# Tag Info

2

There is book Algebraic Aspects of the Advanced Encryption Standard thats gives a good algebraic description of the AES algorithm. Reading it you'll see that there was some freedom in choosing some parametres to fix a standard. Changing this choices, but keeping the algebric properties should give you an equivalent algorithm. This mainly means you can ...

2

If I got the code correctly, it works in the following way: Computes digest $D = SHA256(password + salt)$ Computes table T with $N=MEMSIZE /32$ elements: $T_{0}=D, T_{i}=SHA256(T_{i-1})$ Set $R=T_{N-1}$ Update $R$ by mixing it with $T_{0}$, $T_{1}$, ..., $T_{N-1}$, where "mixing" is a byte addition or subtraction depending on value of the byte ...

1

I wouldn't recommend rolling your own KDF. PBKDF2 is easy to implement with access to SHA-256, and with a high enough iteration count will still slow down an attacker, even if not as much as scrypt. From a quick look, it seems that you are walking the memory linearly both when generating the SHA output and when collecting the data output data through ...

0

Remember the “locked box puzzle” recounted on a “Security Now!” podcast (Episode #33, titled “Symmetric Block Ciphers”, 30 Mar 2006)? Steve Gibson says: … Leo and I answer last week's Puzzler/Brain-Teaser which explored the idea of using two private one-time pad "keys," like two padlocks, to securely convey a message between two parties, neither of ...

2

Small addition: You do not lose integrity when using encrypt-then-MAC. Since encryption is an injection, distinct plaintexts produce distinct ciphertexts, so plaintext forgery implies ciphertext forgery, which is hard if encrypt-then-MAC is secure.

6

Using a MAC on the plaintext may potentially leak information about the plaintext (MAC algorithms do not necessarily ensure confidentiality of the data they are applied to, although some MAC algorithms like HMAC seem pretty safe). If you want to avoid this (theoretical) problem, then you should encrypt the MAC on the plaintext (i.e. MAC-then-encrypt, not ...

6

Actually, given that the MD2 S-box needs to be a permutation, using a Fisher–Yates shuffle does seem a fairly obvious choice to me. (It's pretty much the standard algorithm for generating a uniformly chosen random permutation.) The rand() function used to convert the digits of $\pi$ into a random number from a given interval looks complicated, but is ...

6

While it may be confusing, that Wikipedia article is actually correct! Let me try to explain it a bit better… Definition of key whitening Key whitening is an extremely simple technique to make block ciphers like DES much more resistant against brute-force attacks. Like you’ve already discovered yourself, this is the basic scheme: Or, defining it a bit ...

3

One way key whitening improves security is by increasing resistance to bruteforce attacks (and doing this essentially for free). Consider, for example, DES. Key is 56 bits, so given a single pair $(M, E=DES(K,M))$ attacker will find $K$ in $2^{55}$ operations on average. By employing key whitening it is possible to increase required effort substantially: we ...

4

You can get what you want programmatically. No special ciphers or modes needed. You say there is a single, continuous subset that needs to be encrypted. Thus, you could have a function where the programmer specifies the start of the portion of the plaintext that needs to be encrypted and the number of bytes to encrypt. The function could pull that part out, ...

1

If the question is "can we define a function that, given $s(a)$ and $s(b)$, gives us the value $s(a \oplus b)$, the answer is, yes, of course we can; the obvious implementation of such a function is: $F(x, y) = s( s^{-1}(x) \oplus s^{-1}(y))$ With this function, if $x=s(a)$ and $y=s(b)$, the $F(x,y) = s(a \oplus b)$ However, the real question you need to ...

19

I sent an email to Ron Rivest and got an answer back. The digits of $\pi$ are used as a sort of random number generator that is used in the Durstenfeld shuffle (see also Knuth vol 3, sec 3.4.2). Below is some pseudocode adapted from the description and code he sent me. S = [0, 1, ..., 255] digits_Pi = [3, 1, 4, 1, 5, 9, ...] # the digits of pi def ...

2

If your ints are unsigned then the code r = (r * 33) + (int)c and the fact that you're using 32-bit integers yield the equation $\;\;\;\; \text{new_r} \: \equiv \: (\text{old_r} \cdot 33) + \text{(int)}\hspace{.02 in}\text{c} \;\; \pmod{2^{32}} \;\;\;\;$. Since 33 is odd and $2^{32}$ is even, 33 is a unit mod $2^{32}$. $\:$ I used wolframalpha to determine ...

2

Am I on the right track with reversing DJB2 (can it be reversed?)? Is there some way of finding the remainder of a large number that has been modded by 232? You were on a right track to explain why it can't be easily inverted. Given an arbitrary $h_i$, every letter of the alphabet will give you another potential $h_{i-1}$ that the value was before that ...

3

The problem is almost exactly the same as in password based key derivation, so you could use a similar solution. Derive a master secret from your password and a unique salt using e.g. PBKDF2 or scrypt: $S_m = PBKDF(p, s)$. Derive a site-specific secret from the master using e.g. HKDF and the site URL: $S_u = HKDF(S_m, u)$. Turn the site secret into a ...

Top 50 recent answers are included