# Tag Info

32

You are likely going to have both false positives and false negatives if you try to use Shannon entropy for this. Many compressed files would have close to 8 bits of entropy per byte, resulting in false positives. Any encrypted file that has some non-binary encoding (like a file containing an ASCII-armored PGP message, or just a low entropy header) could ...

9

Your problem is equivalent to solving $m^3 \equiv c \pmod n$. This corresponds to breaking RSA for $e=3$. We know no efficient way for doing that without factoring $n$. If you know the factors of $n$ you can compute the private exponent $d$ as $e \cdot d \equiv 1 \pmod{\varphi(n)}$ using the extended euclidean algorithm and then compute $m$ as $c^d$.

9

I believe the concept you're looking for is a cryptographical hash. This is a function that takes a (potentially) long input, produces a short (fixed length) output, and for which it is impractical to find two different inputs that generate the same output. It is a fixed function; anyone (including your customer) can generate a hash for any input. How it ...

6

If I understand you properly, you are going to test some cryptographical primitives by running them on some plaintext, and then taking the resulting ciphertext and giving it to a randomness test suite; your question is "what plaintext should I use? If I pick a random plaintext, then the test results might reflect the randomness of the plaintext, and no ...

6

Yes its a good indicator and no there won't be many false positives. A high-entropy file indicates that a file is either well-encrypted, well-compressed or just contains truly random bytes. Most compression formats have recognizable headers etc so these can be easily distinguished. Most people do not have files of random bytes lying around - why would ...

6

Before we start with vectorial Boolean functions, let's recall the definition of the nonlinearity of a Boolean function: $$\mathcal{NL}(f) = \min_{a \in \mathbb{F}_2^n} d_H(f, \ell_a \oplus b),$$ where $\ell_a \oplus b$ represents the affine Boolean function defined by the bitvector $a$: $\ell_a(x) = a \cdot x$ ($\cdot$ is the dot product). The above ...

6

Use DLIES, which is essentially Diffie-Hellman with an ephemeral sender key. Assuming you know the receiver's public key, that will cost no extra round trips. The sender does: (eph_sender_private, eph_sender_public) = Generate_Key_Pair() shared_key = SHA-512(Diffie-Hellman(receiver_public, eph_sender_private)) ciphertext = Encrypt(shared_key, message) ...

5

Rather than using a form of encryption which is slow in one direction, you could use a proof-of-work function instead, as Ricky Demer pointed out in the comments. This allows you to freely tune the slowdown while still using normal, widely accepted encryption and authentication algorithms. For example, you could make the sender look for a partial preimage ...

5

Perhaps not of relevance if the question is meant in a purely thoretical (i.e. asymptotical) sense, but the CBC encryption mode is inherently sequential, while decryption can easily be performed in parallel.

5

In lattice-based encryption schemes, the encryption is often slower than the decryption (not artificially, but just as the natural way it works). See this paper Efficient Software Implementation of Ring-LWE Encryption (encryption is 3 times slower than decryption).

5

Yes, there is the one-time MAC. This is a scheme which ensures that an adversary (even one with infinite computational resources) has a negligible chance of altering the message or forging a fake message without detection. Edit to add: Mikero's comment and the other answer demonstrate that we need to be clear about what we mean by "perfect" integrity. "...

5

A block cipher mode is an algorithm used along with a block algorithm to encrypt arbitrary size plaintext, providing both confidentiality and authentication. A single block cipher operates only on a fixed block length. It is not alone enough to encrypt larger plaintexts. It functions as a blackbox in an encryption scheme (see Random Oracle Model). The are ...

4

Well, there are indeed differences between the two standards, as you can see below: key pair generation X9.31 requires that $p-1$, $p+1$, $q-1$, $q+1$ all have prime factors between $2^{100}$ and $2^{120}$, and that $p$ and $q$ differ in at least one of the first 100 bits. These requirements are there to frustrate suboptimal factoring methods, ...

4

The block cipher itself is used as a black box for any mode of operation. The internal design - including if the block cipher uses a Feistel network - is completely tranparent to the mode of operation. The only thing that matters for the mode of operation is the block size of the block cipher. This, together with any usage limitations, limits the ...

4

What you're asking for is impossible by a very simple argument. If you're mapping a large number of things to a smaller number of things, more than one of the things from the bigger group will get mapped into the same thing in the smaller group. This is the pigeonhole principle. When you get your "small number" there will be several different large numbers ...

3

It depends on the application if base 64 is being used to represent keys. Many applications that implement/use cryptography have been originally designed in a time where ASCII based communication was commonplace. If you would directly use BER / DER - a binary encodoing of parameters - then you had a high chance of losing data. For instance, you would not be ...

3

Base-64 is simply a way to represent binary data using the ASCII character set. It's used because a single base64 digit represents a whole number of bits (6 bits), where each decimal digit represents ~3.3 bits, which can make conversion a little tricky. Being able to represent more bits per digit also means its more space efficient than decimal. It takes ...

3

Since any cipher must be able to decrypt every message that it encrypts, it follows that, given a fixed key, any cipher must be an injective function: In mathematics, an injective function or injection or one-to-one function is a function that preserves distinctness: it never maps distinct elements of its domain to the same element of its codomain. In ...

3

Let $a$ and $b$ be the numbers emited rsp. by person A and person B. $E(x)$ means encoded form of $x$. $E(a)$ and $E(b)$ are publicly known, right? Note that if person A knows $a$, $E(a)$, $E(b)$ and person B knows $b$, $E(a)$, $E(b)$ and it is possible to calculate $a+b$ from $E(a)$ and $E(b)$ (that is what you want to do, right? So it must be possible) ...

2

To me that sounds like a specific type of corruption, which can also be used in simple "analog" audio encryption systems. Some analog encryption systems work by reordering of the frequency bands so they are unintelligible. I believe what you are hearing is missing specific frequency bands, most likely by a fault in the encoder, which results in them not ...

2

No, wrapping the data key set seems a good idea to me. It's pretty standard and should even work with e.g. hardware modules. Note that your old ciphertext would still rely on the security of your old secret (password) when you choose this scheme! If $Enckey$ is ever guessed it can be confirmed by decrypting (the first part of) your ciphertext. There is a ...

2

For some modes of operation you can easily show that an involution would be insecure: OFB would be most clearly insecure, since the keystream just repeats the nonce/IV and its corresponding encrypted block. CFB would likewise be insecure, since zero blocks encrypt just like with OFB. This is of more limited advantage to an attacker, but far from secure. ...

2

The keychain was moved to the Secure Enclave, the Apple WWDC 2015 Session 766 transcript states: "We also moved the KeyStore component from the kernel into Secure Enclave and it's that component which controls the cryptography around Keychain items and the data protection."" Thus both symmetric and asymmetric keys are now in the Secure Enclave if the ...

1

Is it fine to do that? Yes, it should be fine, as long as you do not reuse the key/salt-pair for encrypting another piece of data. Or is there a more standard construct? Any authenticated encryption algorithm would work. E.g. AES-GCM with the PBKDF2-derived key. If you are going to use the same password for encrypting many such pieces of data there ...

1

I'm sorry, but chances are this doesn't work. The reason is of course that ECDSA signatures are usually fully randomized, meaning that there's randomness introduced in between the private key and the final signature. If you're looking at an ECDSA specification, the relevant value usually is called $k$. What you'd rather need would be an RSA encryption / ...

1

What you are describing is called a transposition cipher. First of all, it would be easy to detect which method you are using since the frequency distribution of your cipher text will be the same as the language of the plain text. I think the biggest problem with using only transposition as opposed to a combination of both substitution and transposition ...

1

Assuming the set of large numbers is small (otherwise you cannot represent them all as small numbers), what you are looking for can be broken into two steps: Transform the large numbers into small ones. Encrypt them. The first problem is not really cryptographic. In the simplest case it can be simply subtraction. If your set of numbers is sparse it can ...

1

Shift cipher or ceasar cipher attains perfect secrecy only in the special case with the assumption that $26$ keys are used in equal probability in the shift cipher, and to encrypt each symbol we use a different key which is choosen equiprobably (i.e. perfectly random) from the key space. It is easy to check all keys given a plaintext when the key is fixed ...

1

Let $K$ be the set of all possible keys (for AES-256, this set has $2^{256}$ elements.) Let $M$ be the set of all possible messages (for AES, it has $2^{128}$ elements). Let $C$ be the set of all possible cipher texts (for AES, again $2^{128}$ elements). I was reading a proof to the statement: Perfect privacy implies that $|K|=|M|$ ...

Only top voted, non community-wiki answers of a minimum length are eligible