Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
53
votes
5answers
6k views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
48
votes
10answers
3k views
Is modern encryption needlessly complicated?
RSA, DES, AES, etc. all use (relatively) complicated mathematics to encrypt some message with some key. For each of these methods, there have been several documented vulnerabilities found over the ...
27
votes
4answers
5k views
What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?
AES has several different variants (AES-128, AES-192, AES-256), but why would I use one over another?
20
votes
3answers
3k views
How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?
RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large message.
How can I do this?
20
votes
5answers
6k views
Is Convergent Encryption really secure?
Recently a company called Bitcasa demonstrated a product of cloud storage. they indicated that they would use "Convergent Encryption" to secure your data and de-duplicate, essentially one copy of the ...
19
votes
4answers
2k views
Is AES-256 weaker than 192 and 128 bit versions?
From a paper (via Schenier on Security's Another AES Attack) (emphasis mine):
In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. ...
16
votes
3answers
2k views
Identifying encryption method from encrypted string
Is it possible to identify the encryption method or atleast rule out some, by looking at the encrypted text?
For example, if you have 3 encrypted strings where the first 10 characters are the same on ...
16
votes
6answers
893 views
Is there a secure cryptosystem that can be performed mentally?
I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely. However, I can think of many practical situations in which mental ...
16
votes
1answer
337 views
Selective format-compliant JPEG encryption?
I am working towards building a format-compliant encryption system for pictures. The aim of it is to be able to obscure specific areas of a picture (i.e. faces, car license numbers...) while keeping ...
15
votes
2answers
1k views
How were the DES S-box values determined?
It seems like the S-boxes in DES have essentially random values.
How were these chosen?
15
votes
7answers
1k views
How can SSL secure a two-way communication with only one key-pair?
As I understand it, SSL involved the use of a public-private key pair. How does this enable two-way communication?
Suppose I have some server with which I wish to communicate securely. I connect to ...
12
votes
3answers
790 views
Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?
The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes.
Does this mean that an attacker can only see a single ...
12
votes
3answers
867 views
Hashing or encrypting twice to increase security?
Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has ...
11
votes
6answers
354 views
Can I encrypt user input in a way I can't decrypt it for a certain period of time?
I run a baseball league and would like to do silent auctions for free agents. This would require teams to enter their highest bid and the highest bidder at the end of the auction period would win. ...
10
votes
4answers
4k views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
10
votes
3answers
540 views
Is CBC really dead?
I developed a p2p-app in C# which sends and receives encrypted text messages (50KB). For encryption, my app uses AES 128 bit in CBC cipher mode. For each message it uses a new randomly-generated IV.
...
10
votes
2answers
405 views
Encryption scheme for social-network-like data sharing data via untrusted server?
I am thinking quite a lot lately abut the problem of secure, privacy-preserving social networking. Distributing the network among trusted, preferably self-hosted servers (like Diaspora, GNU Social ...
10
votes
1answer
2k views
How to choose a padding mode with AES
Depending on the framework you are using, there are various padding modes that can be used with AES encryption. For example, with .NET we can choose PKCS7, ISO10126, ANSIX923, Zeros or None.
I ...
9
votes
1answer
1k views
Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?
I'm wondering why we use encrypt-decrypt-encrypt sequence in 3DES with three keys instead of three times encryption with three different keys?
9
votes
1answer
217 views
What is the theoretical and practical status of mental poker?
I'm able to find a lot of scattered papers on the development of mental poker since RSA proposed the initial solution but no recent report (i.e. after 2005) on what is the status of the problem, eg:
...
8
votes
2answers
466 views
Why RSA can't handle numbers above 76?
I'm going to encrypt the characters Zhu, and decrypt them using RSA. I'm using the public key $\{e, n\}$ and private key $\{d, n\}$. The values of $e$, $d$ and $p$ ...
8
votes
5answers
264 views
Reduction from signatures to encryption?
Is it possible to construct an (asymmetric) encryption scheme from a signature scheme?
If the signature scheme is deterministic and allows existential forgery (e.g. RSA), then the answer is yes ...
8
votes
2answers
507 views
Salting when encrypting?
I was attending a database encryption session at a developers conference. The presenter (who was a published author on the subject) said that MS SQL Server did not support salted hashes in the ...
8
votes
3answers
240 views
Is it possible to create an asymmetric cryptosystem where the private keys are not easily verifiable as such?
Plaintext that consists of an RSA key is easily recognizable as such, because it satisfies certain mathematical properties, in particular (See the answer for Why can an encrypted private key be brute ...
8
votes
3answers
446 views
What is the best way to put a backdoor in an encryption system?
How can you put a backdoor into an encryption algorithm? Are there any techniques that can be used to reduce the time it takes to break a key?
I am looking for practical examples encryption schemes ...
8
votes
1answer
400 views
How can I make my cipher show the avalanche effect?
I am a beginner in cryptography. I designed an password based encryption-decryption algorithm, which uses a random salt and a password to encrypt a message. I'm using SHA-512 for hashing, matrix ...
7
votes
4answers
291 views
Can I determine if a user has the wrong symmetric encryption key?
We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to ...
7
votes
4answers
1k views
What is the effect of the different AES key lengths?
How does a changing key length affects the ciphertext, not only in case of AES, but in general? I know that the key spaces become much larger and the number of rounds in case of AES changes, but is ...
7
votes
3answers
508 views
Using a Non-Random IV with modes other than CBC
The weakness CWE-329 is an interesting problem with CBC mode. However, does this same weakness affect the other modes of operation that rely upon an IV such as: PCBC, CFB and OFB? My gut feeling is, ...
7
votes
1answer
1k views
Can CBC ciphertext be decrypted if the key is known, but the IV not?
Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?
How hard is ...
7
votes
2answers
2k views
AES in ECB mode weakness
In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long.
Very ...
7
votes
1answer
449 views
Replacing the Rijndael S-Box?
The Rijndael S-Box design generates a permutation cycle of type $2+27+59+81+87$. What effect would replacing that permutation with a cycle of type $256$ have on the security of AES?
6
votes
3answers
448 views
Is this encryption algorithm build from MD5 secure?
I'm being asked to use an encryption algorithm in my code, and besides the fact that I'm sure there will be implementation faults that lead to vulnerabilities, I also have concerns about the algorithm ...
6
votes
3answers
1k views
Why RSA encryption key is based on modulo(phi(n)) rather than modulo n
While calculating RSA encryption key we take modulo(phi(n)) rather that modulo(n). I couldn't understand why its so?
6
votes
4answers
484 views
Is compressing data prior to encryption necessary to reduce plaintext redundancy?
As explained in William Stallings' Book, in PGP encryption is done after compression, since it reduces redundancy.
I couldn't relate encryption strength with redundancy. Could anyone explain more on ...
6
votes
3answers
2k views
Encryption/ciphers/codes in Chinese
I am quite curious as to how you can perform simple encryption for the Chinese language.
Saw a similar question related to encryption/Chinese here: About cryptography in a character language, ...
6
votes
4answers
914 views
What is the difference between a stream cipher and a one-time-pad?
A (synchronous) stream cipher is an algorithm which maps some fixed-length key to an arbitrary-length key-stream (i.e. a sequence of bits): $C : \{0,1\}^k \to \{0,1\}^{\infty}$.
This key-stream is ...
6
votes
2answers
477 views
Why is ciphertext from low entropy plaintext not compressible?
This comes following a discussion with a colleague.
My plaintext file plain consists of a about 100,000 lines of "all work and
no play...". It's size is: 2.2 MB.
...
6
votes
2answers
338 views
What's is the main difference between a key, an IV and a nonce?
What are the main differences between a nonce, a key and an IV. Without any doubt the key should be kept secret. But what about the nonce and the IV. What's the main difference between them and their ...
6
votes
4answers
1k views
Difference between encrypting something and hashing something
What is the difference between encrypting something and hashing something? in what situations would I want one or the other?
6
votes
1answer
379 views
What causes first block of AES decryption to be garbled, even with correct IV?
I am attempting to duplicate wireshark's packet capture decryption for a TLS HTTP session, where I control the private key of the server.
The cipher suite number is 0x00002f, TLS_RSA_AES_128_CBC_SHA
...
6
votes
2answers
275 views
Deniable Encryption from simple primitives
Is there a deniable encryption scheme $M = E(p_1,k_1,p_2,k_2,...,p_n,k_n), p_j = D(M,k_j)$ of $n$ plaintexts $p_1,p_2,...,p_n$ and $n$ keys $k_1,k_2,...,k_n$, such that we can fix $D$ to be a known ...
6
votes
1answer
1k views
How do other, non-RSA algorithms, compare to the PKCS #1 standard?
Arguably the PKCS suite of standards have a profit-oriented bias as they are promoted by RSA and promote their algorithms over others in the form of RFCs and other means.
I'm considering the ...
6
votes
2answers
375 views
Hash decrypts key, key decrypts cipher… why?
I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a ...
6
votes
1answer
579 views
AES and perfect ciphers
I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES.
Obviously AES isn't a perfect cipher, since the ...
6
votes
1answer
153 views
How would one crack a weak but unknown encryption protocol?
I asked a question on security.stackexchange, but was told it would be a better fit here:
http://security.stackexchange.com/questions/32779/how-would-one-crack-a-weak-but-unknown-encryption-protocol
...
5
votes
2answers
332 views
Is it possible to create an easy to use encryption/decryption method that will never be comprimised?
In the comments of the question "Why programming languages don't provide simple encryption methods?" the following statement was made:
A well thought out, tested and understood standard that has ...
5
votes
2answers
845 views
How to attack a classical cipher using known partial plaintext?
I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext.
What are the cryptanalysis approaches for ...
5
votes
1answer
489 views
Why is CAMELLIA suddenly so widely used?
When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available.
Is that not ...
5
votes
3answers
168 views
Stretching passwords for encrypting small files
I would like to know how to store a sensitive file; a credential of sorts. I want to password-protect it, obviously. It would be appropriate - in my application - to prompt the user for the password ...
