All Questions
53
votes
5answers
6k views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
48
votes
10answers
3k views
Is modern encryption needlessly complicated?
RSA, DES, AES, etc. all use (relatively) complicated mathematics to encrypt some message with some key. For each of these methods, there have been several documented vulnerabilities found over the ...
45
votes
7answers
15k views
How is CipherCloud doing homomorphic encryption?
Much of the literature and latest papers suggest that homomorphic encryption is still not practical yet.
How is CipherCloud able to achieve this? Does anyone have an idea? Their website does not ...
45
votes
14answers
3k views
Time Capsule cryptography?
Does there exist any cryptographic algorithm which encrypts data in such a way that it can only be decrypted after a certain period of time?
The only idea that I can think of, is something like this: ...
27
votes
5answers
2k views
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
27
votes
4answers
5k views
What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?
AES has several different variants (AES-128, AES-192, AES-256), but why would I use one over another?
26
votes
2answers
1k views
What makes a hash function good for password hashing?
Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
25
votes
5answers
3k views
How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
I am often told that any key can be broken and that it is only a matter of time and resources for any key to be broken. I know that this it technically true. However, I think that there is probably a ...
24
votes
3answers
3k views
What are the benefits of the two permutation tables in DES?
Why do we use a permutation table in the first step of DES algorithm and one at the end of algorithm?
21
votes
4answers
6k views
How can I generate large prime numbers for RSA?
What is the currently industry-standard algorithm used to generate large prime numbers to be used in RSA encryption?
I'm aware that I can find any number of articles on the Internet that explain how ...
20
votes
10answers
2k views
Now that quantum computers have been out for a while, has RSA been cracked?
D-wave systems has released a commercially viable quantum computer. This means; in theory, that all asymmetric encryption algorithms, such as RSA are now useless, due to the speed at which quantum ...
20
votes
3answers
3k views
How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?
RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large message.
How can I do this?
20
votes
5answers
6k views
Is Convergent Encryption really secure?
Recently a company called Bitcasa demonstrated a product of cloud storage. they indicated that they would use "Convergent Encryption" to secure your data and de-duplicate, essentially one copy of the ...
20
votes
1answer
1k views
What is the “Random Oracle Model” and why is it controversial?
What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else?
And why do some researchers have a strong distrust of this model?
20
votes
4answers
2k views
Is AES-256 weaker than 192 and 128 bit versions?
From a paper (via Schenier on Security's Another AES Attack) (emphasis mine):
In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. ...
20
votes
1answer
1k views
Does the generator size matter in Diffie-Hellman?
For the Diffie-Hellman protocol I've heard that the generator 3 is as safe as any other generator. Yet, 32-bit or 256-bit exponents are sometimes used as generators. What is the benefit of using ...
20
votes
2answers
958 views
How do I apply differential cryptanalysis to a block cipher?
I've read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are, for example, vulnerable to differential cryptanalysis.
I ...
19
votes
4answers
5k views
Why is elliptic curve cryptography not widely used, compared to RSA?
I recently ran across elliptic curve crypto-systems:
An Introduction to the Theory of Elliptic Curves (Brown University)
Elliptic Curve Cryptography (Wikipedia)
Performance analysis of identity ...
19
votes
3answers
882 views
Information leakage from the ecryptfs filesystem
I'm wondering what information might be leaked from the ecryptfs filesystem. This is what Ubuntu uses if you check the box for "encrypted home directory" when using the desktop installer, so is ...
18
votes
4answers
433 views
Necessity of Randomness of Salts?
Given the desire to have unique salts for each user of your system, is it actually necessary to create a cryptographically-random salt for each user? If your system already has some other unique user ...
17
votes
2answers
825 views
How are primes generated for RSA?
As I understand it, the RSA algorithm is based on finding two large primes (p and q) and multiplying them. The security aspect is based on the fact that it's difficult to factor it back into p and q. ...
17
votes
1answer
1k views
Could one prevent double spending in decentralized digital currencies (like Bitcoin) without all transactions being public?
A recent approach to creating a decentralized online currency, called Bitcoin, has been generating some interest. The goal is to have a way to transfer currency without a central authority and without ...
16
votes
5answers
7k views
Taking advantage of one-time pad key reuse?
Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
16
votes
3answers
1k views
How big an RSA key is considered secure today?
I think 1024 bit RSA keys were considered secure ~5 years ago, but I assume that's not true anymore. Can 2048 or 4096 keys still be relied upon, or have we gained too much computing power in the ...
16
votes
3answers
2k views
Identifying encryption method from encrypted string
Is it possible to identify the encryption method or atleast rule out some, by looking at the encrypted text?
For example, if you have 3 encrypted strings where the first 10 characters are the same on ...
16
votes
6answers
900 views
Is there a secure cryptosystem that can be performed mentally?
I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely. However, I can think of many practical situations in which mental ...
16
votes
5answers
1k views
Current mathematics theory used in cryptography/coding theory
What are the mainstream techniques borrowed from algebraic geometry (or some other branch of mathematics) which are currently used in cryptography/coding theory? I've only heard about a small subset ...
16
votes
4answers
648 views
How to fairly select a random number for a game without trusting a third party?
Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.)
Can this be done such that each player has the power to be ...
16
votes
1answer
346 views
Selective format-compliant JPEG encryption?
I am working towards building a format-compliant encryption system for pictures. The aim of it is to be able to obscure specific areas of a picture (i.e. faces, car license numbers...) while keeping ...
15
votes
6answers
239 views
advances in usability for cryptography/authentication
I'm wondering if there have been any recent advances (say, the past 5-10 years) in human usability for cryptography and/or authentication?
By that I mean something that makes it easier for an ...
15
votes
4answers
5k views
Google is using RC4, but isn't RC4 considered unsafe?
Why is Google using RC4 for their HTTPS/SSL?
$ openssl s_client -connect www.google.com:443 | grep "Cipher is"
New, TLSv1/SSLv3, Cipher is RC4-SHA
Isn't RC4 ...
15
votes
2answers
1k views
How were the DES S-box values determined?
It seems like the S-boxes in DES have essentially random values.
How were these chosen?
15
votes
3answers
673 views
Is using slow password hashing on the client side easier attackable than on the server side?
As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
15
votes
7answers
1k views
How can SSL secure a two-way communication with only one key-pair?
As I understand it, SSL involved the use of a public-private key pair. How does this enable two-way communication?
Suppose I have some server with which I wish to communicate securely. I connect to ...
15
votes
3answers
228 views
What differentiates a password hash from a cryptographic hash besides speed?
I understand that password hashes like bcrypt have the principal property of taking a long time to run, but I'm wondering what if anything about password hashes make them superior to merely running a ...
15
votes
1answer
405 views
Should I trust CipherCloud? [closed]
Should I trust CipherCloud's system for "homomorphic encryption" of data in the cloud?
Has the security of their system been subject to peer review or other cryptanalysis? Is there any known analysis ...
14
votes
3answers
1k views
Reverse engineering a hash?
I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question.
I have inputs and outputs from an ...
14
votes
5answers
5k views
How does asymmetric encryption work?
I've always been interested in encryption but I have never found a good explanation (beginners explanation) of how encryption with public key and decryption with private key works.
How does it ...
14
votes
2answers
648 views
Is HTTPS secure if someone snoops the initial handshake?
Let's say I'm on an open wireless network that's being actively sniffed and I connect to an HTTPS site. Even though my subsequent traffic is encrypted, couldn't the sniffer use the data from the ...
14
votes
2answers
686 views
How secure is the Bitcoin protocol?
Are there any evidence (other than not being cracked so far) that the Bitcoin protocol is secure? "How secure" is it?
(I realize that this might not qualify as a meaningful question - feel free to ...
14
votes
2answers
1k views
What is entropy?
We discuss a lot of topics and use measures of entropy to determine how difficult it is for an attacker to be successful. What does entropy mean in the context of cryptography? How is entropy ...
14
votes
3answers
5k views
How should I calculate the entropy of a password?
If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
13
votes
4answers
6k views
Best way to reduce chance of hash collisions: Multiple hashes, or larger hash?
I would like to maintain a list of unique data blocks (up to 1MiB in size), using the SHA-256 hash of the block as the key in the index. Obviously there is a chance of hash collisions, so what is the ...
13
votes
2answers
2k views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
13
votes
4answers
545 views
Is Wiener's attack on RSA extendable to larger keys with low hamming weight?
Using small private exponents with RSA improves performance.
However, it has been shown (Wiener, 1990) that if $\log d \leq \frac14 \log N$, the private exponent $d$ can be reconstructed from the ...
13
votes
2answers
963 views
How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world.
How can we reason about the symmetric ciphers cryptanalysis ...
13
votes
2answers
537 views
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
Wikipedia lists the following pseudocode for HMAC:
...
13
votes
1answer
389 views
Is this password migration strategy secure?
I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
13
votes
3answers
2k views
Is there a simple hash function that one can compute without a computer?
I am looking for a hash function that is computable by hand (in reasonable time). The function should be at least a little bit secure: There should be no trivial way to find a collision (by hand). For ...
12
votes
4answers
690 views
With sufficient randomness, is XOR an acceptable mechanism for encrypting?
I have heard criticism of various cryptosystems saying that "at their heart, they were just XOR."
Is this just ignorance, or is there something inherently wrong with XOR based ciphers?
