# Tag Info

15

Vulnerability #1 You're rolling your own crypto. I'm stealing this from Iszi's comment, but it was my first thought when I saw this as well. The general consensus from cryptographers (read: universal accord with no dissent from anyone with more than a passing interest in cryptography) is that it is terribly difficult to roll your own cryptography until you ...

13

n is the exponent. So when n is doubled from 64 to 128 it doesn't mean that you have to try twice as many values. It means that you have to try $2^{64}$ times the amount you were already trying (as $2^{128} = 2^{2\times64} = 2 ^{64+64} = 2^{64}\times2^{64}$). It is required to only search half of the key space on average (if average is the correct term ...

9

ECB leaks if blocks are identical. For uniformly random data identical blocks become likely when you encrypt about $2^{n/2}$ blocks with an $n$ bit block cipher. CBC and CTR mode develop similar weaknesses when they encrypt that much data. => As long as you encrypt reasonable amounts (up to a petabyte or so) of random data with a 128 bit block cipher, like ...

7

This is called a transposition cipher. It is the kind of thing that was commonplace before the invention of the computer, and some people were really good at breaking that in mere minutes (e.g. Edgar Allan Poe). In all generality, breakage is done by backtracking (wrong hypotheses on permutation elements leading to "impossible digraphs" that cannot occur in ...

7

Decrypt the ciphertext with every possible key and store the result: $2^{56}$ decryptions. Now encrypt the (known) plaintext of the ciphertext with every possible key: $2^{56}$ encryptions. You have found the correct key pair if you find a result of the first list in the second list. All in all $2^{56} + 2^{56} = 2^{57}$ operations, not $2^{112}$. Just the ...

5

Sorry for the late answer, I got busy... So, you know that $\mathsf{Gen}$ is a probabilistic algorithm. What's a probabilistic algorithm? It's an algorithm which, during its execution, can make some random choices, which can be modeled as coin tosses. In programming terms, the algorithm can use a special coin-tossing function, which returns $0$ or $1$ each ...

5

I know that some of them are pretty hard to crack, but since they are so commonly known is it even practical to consider using something like that as an encryption method considering the algorithms for encryption and decryption are commonly known (from a security perspective)? In fact, this is exactly what we want. Schneier's law Anyone, from the ...

5

Here are some hints on how it's done on Mega: The password provided is passed through a KDF to derive a key, that is used to en-/decrypt the master key (later provided by the server through an API call). To bring it down to the crucial bits: The KDF applies $2^{16}$ rounds of AES-128 with it. The details can be found in the function prepare_key() of the ...

4

You can't encrypt a message with ECDH alone, because all it gives you is a shared secret that you can't really control. Rather, you use that secret in a symmetric scheme like AES (generally after passing it through a KBKDF to convert from an ECDH result to a proper-length and less-structured symmetric key, which you then use as the key for symmetric crypto). ...

4

I should begin by noting that this seems like an unusual assignment. I'm not sure why someone would explicitly have a goal of combining block ciphers and stream ciphers. First, let's summarize the difference between block and stream ciphers, since this may be useful for future readers. Block ciphers are so called because they operate over fixed lengths of ...

3

The standard for full-disk encryption (FDE) is XTS mode or ESSIV-AES-CBC. XTS tweaks each block within each sector differently (and hence avoids ECB's problems) and is considered the best choice available at the moment. ESSIV-AES-CBC works by using AES-CBC with the IV being the hash of the sector index. The problem with this mode is that you can flip bits ...

3

Pros of encrypting entire payload: That's simplest to code. Encrypting data may have the side-effect of improving the chances to detect an alteration during transfer of the cryptogram (hence enciphering the whole payload may extend that beneficial side-effect to the whole payload); however that is not the function of encryption, and it must not be assumed ...

3

If you just need random numbers, there's no point in generating random primes. Just make sure that you're using a cryptographically secure random number generator, properly seeded from a secure entropy source. Also, passwords made up of random letters and numbers are very hard to remember (and type). For a password meant to be memorized by a human, it's ...

3

There are no security advantages to evaluating the polynomial at random places instead of sequential. The information theoretic security proof of Shamir secret sharing does not depend on the evaluation points being chosen in any specific manner.

2

A theoretical solution for cryptographic timelocking which if I am not mistaken was proposed by Andrew Miller, is to combine Witness Encryption (link) with the Bitcoin block chain. Witness encryption allows you to encrypt information such that users will only be able to decrypt it if they have access to information that satisfies certain properties. In the ...

2

When creating a signed and encrypted PGP message, you only use your own keypair in the signing phase -- it's not used when encrypting the message (that only uses the recipient's public key). The recipient uses their own keypair only to decrypt the message, not to verify the signature. The two keypairs don't interact at all; that's why they don't have to be ...

2

swap-or-not seems perfect for your use case.

2

Yes, it is because it will use DES (CBC) mode of operation. DES only has an effective key size of 56 bits. Attacks on DES are able to shave a few bits off of that. So the key and the can be brute forced regardless of the (PBKDF1) key derivation. MD5, while considered broken by itself, is less of an issue when it is used within PBKDF1 - as long as the ...

2

Your design seems to be a byte-wise generalization of Jennings' multiplexed generator rather than the alternating step generator. S. M. Jennings, “Multiplexed Sequences: Some Properties of the Minimum Polynomial,” Lecture Notes in Computer Science, vol. 149, 1983. I believe designs like hers [may even be byte based for efficiency] have been used in ...

2

A few approaches: Generic format preserving encryption. For example AES in FFX mode. The downsides of this approach are complexity and performance. Block-ciphers with small (typically 32 bit) blocks. Skip32 derived from Skipjack ipcrypt (very recent, no security analysis so far) The downside of this approach is that these ciphers aren't very popular ...

2

The quoted passage of the Wikipedia article is wrong does not at first reading seem to match Blowfish as in Bruce Schneier's Description of a new variable-length key, 64-bit block cipher (Blowfish) (in proceedings of the first FSE conference, held Dec. 1993) which for this same operation reads: XOR P1 with the first 32 bits of the key, XOR P2 with the ...

2

Better is a subjective term. However for the choice between ECB and CBC, the choice should be CBC for almost all situations. Although ECB and CBC are modes of operation of a block cipher, you could also turn this way of thinking around and see the block cipher as a configuration option for the mode of operation. The mode of operation has a big influence on ...

2

openssl rsa -pubin -inform PEM -text -noout < public_key.pem Public-Key: (64 bit) Modulus: 16513720463601767803 (0xe52c8544a915157b) Exponent: 65537 (0x10001) The modulus is small enough that you can easily factor it After finding the prime factors, you can calculate the private exponent After you have the private exponent, you raise each 64-bit block ...

1

The "logic" of the Enigma machine and the development of the Polish solution, in principle, are well described in David Kahn's "Seizing The Enigma". There may be better descriptions that have come out since, but I found this very clear and continue to recommend it. In addition to the nuts and bolts of the machine itself, Kahn describes the history from ...

1

I think you will not find any scheme that works over $Z$. But, if you want to work over $Z_t$, you just have to choose a LWE-based encryption scheme that encrypts non-binary messages, and there is a lot of them! For example, the paper ML Confidential uses one scheme like that (non-binary messages) to perform classification algorithms over cipher texts. ...

1

Consider what it means for a key $k$ to be chosen according to some distribution over key space $\kappa$: Assume that $\mathsf{Gen}$ picks key $k$ from key space $\kappa$ with probability $p$. Since $\mathsf{Gen}$ is randomized, this means that a $p$-fraction of all the random tapes will lead it to generate $k$ as the key. If we now conceptually redefine ...

1

The keystream is as long as the message, so you don't want to send that to the receiver. The keystream is generated by a much shorter key (e.g., 128-bit private key). That is what the receiver needs in order to decrypt the message. So, how do you get that to the receiver? Well, clearly you can't just send it in the clear or anyone watching the channel would ...

1

Anyone who has the keystream and the ciphertext can trivially calculate the plaintext — it's a xor operation bit by bit. Sending the keystream alongside the ciphertext would completely defeat the purpose of encryption. The principle of stream ciphers is that the sender and the receiver agree on an algorithm, a secret key and some parameters, and both ...

1

A practical solution is CryptonorDB which allows you to run queries without decrypting the data. Is somehow similar with CryptDB which is designed as a plug-in for MySQL(and possible other SQL servers), but CryptonorDB is a NoSQL db system and works with JSON documents. Edit: as suggested by community, I'll detail more about encryption algorithms used in ...

1

The triple DES (3DES) block cipher works by essentially running the block through DES three times. Triple DES is also known as "DES EDE" (encrypt-decrypt-encrypt) and under the name given by the standard document: "TDEA". The TDEA algorithm is described in FIPS NIST Special Publication 800-67 Revision 1 where paragraph 3.2 describes the TDEA Keying Options. ...

Only top voted, non community-wiki answers of a minimum length are eligible