# Tag Info

## Hot answers tagged encryption

8

Let me first answer your actual question (and then I'll proceed to answer something slightly different that I think will be informative and helpful). Your question asks whether it's possible to use only a DSA key. Technically speaking, this is of course possible. The reason is that a DSA key has exactly the same format as an ElGamal key. No one forces you to ...

4

If you can generate uniform random numbers, you can use a variant of Fisher-Yates. //given an array s with the elements to be permuted for i from n-1 to 1: t = rand(0, i) # inclusive swap(s[i], s[t])

4

Does the value of the key array(T) have to be in this range [0-255] if yes could you please specify why? Yes. RC4 operates on bytes. There are 256 possible values for an 8 bit (1 byte) number, that range from 0 to 255. RC4 treats the key as an array of bytes, so every entry in the key array is by definition in the range 0 to 255. Why did they use ...

4

The simple answer is no, even if one can choose "the original unencrypted (cleartext) file".

4

Would this help preventing brute force attacks? It would slow down an attacker and prevent them from trying as many password guesses. E.g. if you used 1000 rounds like in RFC 2898, you would reduce the number of guesses by a factor of 1000. Assuming you count dictionary attacks under brute force attacks, such attacks would definitely not be completely ...

4

@Erez points to the simple and often good enough solution. In more general terms, you want to split the private key knowledge into several "shares" such that all of them are needed to actually obtain the private key. This calls for a few comments: To make the splitting/sharing easier, you can do things indirectly: generate a random symmetric key K, encrypt ...

3

It is very bad practice to use the same private key for two different schemes. In some cases this is secure but you need to explicitly prove it. One example of this can be seen here: http://www.pinkas.net/PAPERS/combined.ps. My suggestion is to take the Cramer-Shoup group and to define a separate key pair for DSA or Schnorr signatures. You can use the ...

3

It is an important feature to be able to see if encryption/decryption failed. Sure, padding oracles are a problem, but so is a protocol that doesn't perform intrinsic verification of the performed operation. If you have a key agreement protocol then you need some kind of method of validating that the decryption of the symmetric key succeeded. Now you could ...

3

There are two ways a cipher can be broken: theoretically and practically. If the paper is correct then: Our fastest attack achieves a nearly feasible $T=2^{101}$ (cf. Section 28.6 and [28]). (emphasis mine) If we verify this claim then we get: If we have a diverse population of at least $2^{79}$ diﬀerent 256-bit GOST keys generated at random, with ...

3

For a given prime $p$, there are many choices for the generator $g$, but $g$ cannot be completely arbitrary. As the name hints, $g$ is supposed to be a generator of the multiplicative group $(\mathbb{Z}/p\mathbb{Z})^*$ (or at least a large subgroup, more on this later), that is, it must have the property that the set of its powers modulo $p$ $\{g^1 \bmod p, ... 3 This question is based on opinion. At least kind-of. But the variants from which one can choose are quite a few. As for general construction the sponge construction (like Keccak / SHA-3 uses) are very versatile and can be used for many purposes, for example hashing, authenticating (= "MAC'ing"), authenticated encryption (see “General Overview of the ... 2 You are looking for a secret sharing algorithms. Such schemes are used in products such as PGP, originally Shamir offered a solution, called Shamir's secret sharing algorithm. 2 Not every cryptosystem is provably secure, in fact most aren't. Even among those that are the security is only proved under a limiting set of assumptions, not in a completely general sense. Of those that are provably secure, what's needed is a formal goal, and a proof that the system accomplishes the goal with zero or more formally stated assumptions. For ... 2 AddRoundKey. That step takes 16 bytes from the expanded key schedule, and exclusive-or's ("adds" in$GF(256)$terminology) it to the intermediate block state. 1 Yes, this is possible. One possible argument is of algebraic nature, using the fact that there is some$a\in\{0,\dots,q-1\}$with$g_2=g_1^a$and rewriting the public key's defining equations using this relation. However, there's a much simpler justification: A Cramer-Shoup public key consists of five elements$g_1,g_2,c,d,h$of a group of order$q$, hence ... 1 If I understand the question correctly, you are asking whether it's really needed to have the KEM be CCA secure, and maybe in the random oracle model it would suffice for it to just be an invertible one-way function. This would not be CCA2-secure. Specifically, let$f$be any invertible one-way function, and construct$f'$so that$f'(x)=0f(x)$for every ... 1 No, this is not possible. The homomorphism only works at one layer. A ciphertext in Paillier is$g^m\cdot r^n\bmod{n^2}$. The plaintext space is the multiplicative group of integers modulo$n$. So, for it to even have a chance to work, first of all, the modulus of the outer encryption would have to be greater than$n^2$, where$n$is the modulus of the ... 1 You can do this slightly better with an additional$\mathcal{0}(2^{56})$memory and with$\mathcal{0}(2^{56})$time. You can notice that the relation$c \leftarrow E_{k_1}(E_{k_2}(m))$can be rewritten as$D_{k_1}(c) = E_{k_2}(m)$(just apply the decrypt function on both sides. First step consists in the generation of every pair$(k_2, E_{k_2}(m))$and ... 1 As far as I understood the method of creating the 128 bit counter in the NIST documents is more or less kept open. There are some hints of deriving the counter, but NIST is essentially saying that anything is secure as long as the counter is unique. Using a starting value of 128 bits is certainly feasible and often required. Java providers - for instance - ... 1 Let$x_k$be binary variables and$a_k$be binary constants. So all arithmetic is modulo 2. Then $$f(x_1,\ldots,x_n)=a_0\oplus a_1 x_1\oplus \ldots\oplus a_n x_n$$ is an affine expression if$a_0\neq 0$and is a linear expression otherwise. An affine equation, e.g., would be $$a_0\oplus a_1 x_1\oplus \ldots\oplus a_n x_n=0$$ where$a_0\neq 0.$This ... 1 I'm going to describe two options that you have. There may be more that I don't know about. The first is to use long-term signing keys to sign public diffie-hellman keys. Upload a bunch of those to the cloud. Then when someone wants to share a file with you, they: download your "next" signed public diffie-hellman key verify the signature using OpenPGP, ... 1 It always depends on what you mean by secure, but note that, as SAI Peregrinus said in the other answer, not every cryptosystem is provably secure. For example showing that it is easy to produce ciphertext from plaintext but is difficult/impossible to get plain text from ciphertext. The property you describe here is called one-wayness (OW), and it ... 1 To make notations simpler, I note$R_i = F(k_i, IV_i)$. Then: $$C_1 = P \oplus R_1$$ $$C_2 = P \oplus R_1 \oplus R_2$$ $$C_3 = P \oplus R_2$$ Therefore: $$C_1 \oplus C_2 \oplus C_3 = P \oplus R_1 \oplus P \oplus R_1 \oplus R_2 \oplus P \oplus R_2 = P$$ Your protocol looks like Shamir's three-pass protocol but it requires a bit more than mere commutativity, ... 1 Yes it is possible for a passive eavesdropper to recover the secret$P$. Here's how: The attacker observes$C_1,C_2,C_3$and formes the XOR of all those values. That's it, the result of$C_1\oplus C_2 \oplus C_3=P\oplus F(K_1,IV_1)\oplus P \oplus F(K_1,IV_1) \oplus F(K_2,IV_2) \oplus P \oplus F(K_2,IV_2)=P$yields the desired plaintext. 1 First, a bit of background. If we refer to the size of an elliptic curve group as$n$, we select an elliptic curve with$n = hq$, where$q$is a large prime, and$h$is a small integer called the cofactor; it is typically either 1, 4 or 8. The values of$q$and$h\$ will be part of the curve definition. As you know, with straight DH, we agree on a point ...

1

KDFs like PBKDF2 are a work multiplier but they can't get blood from a stone. A PBKDF2 using 10,000 rounds "slows" the attacker down by requiring each "guess" to take 10,000 hashes instead of 1. The problem is that passwords like the ones you described are so weak a 10,000x increase in cracking time is like going from 1 ms to 10 seconds. It really isn't ...

Only top voted, non community-wiki answers of a minimum length are eligible