# Tag Info

49

We don't.${}{}{}{}{}{}{}{}{}{}$

33

We don't ever know, in the information theory sense, that a crypto algorithm wont fail suddenly. If we ever knew that, we'd quit using it. However, it has been shown that crypto algorithm failing has a strong tendency to fail according to a two step process: Most crypto algorithms fail quickly in the initial analysis phase, as we apply a pile of known ...

14

yyyyyyy's answer is the correct short version. There is only a single cryptographic algorithm that is mathematically proven secure: the one-time pad. It's hardly ever used because it's impractical: the key size is as large as the data to protect. You can prove that any algorithm that is secure against an adversary with infinite computational power is ...

11

What choice did they have? F1 is a bitwise function with three inputs and one output. There are $2^8 = 256$ such functions. Only 70 of them are "unbiased" (i.e. have as many 0 and 1 outputs in their image). If you further require that each input, as well as the order of inputs, matters for the output, you are left with only 36. However, those 36 are all ...

10

NO, we can't apply an hill-climbing algorithm to Diffie–Hellman. In order to break Diffie-Hellman key exchange, it is enough for Eve to reverse exponentiation modulo the public prime $p$; that is, given $g^x\bmod p$, find $x$. That's the Discrete Logarithm Problem. We do not know that hill-climbing can help for that (or the slightly less general DH ...

10

The simple answer is nobody can prove that an algorithm won't break in a given period of time. The achievable goal is to increase the probability that no effective attack will be developed without warning. There are a couple of characteristics that indicate a particular cipher may remain secure and if degraded will do so 'gracefully'. 1. Time. Time is the ...

9

Contrary to your assumption, this is done, and it is secure: For instance, the hash functions SHA-224 and SHA-384 are basically the same algorithms as SHA-256 and SHA-512! The only differences are in the initial values for the Merkle-Damgård construction used internally and, of course, in that only the first $224$ or $384$ bits of the resulting hash are ...

8

Grover's algorithm treats the function it is evaluating as a black box and finds, with high probability, an input to the black box such that it outputs a specified value in $O(N^{1/2})$ evaluations of the function. Since Grover's algorithm works on the function as a black box, your modification does not hinder Grover's algorithm at all in finding the ...

7

XSalsa20 uses the same cryptographic core as Salsa20 and comes with a security proof that it's secure if Salsa20 is secure. It doesn't use the core of ChaCha and thus has worse diffusion. The way XSalsa20 works is that it hashes its 256 bit key and the first 128 bits of the nonce using HSalsa down to a 256 bit key and then uses that key together with the ...

7

"In software" means programming the cipher on a multifunctional processor or smart chip. The normal instruction set is used to build the algorithm, and not available operations have to be emulated. "In hardware" means building the cipher in real hardware, like on a Field-programmable gate array (FPGA) or Application-specific integrated circuit (ASIC). ...

6

GF$(2^8)$ or $\mathbb F_{2^8}$ can also be viewed as the vector space $\mathbb F_2^8$ of $8$-bit vectors (or bytes) over GF$(2)$ or $\mathbb F_2$. Suppose $\{\beta_0, \beta_1, \cdots, \beta_7\}$ is a basis of $\mathbb F_2^8$ over $\mathbb F_2$, that is, the sum $$a_0\beta_0 \oplus a_1\beta_1 \oplus \cdots \oplus a_7\beta_7, ~ a_i \in \mathbb F_2$$ equals ...

6

There are attacks on both blockciphers and hash functions that can exploit symmetry in the round functions. For example, completely identical round functions can permit Slide Attacks on Hash Functions, and rotational symmetries of the round function can permit rotational cryptanalysis. The round constant addition or 'iota' step of the Keccak Hash Function ...

6

Your doubts are absolutely valid. Disguising the algorithm is not a valid argument for security. It also contradicts to Kerckhoffs Law. It (the algorithm) should not require secrecy, and it should not be a problem if it falls into enemy hands; Designing cryptographic algorithms (ciphers, hashfunctions, ...) is a long and complicated process. In ...

6

The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a lot cheaper). With HMAC, here is what we have: we have an authenticator that has a secret key. It takes a message, and gives that (and the secret key) to the ...

5

The numbers $n$ (coding source) and $m$ (coding index for a given source) can be combined into a single bitstring; e.g. with $0\le m<2^u$ and $0\le n<2^v$, as a bitstring of $\lceil u+v\rceil$ bits. Then, converting that single bitstring into a unique random-like number can be done by encryption with a secure block cipher with block width $w\ge u+v$ ...

5

As I noted in another answer, Auguste Kerckhoffs published his principles in the scientific/academic journal “Journal des sciences militaires, vol. IX, pp. 5–38 in his article "II. DESIDERATA DE LA CRYPTOGRAPHIE MILITAIRE.", Jan. 1883. So, when you ask since when academics and cryptographers “might” have been accepting (and even applying) those rules, the ...

5

First, it's not said that AES is unbreakable, merely that none of the currently known attacks reduce the computational cost to a point where it's feasible. The current best attack on AES-128 takes 2^126.1 operations, if we had a computer (or cluster) several million times more efficient than any current computer and could operate at the thermodynamic ...

5

The pseudocode has a serious issue: changing the value of nonce2 in an otherwise valid cryptogram is not detected, and results in invalid deciphered plaintext. That would be fixed by encrypt(password, string): nonce1 := generate_random_nonce() nonce2 := generate_random_nonce() key := derive_key(nonce1, password) encrypted := nonce2 || cipher(nonce2, ...

5

Most standard-use iterative hash functions (including SHA-512) are build in a way that these types of operation are not possible (without breaking the hash function). They work generally in this way: The message is split in same-size blocks (usually with some padding at the end to fill the last block): $pad(M) = M_0 || M_1 || M_2 ... || M_n$. There is ...

5

No, or at least, if you can, you have an Extremely Significant result; you've just shown that Paillier is a Fully Homomorphic system, and so it could perform any operation on encrypted data (and in a way that's significantly more efficient than any other known FHE system). Here's why: The $|a - b|$ operation is effectively an $XOR$; if the ciphertexts $a, ... 4 There is a simpler way: implement a stream cipher using the hash function, and use that to encrypt the plaintext. Probably the most used stream mode is counter (CTR) mode, which is normally defined for block ciphers. CTR mode works equally well with a PRF (MAC) as with a PRP (block cipher). It only uses the function as a one-way function; with a block ... 4 Yes you could use a hash function as round function, but if you are using the "same key" over all rounds, you are vulnerable to slide attacks. Using a hash function is not a very good idea. Your round function should not introduce biases, should not lead to special differences (attack: differential cryptanalysis), and it should also not be writable as a ... 4 There are in the RFC : http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04#section-7 The following blocks contain test vectors for ChaCha20. The first line contains the 256-bit key, the second the 64-bit nonce and the last line contains a prefix of the resulting ChaCha20 key-stream. KEY: ... 4 You are essentially asserting that if$k \equiv 1 \pmod N$, then$a^k \equiv a \pmod N$. This is false in general. The correct assertion is the following:$a^k \equiv a^\ell \pmod N$if$k\equiv \ell \pmod{\phi(N)}$. In more general group-theoretic terms, if$a$is an element of order$n$in a group$G$, then$a^k = a^\ell$if and only if$k \equiv \ell ...

4

Does the value of the key array(T) have to be in this range [0-255] if yes could you please specify why? Yes. RC4 operates on bytes. There are 256 possible values for an 8 bit (1 byte) number, that range from 0 to 255. RC4 treats the key as an array of bytes, so every entry in the key array is by definition in the range 0 to 255. Why did they use ...

4

Before answering the actual question, I will offer some general advice. It is important to pay attention, both in class and to the textbook you are reading. If learning how to solve such exercises is a key goal of the course, such solutions have very probably been discussed at length in class. Moreover, your textbook also has proof examples, and in this ...

3

"Software" in this case generally refers to software with few threads, but possibly quite a lot of memory accesses/bandwidth required. Memory bandwidth is expensive in die area, so hardware isn't suited to things that use tons of memory. eg scrypt requires quite a lot of memory, bcrypt makes a lot of data-dependent memory reads, etc. You CAN make hardware to ...

3

First things first: what you are describing there is not a one-time-pad! As I explained in another answer of mine: Per definition, OTP requires the “key“ to be… a truly random one-time pad value, generated and exchanged in a secure way, at least as long as the message, and only to be used once. What you describe (eg: using a key ...

3

This scheme is vulnerable to a "truncation attack", which allows an attacker to forge new ciphertexts (EN-FILEs). Here's how this works. Assume that the attacker controls a section of the plaintext and can predict (with reasonable probability) the plaintext prior to that section. In another words, a value $A \| B \| C$ is encrypted, where $A$ is ...

3

Server receives three messages: $I=x+z$. This is the value $x$ encrypted with a one-time pad $z$. The server cannot find $x$ without knowing (something about) $z$. $w$. This is (presumably) independent of anything secret. $c=(-z)\cdot w+a$. This is the value $(-z)\cdot w$ encrypted with a one-time pad $a$. The server receives no information about ...

Only top voted, non community-wiki answers of a minimum length are eligible