# Tag Info

8

Let me first answer your actual question (and then I'll proceed to answer something slightly different that I think will be informative and helpful). Your question asks whether it's possible to use only a DSA key. Technically speaking, this is of course possible. The reason is that a DSA key has exactly the same format as an ElGamal key. No one forces you to ...

6

Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. The ciphertext is the ENTIRE ciphertext (including IV etc.), and this is what must be MACed. This is granted. However, if you MAC-then-encrypt in the ...

4

The simple answer is no, even if one can choose "the original unencrypted (cleartext) file".

4

They're both broken under known plaintext attack, where attacker knows two (plaintext, ciphertext) pairs, $(m_1,c_1)$ and $(m_2,c_2)$: $E'_1(k_1,k_2) := k_1 \oplus E(k_2,m)$ $E'_1(k1,m_1) \oplus E'_1(k1,m_2)=E(k1,m_1) \oplus E(k1,m_2)$ The attacker simply computes $E(k1,m_1) \oplus E(k1,m_2)$ for every possible value of $k_1$ and compares it with $c_1 ... 4 @Erez points to the simple and often good enough solution. In more general terms, you want to split the private key knowledge into several "shares" such that all of them are needed to actually obtain the private key. This calls for a few comments: To make the splitting/sharing easier, you can do things indirectly: generate a random symmetric key K, encrypt ... 4 Would this help preventing brute force attacks? It would slow down an attacker and prevent them from trying as many password guesses. E.g. if you used 1000 rounds like in RFC 2898, you would reduce the number of guesses by a factor of 1000. Assuming you count dictionary attacks under brute force attacks, such attacks would definitely not be completely ... 4 If you can generate uniform random numbers, you can use a variant of Fisher-Yates. //given an array s with the elements to be permuted for i from n-1 to 1: t = rand(0, i) # inclusive swap(s[i], s[t]) 4 Does the value of the key array(T) have to be in this range [0-255] if yes could you please specify why? Yes. RC4 operates on bytes. There are 256 possible values for an 8 bit (1 byte) number, that range from 0 to 255. RC4 treats the key as an array of bytes, so every entry in the key array is by definition in the range 0 to 255. Why did they use ... 3 It is an important feature to be able to see if encryption/decryption failed. Sure, padding oracles are a problem, but so is a protocol that doesn't perform intrinsic verification of the performed operation. If you have a key agreement protocol then you need some kind of method of validating that the decryption of the symmetric key succeeded. Now you could ... 3 For a given prime$p$, there are many choices for the generator$g$, but$g$cannot be completely arbitrary. As the name hints,$g$is supposed to be a generator of the multiplicative group$(\mathbb{Z}/p\mathbb{Z})^*$(or at least a large subgroup, more on this later), that is, it must have the property that the set of its powers modulo$p\{g^1 \bmod p, ...

3

This question is based on opinion. At least kind-of. But the variants from which one can choose are quite a few. As for general construction the sponge construction (like Keccak / SHA-3 uses) are very versatile and can be used for many purposes, for example hashing, authenticating (= "MAC'ing"), authenticated encryption (see “General Overview of the ...

2

XTS has been designed for disk encryption, where an attacker typically has access to the disk only a single time (when they steal/confiscate the device). When an attacker sees several ciphertexts encrypted using the same key, they can tell which blocks differ between the versions, but not the content of the blocks. Compare this with CTR mode, which leaks ...

2

You are looking for a secret sharing algorithms. Such schemes are used in products such as PGP, originally Shamir offered a solution, called Shamir's secret sharing algorithm.

2

Not every cryptosystem is provably secure, in fact most aren't. Even among those that are the security is only proved under a limiting set of assumptions, not in a completely general sense. Of those that are provably secure, what's needed is a formal goal, and a proof that the system accomplishes the goal with zero or more formally stated assumptions. For ...

2

It is very bad practice to use the same private key for two different schemes. In some cases this is secure but you need to explicitly prove it. One example of this can be seen here: http://www.pinkas.net/PAPERS/combined.ps. My suggestion is to take the Cramer-Shoup group and to define a separate key pair for DSA or Schnorr signatures. You can use the ...

1

AddRoundKey. That step takes 16 bytes from the expanded key schedule, and exclusive-or's ("adds" in $GF(256)$ terminology) it to the intermediate block state.

1

You can do this slightly better with an additional $\mathcal{0}(2^{56})$ memory and with $\mathcal{0}(2^{56})$ time. You can notice that the relation $c \leftarrow E_{k_1}(E_{k_2}(m))$ can be rewritten as $D_{k_1}(c) = E_{k_2}(m)$ (just apply the decrypt function on both sides. First step consists in the generation of every pair $(k_2, E_{k_2}(m))$ and ...

1

Let $x_k$ be binary variables and $a_k$ be binary constants. So all arithmetic is modulo 2. Then $$f(x_1,\ldots,x_n)=a_0\oplus a_1 x_1\oplus \ldots\oplus a_n x_n$$ is an affine expression if $a_0\neq 0$ and is a linear expression otherwise. An affine equation, e.g., would be $$a_0\oplus a_1 x_1\oplus \ldots\oplus a_n x_n=0$$ where $a_0\neq 0.$ This ...

1

I'm going to describe two options that you have. There may be more that I don't know about. The first is to use long-term signing keys to sign public diffie-hellman keys. Upload a bunch of those to the cloud. Then when someone wants to share a file with you, they: download your "next" signed public diffie-hellman key verify the signature using OpenPGP, ...

1

It always depends on what you mean by secure, but note that, as SAI Peregrinus said in the other answer, not every cryptosystem is provably secure. For example showing that it is easy to produce ciphertext from plaintext but is difficult/impossible to get plain text from ciphertext. The property you describe here is called one-wayness (OW), and it ...

1

To make notations simpler, I note $R_i = F(k_i, IV_i)$. Then: $$C_1 = P \oplus R_1$$ $$C_2 = P \oplus R_1 \oplus R_2$$ $$C_3 = P \oplus R_2$$ Therefore: $$C_1 \oplus C_2 \oplus C_3 = P \oplus R_1 \oplus P \oplus R_1 \oplus R_2 \oplus P \oplus R_2 = P$$ Your protocol looks like Shamir's three-pass protocol but it requires a bit more than mere commutativity, ...

1

Yes it is possible for a passive eavesdropper to recover the secret $P$. Here's how: The attacker observes $C_1,C_2,C_3$ and formes the XOR of all those values. That's it, the result of $C_1\oplus C_2 \oplus C_3=P\oplus F(K_1,IV_1)\oplus P \oplus F(K_1,IV_1) \oplus F(K_2,IV_2) \oplus P \oplus F(K_2,IV_2)=P$ yields the desired plaintext.

1

First, a bit of background. If we refer to the size of an elliptic curve group as $n$, we select an elliptic curve with $n = hq$, where $q$ is a large prime, and $h$ is a small integer called the cofactor; it is typically either 1, 4 or 8. The values of $q$ and $h$ will be part of the curve definition. As you know, with straight DH, we agree on a point ...

1

KDFs like PBKDF2 are a work multiplier but they can't get blood from a stone. A PBKDF2 using 10,000 rounds "slows" the attacker down by requiring each "guess" to take 10,000 hashes instead of 1. The problem is that passwords like the ones you described are so weak a 10,000x increase in cracking time is like going from 1 ms to 10 seconds. It really isn't ...

1

Knowing the message $m_j$ should not help you to get $r_j$. In-fact, ElGamal is assumed to be CPA secure (assuming that DDH is hard). Meaning that even if we choose two different plaintexts and give them to alice and she is encrypting only one of them, we won't be able to know which one she encrypted. You can easily show that if you could retrieve $r_j$ ...

Only top voted, non community-wiki answers of a minimum length are eligible