Tag Info

Hot answers tagged

15

Vulnerability #1 You're rolling your own crypto. I'm stealing this from Iszi's comment, but it was my first thought when I saw this as well. The general consensus from cryptographers (read: universal accord with no dissent from anyone with more than a passing interest in cryptography) is that it is terribly difficult to roll your own cryptography until you ...


13

n is the exponent. So when n is doubled from 64 to 128 it doesn't mean that you have to try twice as many values. It means that you have to try $2^{64}$ times the amount you were already trying (as $2^{128} = 2^{2\times64} = 2 ^{64+64} = 2^{64}\times2^{64}$). It is required to only search half of the key space on average (if average is the correct term ...


11

Decrypt the ciphertext with every possible key and store the result: $2^{56}$ decryptions. Now encrypt the (known) plaintext of the ciphertext with every possible key: $2^{56}$ encryptions. Now you have to check every entry, which is in both lists and try it with another plaintext-ciphertext pair. If you can successfully decrypt that, you are very likely to ...


9

ECB leaks if blocks are identical. For uniformly random data identical blocks become likely when you encrypt about $2^{n/2}$ blocks with an $n$ bit block cipher. CBC and CTR mode develop similar weaknesses when they encrypt that much data. => As long as you encrypt reasonable amounts (up to a petabyte or so) of random data with a 128 bit block cipher, like ...


5

Sorry for the late answer, I got busy... So, you know that $\mathsf{Gen}$ is a probabilistic algorithm. What's a probabilistic algorithm? It's an algorithm which, during its execution, can make some random choices, which can be modeled as coin tosses. In programming terms, the algorithm can use a special coin-tossing function, which returns $0$ or $1$ each ...


5

Here are some hints on how it's done on Mega: The password provided is passed through a KDF to derive a key, that is used to en-/decrypt the master key (later provided by the server through an API call). To bring it down to the crucial bits: The KDF applies $2^{16}$ rounds of AES-128 with it. The details can be found in the function prepare_key() of the ...


4

You can't encrypt a message with ECDH alone, because all it gives you is a shared secret that you can't really control. Rather, you use that secret in a symmetric scheme like AES (generally after passing it through a KBKDF to convert from an ECDH result to a proper-length and less-structured symmetric key, which you then use as the key for symmetric crypto). ...


4

I should begin by noting that this seems like an unusual assignment. I'm not sure why someone would explicitly have a goal of combining block ciphers and stream ciphers. First, let's summarize the difference between block and stream ciphers, since this may be useful for future readers. Block ciphers are so called because they operate over fixed lengths of ...


4

In computer science, and implementation of crypto, ROTL stands for ROTate Left. ROTL is also noted ROL, or RLNC for Rotate Left No Carry. On a $w$-bit word with bits numbered from $0$, bit number $j$ of the input of ROTL with a shift count of $n$ goes to bit $j+n\bmod w$ of the result; $n=1$ unless otherwise specified. The venerable VAX has a ROTL ...


3

There are no security advantages to evaluating the polynomial at random places instead of sequential. The information theoretic security proof of Shamir secret sharing does not depend on the evaluation points being chosen in any specific manner.


3

The standard for full-disk encryption (FDE) is XTS mode or ESSIV-AES-CBC. XTS tweaks each block within each sector differently (and hence avoids ECB's problems) and is considered the best choice available at the moment. ESSIV-AES-CBC works by using AES-CBC with the IV being the hash of the sector index. The problem with this mode is that you can flip bits ...


3

Pros of encrypting entire payload: That's simplest to code. Encrypting data may have the side-effect of improving the chances to detect an alteration during transfer of the cryptogram (hence enciphering the whole payload may extend that beneficial side-effect to the whole payload); however that is not the function of encryption, and it must not be assumed ...


3

If you just need random numbers, there's no point in generating random primes. Just make sure that you're using a cryptographically secure random number generator, properly seeded from a secure entropy source. Also, passwords made up of random letters and numbers are very hard to remember (and type). For a password meant to be memorized by a human, it's ...


2

Your design seems to be a byte-wise generalization of Jennings' multiplexed generator rather than the alternating step generator. S. M. Jennings, “Multiplexed Sequences: Some Properties of the Minimum Polynomial,” Lecture Notes in Computer Science, vol. 149, 1983. I believe designs like hers [may even be byte based for efficiency] have been used in ...


2

Better is a subjective term. However for the choice between ECB and CBC, the choice should be CBC for almost all situations. Although ECB and CBC are modes of operation of a block cipher, you could also turn this way of thinking around and see the block cipher as a configuration option for the mode of operation. The mode of operation has a big influence on ...


2

openssl rsa -pubin -inform PEM -text -noout < public_key.pem Public-Key: (64 bit) Modulus: 16513720463601767803 (0xe52c8544a915157b) Exponent: 65537 (0x10001) The modulus is small enough that you can easily factor it After finding the prime factors, you can calculate the private exponent After you have the private exponent, you raise each 64-bit block ...


2

When we have regions of the packet that we only authenticate but not encrypt, that happens because we have data that we want to bind to the encrypted region, but we don't need to include within the encrypted region. Examples of this are: For IPsec, we include the sequence number (as a part of the ESP header). We include that within the authentication ...


2

The quoted passage of the Wikipedia article is wrong does not at first reading seem to match Blowfish as in Bruce Schneier's Description of a new variable-length key, 64-bit block cipher (Blowfish) (in proceedings of the first FSE conference, held Dec. 1993) which for this same operation reads: XOR P1 with the first 32 bits of the key, XOR P2 with the ...


2

A few approaches: Generic format preserving encryption. For example AES in FFX mode. The downsides of this approach are complexity and performance. Block-ciphers with small (typically 32 bit) blocks. Skip32 derived from Skipjack ipcrypt (very recent, no security analysis so far) The downside of this approach is that these ciphers aren't very popular ...


1

My own two cents on this is that it started with a psychological bias, due to the illusion that AES-ciphering consecutive numbers in CTR mode is a weakness compared to the recursive AES-ciphering in CBC. Actually, I think I remember it was more of less told during that course on Coursera, that a consensus about the inoffensiveness of that counter with regard ...


1

It seems you want some sort of anonymization, and you already jump to a conclusion with encrypting symbols. Maybe you should step away of that for a moment, and ask yourself what your actual goal is. Encryption is useful, if you want to be able to reverse that process. If you don't hashing is a better choice in general. Your set is small enough that you ...


1

Apart from the performance hit of encrypting / decrypting twice, and the inconvenience of having two keys to not lose, this should work fine. In fact I wish more people had your approach to data privacy and encrypted things before sending them over the internet! About Altdrive in particular, a good question to ask yourself about their upload service / ...


1

The "logic" of the Enigma machine and the development of the Polish solution, in principle, are well described in David Kahn's "Seizing The Enigma". There may be better descriptions that have come out since, but I found this very clear and continue to recommend it. In addition to the nuts and bolts of the machine itself, Kahn describes the history from ...


1

I think you will not find any scheme that works over $Z$. But, if you want to work over $Z_t$, you just have to choose a LWE-based encryption scheme that encrypts non-binary messages, and there is a lot of them! For example, the paper ML Confidential uses one scheme like that (non-binary messages) to perform classification algorithms over cipher texts. ...


1

Consider what it means for a key $k$ to be chosen according to some distribution over key space $\kappa$: Assume that $\mathsf{Gen}$ picks key $k$ from key space $\kappa$ with probability $p$. Since $\mathsf{Gen}$ is randomized, this means that a $p$-fraction of all the random tapes will lead it to generate $k$ as the key. If we now conceptually redefine ...


1

The keystream is as long as the message, so you don't want to send that to the receiver. The keystream is generated by a much shorter key (e.g., 128-bit private key). That is what the receiver needs in order to decrypt the message. So, how do you get that to the receiver? Well, clearly you can't just send it in the clear or anyone watching the channel would ...


1

Anyone who has the keystream and the ciphertext can trivially calculate the plaintext — it's a xor operation bit by bit. Sending the keystream alongside the ciphertext would completely defeat the purpose of encryption. The principle of stream ciphers is that the sender and the receiver agree on an algorithm, a secret key and some parameters, and both ...


1

A practical solution is CryptonorDB which allows you to run queries without decrypting the data. Is somehow similar with CryptDB which is designed as a plug-in for MySQL(and possible other SQL servers), but CryptonorDB is a NoSQL db system and works with JSON documents. Edit: as suggested by community, I'll detail more about encryption algorithms used in ...


1

The triple DES (3DES) block cipher works by essentially running the block through DES three times. Triple DES is also known as "DES EDE" (encrypt-decrypt-encrypt) and under the name given by the standard document: "TDEA". The TDEA algorithm is described in FIPS NIST Special Publication 800-67 Revision 1 where paragraph 3.2 describes the TDEA Keying Options. ...



Only top voted, non community-wiki answers of a minimum length are eligible