# Tag Info

13

The algorithm (now reasonably clear) is reminiscent of a block cipher in CFB mode, with $random$ as the IV (which can be public), $secret$ as the key, and MD5 used as keystream generator instead of the block cipher. Decryption works as in CFB: $$M_1 = C_1 \oplus \operatorname{MD5}( secret||random )$$ M_n = C_n \oplus \operatorname{MD5}( secret||C_{n-1} ...

9

Sure. If you want a $b$-bit hash of the message $m$, then use the first $b$ bits of AES-CTR(SHA256($m$)). That'll do the trick. In other words, compute SHA256($m$) and treat the resulting 256-bit string as a 256-bit AES key. Next, use AES in counter mode (with this key) to generate an unending stream of pseudorandom bits. Take the first $b$ bits from ...

8

If a block cipher is linear with respect to some field, then, given a few known plaintext-ciphertext pairs, it is possible to recover the key using a simple Gaussian elimination. This clearly contradicts the security properties one expects from a secure block cipher.

8

It's not clear from your decryption what the algorithm is used for. But you should be aware that while at first glance it provides privacy : it's a weird mode CFB with md5 used as a block cipher ; it doesn't provide authenticity. A simple bit flip of the ciphertext will result in the corresponding bit being flipped in the plaintext and such a bit flip ...

7

Mostly yes: usual cryptographic operations, including hashes, are defined using operations on integers and bit vectors, not Floating Point Numbers. I think the main reason is that in cryptography, we need different computers (e.g. the one that hashes a file to protect its integrity, and the one that verifies the integrity) to get the exact same result, and ...

7

In general, each combination of a (secure) hash function for input with a (deterministic) pseudo random number generator for output will work here - one "state of the art" example is the one given by D.W. (using AES-CTR as PRNG and SHA-256 as hash). Another way is similar to what PBKDF-2 does to have output with the right length: hash the input (or a hash ...

6

EDIT: The following block of text (between the lines) was written as an answer to the original question, which did not explicitly state that the secret was used for any blocks after the initial one. Hmmm, I assume that the goal of this algorithm is to provide privacy; that is, to create an encrypted message, and someone that hears this encrypted message ...

5

As D.W. notes, you can use the output of any conventional hash function to key a stream cipher (or a block cipher in a streaming mode like CTR), and then take the output of the cipher as your digest. However, there has been a trend in modern hash function design to support arbitrary-length output directly, without the need for additional layers. For ...

5

The fragment " what to do about padding the key ? " of the question looks scarily like transforming a password into a cryptographic key using some padding mechanism. Doing this would be a known, serious, often made and often exploited mistake. A standard security assumption for ciphers is that the key is chosen at random, and a padded password is not random ...

5

I think that a stream cipher would be the natural progression from a Vinegere, (before moving onto a block cypher). ARC4 would be my choice and there are good argument for that made by Arnold Reinhold over on http://ciphersaber.gurus.org/

5

Here's the cryptography theory perspective. We want block ciphers to resemble pseudo-random permutations (PRPs). PRPs are a desirable modeling goal because a block cipher under a given key is a permutation on the input, and a PRP is simply a random collection of permutations. The block cipher's key can never be better at creating permutations than an actual ...

5

The Skein family of hash functions (submitted to NIST for the SHA-3 competition, but not selected as the winner) has a really well-written paper that tries to go into detail for how it was designed, how constants were chosen, etc. It might be a good place to start.

5

Points 3 and 4 are a secure way of storing the input to bcrypt (with appropriate choice of parameters for bcrypt). Points 1 and 2 aren't necessary but don't harm: they would add a small amount of extra computation for an attacker is possession of the password database that wants to do a dictionary attack; the attacker wouldn't be able to straight-out use ...

4

A simple block cipher would be Threefish (p. 11-13). It's a bit more complicated than RC4 or RC5 yet doesn't drive you insane with seemingly random design choices. It is presumably secure and was designed by experts but has not yet been reviewed extensively, so it shouldn't be used in sensitive applications yet (consider it an exercise). You'll be able to ...

4

The goal for salts is that they be unique to each account and that they be values highly unlikely to appear in a rainbow table. Here, if usernames are unique then so are the salts. Since hash values are long and random, they won't be in rainbow tables. So hashing the username looks like it provides a good salt value to the extent that usernames are unique in ...

4

Montgomery arithmetic is used only for modular multiplication. At the cost of some pre- and post-computation (of mostly negligible cost in the case of modular exponentiation in the context of cryptography with exponents big enough to be private), it simplifies the modular reduction step, by avoiding possible mis-estimation of the quotient, and allowing to ...

3

There are schemes of this form. The keyword is "proxy re-encryption". Searching the cryptographic literature will find you instances of schemes like this. I think that's what you're looking for; in any case, I suggest you read about them, determine whether they meet your requirements, and if not, explain in your question how your problem differs. ...

3

Mathematically, a block cipher is just a keyed pseudorandom permutation family on the set $\{0,1\}^n$ of $n$-bit blocks. (In practice, we usually also require an efficient way to compute the inverse permutation.) A block cipher on its own is not very useful for practical cryptography, at least unless you just happen to need to encrypt small messages that ...

3

If for some reason the solution given by @poncho does not please you (e.g. you want $N$ to be on the magnitude of a few billions but you do not have a few gigabytes of RAM), then there are other solutions, in which you get the permutation as an evaluable procedure (in other words, a block cipher). A practical solution is the Thorp shuffle. It is ...

3

From what could gather from the chat yesterday, you are looking into a scheme that implements some kind of locality preserving hashing. Let me first explain how I understood the scheme you are describing: Given a feature extractor $E : \{0,1\}^* \rightarrow {\{0,1\}^k}^n$ (i.e. given a message $m$ it extracts $n$ features of lenth $k$) and a cryptographic ...

3

I don't think that's possible, at least not without the kind of intrusive mechanisms you'd need for reliable DRM. Basically, if the user gets a key that lets them decrypt the files, what's to stop them from just decrypting them all and keeping the decrypted versions? The only way this could possibly work if you only allowed access to the files through a ...

3

Of course there are ways to do that. See for example, Secure Integer Comparison with Applications in Economics which is implemented in VIFF. Also, solutions to the millionaire's problem would probably do the trick too. There are lots of these. Just search around for solutions to that problem.

3

The IV for a block cipher in CBC mode must not only be "uniquely used for each message encrypted with the same key". It is usually assumed to be indistinguishable from random by an adversary. If the IV is predictable, some attacks apply. For example, if an attacker is able to choose plaintext messages with prior knowledge of what the IV will be for this ...

3

One of the best avenues for study is to practice breaking existing cyphers. Start small, with classic cyphers such as monoalphabetic substitution, polyalphabetic cyphers, transpositions, etc. Do the daily Cryptoquip in the newspaper! Learn what makes them weak, what makes them exploitable, and what makes them strong. Then move on to stream cyphers, to ...

3

I think what you want to look at is "fair exchange". There's a giant catalog of protocols for fair exchange. They've been designed for doing exactly what (I think) you want. See, e.g., https://en.wikipedia.org/wiki/Multi_party_fair_exchange_protocol Alice trusts Bob only when Bob trusts Alice Some fair exchange protocols require a third party who ...

2

You've asked two different questions here: Q1: how to put a trapdoor in a block cipher, and Q2: examples of block ciphers that are good for learning block cipher cryptanalysis. @mikeazo has answered question Q2 well. I'm going to answer question Q1. For an example of how to put a hidden backdoor (trapdoor) in a block cipher, see the following research ...

2

You should read the following paper: Cascade ciphers: The importance of being first, Ueli M. Maurer and James L. Massey. Journal of Cryptology, volume 6, number 1, pp.55-61, 1993. It covers exactly this topic. The conclusion is: if you use independent keys, and if we are talking about ciphertext-only or known-plaintext attacks, the combination is ...

2

You should look at AdHash, by Bellare et al. It computes something like $\sum_i H(i,M_i) \bmod n$ where $M_i$ is the $i$th block of the message. I think this is almost exactly the sort of thing you were suggesting. The problem with AdHash is that, for it to be secure, $n$ needs to be quite large, e.g., 1600 bits or more. This hurts efficiency. (If $n$ ...

2

Well, the problem "given a finite set $A$ of integers, is there a subset that sums to a target value $B$" is known as the Subset Sum problem; it is known to be hard. Specifically, the decisional problem (is there such a sum) is NP-complete, and the computational problem (find the subset) is NP-hard. That means that if you could solve large instances of ...

2

The classical way to generate a random permutation is the Fisher-Yates shuffle; it takes an underlying random number generator, and produces a random permutation. With just a bit of care, it can generate each permutation with equal probability (assuming the underlying random number generator outputs are independent and uniformly distributed). The only ...

Only top voted, non community-wiki answers of a minimum length are eligible