Tag Info

22

Yes, there are advantages to the attacker. Using a well vetted encryption algorithm provides a better assurance of security. There may be cryptographic algorithm flaws and/or coding mistakes. As noted, relying on the algorithm being private just adds a layer of false security.

11

Modern cryptographic algorithms are specified in terms of bytes or even bits, not characters. Whether the data you encrypt happens to represent latin or cyrillic letters or pictures or audio data or anything else does not matter at all to an encryption algorithm; all it ever sees is a bunch of bytes. What this means in practice is: You have to fix some ...

9

XORing a master key (presumably a long term key) with data is a very dangerous idea. If any data key is leaked, then the master key may be easily calculated, thus leaking all keys. ($m$ for the master key, $d_x$ for all data keys) $$c_x = d_x \oplus m$$ then somehow $d_4$ is leaked $$m = d_4 \oplus c_4$$ $$d_x = c_x \oplus m$$ You'd be better off applying a ...

8

The only advantage I can think of is that they're able to put "State of the art encryption" on their website. But even then, those with a trained eye may spot it as an issue, therefore rendering it as yet another disadvantage. But other than that pseudo-advantage, there are none. Chances are overwhelmingly good that this new cipher, having been ...

8

The main advantage is that using a proprietary algorithm gives you access to trade secrets like additional cryptographic attacks that other algorithms fall to but to which the proprietary algorithm is resistant. Whether this is important depends on the amount of trust you have in the vendor. As other answers have noted, usually the staff of any one ...

7

The standard answer to this question is format-preserving encryption (FPE). FPE is a class of techniques that allow you to encrypt data while preserving some of its format (which can include its length). In terms of security, most FPE schemes are deterministic, which means they do not achieve the standard IND-CPA notion of security. However, for ...

6

Wrapping up my comment as an answer: Imagine you’re a Japanese cryptanalyst in the year 1944. There is no such thing yet called “television”, and you’re still decades away from a wordwide network feeding you with all the knowledge you could wish for. In that case there’s only a minimal chance you’ve ever heard or seen a Navajo. So, you’ll be wondering ...

5

Let's say the plaintext is English text (or some language that uses the basic latin characters), encoded in Unicode. That means each byte represents one character, and because of the quirks of Unicode, the basic latin characters and typical punctuation marks all have a zero for the most significant bit. To attack your scheme, an attacker would look for ...

5

Custom crypto can be valuable when other aspects are more important than the confidentiality guarantee, and the well-known ciphers don't address those aspects. A custom cipher or custom application of a cipher would tend to offer a weaker guarantee of confidentiality than well-tested systems. But some users of encryption can handle an eventual breach so ...

5

AES is a block cipher and would return wrong data when a wrong key is used. It only works on a single block of data (16 bytes). The default CBC mode of operation enables you to encrypt multiple blocks of data. The padding then enables you to encrypt plaintexts of arbitrary length. The padding has to be removed somehow after the decryption. You're seeing a ...

5

Strictly speaking, it does make a brute-force attack more likely to recover a key for any message pair, but the impact of recovering a single key is minimized by frequent re-keying, since that key can't aid the adversary in decrypting any other messages. If you don't re-key, a brute force attack is only marginally more difficult but success gives you ...

4

OTR uses 128 bit AES-CTR. There is a risk that the same AES key will be generated more than once, but if significantly less than $2^{32}$ messages are ever exchanged between any pair of peers, this risk might be safely considered to be negligible. However, if a pair of peers exchange more messages than $2^{32}$ and depending on how the implementation ...

4

There is no security difference; there are a handful of practical ones: With xor, you can have the same code to do encryption and decryption With xor, you don't have to pick a 'word size'; a larger CPU can handle 4 or 8 bytes at a time, while a microcontroller can handle 1 byte at a time, without changing the ciphertext With xor, you don't have to worry ...

4

What you are looking for is a definition of PEM, privacy enhanced mail. Obviously PEM is not just used for mail anymore. The definition of the header lines seems to be best described by section 4.6: "Summary of Encapsulated Header Fields" of RFC 1421: "Privacy Enhancement for Internet Electronic Mail: Part I: Message Encryption and Authentication ...

4

Can AES work with Cyrillic letters? No, AES is a block cipher that can only operate on blocks of 16 bytes. AES may be securily used within a mode of operation to operate on plaintext of any bit/byte size. So you only have to encode your Cyrillic letters to any bit or byte encoding. Unicode - which designates code points to a huge range of characters - ...

4

Using generic homomorphic encryption the answer for all three is essentially yes. Although 3. in general is probably mainly of theoretical interest as it would be impractically slow. For simply compressed data this is simple since compression should not do anything to hide the data. Just decompress, do the operation and possibly compress the result if ...

4

There are lots of security algorithms. One of the way to measure security of a cryptography algorithm is to find out its key size. There are many key size of a single algorithm. But how can I calculate key size of an algorithm? How a single algorithm has different key size? There is no standardized method that can help you with that. The best way to ...

3

Any cryptosystem in which the size of the ciphertext equals that of the plaintext is necessarily deterministic, and thus can only be secure if each key is used to encrypt only one message.

3

Strictly speaking, we can't know for sure that the output of AES is indistinguishable from random noise. It's conjectured to be true but no "proof" of that fact exists. For most commonly-used ciphers, it is conjectured that their output is indistinguishable from random. Specifically, modern ciphers are conjectured to be "strong pseudorandom permutations", ...

3

I'm not sure I understand your question entirely. If there is only one possible message, then the ciphertext can be trivially decrypted simply by choosing this message. I'll assume instead that the ciphertext contains the shuffled bit pattern of a name chosen from a set of more than one name. The problem with bit shuffling is that the number of set bits ...

3

That doesn't hide Bob's identity from eavesdroppers. (The OP mentioned in chat that the OP isn't trying to do that.) I can no longer spot any other problems with the key exchange part. The encryption/decryption of application level data is vulnerable to arbitrary replays and reflection and dropping. ​ The public MAC input should indicate direction and ...

2

There are many block-cipher modes. CBC for example works only on full blocks of plaintext and produces ciphertext as a multiple of the block size, it is therefore not applicable to your case. CTR transforms a block-cipher into a stream-cipher, which produces a ciphertext that has the same length as the plaintext. This mode requires the use of a nonce as ...

2

The reference definition of Spritz seems to be: Ronald L. Rivest and Jacob C. N. Schuldt, Spritz - a spongy RC4-like stream cipher and hash function, presented at Charles River Crypto Day (2014). The code snippet of the question shows how the state of Spritz repeatedly used in DBRG output mode is updated and its next output byte $z$ produced; the state ...

2

A possible advantage is the need for cryptanalysis. Using only standard algorithms, an adversary who had a machine capable of breaking them could just feed your ciphertext into the machine. With a proprietary algorithm they would not have a ready-made machine for breaking it, so they would have to analyze it first, even if after that it would be very easy ...

2

What you ask is very well possible. Let's assume you have a document DATA you want to encrypt. You first randomly generate a symmetric key K and authenticate and encrypt DATA using this one. In the next step you asymmetrically encrypt K with the end user's public key and store the resulting cipher text along with the encrypted data. For allowing your ...

2

What you seem to be looking for is a scheme like the following: It consists of two algorithms, a key generation algorithm $K$ and a "key use" algorithm $U$. The key generation algorithm outputs a pair of keys $(k_0, k_1)$. The "key use" algorithm takes as input a key and an element from some set $S$ (which may depend on $k_0$ and $k_1$), and outputs an ...

2

Which techniques can I use? You can use a system like the ones used for the encryption of credit card numbers: AES (for a good grade of encryption) + FPE (for preserve length). Have a look at “A Synopsis of Format-Preserving Encryption” by Phillip Rogaway (PDF)

2

what is the range for exponent e? Actually, there is no required upper bound for $e$ (except that some implementations may reject ridiculously large values). The math behind RSA states that any $e$ that is relatively prime to both $p-1$ and $q-1$ will work, no matter how large it is. There might not appear to be a need for an $e > lcm(p-1, q-1)$ (as ...

2

Without knowing $g$ and $h$ we can do as the original paper says: Pick $m,n$ random, both from $\mathbb{Z}_q$ where $n \neq 1, c^m \neq 1, d^m \neq 1$. Then $\sigma' = (c^n, d^n,ac^m, bd^m) \pmod p$ will do. The decryption routine is also in that paper.

2

I guess you do not want to break anything at all. Universal re-encryption pursues the idea that anyone given a ciphertext can WITHOUT knowledge of the public key re-randomize a given ciphertext to an unlinkable ciphertext to the same message. Thus you include an additional encryption of the identity (1 in the group $\mathbb{Z}_p^*$) with independent ...

Only top voted, non community-wiki answers of a minimum length are eligible