Tag Info

Hot answers tagged

7

You can in principle encrypt using a hash function, in the manner you describe (although what you have described is not necessarily a secure construction). What you are trying to do is generate a keystream from a hash function and a key. You can use counter mode to turn any strong pseudorandom function (PRF) into a stream cipher. CTR mode produces a ...


6

The point of cryptography is having algorithms that are secure even when the attacker knows them. Google security by obscurity to see why it's bad. I'll add the following based on otus comment. Python can be reverse engineered, so you can't hide your algorithms. Basically, if someone can run your code, they can reverse engineer the algorithms. The point of ...


4

Yes, you can, but you would need access to raw or textbook RSA encryption and you would have to implement the PKCS#1 v1.5 or PSS padding primitives yourself. Beware that PKCS#1 v1.5 compatible padding is different for encryption signature generation. If you only have PKCS#1 v1.5 encryption or OAEP encryption available then the encryption routine will ...


4

You got what a "semiprime" number is; it's a number which is the product of two primes. When people talk about "multi-prime RSA", what they mean is something which is pretty much the standard RSA algorithm; however the modulus is the product of at least 3 prime numbers (as opposed to standard RSA, which has only 2 prime factors). Why would anyone do this? ...


3

The only way you could do this if if you could affect the padding schemes appropriately. Mathematically, textbook RSA encryption with the private key is the same as textbook RSA signature generation. Nobody should use textbook RSA, however. In practice, padding schemes are used and they differ between the two operations. So unless you can turn off padding ...


3

In a group of size $n$ (e.g. an elliptic curve), the order of a subgroup generated by a group element necessarily divides $n$. We usually choose curves so that their order $n$ is prime; in that case, the order of a point must be either $1$ (the point is the "point at infinity") or $n$ (all other points). Thus, if $n$ is prime, then every non-zero point is ...


2

Python is a scripting language, so if you've got the program, you usually also have the source code. So you don't even have to reverse-engineer. That doesn't matter much for two reasons: other languages are pretty easy to reverse engineer (or they are complex for both the programmer and the attacker); the algorithm does not have to be kept safe anyway, due ...


2

This is called the common modulus attack. Bezout's Identity says that there exists $x$ and $y$ such that $ax + by = gcd(a, b)$. In our case we have $gcd(e_a,e_b) = 1$, so we can find $x$ and $y$ such that $e_{a}x + e_{b}y = 1$ (you can use the extended euclidean algorithm for this). After solving for $x$ and $y$, you compute: $C^xC^y\mod N$ to get $M$. ...


2

Yes, it is possible to turn a hash into a secure cipher, though not in the manner described. The encryption scheme described is extremely poor: if someone can guess the first 32 bytes of the message (e.g. because that's a standard file header), it is trivial to recover SHA256(key): that's the XOR of the 32-byte guess and the first 32 bytes of ciphertext. It ...


2

There are two answers, really depending on your specifications and how your generator will be evaluated. If all you need is to have a PRNG with statistically excellent random, but really don't care about predictability or cryptographic considerations, go for something simple like a Mersenne Twister. If you actually need some effective stream-cipher, look ...


2

Encryption algorithms encrypt bits. All digital media (text, pictures, videos, etc) is stored as bits at the lowest level, therefore, they can all be encrypted.


2

BCrypt is considered more secure The theoretical security of bcrypt has received less scrutiny than that of PBKDF2, SHA2 and HMAC. PBKDF2 is thus widely standardised (e.g. in NIST SP800-132 and PKCS #5) while bcrypt is not. In practice the security (resistance to brute force attack or dictionary attack) of bcrypt and PBKDF2-HMAC-SHA512 can be ...


2

TLS 1.0 is in effect SSL 3.1. If you need more details about the history and why it is called TLS 1.0 instead of SSL 3.1 read Wikipedia.


2

Take a point $G$ on the elliptic curve $E$. Someone calculates point $P = h*G$ where $h$ is some secret number (this can be done with point addition and duplications fast). Your task: Given public points $P$ and $G$ and curve $E$, find the secret $h$. Solving this problem is hard. That is the problem that makes elliptic curves secure. Does a larger n ...


2

A few relevant mailing lists: cypherpunks@cpunks.org cryptography@metzdowd.com (moderated) cryptography@randombit.net liberationtech@lists.stanford.edu Other crypto mailing lists with a narrower technical focus: messaging@moderncrypto.org curves@moderncrypto.org cfrg@irtf.org tls@ietf.org


1

Nitpick: keytool accepts both alias and keypass if specified; if not specified it prompts for key password if needed but defaults alias to mykey. A JCEKS file can be operated on either by keytool or by other code. JCEKS can support three types of entries: privateKey, trustedCert, and secretKey (the older and default JKS file can do the first two). The ...


1

The tricky point is that modulo a Blum integer (the product n = pq of two primes p and q that are equal to 3 modulo 4), in general, a quadratic residue (a value that is a square of something) has four square roots, not two. Consider the "normal" Rabin algorithm. Message m is encrypted into c = m2 mod n. To decrypt, you work modulo p and ...


1

In both options, if the adversary has a way to check either AES key, then a brute password guessing attack can be attempted, and BCrypt is the main line of defense against that. For constant effort, option 2 force to halve the cost parameter in BCrypt, and is thus twice more vulnerable to password guessing than option 1 is. BCrypt's output is described as ...


1

This is pretty common. The method of encryption is public information, so it is safe to leave in the clear. In your post you made no mention of authentication. This is something you absolutely must use, otherwise you have no way of knowing if your data has been modified and leaves you open to many attacks. Consider using HMAC with SHA-256, or a block ...


1

It means that $n$ is the order of the elliptic curve group, that is, the number of points in that group. The private key in ECC is a scalar value $k$ where $1 \leq k \lt n$. A larger $n$ implies a higher security level. The size of $n$ should be twice your expected security level in bits e.g. a 256-bit $n$ for 128-bit security.


1

Others have already given the answer, so the following just uses slightly different words that might be helpful. Files on a computer consists of bytes. Bytes are made up of bits. A bit is a 0 or a 1. A byte consists of 8 bits. That is, a byte is a string of 8 1's and 0's (a binary string). Most encryption algorithms works of the bits. So if you have a file, ...


1

All files (text, video, whatever) consist of bits. The general procedure with symmetric encryption algorithms (such as AES) is they generate a stream of pseudo random bits, which is derived from a key or password, and then they mangle (typically XOR) the original data with the random data. Thus resulting in new data that appears to be totally random. ...


1

Another way to encrypt with a hash function is chaffing and winnowing.


1

According to this primitives like AES and SHA generate proper pseudo random numbers that pass relevant tests. Hence, your scheme should be sufficient for generating a stream of random bytes as encryption key for stream cipher. Although, it should be noted again (as you already did): You do not generate a real one-time pad, but just a stream that might look ...


1

Although I do not have a formal proof I think a compressing encryption algorithm could not be secure. The reason is that we know there is no way to compress every input (information theoretically this is impossible). That means that a lossless compression algorithm can really only compress certain input strings. That in turn means that if our encryption ...


1

Since you already know $K$, you just need to know the length of $H$ based on the hash algorithm you are using, which should be constant, then simply split the output of $D_k$ into the 2 parts of appropriate length. You can then perform the keyed hash on the first part and match it against the last part, which will match if the decryption was successful. It ...


1

For 1) you need to show that $S(X)$ is linear with respect to xor. We can define $S(X)$ as: $S(X) = (x_{7}, x_{0}, x_{1}, x_{2}, x_{3}, x_{4}, x_{5}, x_{6})$ And define $A \oplus B$ as: $A \oplus B = (a_0 \oplus b_0, a_1 \oplus b_1,a_2 \oplus b_2,a_3 \oplus b_3,a_4 \oplus b_4,a_5 \oplus b_5,a_6 \oplus b_6,a_7 \oplus b_7,)$ So we have: $S(A \oplus B) = ...


1

Say you have the value $n$ which is the size of the alphabet (i.e. the range of characters that make up your plaintext and ciphertext). And say $m = x \times n$ is the largest value you have that is not higher than $y$ where $y$ is the largest size produced by your random number generator. For each character: Take values from the random number generator ...


1

Sorry, 64-bit RSA is terminally unsafe: hand the modulus to Wolfram and its factorization is returned among other trivia. Some mention of use of 64-bit RSA in commercial products can still be found, but do not count on Crypto.SE for any recommendation about that. More generally, we know no method comparable in goal to RSA encryption that is even mildly ...



Only top voted, non community-wiki answers of a minimum length are eligible