Hot answers tagged

28

You could be thinking about the Merkle-Hellman knapsack cryptosystem. It was invented in 1978 and everything seemed well and good until it was completely broken six years later in 1984 by Shamir - it was a complete and total break, i.e. the cryptosystem became unusable overnight. That said I don't know if the knapsack cryptosystem was ever "popular" in the ...


18

DES has not been mentioned in the previous two answers. Although it was known to be quite weak from very early on it was widely used for a couple of decades at least, until newer algorithms (3DES, AES, but also e.g. RC4) displaced it. Nowadays it can be broken in hours with dedicated hardware or with at most a few thousand dollars of cloud computing time. ...


17

This is a shot in the dark, but could you be thinking of the Needham-Schroeder protocol? It was published in 1978 [1], and an attack was published as much as 18 years later, in 1996 [2]. It is not an encryption method, though, but a protocol. In fact, the original paper does not even specify an encryption method to be used, but uses encryption symbolically. ...


13

There are a number of considerations here, I'll try to lay them out one at a time for ease of following: What must the site do with the data? Oftentimes, we ask web sites to do things on our behalf when we are not actually visiting them. For example, I may want crypto.SE to email me when there are responses to this post. The site could not do that ...


13

Assuming that: the functions $F_k(s) = {\rm hash}(k + s)$ form a pseudorandom function family (PRF) indexed by the key $k$, and each key is only used to encrypt one message, then this construction is provably1 secure against chosen-plaintext attacks. Being a PRF is not a standard property of a cryptographic hash function, so one cannot just assume that ...


11

There are several possible attacks. Off the top of my head, if an attacker manages to fool you into encrypting a very long message consisting of zeros (00.......00000), then the resulting ciphertext can be used to decrypt all the ciphertexts encrypted with that key. That kind of attack would be a chosen-plaintext attack. That means that your cipher doesn't ...


11

In general the AAD itself is not required or won't change the security of the GCM mode of operation itself. It may however directly influence the security of the protocol in which GCM is deployed. For instance, you may have specific configurable parameters outside the ciphertext itself. These parameters may very well include: version number of the ...


9

There are two facets in the use of TLS-1.0 with TLS_RSA_WITH_RC4_128_MD5. From a cryptographic point of view: TLS-1.0, as a protocol, is not broken. It does a number of things in a suboptimal way, forcing implementations to jump through intricate and topologically improbable hoops in order to avoid side-channel leakages. Recent implementations ought to be ...


8

AAD has nothing to do with making it "more secure". The aim of AAD is to attach information to the ciphertext that is not encrypted, but is bound to the ciphertext in the sense that it cannot be changed or separated. (Conceptually, the MAC is computed over the AAD and the ciphertext together.)


8

With some modes you can encode then encrypt, specifically stream cipher modes (CTR, OFB). Bit errors during transmission translate to identical bit errors in the encoded plaintext, and error correction will work as intended. However, with standard block cipher modes (ECB, CBC), the entire block is encrypted, and a 1 bit error in the ciphertext creates many ...


8

Historically, there did exist a benefit to using a language that the adversary was not familiar with. The name for this is code talkers, and the most famous ones (at least in the USA) are the Navajo code talkers of World War II. The idea was to defeat attacks that relied on statistics about the language used in the plaintext. In modern cryptography, ...


7

This is identical with CTR mode encryption with a MAC. That's known to be secure. It doesn't say in your question if: the Ai blocks are completely unique; the header is included in the MIC calculation. If those preconditions are met then I don't see any issue with the protocol. The first one I cannot verify but seems likely, the second one is certainly ...


6

OpenPGP is a hybrid cryptosystem. The actual message is encrypted applying a symmetric cipher like AES with a random session key. This session key again is encrypted using a public/private key cryptography algorithm like RSA. This is mostly because symmetric encryption is much faster than public/private key cryptography, especially for large messages. As the ...


5

There is some confusion here. The definition of prime numbers states that cannot be factored (see Definition of prime numbers) You seem to be talking about RSA modulus which is the product of two prime numbers (see RSA cryptosystem). As far as keylength is concerned 768 bits is not considered safe today. Note that the keylength choice is a compromise ...


5

Is there a reason that expanded messages are much more difficult to crack? When looking purely at encryption, message expansion does not really tell you anything about the difficulty to crack it. Message expansion is often a feature of asymmetric cryptosystems. Those are not inherently more difficult to crack than symmetric systems. Block ciphers also ...


5

BitTorrent, when encryption is used (optional in most clients), uses the Diffie-Hellman protocol for key exchange and RC4 for confidentiality. It also drops the first 1kb of data from the RC4 output as part of the specification. There is no authentication, not really enforceable anyway due to the nature of peer-to-peer sharing networks. Standard theory ...


4

OK, so this takes a bit of guessing, but I'm assuming the following: A is the identity of A, which can be used to select the right public key of A; Kxa() is a signing operation (with message recovery) that signs the random Ra and a tag Ts which is used as proof; Kya() is an encryption operation with the public key A, so that the session key Ks is kept ...


4

Ciphertext expansion, or expansion ratio are terms used to indicate this.


4

I can tell that using new hash function is a bad idea since no one has yet to research and attack it, aside from the fact that more bits is less efficient. Apart from this explanation, I don't see other reason to disqualify this answer. That one is largely correct, although more bits doesn't have to mean "less-efficient" as for example Skein-512 ...


4

Exponential cipher is a symmetric-key algorithm, not public-key one. So you don't have any public and private keys. You only have one secret key and it's used for encryption of messages between people that know the key. The security of exponential cipher is not in the computiation of $d$ from $e$, which is easily computable by EEA as you said. The security ...


4

In 2006-07, NIST published a new standard for cryptographically secure random number generation. One of their suggestions was based on elliptic curves, DUAL_EC_DRBG. in 2006, Daniel Brown and Kristian Gjosteen discovered that this algorithm had a subtle bias for certain numbers. Later, in 2007, Dan Shumow and Niels Ferguson said they had found what caused ...


4

The cipher suite with the best theoretical security for TLS (v1.2) right now is clearly: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 with P-521 as the associated curve for the certificate and the key-exchange. The arguments are simple: ECDHE and ECDSA with P-521 both provide 256-bit security against forgery / key recovery attacks AES-256 is the strongest ...


4

Yes, 3DES is a symmetric cipher and you use a secret key for both encryption and decryption with it. However, that is not the same thing as the keys used in RSA or other public key cryptography – you cannot (and should not) use either of them for 3DES. Since you are using S/MIME, you are actually using public key encryption. Any reference to 3DES is about ...


4

As indicated, the header format of your proprietary encryption is entirely up to you. Still, as I see this forgotten or done imperfectly a lot of times, I'll give some general hints in the right direction. First of all, complexity is the enemy of security. If you make your header overly complex you may get into trouble. It could be possible to generate ...


4

If you're referring to a classical cipher, it might complicate frequency analysis and other such techniques. For a modern cipher, it makes no difference. Modern ciphers operate on arbitrary patterns of information. Ideally, the ciphertext of a modern cipher should have no relation of any kind to the associated plaintext, other then the key.


4

The XOR state is irreversible without the proper key which is what I understand, so whats the point of all of the other operations that happen on the key? Suppose all we had was secret keys and the XOR operation. Well, actually, it is possible to build a secure cipher out of that, called the one time pad. One time pads offer perfect secrecy, but suffer ...


4

Yes, there is the one-time MAC. This is a scheme which ensures that an adversary (even one with infinite computational resources) has a negligible chance of altering the message or forging a fake message without detection. Edit to add: Mikero's comment and the other answer demonstrate that we need to be clear about what we mean by "perfect" integrity. "...


3

You can compute a statistical distance measure between the observed letter frequencies in your candidate plaintext and the typical letter frequencies in English text. There are a number of different ways to measure the similarity between two statistical distributions, and I'm not aware of any theoretical or empirical studies on which of them would be ...


3

WEP for securing wireless networks: Wired Equivalent Privacy (WEP) is a security algorithm for IEEE 802.11 wireless networks. Introduced as part of the original 802.11 standard ratified in 1997, its intention was to provide data confidentiality comparable to that of a traditional wired network. WEP, recognizable by the key of 10 or 26 hexadecimal digits, ...


3

Loading and using encrypted firmware usually requires one of the following conditions to be met: You have a security (co-)processor and the processor is trusted to follow the instructions given by that (co-)processor You have a trusted processor and some tamper-resistant storage Scenario 1 You have a security (co-)processor and the processor is ...



Only top voted, non community-wiki answers of a minimum length are eligible