Tag Info

0

As you specified in the question, the key, nonce, and initial counter value are what is required in addition to the ciphertext and algorithm used. However, it is best practice to have the initial counter always be 0. Common standards place no specific restrictions on the size of the nonce unless it is used in an authenticated encryption mode, but it is ...

2

A better way to solve your problem is: on the server, encrypt the document under a document encryption key (a unique key that's specific to that document). The document remains encrypted in storage encrypted under this document key. When a client requests the document, send the client a copy of the encrypted document, as well as an encryption of the ...

2

The main difficulty in designing what I asked, is coming up with a permutation over a relatively small set, that is easy to compute in the forward direction, but convincingly much more difficult to invert. The least unsatisfactory I have so far is based on the discrete logarithm problem in $\mathbb Z_p$. If $p$ and $(p-1)/2$ are primes, and $g\in\{2\dots ... 5 Did you try Wikipedia? DES consists of 16 rounds of the form: $$L_{i+1} = R_{i}, \quad R_{i+1} = L_i \oplus F(R_i, K_i),$$ which are identical except for the round subkeys$K_i$. (The last round is slightly different, in that the half-blocks$L$and$R$are not swapped as they are after all other rounds, but that makes no cryptanalytic difference.) The ... -1 I have a 128-bit block cipher that can be modified to fit your requirements (possibly). It is an AES variant with a 16x16 matrix multiplication that operates on the entire state instead of the standard 4x4. ShiftRows is maintained but not necessary for diffusion. The matrix is its own self inverse. The s-box has been replaced with one that has a more ... 3 Each half of the key is 28 bits long, so there will be$2^{28}$possible choices for each of them. In the first part of your attack, you start with the known block of plaintext and encrypt it for the first 8 rounds using each possible left half of the key. This gives you$2^{28}$"half-encrypted" 64-bit blocks. This is less than the birthday bound, so ... 2 Here's the best I can do. Let$\mathbb{G}$be an elliptic curve group over a 64-bit prime. Define$f:\{0,1,2,\dots,2^{64}-1\} \to \mathbb{G}$by$f(n) = ng$, where$g \in \mathbb{G}$is a generator of order at least$2^{64}$. Notice that you can represent any group element in 65 bits, using point compression. Also, notice that$f$is injective. This ... 1 AES-128 uses the full set$\{0, 1\}^{128}$as keyspace, and for each key the blockcipher is defined for each input block in$\{0, 1\}^{128}$. The same goes for AES-256, but it uses a 256-bit keyspace (but still a 128-bit block). So the answer to 1 is yes. For 2, we have this equation: $$AES_K(AES_K^{-1}(x)) = x$$ We can decrypt both sides: ... 1 Very few cryptosystems actually use a block cipher directly (i.e. in "ECB mode") to encrypt data — and those that do usually only do so because whoever designed them didn't really understand how a block cipher should be used. Rather, the main use of block ciphers in cryptography is as versatile building blocks for other cryptographic components, such ... 2 What the specification is saying is that prior to processing, the message is padded to a full block length, with the empty message padded to a single block. The spec on page 4 describes the input into the algorithm as: Define$||a||_n = max\{1, \lceil|a|/n\rceil \}$, where the empty string counts as one block Let$m = ||M||_n$Partition$M$into$M[1] ... ...

1

I'm still a little unsure what your question is, but I'll try and answer what I think you're asking. If it isn't, please clarify your question or comment below. Let us assume that $E_k$ is an ideal block cipher$^{[1]}$, and so acts like a random permutation of $2^{64}$ elements. Given $(m,c)\in M\times C$ find $k\in K$ such that $E(m,k)=c$. How long ...

Top 50 recent answers are included