# Tag Info

12

The most efficient related-key attacks on AES-256 and resulting weaknesses AES-256-based hash functions are summarized in my PhD thesis. Though collision and preimage attacks on hash functions are out of reach yet, the components of these functions still expose some properties that are not expected of good hash functions or random oracles. Getting to the ...

5

I don't know of any practical attacks on these schemes that would break collision-resistance or pre-image resistance, but the existence of related-key attacks on AES is still worrisome. The Miyaguchi-Preneel hash construction is better in this sense, because the attacker doesn't directly control anything that goes into the key input. Miyaguchi-Preneel is ...

3

Remark: in One Time Pad the pad is used once, thus this is not OTP, since here $k$ is reused. Hint for part 1: Write the relations between $k$, the message blocks $m_i$, the ciphertext blocks $\small C_i$ with the convention $\small\text{IV}=\small C_0$. Then, find equations that allow computing the desired $m_3⊕m_4$ from known quantities. Hint for part 2, ...

3

A conceivable attack is inspired by this extract of LUKS On-Disk Format Specification Version 1.1.1, section 1: A partition can have as many user passwords as there are key slots. To access a partition, the user has to supply only one of these passwords. If a password is changed, the old copy of the master key encrypted by the old password must be ...

2

Read about the CRIME and BREACH attacks. They are the classic example where compression before encryption can leak information about the input. The length of the compressed data leaks information about the contents of the data itself. See also http://security.stackexchange.com/q/19911/971 and http://security.stackexchange.com/q/20406/971 and ...

2

It's not clear what they actually mean by half of their things, or if there is any benefit of using them together. That site doesn't want to create any meaningful security, it's just to play around with numbers and letters. They state to use Vigenere, that's okay, usual classic cipher, which can be broken if the text is long enough. "Caesar box code": I ...

2

In general there is no such recommendation. Python is quiet useful for quick prototyping, but is generally very slow. Too slow to do any expensive computations. However, you can, for instance, write you core analysis functions in c and then use them in your python analysis tools. This is actually a quiet common method of going about things.

1

This is actually a good question, about how a mode of operation will affect analysis of a data stream. In regards to an implementation of AES-PCBC, if you have AES-ECB you can build a wrapper for PCBC around it with the appropriate block size. It is not too difficult, but unnecessary... In regards to security analysis, PCBC is no more resistant than CBC ...

1

The problem is not with compression and encryption, it is with the protocol that is being used, and the type of data being compressed (or not) prior to encryption. The most damning leaks are on protocols that were either designed to be compressed without encryption, or encrypted without compression. The best example I have is VOIP systems that use a ...

1

Perfect Secrecy (or information-theoretic secure) means that the ciphertext conveys no information about the content of the plaintext. In effect this means that, no matter how much ciphertext you have, it does not convey anything about what the plaintext and key were. It can be proved that any such scheme must use at least as much key material as there is ...

1

Perfect secrecy is the notion that, given an encrypted message (or ciphertext) from a perfectly secure encryption system (or cipher), absolutely nothing will be revealed about the unencrypted message (or plaintext) by the ciphertext. A perfectly secret cipher has a couple of other equivalent properties: Even if given a choice of two plaintexts, one the ...

Only top voted, non community-wiki answers of a minimum length are eligible