# Tag Info

6

Current symmetric cryptography and hashes are actually believed to be reasonably secure against quantum computing. Quantum computers solve some problems much faster than the best known classical algorithms, but the best known quantum attack against AES is effectively "try all the keys." In a quantum computer, the time taken to solve a general search problem ...

4

There are many reasons why the IV could be expected as an input parameter: it could be to let the user use his/her own random number generator, possibly because the device has none (as G_G has already stipulated) it could be to allow for creating larger ciphertext (as ArtjomB has already mentioned) by using the IV to contain the last vector it could be to ...

3

In your example, $Encryption_1$ is $\textsf{AES}_{CTR}$ and $Encryption_2$ is $\textsf{Salsa20}$. Then, the encryption method you are proposing is $Encryption_1(Encryption_2(plaintext))$, which is in fact a cascade of stream ciphers. Note that, because you simply XOR the streams, this cascade cipher commutes, that is, you will have the same result if you use ...

3

Asmuth and Blakley provided a proof that, assuming the keys for each cryptosystem are chosen independently, breaking their composite cryptosystem is at least as hard as breaking the hardest part of either. [1] Building on their work, cascade ciphers have been shown to in fact be harder to break than the hardest part of either. Admittedly, what you're ...

3

Yes, it is possible.

2

I did some more research and yes it does include both AD length and ciphertext length, so is not vulnerable to a length extension attack as length is part of GCM GHASH. Based on NIST SP-800-38D (PDF) page 18 len(A) and len(C) are both part of the input into the GHASH function. And double-checked this in an implementation gcm_finish method: both lengths are ...

2

Dmitry's suggestion to use AES in counter mode sounds good to me, assuming that you only need confidentiality, and not integrity protection. (Counter mode, like most stream ciphers, is very malleable.) One trick you can use to save a bit of space is to use the current time as part of the nonce. (Of course, this only works if your devices have fairly well ...

2

A self-made modification to CBC is a bad idea, since your "IV" will not be random enough, whereas it must be truly random for CBC. Stream cipher is a good idea. You may use AES in the Counter mode, or you could use Salsa20, or any other eStream portfolio cipher (software and hardware implementations are available for all of them). Ensure that you have ...

2

What you're looking for is called a key derivation function, and more specifically a key stretching function. A key derivation function takes some variable-size material and turns it into a fixed-size key in a deterministic way, such that calling the same function on the same input yields the same key, and the original material cannot be reconstructed from ...

2

Your example is missing something: your two calls to the OpenSSL library are entirely entirely independent, but your calls to the mcrypt library reuse an existing handle. CBC has the property that identical plaintext blocks are exceedingly unlikely to encrypt to the same value due to chaining of the previous output into the next input. Your OpenSSL calls ...

2

I don't think there is a dedicated name for this. If I had to find a word, it would probably be "stateful" or "with explicit state". What you observe is actually the usual case: The user initializes an encryption system with a key, resulting in some state of the system. Then, each time the user wishes to encrypt some data, he has to pass the current state ...

2

As CodesInChaos pointed out, the major flaw with this is that filenames aren't unique. If you did this on a large scale, anyone who's been given a key for a filename could decrypt any file with that filename. Even if the contents of the file are different, and they weren't intended to be given access to that file. Here's another solution that has one unique ...

2

Yes, it's safe, as you can't calculate the secret key from the HMAC result. HMAC would be useless without this feature No, Bob will not be able to use his key to calculate the other keys, as long as you use a reasonable hash function (SHA-2 should fit) It's the same as 1., Bob doesn't get more information by more derived keys But when Bob get the key for ...

2

Timestamps, as mentioned by user93353, are one possible answer. The drawback is that they require synchronized clocks, which can't always be assumed. Another possible approach to prove liveness (that is, that this isn't a replay) is for the receiver to select a random value (a "nonce"), send that to the server, and have the server sign the command ...

2

"you actually solved my riddle good job you win" How to: First determine the key word number sequence by taking the key word and assigning each letter its position in the true alphabet: J U L I E T 10 21 12 9 5 20 Then take the encrypted message and assigned each letter a number by repeating the key word number sequence: I J G J H N E V ...

1

Unfortunately, unless the developers made rookie mistakes in their implementation of their malware, you will not be able to recover the decryption keys. The ideal solution is to recover your files from a recent backup. I suppose you can pay whatever ransom is asked for, if you can morally justify it (ransomware typically has an incentive to give you access ...

1

"Will such security always remain secure?" No. $\:$ In particular, quantum computers will break RSA and elliptic curves. Has it been mathematically proved that these algorithms can not be cracked, or is it a possibility? It is a possibility, since a very-practical algorithm for the Boolean satisfiability problem would be enough to break essentially all ...

1

Yes it is possible and already in use in multiple way (LUKS for example). The way it works: Have a master key that encrypts the whole data Append a header in front that contains the master key encrypted by the password you want To add a password add a keyslot (master key encrypted by another password) To revoke a password remove said keyslot (the user ...

1

It doesn't make too much sense at all to send the IV together with the key. The whole idea of an IV is that it is unique per key. But if the key changes value each time, then any IV is unique. So you could use a static IV or even an IV that consists of all zeros. In that case you only need to worry that you don't reuse the key at other locations in the ...

1

In the traditional sense, a nonce is a number that is only used once (with the same key). Though occasionally there are other requirements. For example, we may require that the nonce be unpredictable. For more on this I recommend you read this answer and this answer. Now, you don't go into enough detail on what you are doing to say whether or not you need ...

1

It depends on the format. The size suggests it is a video. However, video formats seems to be designed to be seekable. That means, the attacker seems to be able to: Create some header (guessing the resolution and some other information) If the beginning was damaged, play and seek in the file.

1

This looks like part of a problem posted from the first week's assignment of the Cryptography 1 Coursera course. Boneh outlines in his course material how XOR'ing two cipher texts encrypted with the same key result in a new cipher, similar to below.  m_1 \oplus k = c_1 \\ m_2 \oplus k = c_2 \\ c_1 \oplus c_2 = m_1 \oplus k \oplus m_2 \oplus k = m_1 ...

1

Information leakage in systems that do data deduplication typically involves timing hints that the data is already stored and related leverage of that information. See the comments in Online backup : how could encryption and de-duplication be compatible? for insights there. Suggest you consider your attacker's profile and see of any of those issues apply as ...

1

Check out www.Coursera.org. There are two fairly rigorous courses there (both free). One from Stanford (upper undergrad level) and another from Univ Maryland (lower undergrad level). Both require some hard work, college algebra, and some integer number theory (taught in the class) - no calculus or complex number. Working familiarity with a programming ...

1

The first 32 bytes seem to be the ASCII representation of a 16-byte hexadecimal string. Possibly an Initialization Vector (IV) or similar. That would leave us with 88 bytes remaining. My guess is that this encryption is made by some 128-bit block cipher (e.g., AES-128), using some mode of operation such as CTR or CBC. Note that 88 bytes is not a valid ...

1

In addition to yyyyyyy's answer, there is also probabilistic encryption, in which the encryption process incorporates some randomness. That allows many identical messages with the same key to be encrypted differently; it doesn't necessarily encrypt the same text differently in the same message (it might encrypt $a+a$ as $E(a)+E(a)$), but it does let you send ...

Only top voted, non community-wiki answers of a minimum length are eligible