Questions tagged [encryption]

Encryption is the process of transforming plaintext using a cipher into ciphertext to make it unreadable to anyone except those possessing the key. Decryption is the process of transforming that ciphertext back into plaintext, using the key.

Filter by
Sorted by
Tagged with
422 votes
13 answers
189k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
Thomas Pornin's user avatar
151 votes
7 answers
110k views

Should we sign-then-encrypt, or encrypt-then-sign?

Frequently, we want to send messages that are (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
David Cary's user avatar
  • 5,664
172 votes
2 answers
183k views

What is the main difference between a key, an IV and a nonce?

What are the main differences between a nonce, a key and an IV? Without any doubt the key should be kept secret. But what about the nonce and the IV? What's the main difference between them and their ...
curious's user avatar
  • 6,150
39 votes
3 answers
48k views

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
asudhak's user avatar
  • 491
25 votes
2 answers
15k views

Is RSA encryption with a private key the same as signature generation?

It is often said that RSA encryption of a cryptographic hash with a private key is the same as signing (signature generation). And that verification consists of decryption using a public key. Is RSA ...
Maarten Bodewes - mod election's user avatar
17 votes
1 answer
29k views

Bit Flipping Attack on CBC Mode

To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
CXB's user avatar
  • 311
7 votes
1 answer
3k views

Multiple AES Key Derivation from a master key

I need cryptography advice regarding this issue. Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
Omer Levi Hevroni's user avatar
24 votes
4 answers
6k views

Is it feasible to build a stream cipher from a cryptographic hash function?

A few years ago I devised a symmetric-key system that worked like so: ...
John Gietzen's user avatar
  • 1,505
77 votes
1 answer
61k views

Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?

I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area. I'm trying to understand that attack, but every explanation I saw starts with the ...
Bush's user avatar
  • 2,130
90 votes
4 answers
104k views

What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?

AES has several different variants: AES-128 AES-192 AES-256 But why would someone prefer use one over another?
samoz's user avatar
  • 3,236
70 votes
3 answers
115k views

Why shouldn't I use ECB encryption?

I'm using Java to generate encrypted strings, and I get this warning at build time: ECB encryption mode should not be used So I'm wondering why I shouldn't use ECB and what I can use instead?
Rogue's user avatar
  • 826
189 votes
23 answers
29k views

Time Capsule cryptography?

Does there exist any cryptographic algorithm which encrypts data in such a way that it can only be decrypted after a certain period of time? The only idea that I can think of, is something like this: ...
user avatar
22 votes
5 answers
9k views

Using CBC with a fixed IV and a random first plaintext block

What if, instead of using CBC mode in the normal way with a random IV, I used this approach: Use a fixed IV (like a block of 0's). Before encrypting, generate a random block and prepend it to the ...
danieltorres's user avatar
72 votes
4 answers
41k views

How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?

RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large (encrypted) message. How can I do this?
samoz's user avatar
  • 3,236
6 votes
3 answers
2k views

How can frequency analysis be applied to modern ciphers?

I am building a computer program that deciphers Caesar, Vigenere and monoalphabetic substitution ciphers. All of those are susceptible to frequency analysis. However, it does not seem to be real-world ...
Marvin's user avatar
  • 165
46 votes
5 answers
10k views

Is there a secure cryptosystem that can be performed mentally?

I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely. However, I can think of many practical situations in which mental ...
John Gietzen's user avatar
  • 1,505
38 votes
2 answers
24k views

Why should I use Authenticated Encryption instead of just encryption?

There are various different modes of operation for block cipher use, some of which provide "encryption" and some of which provide authenticated encryption. Why should I use an authenticated ...
Cryptographeur's user avatar
24 votes
4 answers
38k views

Is using the same IV in AES similar to not using an IV in the first place?

So if I understand how an IV works with AES, I'm supposed to generate a different IV for every message because using only a key, I will get the same encryption if the message was encrypted twice (...
Ali_Nass's user avatar
  • 343
99 votes
1 answer
167k views

What is the difference between PKCS#5 padding and PKCS#7 padding

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
Maarten Bodewes - mod election's user avatar
37 votes
2 answers
13k views

Why should I use an Initialization Vector (IV) when I have unique keys?

I took a look at “Why, or when, to use an Initialization Vector?” but my question is not the same. I have unique keys encrypting each plaintext (in CBC mode, AES-256) and I do not use a key to ...
Ashwin's user avatar
  • 473
148 votes
5 answers
130k views

What is a cryptographic "salt"?

I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it. Can I get a ...
Bhavik Ambani's user avatar
41 votes
2 answers
24k views

Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?

I'm wondering why we use encrypt-decrypt-encrypt (EDE) sequence in 3DES (also known as DES-EDE, TDES or TDEA) with three keys instead of three times encryption (EEE) with three different keys?
alaamub's user avatar
  • 583
20 votes
2 answers
3k views

Is the encryption of a hash a good MAC?

At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = \mathrm{hash}(k||\mathrm{data})$...
user avatar
4 votes
2 answers
2k views

Mathematical formula for switching the key for OTP?

Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? The new key must be as random and ...
Anonymous's user avatar
32 votes
2 answers
25k views

Using the same RSA keypair to sign and encrypt

The RSA signature operation is basically the same as encrypting with the private key. In particular, both operations use the same kind of keys. Is it safe to use the same RSA keypair both for ...
Lay András's user avatar
59 votes
2 answers
12k views

Is the software that uses PGP broken, or is it PGP itself?

PGP is all over the news (even on TV) and there seems to be a lot of confusion about it. For the time being, people face articles like Attention PGP users: new vulnerabilities require you to take ...
e-sushi's user avatar
  • 17.9k
43 votes
6 answers
15k views

Is Convergent Encryption really secure?

Recently a company called Bitcasa demonstrated a product of cloud storage. they indicated that they would use "Convergent Encryption" to secure your data and de-duplicate, essentially one copy of the ...
Justin King's user avatar
28 votes
2 answers
34k views

Why is asymmetric cryptography bad for huge data?

I've been told that asymmetric cryptography requires that the message to be encrypted be smaller than its key length. Why is this? I know about hybrid encryption, which uses symmetric encryption to ...
K_X's user avatar
  • 393
18 votes
5 answers
11k views

Is it easy to crack a hashed phone number?

I want to SHA256 hash phone numbers in order to hide them. Is this a good idea? Are there any other ways I could make this safe?
Jack Resone's user avatar
58 votes
3 answers
117k views

RSA encryption with private key and decryption with a public key

When using the RSA cryptosystem, does it still work if you instead encrypt with the private key and decrypt with the public key? What about in the case of using RSA for sender authentication?
Humam Shbib's user avatar
33 votes
5 answers
17k views

Any practical uses of machine learning for cryptography?

I am about to go study for my masters in machine learning, data mining and high performance computing, but have recently become very interested in cryptography after taking Dan Boneh's Cryptography ...
Michael Aquilina's user avatar
5 votes
2 answers
2k views

Is using 7-8 random words from all words of a language as password a good idea?

The Bitcoin Bip-39 dictionary has 2048 words. And a random 24 of them are pretty secure together. What if the source is bigger (all words in the language) but there are only about 7-8 words? These ...
Anonymous's user avatar
4 votes
2 answers
2k views

Is direct RSA encryption of AES keys secure?

I am wondering: If we take this scheme/procedure and each of it seems very secure (to me at least), is it truly secure or is there a vulnerability hidden in the process? This is the scheme: Bob has ...
alberto123's user avatar
163 votes
10 answers
46k views

Why is writing your own encryption discouraged?

Say I want to write an encryption algorithm to communicate between me and my friend for this private use. How is that bad? E.g. I can take the word Hello and ...
Pierte's user avatar
  • 1,537
27 votes
2 answers
3k views

Why is PuTTYgen-created RSA public exponent(e) not in {3,17,65537}?

As far as I know, RSA public exponent(e) should be one of {3,17,65537}. However, I found PuTTYgen-created RSA public exponent(e) is 0x25(37) by default,as follows, (PuTTYgen version: 0.66) I am ...
Matt Elson's user avatar
24 votes
4 answers
5k views

How will Cryptography be changed by Quantum Computing?

I realise this isn't a 'yes or no' question, and I apologise for asking something that could be seen as a discussion thread, but I had to ask. I'm currently doing an EPQ in CS (specifically how QC ...
Cameron Allan's user avatar
24 votes
2 answers
6k views

How exactly was the finalist chosen in the NIST AES competition?

I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen: Unfortunately the NIST site is down so I can't gain further information ...
J_M's user avatar
  • 341
14 votes
3 answers
29k views

Deciphering the RSA encrypted message from three different public keys

I have three different 1024-bit public keys with common exponent $e$ but different moduli. A message $m$ is encrypted (without padding) using the three keys, which results in three different encrypted ...
user3719749's user avatar
11 votes
4 answers
38k views

Can I find the encryption key if I know the plain text and the encrypted text (DES and AES)?

If I have the plain text and its output after encryption with a key K1, is it algorithmically feasible to find K1? I am specifically interested in the cases of DES and AES encryption algorithms.
Joezer's user avatar
  • 213
6 votes
1 answer
5k views

Encrypt a file with AES using a secret key derived with Argon2

I would like to encrypt some sensitive files on my computer and smartphone so that they remain unreadable even if the computer is stolen. So far as I'm concerned, AES is the best encryption algorithm,...
K. Gabor's user avatar
59 votes
4 answers
125k views

Difference between stream cipher and block cipher

I read that A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time. (...
Ravindra Bagale's user avatar
40 votes
2 answers
19k views

How does order-preserving encryption work?

Order-preserving encryption (OPE) is, apparently, a method of encrypting data so that it's possible to make efficient inequality comparisons on the encrypted items without decrypting them. I've been ...
Ilmari Karonen's user avatar
26 votes
3 answers
12k views

How is the One Time Pad (OTP) perfectly secure?

The Wikipedia entry on One Time Pads (OTPs) states that if this cipher is used properly; ie, the keys are truly random and each part of the key is independent of every other part, it's uncrackable, ...
xyz's user avatar
  • 455
20 votes
4 answers
22k views

Can CBC ciphertext be decrypted if the key is known, but the IV not?

Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file? How hard is it?...
Ben's user avatar
  • 365
7 votes
2 answers
3k views

How to create an EC point from a plaintext message for encryption

It seems that ElGamal encryption is also possible for Elliptic Curve cryptography. However, that requires the user to convert the message to a point on the curve. What strategies are there to derive a ...
Maarten Bodewes - mod election's user avatar
7 votes
3 answers
3k views

A simple block cipher based on the SHA-256 hash function [duplicate]

I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
user avatar
89 votes
10 answers
18k views

In end-to-end encryption, doesn't the server need to be trusted?

Applications like WhatsApp use end to end encryption. WhatsApp says that only the users share a specific key and no third party can view the messages. But I do not understand how the two users agree ...
AV94's user avatar
  • 1,009
27 votes
3 answers
10k views

Plain text size limits for AES-GCM mode just 64GB?

Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB. We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ...
DeepSpace101's user avatar
  • 1,697
23 votes
3 answers
3k views

How to publish a cipher (concept)?

In the last months I was searching for a subject for my bachelor thesis. I came up with an idea for a new cipher concept that works by combining already known techniques in a (hopefully) new way. So ...
masinger's user avatar
  • 463
22 votes
4 answers
81k views

How long would it take to brute force an AES-128 key?

How long would it take to crack a AES-128 key using the most advanced technology currently available? The hardware can be anything, be it a high-performance CPU, GPU or even FPGA?
Joy's user avatar
  • 321

1
2 3 4 5
15