Tag Info

6

It looks like, given your adversary model, things should be secure. HMAC as a randomness extractor has been shown to be good, especially when we can assume the hash function is collision resistant. That paper also has some results which tell how you could guard against the collision resistance being broken (basically use a hash function with larger output ...

4

It mainly depends on how the algorithm was selected. If it was selected by a public competition like for AES, then it is likely to be secure. If it was forced in by the NSA such as Dual-EC random number generator, then you may have some doubts. Other questions you may want to ask yourself are: Is this an "original" algorithm or was the problem that it ...

4

From the sound of your questions, it almost appears that you have some confusion between the CBC-MAC key and the CBC-MAC tag. The CBC-MAC algorithm takes the message (in this case, most likely the ciphertext) and a secret key; it outputs a tag (which can be public). The security property of CBC-MAC is that someone who does not know the key cannot generate ...

3

AES is a block cipher which actually only "maps" (encrypt) a 128 bit block (plainblock) to a 128 bit block (cipherblock) and vice versa. This "mapping" is key dependent. To encrypt some data you normally apply an encryption mode like CBC, CTR, GCM etc. using e.g. AES as block cipher within this mode. These modes normally require an IV or Nonce. So, not ...

3

If you can read the intermediate states of the encryption algorithm you could recover, one by one all the round keys. Given a AES round, all the operation between the two AddRoundKey (at the beginning and the ond of the round) are invertible. Take for example round 1: you get the internal state before AddRoundKey (of round 2), you get back at the beginning ...

3

The catch how ever is that if a small part of the file is given along with the location of that bytes from the beginning of the file we should be able to decrypt just that piece. Normal CTR mode encryption allows one to decrypt any block of the file independent of the rest, so no need to invent your own mode. With AES the block size is always 128 bits, ...

3

You basically want a full disk encryption mode for a block cipher; XTS mode seems to be the current standard. In your case each "disk block" is actually a file offset. Note that using a stream cipher or counter mode is NOT secure if the data is ever modified in the file, as it would violate the cardinal sin of using the same key and initialization vector to ...

3

Other advantages of CTR are: easier to decrypt from a certain offset within the ciphertext no randomness requirements for the nonce nonce can be calculated, e.g. be a simple counter nonce can be a message identifier $E = D$: encryption is the same as decryption, which means only encryption or decryption required from the block cipher less logic ...

3

There seems to be an attack on SSH when using CBC: Plaintext Recovery Attacks Against SSH. I have just scanned the paper and they state, that this will not be possible when CTR mode is used. I don't think that en-/decryption parallelization is need or even utilized in SSH. Update: Link to CERT concerning the topic: Vulnerability Note VU#958563 SSH CBC ...

3

You should never keep keystreams. You should keep a key, and store an IV or Nonce with the ciphertext. You first need to think about where to store the key, if you store it in the same location or with the same security as your ciphertext, your scheme is meaningless. Check this answer I just created on Stackoverflow, and learn about key management. This ...

3

This algorithm is vulnerable to a Man in the middle. From Wikipedia: In the original description, the Diffie–Hellman exchange by itself does not provide authentication of the communicating parties and is thus vulnerable to a man-in-the-middle attack. Mallory may establish two distinct key exchanges, one with Alice and the other with Bob, effectively ...

2

Yes, it's secure. It is somewhat overkill, however, since you could stop replay attacks by using either: a persistent counter as IV, or a random nonce, and including a timestamp in the message. The AEAD must authenticate the IV (and GCM certainly does), so either would work without requiring any extra round-trips. You can just use the IV in the initial ...

2

Using Diffie-Hellman key agreement for generating a nonce should be safe as long as both key pairs are ephemeral, i.e. generated for each run of the key agreement protocol. Otherwise a man-in-the-middle can fool one of the parties in generating the same nonce over and over again. Ephemeral Diffie-Hellman is however overkill for generating a nonce, as the ...

2

There is no uniform permutation; there is a permutation uniformly chosen from the set of all possible permutations over $Z_2^{128}$. It is evident that AES is not a uniformly chosen permutation, since its permutation is fixed for any key. One can consider a family $\{AES_K\}$ of AES permutations under all possible keys $K$. Even if the key is chosen ...

2

There is book Algebraic Aspects of the Advanced Encryption Standard thats gives a good algebraic description of the AES algorithm. Reading it you'll see that there was some freedom in choosing some parametres to fix a standard. Changing this choices, but keeping the algebric properties should give you an equivalent algorithm. This mainly means you can ...

1

As additional detail, while the two keys need to be distinct and secret, you can derive the CBC-MAC key and the CBC encryption key from the same master key. Generate a random master key, then use any key derivation algorithm with two different salts to derive the authentication and encryption keys. For example, $K(m, \text{'auth'})$ and $K(m, \text{'enc'})$ ...

1

There are good reasons to think an algorithm being in Suite B is evidence NSA thinks it's secure (they are used to protect classified materials). There are also reasons to think algorithms they recommend for others may not be (it's happened before). So I don't think you can objectively say much about an algorithm either way just on the basis of whether it's ...

1

If the question is "can we define a function that, given $s(a)$ and $s(b)$, gives us the value $s(a \oplus b)$, the answer is, yes, of course we can; the obvious implementation of such a function is: $F(x, y) = s( s^{-1}(x) \oplus s^{-1}(y))$ With this function, if $x=s(a)$ and $y=s(b)$, the $F(x,y) = s(a \oplus b)$ However, the real question you need to ...

1

What is the probability that both [Hu] = [Hmu] and [He] = [Hme]. In english, what is the chance that two different files can have identical hashes in both an unencrypted and encrypted form? Depends on whether they are "random" files or attacker controlled. MD5 is a 128-bit hash, so for two random files that differ the probability that they have the ...

Only top voted, non community-wiki answers of a minimum length are eligible