Tag Info

New answers tagged

0

SRP protocol is quite abstract so to provide matching implementation for version 6a you need to know following: N, g - group parameters H - hash function, there can be different hash functions used for different values how is private key x calculated how is shared session key K calculated how are evidence messages (M1, M2) calculated In addition you need ...


2

The algorithm produces a password based on the value of the time that is input as an argument. That value does not have to be the current time. For the purposes for which TOTPs are generally used, there is no value in producing the password for a time other than the current time step - it won't be recognized by the validator.


4

Where did SHAKE128 and SHAKE256 originate from? They follow from the general properties of the sponge construction. A sponge function can generate an arbitrary length of output. The submission of Keccak to the SHA-3 competition proposed a single "XOF" (extendable-output function) with a user defined length, which would have been essentially SHAKE-288. ...


11

I restrict to hash functions $H$ with an output of some fixed size $n\ge1$ bit(s), accepting as input some strings, including all $n$-bit strings; MD5 (resp. SHA-1, SHA-256) is an example of such function for $n=128$ (resp. $n=160$, $n=256$). Whether there exists a solution to $H(x)=x$ depends on the particular hash function. If $H$ is a random function (as ...


1

In general, the key length and number of rounds are the dominant factors in deciding cipher strength. But you need to consider how the rounds are constructed and how the key is used. Substitution and permutation are the bread and butter of DES. That's literally all it is - substitution, permutation, and XOR. Here is a diagram of the DES fiestel function ...


3

The correction question you should ask about why various operations in RC4 (or, for that matter, any other cipher) are there would be "if I were to remove that, what would the impact be? Would this weaken the cipher in some way?" At your current state of knowledge, that may be a rather imponderable question, but it is still the correct one. I can try to ...


0

I'm assuming your deniability/indistinguishability definition requires a random piece of data and a error correcting piece of data to look the same to a decoder, because that seems like a requirement in the application you linked. In that case any error-correcting code that can fix all one bit errors is necessarily distinguishable from random data. Sketch of ...


0

In general, an error correcting code $C$ is simply a collection of codewords of a given length $n$ that meet some desired minimum (Hamming) distance properties. Any tell-tale structure that is present is not intrinsic to the error-correcting properties, it's there in order to ease encoding and decoding and to allow you to prove that the desired properties ...


0

Layering your encryption mechanisms like that would not display collusion-resistance between the two schemes. For example, someone with an Org-A key could decrypt the outer encryption over a record designated for Org-A administrators and then pass the inner ciphertext to someone with an Administrator key. Of course, you could use a different key for each ...


1

I'm looking forward to reading other answers -- a structure with these properties would be very useful for plausibly deniable encryption. Perhaps something like this might be adequate: // untested pseudocode initialize(): global_current_index = 0 global_array = [] for each word in a dictionary of plausible words: set( word, ...


2

Take a look at the Fujisaki-Okamoto CCA2-Security conversion. This is what you need. In short, this is a conversion that makes the ciphertext of the McEliece encryption scheme (which is based on error correction codes) to be indistinguishable from random.


3

Here's an approach that corrects some errors: Alice has a bitstring S that is indistinguishable from random that she wants Trent to know. (Perhaps it's actually a ciphertext that only Bob knows how to decrypt). Alice generates 5 fresh new random bit-strings pM, pN, pP, pQ, and pR just as long as the original random bitstring S. For each bit of S, Alice ...


14

CBC does not perform authentication This property makes it less suitable for places where authentication is required, basically any transport protocol. TLS uses CBC, but by default performs authentication over the plain text instead of the ciphertext, which opened up a host of attacks. CBC can be used here, but it is error prone and may require an ...


2

This answer builds on the answer supplied by @otus. There is also an important worry about whether the main solution works at all as advertised. I am posting it now to make clearer to @otus a question I asked in a comment. I will eventually either delete it or substantially revise it. First off, let me emphasize that if the table is going to be used to ...


7

There are several scenarios where you wouldn’t want to use AES in CBC mode. In CBC mode, each block is dependent on a previous one. As @fgrieu nicely hinted at in his comment, using CBC means that if you have a large, encrypted file and you only want to update/change/modify a tiny fraction of it, you would have to follow the decrypt-modify-encrypt path each ...


-2

CBC is one of the five confidentiality modes of block cipher. It needs one IV (Initialization Vector). The IV must be same length to the blocksize of the algorithm (e.g. 128bit for AES). The IV is done exclusive-ORed with the first plaintext block P1. The result of the first XOR operation is C1. Next C1 is exclusive-ORed with the second plaintext block P2. ...


1

You can create a lossy version of the data structure using a hash table. If the $k$ values are not uniformly randomly distributed, you would initially hash them $k' = H(k)$ and use that as $k$ below. Initialize the table of size $N$ with random data. When inserting $(k,v)$, encrypt $v$ using $k$ as the key with some symmetric encryption algorithm $E_k(v)$. ...


0

There are alternative representations of $GF(2^8)$ where the multiplicative inverse can be computed by computing the inverse in $GF(2^4)$, along with a handful of other operations (several $GF(2^4)$ multiplies, additions and a square). Does your $\delta$ convert from the standard AES representation into such an alternative representation of $GF(2^8)$? ...


2

It depends on what you think of as an alternative. If you think of the scheme where you do not use M as a modulus, but the keys a picked as: $$ k \leftarrow \{1, \ldots, M-1\} $$ Encryption: $$ C = d + k $$ Decryption: $$ d = C - k $$ Then the scheme is insecure. One way to see this is to note that we have C >= d. So the ciphertext communicates the ...


2

Yes, it would be more secure if they were used correctly. But as it would require a substantially different algorithm, you really would not be talking about DES anymore. Brute forcing usually scales exponentially with the size of the key. However, if the algorithm is substantially altered then it is required to analyze the algorithm again. Note that AES is ...



Top 50 recent answers are included