# Tag Info

5

It's generally strongly recommended you use an existing library for your crypto, instead of trying to reimplement it. One big advantage of a widely used existing library is that it's been improved over time to deal with new threats. You may be aware of timing attacks as a current weakness, but these libraries have already solved those problems and many ...

5

Yes, you are remembering correctly. Yes, this is a reasonable method to find the key length. The reason why this works is because, typically, the plaintext is not uniformly random. For instance, rather than a random bit-string, the plaintext might be some English text, encoded in ASCII. If $X,Y$ represent two random English letters, encoded in ASCII, ...

4

That is quite impossible. Lets assume that such an encryption scheme would exist and assume that it always outputs ciphertexts of length $n$ bits. Then, because the scheme is assumed to encrypt plaintexts of arbitrary length, it in particular encrypts all plaintexts of length $n+1$ to ciphertexts of length $n$. However, there exist twice as many plaintexts ...

4

To prove that a scheme is not secure under such a definition you usually would propose an algorithm such that the experiment described in your question outputs $1$ with probability non-negligibly larger than $1/2$. As this looks very much like a homework problem I will not give you a solution. However constructing the algorithm is actually very simple in ...

3

The main pitfall is possibly thinking that it provides authentication. The result is still a public key scheme. It won't help to include the IV in the associated data, since that is already covered by the authenticated part of AEAD. Including the RSA-encrypted symmetric key in the associated data would help by making the resulting hybrid encryption CCA2 ...

3

That sort of thing is known as multi-party computation, and you should use a Socialist Millionaire Protocol for your particular instance.

3

Almost all other languages can call C code, so using C is a safe bet. Serpent, Twofish, Threefish and scrypt all provide C implementations. (See the links.) Some even provide optimized code. Writing objC or C++ wrappers seems unnecessary since both can call C funtions. The sleep(3) library function is part of POSIX. So you'll find it on linux, mac, *BSD but ...

2

First and foremost: it is a bad idea to invent a method to sign or encrypt with RSA (or any crypto). Standards like PKCS#1 or ISO/IEC 9796-2 are here for that purpose, and even these occasionally have more or less subtle flaws. Given comments, I'll assume that the question is about an RSA encryption scheme enciphering message $M$ into $(M||S)^e\bmod N$, and ...

2

Step 1: good job, this is the right way. You can also use bcrypt or scrypt for extra resistance. Make sure you have chosen sufficiently strong parameters, that is, 64-bit salt and 10000 rounds absolute minimum. Step 2: no! once you have a strong derived master key, you don't need to apply PBKDF2 on any keys derived from this master key. You are just wasting ...

2

The AES solution will fail if either: the secret key is leaked, or AES-256 is broken. The RSA+AES solution will fail if either of the above happens, or if: RSA-4096 is broken. Thus, even without considering the relative likelihoods of these events occurring within the next 30 years, it is clear that the AES-only solution cannot be any less secure ...

2

Yes, this is fine, at the record level. (What you've built would be classified as a "Encrypt-then-Authenticate" scheme in the literature, and there are standard provable security results for such schemes.) Well done on constructing a solid, well-engineered cryptographic scheme. An AEAD mode would spare you from having to invent such a scheme, but what ...

1

If you agree to define "fixed length cipher text" in such way that the import criterion isn't that the cipher text has a constant bounded length, but that the length of the cipher text is independent of the length of the plain text, the trick is simply to ensure that the cipher text is at least not shorter than the total amount of plain text. In practice, ...

1

Practical Cryptography, by Ferguson and Schneier, is slightly more engaging than a pure reference book, and you might find it more readable than some of the other more technical tomes. Otherwise, there are not many straight-up "story books" that discuss the technology at a bits-and-bytes level. You will likely find more interesting books in the history ...

1

The primary problem with encrypt-then-sign (signing the ciphertext) relates to the difference between signing for the purpose of assigning responsibility vs for the purpose of taking credit. Encrypt-then-sign is OK for the former but not for the latter. The issue is quite subtle. In particular, in your protocol, the recipient has no reason to believe the ...

1

You could GPG-encrypt both the .7z archive and the PAR2 error-correction data. That will take care of the security issues. Alternatively, you could compute the PAR2 error-correction data on the results of the GPG encryption, for the reasons Ricky Demer explains. That would be secure too. Either one works.

1

Selective format-compliant JPEG encryption as you are trying to do it is a great idea, but it won't work... not like this. To keep the reasons short and simple: JPEG uses lossy compression (and even lossier recompression). If you really want to create a format-compliant implementation, you'll have to take care that you're independent of any ...

Only top voted, non community-wiki answers of a minimum length are eligible