# Tag Info

10

This is trivially true via the pigeonhole principle. SHA-2/512 has $2^{512}$ possible outputs, but $2^{2^{128}} - 1$ possible inputs. Trying $2^{512}+1$ unique inputs is sufficient to produce at least one collision. That said, SHA-2/512 is designed to be collision resistant, which implies that it should be hard to find two inputs that hash to the same ...

5

You could view it as a form of One-Time-Pad encryption. In this view one of the two "messages" is the key and the other is the ciphertext (it does not matter which you think of as which as their roles are symmetric). It may, however, be more natural to think of as a simple secret sharing scheme. Roughly speaking a secret sharing scheme is a scheme where a ...

5

The prime number theorem says that there are approximately $N/\log{N}$ primes less than $N$. If we consider $2048$ bit RSA, that means the primes we are using are $1024$ bits. How many $1024$ bit prime numbers are there? Approximately $2^{1025}/\log{2^{1025}} = 2^{1025}/1025\approx 2^{1015}$ (from the theorem). So, just to store the primes we are going to ...

4

No, if the RSA cryptosystem is secure, i.e. when it uses random padding such as PKCS#1 v1.5 padding or OAEP, then you cannot. As Stephen already mused, it is pretty likely that you can find out the key simply because it is included or can be derived; generally public keys are not meant to be secure. If textbook (raw modular exponentiation) RSA is used then ...

4

Of course, it strongly depends on what exactly you mean when writing “casual person”. The cipher algorithm works similar to a shift cipher. As long as the attacker does not know the original order of the cards (of one or more decks of cards), then the cipher should be close to being unbreakable for a “casual person” – assuming that that casual person is ...

4

First, let me address the assumption that private keys will be found in a few years using a fast computer. Unless there are serious algorithmic improvements in the cryptanalysis of a scheme, this simply is not true. Of course, the length of the key is of importance, and if you need security for the far future then you should be using 4096-bit keys (or even ...

4

Decoding information within a time frame is of absolute importance. Say xyz is an terrorist, the information of his attack will be useful today, not years after the attack has happened. And similarly decoding your message is important today, not years later. also there might be a possibility that when somebody has decoded your key for future use, you might ...

4

Actually, it's fairly simple: Generate an image with random pixelation; that is, each pixel is either black or white with probability 1/2. We'll call this image 1. Exclusive-or image 1 with the target to generate image 2; so that a pixel image 2 will be white if the pixels in image 1 and the target are the same (both with or both black), and black if they ...

4

A public-key encryption algorithm cannot rely exclusively on "public" randomness. The reason comes down to the fact that encryption is a public algorithm that can be run by anyone. If the algorithm's output included all the random coins that it used, then an adversary could determine the message from the ciphertext, by running the encryption algorithm with ...

3

What is stopping someone from saving encrypted info, and decoding it later? Nothing. That's exactly why certain three letter institutions build large data centers... Waiting for the first large quantum computer to be built or for new attack techniques that allow to break e.g. RSA for the key sizes used today. Are there any time-sensitive safeguards ...

3

There are two ways a cipher can be broken: theoretically and practically. If the paper is correct then: Our fastest attack achieves a nearly feasible $T=2^{101}$ (cf. Section 28.6 and [28]). (emphasis mine) If we verify this claim then we get: If we have a diverse population of at least $2^{79}$ diﬀerent 256-bit GOST keys generated at random, with ...

2

A Cramer-Shoup public key has the form: $B = g_1^{b_1} g_2^{b_2}; \quad C = g_1^{c_1} g_2^{c_2}; \quad D = g_1^{d_1} g_2^{d_2}$ and an encryption of $m$ has the form: $g_1^r, ~ g_2^r, ~ m B^r, ~ (CD^\mu)^r$ where $\mu$ is a hash of the first 3 components. CCA security proof breaks down: In the CCA security proof, you observe that if you know ...

2

I further assume you mean a DER-encoded unencrypted PKCS#8 RSA key, since you wouldn't care about exposing an encrypted key, and it's a conventional two-prime key with equal-size factors (each 1024 bits) and the ubiquitous e=65537 using the standard PKCS#1 CRT-form representation. I also note that 21 bits is a really odd amount to disclose: not 2 octets, ...

2

The ciphertext should look like a random element within 1 and the modulus (since it is a value from within that range as Yehuda Lindell pointed out). Without knowing the modulus it should not be feasible to distinguish two ciphertexts encrypted with different keys. If the public key is stored in some key-database you could ofc try to encrypt the decrypted ...

2

Some information about the RSA public key is revealed by the ciphertext. This is due to the fact that the ciphertext is a value between 1 and the modulus. Beyond this, I don't know what is revealed. However, what I can prove is that whatever you can learn from the plaintext and ciphertext together, you can learn from the ciphertext only. I can prove this ...

2

Assume that $P_1$ contains " the ". In that case you can get the key stream by XOR'ing " the " with $C_1$, lets call this key stream $K^1$. If this key stream is correct then $P_3^1$ should make sense, where $P_3^1 = K^1 \oplus C_3$. If $P_3^1$ doesn't make sense then you can create $K^2$ and $P_3^2$ from $C_2$ in using an identical calculation and check ...

1

A DES key is, by definition, a (pseudo)randomly chosen sequence of 8 × 7 = 56 key bits, plus 8 parity bits,* for a total of 64 bits. If what you have isn't 64 bits long (with the appropriate parity bits), then it's not a DES key, but something else (e.g. a passphrase). To turn that "something else" into a DES key, you need a key derivation function ...

1

BDK and KSN are used to derive a transaction key which is unique for that session. The are unique because KSN is updated after each transaction. Once this key is derived you apply different variants to get PIN, Data or MAC key. For the PIN and MAC key: these variants are simply XORed with derived key. One more encryption is performed to calculate the data ...

1

Would there be a minimum ciphertext size that is related to the public key size? It depends on the algorithms used. An RSA signature, without any bells and whistles, is equal to the key length in size (i.e. 2048 bits for 2048-bit RSA). Likewise raw RSA encryption adds the same. So if you just use both, you add twice the key length, or 512 bytes for a ...

1

Well, firstly, SHA-1 still seems to have 160-bit preimage and second preimage resistance, so using it in HMAC requires more than 128-bit AES keys to get equivalent security. AES 192 would be sufficient, but isn't used in e.g. TLS – RFC 3268 says: The AES supports key lengths of 128, 192 and 256 bits. However, this document only defines ...

1

TL;DR: use (D)TLS. This is exactly the kind of problem it was meant to solve. If possible, use cert pinning too (if you get to deploy the code on both ends of the channel, this should be possible). The general rule is: don't design your own crypto protocol unless both of the following apply. You have done a detailed review of what exists already and ...

1

I'm quickly assuming your question asks how to retrieve the public (RSA-) key from a set of samples of unencrypted and encrypted messages. If you're question is about: "How can I get my files back after being infected by CryptoWall?" I suggest you read the hits by the search function on InfoSec. Please also note that in most use cases RSA isn't used to ...

1

As for "how to build the substitution as hardware", it should be easy if you know any of the hardware description language (eg. VHDL or Verilog). Simply write the Sboxes of DES, then the synthesis software will handle the rest. You can also "synthesis" by hand, although that may take a lot of effect. Still, I'm not sure if this is what you are looking for. ...

1

Let's assume that the leaked bits were from the "actual" private key, i.e. the primes $p$, $q$, the private exponent or its value modulo one of the primes. A Coding-Theoretic Approach to Recovering Noisy RSA Keys gives a bound of 20% of the key material needing to be known for an attack. Given that you have a 2048-bit key, I don't think leaking 21 bits ...

1

Using the same key and IV for different, independently encrypted cells is a bad idea, regardless of which encryption algorithm you use. It would allow attackers to find either XORs of cells (with CTR) or at least equality of prefixes (with CBC). If you are going to use authenticated encryption, you need to choose whether the MAC applies to each cell ...

1

Since Bob already knows $K_{AB}$ he can run $D_{K_{AB}}(E_{K_{AB}}(E_{K_{AC}}(K)))$. Which will leave him with $E_{K_{AC}}(K)$. And to decrypt that any further (in order to get $K$) he would need either Alice or Charlie's help.

1

Is there a standard or at least "commonly used" format to format the result? PKCS #7 (and CMS which is a further development) describes a standard format for encrypted data. While it's mainly meant for public key encrypted data, it also has options for symmetric keys. It's rather complex due to all the features it supports, however, so unless you can ...

1

You don't need to hide the certificate at all. The certificate only contains the public key and additional info of the owner (in this case the server). It shouldn't contain any private information. What you need to do is to store the certificate in such a way that you can trust the origin of the certificate. So what you need to think about is certificate ...

1

The simulator obtains "client $B$'s input" in the same way the simulator obtains $\:\{\hspace{-0.03 in}0,\hspace{-0.04 in}0\hspace{-0.03 in}\}\;$. Even in the real world, the server computes its response without using any secrets, that response is the only message $B$ receives, and (from your description) no other party gives any output. $\:$ Thus, it ...

1

Yes, this is possible. One possible argument is of algebraic nature, using the fact that there is some $a\in\{0,\dots,q-1\}$ with $g_2=g_1^a$ and rewriting the public key's defining equations using this relation. However, there's a much simpler justification: A Cramer-Shoup public key consists of five elements $g_1,g_2,c,d,h$ of a group of order $q$, hence ...

Only top voted, non community-wiki answers of a minimum length are eligible