# Tag Info

0

To forge a message using a hash collision, you need to generate a signature (using that hash function to sign a "good" message); then that signature is also a valid signature for the "bad" message. So, to prevent this from being a concern, you just never sign a message using MD5 as your hash function. Yes, the attacker can generate a "good" and a "bad" ...

0

Leading coefficient of a rational function was defined at 5.3 on page 11 of Report 31 as another function (multiplied by (x/y)^d for some d) evaluated at identity. Handling the case of point at identity was explained at top of page 8, namely multiplying numerator and denominator by y^d and x^d to make them of the same degree, resulting in another rational ...

0

Let $r_0$ be the root of $f(x)$, so $r_0$ should be in $\{0,...,p-1\}$ and $f(r_0)=0 \pmod p$. If we cant find such $r_0$, our polynomial haven't root in $F_p$. If $p$ be small we can easily find such $r_i$(root of $f^i(x)$) and compute $f^n(x)=\frac{f^{n-1}(x)}{x-r_{n-1}}$ where $f^0(x)=f(x)$, then repeat this recursively for $n$. Founded $r_i$'s are ...

1

While Switch is right about the difference between Merkle–Damgård and Sponge constructions, I don't believe he is correct as to NIST's reasoning. I happened to talk to a NIST cryptographer (John Kelsey) about this. He indicated that they selected Keccak not because they distrust the SHA-2 design (Merkle–Damgård is provably secure if the compression ...

4

The difference is: All SHA-0, 1 & 2 and MD5 come under a class of algorithm called Merkle–Damgård construction, while SHA-3 falls under Sponge functions. Merkle–Damgård construction is a method of building collision-resistant cryptographic hash functions from collision-resistant one-way compression functions. And, Sponge functions are a class of ...

1

RIPEMD-160 uses precisely the same padding and endianess convention as MD5. Everything is little-endian, with the exception of the order of bits in bytes, which is kept big-endian. If the message is $n$-bit, it is appended a single bit at 1 and $511-((n+64)\bmod512)$ bit(s) at 0 , then the representation of $n$ on 64 bits. The resulting padded message is an ...

3

Such a category of functions is not generally used as is, but compression functions, which are close to what you describe, are (as you describe) used to build (variable length) hash functions. For example, Merkle–Damgård hashes like SHA-2 have a compression function that takes an IV (or previous block output) and a fixed size data block to generate a smaller ...

0

If $v1\neq v2$ then Alice and Bob can not agree to same key. So $v1$ and $v2$ must be same. In this case your problem is Diffie Hellman key exchange problem that are well known in cryptography. For more detail you can search "Diffie Hellman key exchange" in google. Edit: If your computation is not in $\mathbb Z_n$ then this system is not secure. You can't ...

2

The approach you describe is very much like the approach that is used in the masterpassword app (http://masterpasswordapp.com/). Roughly they generate a password for each site depending on: Your master password The site name A number (so that if you have to change your password you can just increase the number) Some salts that they decice. And then they ...

4

Is there any problems from using the approach I am suggesting? Yes, there are several. First of all, some sites generate first time passwords, or even long time passwords. You may want to store those too. What if a site requires frequent updates? If one password is reversed, you'd still loose confidentiality. Would it actually be less secure if ...

1

@Jeroba88 your idea of using a hash function rather than just appending the service name to your secret password is simple yet crucial to achieve what you have set off to do. Some level of customisation (be careful), such as using PBKDF2 (or Scrypt) in place of just a plain HASH(Password|Service) (especially since it's probably preferable to use ...

2

There are several different scenarios to consider. If you assume all the sites/apps do things right, use a strong password hash, stay uncompromised, then no one should be able to find your master password anyway (unless it is a very poor low entropy password). So how or whether it is combined at all does not matter. More likely, you are interested in ...

0

I think the answer is in some ways very obvious and in some ways less obvious. The advantage is that if it's proprietary, then that means you're almost certainly paying another party for it and therefore holding them responsible for reviewing, maintaining, and debugging the encryption library when problems arise. Contrast this with a library like OpenSSL, ...

2

A possible advantage is the need for cryptanalysis. Using only standard algorithms, an adversary who had a machine capable of breaking them could just feed your ciphertext into the machine. With a proprietary algorithm they would not have a ready-made machine for breaking it, so they would have to analyze it first, even if after that it would be very easy ...

-1

Obscurity can work if your application is, indeed, obscure. If you're Microsoft, that won't work. If millions of dollars depend on the security, that won't work either. But don't make up your own encryption algorithm - chances are it'll be easy to break. Instead, modify an existing encryption algorithm that's already good. For instance, use AES but ...

0

I can think of only one answer: DRM. Or rather, anywhere you have a system in which the consumer must be able to decrypt and consume the encrypted data in a controlled fashion, but at the same time must not be able to do so freely. Consider, as an example, a 2D game with user-provided content, where users can create graphical assets for their own areas, ...

5

Custom crypto can be valuable when other aspects are more important than the confidentiality guarantee, and the well-known ciphers don't address those aspects. A custom cipher or custom application of a cipher would tend to offer a weaker guarantee of confidentiality than well-tested systems. But some users of encryption can handle an eventual breach so ...

8

The main advantage is that using a proprietary algorithm gives you access to trade secrets like additional cryptographic attacks that other algorithms fall to but to which the proprietary algorithm is resistant. Whether this is important depends on the amount of trust you have in the vendor. As other answers have noted, usually the staff of any one ...

8

The only advantage I can think of is that they're able to put "State of the art encryption" on their website. But even then, those with a trained eye may spot it as an issue, therefore rendering it as yet another disadvantage. But other than that pseudo-advantage, there are none. Chances are overwhelmingly good that this new cipher, having been ...

22

Yes, there are advantages to the attacker. Using a well vetted encryption algorithm provides a better assurance of security. There may be cryptographic algorithm flaws and/or coding mistakes. As noted, relying on the algorithm being private just adds a layer of false security.

Top 50 recent answers are included