处理它。在图6.8中，这些块被标记为$M_1, M_2, \ldots, M_n$。如果消息不能整齐地放入块中，那么我们填充最后一个块(参见第4.3.2节)。

如图6.8所示，发送端MAC的计算方法如下:

取第一个消息块$M_1$，并使用密钥$K$对其加密(使用块密码)以获得$C_1$。

将$C_1$与第二个消息块$M_2$进行XOR，并使用密钥$K$对结果进行加密，得到$C_2$。

重复此过程，直到倒数第二个密文块$C_{n-1}$被xor到最后一个消息块$M_n$，并使用密钥$K$对结果进行加密以获得$C_n$。

将消息$M_1, M_2, \ldots, M_n$发送给接收者，并附带最后一个密文块$C_n$。最后一个密文块$C_n$是MAC，我们表示为$\operatorname{MAC}_K(M)$。

数学代写|密码学作业代写Cryptography代考|HMAC

现在，我们将简要介绍另一个众所周知且广泛部署的MAC，这一次是基于哈希函数。我们在6.3.2节中的讨论应该已经清楚地表明，设计MAC的一种非常自然的方法可能是从哈希函数开始，然后以某种方式构建密钥的使用。这正是基于哈希的消息身份验证码(HMAC)背后的思想。至少在理论上，这种类型的MAC可以由任何加密散列函数构造。因此，通常将HMAC更精确地称为HMAC- md5，其中的后缀标识底层哈希函数的名称。

HMAC的设计非常简单。设$h$为哈希函数，设$K_1$和$K_2$为两个对称密钥。则消息$M$上的MAC计算如下:

计算与消息连接的$K_2$的哈希值(参见1.6.1节);换句话说，计算$h\left(K_2 | M\right)$;和

计算与步骤1的输出连接的$K_1$的哈希值;换句话说，计算:
$$
h\left(K_1 | h\left(K_2 | M\right)\right) .
$$
因此，计算MAC涉及到底层哈希函数的两个应用程序，首先是$K_2$和消息，然后是$K_1$和第一个哈希输出。HMAC是简单和快速实现。那么，问题是什么呢?

从某种意义上说，这是没有陷阱的;然而，重要的是要认识到HMAC的安全性取决于三个独立的因素:

密钥的安全性。HMAC使用两个对称密钥。因此，HMAC密钥的长度可以看作是这两个密钥长度的和。

哈希函数的安全性。HMAC的安全性取决于底层哈希函数的安全性。因此，它应该使用哈希函数来部署，哈希函数已经被公认的专家批准用于HMAC。

MAC输出的长度。正如我们在6.3.3节中讨论的，可以只使用HMAC输出的一部分作为实际MAC，但是减少它的长度会降低安全性。

统计代写请认准statistics-lab™. statistics-lab™为您的留学生涯保驾护航。

金融工程代写

非参数统计代写

非参数统计指的是一种统计方法，其中不假设数据来自于由少数参数决定的规定模型；这种模型的例子包括正态分布模型和线性回归模型。

广义线性模型代考

广义线性模型（GLM）归属统计学领域，是一种应用灵活的线性回归模型。该模型允许因变量的偏差分布有除了正态分布之外的其它分布。

有限元方法代写

随机分析代写

时间序列分析代写

回归分析代写

MATLAB代写

R语言代写	问卷设计与分析代写
PYTHON代写	回归分析与线性模型代写
MATLAB代写	方差分析与试验设计代写
STATA代写	机器学习/统计学习代写
SPSS代写	计量经济学代写
EVIEWS代写	时间序列分析代写
EXCEL代写	深度学习代写
SQL代写	各种数据建模与可视化代写

数学代写|密码学作业代写Cryptography代考|Different levels of data integrity

Posted on 2023年7月10日2023年7月10日 by statistics-lab

如果你也在怎样密码学Cryptography Theory 这个学科遇到相关的难题，请随时右上角联系我们的24/7代写客服。密码学Cryptography Theory 是对存在对抗行为的安全通信技术的实践和研究。更广泛地说，密码学是关于构建和分析防止第三方或公众阅读私人信息的协议；信息安全的各个方面，如数据保密性、数据完整性、认证和不可抵赖性是现代密码学的核心。现代密码学存在于数学、计算机科学、电子工程、通信科学和物理学等学科的交叉点。密码学的应用包括电子商务、基于芯片的支付卡、数字货币、计算机密码和军事通信。

密码学Cryptography Theory 在现代很大程度上是基于数学理论和计算机科学实践的；密码学算法是围绕计算硬度假设设计的，这使得这种算法在实际操作中很难被任何对手破解。虽然在理论上有可能破解一个设计良好的系统，但在实际操作中这样做是不可行的。因此，这种方案，如果设计得好，被称为 “计算安全”；理论上的进步（例如，整数分解算法的改进）和更快的计算技术要求这些设计被不断地重新评估，如果有必要的话，要进行调整。信息理论上的安全方案，即使有无限的计算能力也无法被破解，如一次性密码键盘，在实践中比理论上可被破解但计算上安全的最佳方案更难使用。

数学代写|密码学作业代写Cryptography代考|Different levels of data integrity

Data integrity is a slightly confusing security service because it is often referred to in different contexts. The best way of identifying the context is to consider the strength of a potential ‘attack’ against the integrity of some data. For our purposes, we will consider four different levels of data integrity which can be provided by considering four increasing levels of attack:

Accidental errors. This first level of data integrity provides protection only against accidental errors. Such errors are most likely to occur through noise in a communication channel. Data integrity mechanisms offering this level of data integrity include error-correcting codes (see Section 1.4.4) and simple checksums such as cyclic redundancy checks (CRCs). These techniques involve the computation of a digest which is appended to the original data. The digest is computed using a simple mathematical computation based on the data. Since the digest can be computed by anyone, these mechanisms offer no protection against an active attacker. We will not further discuss mechanisms in this category, since their integrity protection is weak.

Simple manipulations. The second level of data integrity protects against simple manipulations. Mechanisms providing protection only against accidental errors often have the property that if the data is changed in a particular way, then the new integrity digest can be predicted without needing to formally recalculate it. For example, the integrity digest of the XOR of two messages might be the XOR of the two integrity digests. Hash functions are examples of mechanisms which can protect against simple manipulations, since they have inherent security properties which can detect such manipulations. However, an active attacker can still defeat integrity mechanisms in this category since the integrity digest can still be computed by anyone. This second category is only distinct from the first category in that an active attacker cannot ‘shortcut’ the computation of a new digest by manipulating old ones. We will discuss hash functions in Section 6.2.

Active attacks. The third level of data integrity protects against active attacks. Unlike the previous two categories, mechanisms in this category must be able to prevent an attacker from creating a ‘valid’ integrity digest on some data for which they have not previously seen an integrity digest. This strong notion of data integrity normally requires data origin authentication, since the most natural way of preventing active attacks of this type is to provide a binding between the underlying data and the source creating it. The main cryptographic mechanisms for providing this level of data integrity are MACs, which we discuss in Section 6.3.

数学代写|密码学作业代写Cryptography代考|Hash functions

Hash functions are probably the most versatile of all cryptographic primitives. They are extremely useful and appear in all sorts of surprising applications. As a stand-alone tool, they have few uses. However, no cryptographic designer should ever leave home without one! Such is their ubiquity that when an unexpected attack was announced in 2004 against several of the most widely deployed hash functions, there was considerable concern. Their many important and varied uses include:

As strong one-way functions. Hash functions are sometimes used to ‘encrypt’ highly confidential data which does not require ‘decryption’, such as passwords (see Section 6.2.2).

To provide a weak notion of data integrity. Hash functions can be used to provide checks against accidental changes to data and, in certain cases, deliberate manipulation of data (see Section 6.2.2). As such they are sometimes referred to as modification detection codes or manipulation detection codes.

As components to build other cryptographic primitives. Hash functions can be used to construct different cryptographic primitives such as MACs (see Section 6.3.4) and digital signature schemes with appendix (see Section 7.3.4).

As a means of binding data. Hash functions are often used within cryptographic protocols to bind data together in a single cryptographic commitment.

As sources of pseudorandomness. Hash functions are sometimes used to pseudorandomly generate numbers for use in cryptography, with an important example being the generation of cryptographic keys (see Section 10.3).

Note the term hash function has several other wider meanings in the field of computer science. While we will use the term hash function because our context is clear, our hash functions are sometimes more specifically referred to as cryptographic hash functions.

密码学代写

数学代写|密码学作业代写Cryptography代考|Different levels of data integrity

数据完整性是一个稍微令人困惑的安全服务，因为它经常在不同的上下文中被提及。识别上下文的最佳方法是考虑针对某些数据完整性的潜在“攻击”的强度。为了达到我们的目的，我们将考虑四个不同级别的数据完整性，这可以通过考虑四个递增的攻击级别来提供:

意外错误。第一级数据完整性仅提供针对意外错误的保护。这种错误最有可能通过通信信道中的噪声发生。提供这种级别数据完整性的数据完整性机制包括纠错码(参见第1.4.4节)和简单的校验和，如循环冗余检查(crc)。这些技术涉及到附加到原始数据的摘要的计算。摘要是使用基于数据的简单数学计算来计算的。由于任何人都可以计算摘要，因此这些机制无法提供针对活动攻击者的保护。我们不会进一步讨论这一类的机制，因为它们的完整性保护很弱。

简单的操作。第二级数据完整性防止简单的操作。仅针对意外错误提供保护的机制通常具有这样的属性:如果数据以特定方式更改，则可以预测新的完整性摘要，而无需正式重新计算它。例如，两个消息的异或的完整性摘要可能是两个完整性摘要的异或。哈希函数是可以防止简单操作的机制的示例，因为它们具有可以检测此类操作的固有安全属性。然而，主动攻击者仍然可以破坏这一类中的完整性机制，因为任何人仍然可以计算完整性摘要。第二类与第一类的唯一区别在于，主动攻击者不能通过操纵旧摘要来“捷径”计算新摘要。我们将在6.2节讨论哈希函数。

主动攻击。第三级的数据完整性可以防止主动攻击。与前两类不同，这一类中的机制必须能够防止攻击者在之前没有看到完整性摘要的数据上创建“有效的”完整性摘要。这种强大的数据完整性概念通常需要数据源身份验证，因为防止这种类型的主动攻击的最自然的方法是在底层数据和创建它的源之间提供绑定。提供这种级别的数据完整性的主要加密机制是mac，我们将在6.3节中讨论。

数学代写|密码学作业代写Cryptography代考|Hash functions

哈希函数可能是所有密码原语中最通用的。它们非常有用，出现在各种令人惊讶的应用程序中。作为一个独立的工具，它们几乎没有什么用途。然而，任何密码设计师都不应该不带密码出门!由于它们的普遍性，当2004年宣布针对几个最广泛部署的散列函数的意外攻击时，引起了相当大的关注。它们的许多重要和不同的用途包括:

作为强单向函数。哈希函数有时用于“加密”不需要“解密”的高度机密数据，例如密码(参见第6.2.2节)。

提供一个数据完整性的弱概念。哈希函数可用于检查数据的意外更改，以及在某些情况下故意操纵数据(参见第6.2.2节)。因此，它们有时被称为修改检测代码或操作检测代码。

作为组件来构建其他加密原语。哈希函数可以用来构造不同的加密原语，比如mac(见6.3.4节)和数字签名方案(见7.3.4节)。

作为绑定数据的一种手段。哈希函数通常在加密协议中用于将数据绑定到单个加密提交中。

作为伪随机性的来源。哈希函数有时用于伪随机生成用于密码学的数字，一个重要的例子是生成密码学密钥(参见10.3节)。

请注意，术语哈希函数在计算机科学领域还有其他几个更广泛的含义。虽然我们将使用术语哈希函数，因为我们的上下文很清楚，但我们的哈希函数有时更具体地称为加密哈希函数。

统计代写请认准statistics-lab™. statistics-lab™为您的留学生涯保驾护航。

金融工程代写

非参数统计代写

非参数统计指的是一种统计方法，其中不假设数据来自于由少数参数决定的规定模型；这种模型的例子包括正态分布模型和线性回归模型。

广义线性模型代考

广义线性模型（GLM）归属统计学领域，是一种应用灵活的线性回归模型。该模型允许因变量的偏差分布有除了正态分布之外的其它分布。

有限元方法代写

随机分析代写

时间序列分析代写

回归分析代写

MATLAB代写

R语言代写	问卷设计与分析代写
PYTHON代写	回归分析与线性模型代写
MATLAB代写	方差分析与试验设计代写
STATA代写	机器学习/统计学习代写
SPSS代写	计量经济学代写
EVIEWS代写	时间序列分析代写
EXCEL代写	深度学习代写
SQL代写	各种数据建模与可视化代写

数学代写|密码学作业代写Cryptography代考|Limiting factors

Posted on 2023年7月10日2023年7月10日 by statistics-lab

数学代写|密码学作业代写Cryptography代考|Limiting factors

Despite its benefits, there are two significant factors which limit the adoption of public-key encryption:

Computational costs. As noted in Section 5.4.2, public-key encryption and decryption are relatively expensive computations to perform. This means that in applications where processing speed is important (in other words, almost every application!), it is often regarded as a good idea to restrict the number of public-key encryption and decryption operations performed. This is by far the most important restriction on the use of public-key encryption.

Long-plaintext security issues. All our discussion in this chapter has involved encryption of single plaintexts which can be represented by one ‘unit’ of public-key encryption. For example, we assumed a plaintext to be encrypted using an RSA public key $(n, e)$ could be represented as a number less than $n$. If we want to encrypt a longer plaintext, then we first have to split the plaintext up into separate ‘units’ and then encrypt these separately. If we consider each of these plaintexts as ‘blocks’ (which is a reasonable analogy), then by default we would be encrypting these separate blocks using the public-key equivalent of ECB mode for a block cipher. This gives rise to several security issues we discussed in Section 4.6.1, all of which were resolved by proposing different modes of operation for block ciphers. However, there are no alternative modes of operation proposed for public-key encryption. (This is, of course, primarily because of the lack of demand, due to the computational issue just discussed.) Thus, from a security perspective, it might also be wise to restrict the use of public-key encryption to single plaintexts, where by ‘single’ we mean the entire plaintext can be encrypted in one computation.

Thus, there is a strong case from both an efficiency and a security perspective for limiting the use of public-key encryption to ‘occasional’ short plaintexts.

数学代写|密码学作业代写Cryptography代考|Hybrid encryption

There are many applications where we want to use public-key encryption for the benefits discussed in Section 5.1.1, but where the plaintexts are long, thus precluding the use of public-key encryption for the reasons just discussed in Section 5.5.1. The elegant and simple solution to this conundrum is known as hybrid encryption. If Alice wants to encrypt a (long) plaintext and send it to Bob, she:

Generates a symmetric $K$ and public-key encrypts the symmetric key $K$ using the public key of Bob; and
Symmetrically encrypts the plaintext using $K$.
Alice then sends both of these ciphertexts to Bob. On receiving the two ciphertexts, Bob:
Recovers the symmetric key $K$ by decrypting the first ciphertext using his private key; and
Recovers the original plaintext by decrypting the second ciphertext using $K$.
This hybrid encryption process is depicted in Figure 5.2.

Note from Table 5.2 that a symmetric key can always be represented as a short plaintext with respect to the recommended lengths of security parameters for public-key cryptosystems. Indeed, a 128-bit AES key is small enough to be encrypted as a single plaintext using any of the public-key cryptosystem parameters in Table 5.2, including those of an elliptic-curve-based cryptosystem offering just 64 bits of symmetric security (although it would be rather bizarre to do this since the effective security of the hybrid encryption would be reduced to just 64 bits).

In this way, hybrid encryption gains the best of both cryptographic worlds by benefitting from the following:
Speed. The speed of symmetric key encryption is utilised for the encryption of the plaintext.
Convenience. The key management convenience of public-key cryptosystems enables two entities who do not have a direct trust relationship to securely communicate.

密码学代写

数学代写|密码学作业代写Cryptography代考|Limiting factors

尽管它有好处，但有两个重要因素限制了公钥加密的采用:

计算成本。如第5.4.2节所述，公钥加密和解密是相对昂贵的计算。这意味着在处理速度很重要的应用程序中(换句话说，几乎所有应用程序都是如此!)，通常认为限制所执行的公钥加密和解密操作的数量是一个好主意。这是迄今为止对使用公钥加密最重要的限制。

长明文安全问题。本章的所有讨论都涉及到单个明文的加密，它可以用一个“单位”的公钥加密来表示。例如，我们假设使用RSA公钥$(n, e)$加密的明文可以表示为小于$n$的数字。如果我们想加密较长的明文，那么我们首先必须将明文分成单独的“单元”，然后分别加密它们。如果我们将这些明文中的每一个视为“块”(这是一个合理的类比)，那么默认情况下，我们将使用相当于块密码的ECB模式的公钥来加密这些单独的块。这引起了我们在4.6.1节中讨论的几个安全问题，所有这些问题都通过为分组密码提出不同的操作模式来解决。但是，没有为公钥加密提出其他的操作模式。(当然，这主要是因为刚刚讨论的计算问题导致需求不足。)因此，从安全的角度来看，将公钥加密的使用限制为单一明文可能也是明智的，这里的“单一”是指整个明文可以在一次计算中加密。

因此，从效率和安全的角度来看，将公钥加密的使用限制为“偶尔的”短明文是很有必要的。

数学代写|密码学作业代写Cryptography代考|Hybrid encryption

在许多应用程序中，我们希望使用公钥加密来获得第5.1.1节中讨论的好处，但是在这些应用程序中明文很长，因此由于第5.5.1节中讨论的原因，无法使用公钥加密。这个难题的优雅而简单的解决方案被称为混合加密。如果Alice想加密(长)明文并将其发送给Bob，她:

生成对称密钥$K$，并使用Bob的公钥对对称密钥$K$进行加密;和

使用$K$对称加密明文。
然后Alice将这两个密文发送给Bob。收到这两个密文后，Bob:

通过使用他的私钥解密第一个密文恢复对称密钥$K$;和

通过使用$K$解密第二个密文恢复原始明文。
这种混合加密过程如图5.2所示。

从表5.2中可以注意到，对称密钥总是可以表示为相对于公钥加密系统的推荐安全参数长度的简短明文。实际上，128位AES密钥足够小，可以使用表5.2中的任何公钥密码系统参数作为单个明文进行加密，包括那些仅提供64位对称安全性的基于椭圆曲线的密码系统(尽管这样做会相当奇怪，因为混合加密的有效安全性将减少到64位)。

通过这种方式，混合加密通过以下优点获得了两个加密世界的优点:
速度。对称密钥加密的速度被用于明文的加密。
方便。公钥密码系统的密钥管理便利性使没有直接信任关系的两个实体能够安全地通信。

统计代写请认准statistics-lab™. statistics-lab™为您的留学生涯保驾护航。

金融工程代写

非参数统计代写

非参数统计指的是一种统计方法，其中不假设数据来自于由少数参数决定的规定模型；这种模型的例子包括正态分布模型和线性回归模型。

广义线性模型代考

广义线性模型（GLM）归属统计学领域，是一种应用灵活的线性回归模型。该模型允许因变量的偏差分布有除了正态分布之外的其它分布。

有限元方法代写

随机分析代写

时间序列分析代写

回归分析代写

MATLAB代写

R语言代写	问卷设计与分析代写
PYTHON代写	回归分析与线性模型代写
MATLAB代写	方差分析与试验设计代写
STATA代写	机器学习/统计学习代写
SPSS代写	计量经济学代写
EVIEWS代写	时间序列分析代写
EXCEL代写	深度学习代写
SQL代写	各种数据建模与可视化代写

数学代写|密码学作业代写Cryptography代考|Security of RSA

Posted on 2023年7月10日2023年7月10日 by statistics-lab

数学代写|密码学作业代写Cryptography代考|Security of RSA

There are two obvious ways of trying to break RSA. Indeed, these apply to any public-key cryptosystem. An attacker can either attempt to:

Decrypt a ciphertext without knowledge of the private key; or
Determine the private key directly from the public key.
Clearly the second attack is more powerful than the first, since an attacker who can perform the second attack can then decrypt subsequent ciphertexts. We now consider these two attack strategies.
DECRYPTING ACIPHERTEXT WITHOUT KNOWLEDGE OF THE PRINATE KEY
Consider trying to decrypt an RSA ciphertext without the private key. Recall that we specified in Section 5.1.4 that a public-key encryption function should be a trapdoor one-way function. By assuming we do not know the private key, we are thus assuming we do not know the trapdoor. Thus, to assess the difficulty of determining the plaintext directly from the ciphertext, we need to assess the effectiveness of the one-way function which lies at the heart of RSA.

We need to take a closer look at the function being used for RSA encryption. The encryption process in RSA involves computing the function:
$$
C=P^e \bmod n .
$$
An attacker who observes $C$, and has knowledge of $e$ and $n$ (but not $d$ ), needs to work out what the value $P$ is. Computing $P$ from $C, e$, and $n$ is regarded as a hard problem (fortunately!), and thus the encryption function of RSA is believed to be a one-way function.

Although this hard problem might look familiar, it is in fact the first time we have come across it. It is commonly referred to as the RSA problem. It superficially resembles the discrete logarithm problem we discussed in Section 5.1.4; however, there are two subtle differences:

In the discrete logarithm problem, we are given $C, P$, and $n$ and we try to find $e$. In the RSA problem we are given $C$, $e$, and $n$, and we try to find $P$.
In the discrete logarithm problem we discussed in Section 5.1.4, we worked modulo a prime, whereas in the RSA problem our modulus is the product of two primes.

数学代写|密码学作业代写Cryptography代考|RSA in practice

As with most of the cryptographic primitives we discuss, our explanation of RSA has been simplified in order to emphasise the main design aspects. It is essential that RSA is not deployed in any real implementation in exactly the way we have described. Rather, the latest best-practice guidelines outlined in the relevant standards should be consulted and followed. Perhaps the most critical alteration to the ‘textbook’ version of RSA which is often made in practice is to introduce randomisation into the encryption process. We now look at why this is important.
PROBABILISTIC ENCRYPTION
The version of RSA we presented in Section 5.2.2 is an example of deterministic encryption, which means that each time the same plaintext is encrypted using the same public key, the resulting ciphertext will be the same.

A significant disadvantage of deterministic public-key encryption is that the following attack is possible. Suppose a ciphertext sent to a known recipient has been observed by an attacker, who then proceeds as follows:

The attacker makes an informed guess as to the value of the plaintext;
The attacker encrypts the guessed plaintext using the known recipient’s public key; and
If the result matches the observed ciphertext, then the guess was correct; if not, the attacker tries another guess of the plaintext.

This attack is particulary effective in situations where there are limited choices for the plaintext (for example, if the plaintext is a database entry from a limited range). We will refer to this attack as an informed exhaustive plaintext search.

Note this attack does not apply to symmetric encryption. This is because the encryption key is secret. Even if the attacker knows that the plaintext comes from a small set of potential values (perhaps even just two), the attacker cannot conduct this attack because any encryption key could have been used. This is why the attacker has to exhaustively search through all the potential symmetric keys instead.

密码学代写

数学代写|密码学作业代写Cryptography代考|Security of RSA

有两种明显的破解RSA的方法。实际上，这些适用于任何公钥密码系统。攻击者可以尝试:

在不知道私钥的情况下解密密文;或

直接从公钥确定私钥。
显然，第二次攻击比第一次攻击更强大，因为可以执行第二次攻击的攻击者可以解密随后的密文。我们现在考虑这两种攻击策略。
在不知道私钥的情况下解密密文
考虑尝试在没有私钥的情况下解密RSA密文。回想一下，我们在第5.1.4节中指定，公钥加密函数应该是一个陷门单向函数。通过假设我们不知道私钥，我们也就假设我们不知道活板门。因此，为了评估直接从密文中确定明文的难度，我们需要评估RSA核心的单向函数的有效性。

我们需要仔细研究RSA加密所使用的函数。RSA中的加密过程包括计算以下函数:
$$
C=P^e \bmod n .
$$
一个观察$C$并了解$e$和$n$(但不了解$d$)的攻击者需要计算出$P$的值是多少。从$C, e$计算$P$，而$n$被认为是一个难题(幸运的是!)，因此RSA的加密函数被认为是单向函数。

虽然这个难题看起来很熟悉，但实际上这是我们第一次遇到它。它通常被称为RSA问题。它表面上类似于我们在5.1.4节讨论的离散对数问题;然而，有两个细微的区别:

在离散对数问题中，我们已知$C, P$和$n$我们试着求出$e$。在RSA问题中我们已知$C$$e$和$n$，我们试着找出$P$。

在5.1.4节讨论的离散对数问题中，我们对一个素数取模，而在RSA问题中，我们的模是两个素数的乘积。

数学代写|密码学作业代写Cryptography代考|RSA in practice

与我们讨论的大多数加密原语一样，为了强调主要的设计方面，我们对RSA的解释进行了简化。RSA在任何实际实现中都不能完全按照我们所描述的方式进行部署，这一点很重要。相反，应参考并遵循相关标准中概述的最新最佳实践指南。在实践中，对RSA“教科书”版本最关键的改变可能是在加密过程中引入随机化。现在我们来看看为什么这很重要。
概率加密
我们在5.2.2节中介绍的RSA版本是确定性加密的一个例子，这意味着每次使用相同的公钥加密相同的明文时，产生的密文将是相同的。

确定性公钥加密的一个显著缺点是可能出现以下攻击。假设发送给已知接收者的密文已被攻击者观察到，然后攻击者进行如下操作:

攻击者对明文的值进行知情猜测;

攻击者使用已知接收者的公钥加密猜测的明文;和

如果结果与观察到的密文匹配，那么猜测是正确的;如果没有，则攻击者尝试对明文进行另一次猜测。

这种攻击在明文选项有限的情况下特别有效(例如，如果明文是来自有限范围的数据库条目)。我们将把这种攻击称为知情详尽明文搜索。

注意，这种攻击不适用于对称加密。这是因为加密密钥是保密的。即使攻击者知道明文来自一小部分潜在值(甚至可能只有两个)，攻击者也无法进行这种攻击，因为任何加密密钥都可能被使用。这就是攻击者必须彻底搜索所有可能的对称密钥的原因。

统计代写请认准statistics-lab™. statistics-lab™为您的留学生涯保驾护航。

金融工程代写

非参数统计代写

非参数统计指的是一种统计方法，其中不假设数据来自于由少数参数决定的规定模型；这种模型的例子包括正态分布模型和线性回归模型。

广义线性模型代考

广义线性模型（GLM）归属统计学领域，是一种应用灵活的线性回归模型。该模型允许因变量的偏差分布有除了正态分布之外的其它分布。

有限元方法代写

随机分析代写

时间序列分析代写

回归分析代写

MATLAB代写

R语言代写	问卷设计与分析代写
PYTHON代写	回归分析与线性模型代写
MATLAB代写	方差分析与试验设计代写
STATA代写	机器学习/统计学习代写
SPSS代写	计量经济学代写
EVIEWS代写	时间序列分析代写
EXCEL代写	深度学习代写
SQL代写	各种数据建模与可视化代写

数学代写|密码学作业代写Cryptography代考|Setting up EIGamal

Posted on 2023年6月26日2023年6月26日 by statistics-lab

数学代写|密码学作业代写Cryptography代考|Setting up EIGamal

We now describe how to set up key pairs for use in ElGamal. Each user who wishes an ElGamal key pair conducts the following process:

Choose a large prime $\boldsymbol{p}$. We will present a simplified version of ElGamal which works with numbers modulo $p$. In practice, ElGamal is often based on a slightly more general number system (and in the case of elliptic curve variants, is based on quite different number systems). By ‘large’ we mean a prime of similar size length to an RSA modulus. Thus, a reasonable length would be in the order of 3072 bits.

Choose a special number $\boldsymbol{g}$. The special number $g$ must be what is known as a primitive element modulo $p$. This number must be between 1 and $p-1$, but cannot be any such number because not all numbers in this range are primitive. It suffices to accept $g$ as being ‘special’, but if you wish to learn more about what primitive means then see the Mathematics Appendix.

Choose the private key. The private key $x$ can be any number bigger than 1 and smaller than $p-1$. We assume the private key is generated using a suitably random process, which results in it being extremely unlikely that two users of the same system have the same private key.

Compute the last part of the public key. The value $y$ is computed from the parameters $p, g$ and the private key $x$ as follows:
$$
y=g^x \quad \bmod p .
$$

数学代写|密码学作业代写Cryptography代考|Encryption and decryption using EIGamal

While the generation of an ElGamal key pair is arguably simpler than the equivalent process for RSA, encryption and decryption are slightly more complex than RSA.
ELGAMAL ENCRYPTION
Suppose we wish to send a plaintext to someone whose ElGamal public key is $(p, g, y)$. ElGamal encryption operates on numbers modulo $p$. Thus, the first task is to represent our plaintext as a series of numbers modulo $p$. Just as we did for RSA, we assume there is some agreed method of doing this.
Suppose we now want to encrypt the first plaintext $P$, which we have already represented as a number modulo $p$. The encryption process to obtain the ciphertext $C$ is as follows:

Randomly generate a number $k$;
Compute two values $C_1$ and $C_2$, where:
$$
\begin{aligned}
C_1 & =g^k \quad \bmod p, \
C_2 & =P y^k \quad \bmod p \text {; then }
\end{aligned}
$$
Send the ciphertext $C$, where $C$ consists of the two separate values $\left(C_1, C_2\right)$, sent together.
We now look more carefully at $C_1$ and $C_2$ in order to determine what role in the ciphertext each plays:

The value $k$ is randomly generated for this ciphertext, and only for this ciphertext. The next time a plaintext is encrypted, even if it is exactly the same plaintext as before, a new $k$ should be randomly generated. The use of this value means that EIGamal provides probabilistic encryption (see Section 5.2.4). We can think of $k$ as being a temporary (one-time) ‘key’. The first component $C_1$ of the ciphertext is $g^k \bmod p$. Recall from Section 5.1.4 that modular exponentiation (of which this is an example) is believed to be a one-way function. This means calculating $C_1$ is easy, but determining $k$ from $C_1$ is believed to be hard. Thus, $C_1$ is best thought of as a one-way representation of the temporary key $k$.
The second ciphertext component $C_2$ is a function of the plaintext $P$, the public-key component $y$, and the temporary key $k$. More precisely, it is $P$ multiplied by $y^k$, and then reduced modulo $p$. Thus, $C_2$ can be thought of as the encryption of $P$ using both the public-key component $y$ and the temporary key $k$.

密码学代写

数学代写|密码学作业代写Cryptography代考|Setting up EIGamal

现在我们描述如何设置在ElGamal中使用的密钥对。每个希望使用ElGamal密钥对的用户执行以下过程:

选择一个大质数$\boldsymbol{p}$。我们将介绍一个简化版本的ElGamal，它与数字模数$p$一起工作。在实践中，ElGamal通常基于稍微更通用的数字系统(在椭圆曲线变体的情况下，基于完全不同的数字系统)。这里的“大”是指与RSA模数长度相似的素数。因此，一个合理的长度应该是3072位。

选择一个特殊的号码$\boldsymbol{g}$。特殊数$g$必须是所谓的基本元素模$p$。这个数字必须在1和$p-1$之间，但不能是任何这样的数字，因为不是这个范围内的所有数字都是原始的。它足以接受$g$是“特殊的”，但如果你想了解更多关于什么是原始的意思，请参阅数学附录。

选择私钥。私钥$x$可以是大于1且小于$p-1$的任意数字。我们假设私钥是使用适当的随机过程生成的，这导致同一系统的两个用户极不可能拥有相同的私钥。

计算公钥的最后一部分。$y$由以下参数$p, g$和私钥$x$计算得出:
$$
y=g^x \quad \bmod p .
$$

数学代写|密码学作业代写Cryptography代考|Encryption and decryption using EIGamal

虽然ElGamal密钥对的生成可以说比RSA的等效过程简单，但加密和解密比RSA稍微复杂一些。
密码加密
假设我们希望将明文发送给其ElGamal公钥为$(p, g, y)$的某人。ElGamal加密操作的数字模$p$。因此，第一个任务是将明文表示为对$p$取模的一系列数字。就像我们对RSA所做的那样，我们假设存在某种商定的方法来完成此操作。
假设我们现在要加密第一个明文$P$，我们已经将其表示为数字模数$p$。获取密文$C$的加密过程如下:

随机生成一个数字$k$;

计算两个值$C_1$和$C_2$，其中:
$$
\begin{aligned}
C_1 & =g^k \quad \bmod p, \
C_2 & =P y^k \quad \bmod p \text {; then }
\end{aligned}
$$

发送密文$C$，其中$C$由两个单独的值$\left(C_1, C_2\right)$组成，一起发送。
我们现在更仔细地查看$C_1$和$C_2$，以确定它们在密文中各自扮演的角色:

值$k$是针对该密文随机生成的，且仅针对该密文。下一次加密明文时，即使它与以前完全相同，也应该随机生成一个新的$k$。使用此值意味着EIGamal提供概率加密(参见5.2.4节)。我们可以把$k$看作是临时的(一次性的)“钥匙”。密文的第一个组件$C_1$为$g^k \bmod p$。回想一下第5.1.4节，模幂运算(这是一个例子)被认为是一个单向函数。这意味着计算$C_1$很容易，但从$C_1$确定$k$则很难。因此，最好将$C_1$视为临时密钥$k$的单向表示。

第二个密文组件$C_2$是明文组件$P$、公钥组件$y$和临时密钥$k$的函数。更准确地说，它是$P$乘以$y^k$，然后对$p$进行模化。因此，可以将$C_2$视为使用公开密钥组件$y$和临时密钥$k$对$P$进行加密。

统计代写请认准statistics-lab™. statistics-lab™为您的留学生涯保驾护航。

金融工程代写

非参数统计代写

非参数统计指的是一种统计方法，其中不假设数据来自于由少数参数决定的规定模型；这种模型的例子包括正态分布模型和线性回归模型。

广义线性模型代考

广义线性模型（GLM）归属统计学领域，是一种应用灵活的线性回归模型。该模型允许因变量的偏差分布有除了正态分布之外的其它分布。

有限元方法代写

随机分析代写

时间序列分析代写

回归分析代写

MATLAB代写

R语言代写	问卷设计与分析代写
PYTHON代写	回归分析与线性模型代写
MATLAB代写	方差分析与试验设计代写
STATA代写	机器学习/统计学习代写
SPSS代写	计量经济学代写
EVIEWS代写	时间序列分析代写
EXCEL代写	深度学习代写
SQL代写	各种数据建模与可视化代写

数学代写|密码学作业代写Cryptography代考|Performance issues

Posted on 2023年6月26日2023年6月26日 by statistics-lab

数学代写|密码学作业代写Cryptography代考|Performance issues

In comparison with most symmetric encryption algorithms, neither RSA nor any variants of ElGamal are particularly efficient. The main problem is that in each case encryption involves exponentiation. We saw in Section 3.2.3 that exponentiation has complexity $n^3$. This means it is easy to compute but is not as efficient as other more straightforward operations such as addition (complexity $n$ ) and multiplication (complexity $n^2$ ).

In this respect, RSA is more efficient for encryption than ElGamal variants, since it only requires one exponentiation (and by choosing the exponent $e$ to have a certain format, this can be made to be a faster-than-average exponentiation computation), whereas ElGamal variants need two. However, we already noted in Section 5.3.4 that the computation of $C_1$ could be done in advance, and so some people argue there is very little difference in computational efficiency.

In contrast, decryption is slightly more efficient for ElGamal variants than for RSA. This is because the decryption exponentiation is typically performed with a smaller exponent than for RSA. If the exponent is carefully chosen, then, even with the additional ElGamal decryption costs of running the Extended Euclidean Algorithm, the result is typically a more efficient computation than an RSA decryption based on a much larger exponent.

There has been a lot of work invested in trying to speed up the exponentiation process in order to make RSA and ElGamal variants more efficient. A combination of clever engineering and mathematical expertise has led to faster implementations, but they are all slower than symmetric computations. For this reason, none of these public-key cryptosystems are normally used for bulk data encryption (see Section 5.5).

数学代写|密码学作业代写Cryptography代考|Limiting factors

Despite its benefits, there are two significant factors which limit the adoption of public-key encryption:

Thus, there is a strong case from both an efficiency and a security perspective for limiting the use of public-key encryption to ‘occasional’ short plaintexts.

密码学代写

数学代写|密码学作业代写Cryptography代考|Performance issues

与大多数对称加密算法相比，RSA和ElGamal的任何变体都不是特别有效。主要问题是，在每种情况下，加密都涉及到幂运算。我们在3.2.3节中看到，取幂的复杂度为n^3。这意味着它很容易计算，但不如其他更直接的操作(如加法(复杂度$n$)和乘法(复杂度$n^2$)有效。

在这方面，RSA比ElGamal变体更有效地进行加密，因为它只需要一次幂运算(通过选择指数$e$具有某种格式，可以使其比平均幂运算速度更快)，而ElGamal变体需要两次幂运算。然而，我们在5.3.4节已经注意到，$C_1$的计算可以提前完成，因此有些人认为计算效率的差异很小。

相比之下，ElGamal变体的解密效率略高于RSA。这是因为解密取幂通常使用比RSA更小的指数来执行。如果仔细选择指数，那么，即使使用运行扩展欧几里得算法的额外ElGamal解密成本，结果通常比基于大得多的指数的RSA解密更有效。

为了使RSA和ElGamal变体更有效，已经投入了大量的工作来尝试加快幂运算过程。聪明的工程技术和数学专业知识的结合导致了更快的实现，但它们都比对称计算慢。由于这个原因，这些公钥加密系统通常都不用于批量数据加密(参见第5.5节)。

数学代写|密码学作业代写Cryptography代考|Limiting factors

尽管它有好处，但有两个重要因素限制了公钥加密的采用:

因此，从效率和安全的角度来看，将公钥加密的使用限制为“偶尔的”短明文是很有必要的。

统计代写请认准statistics-lab™. statistics-lab™为您的留学生涯保驾护航。

R语言代写	问卷设计与分析代写
PYTHON代写	回归分析与线性模型代写
MATLAB代写	方差分析与试验设计代写
STATA代写	机器学习/统计学习代写
SPSS代写	计量经济学代写
EVIEWS代写	时间序列分析代写
EXCEL代写	深度学习代写
SQL代写	各种数据建模与可视化代写