# Tag Info

17

In short: You must authenticate the IV. Which particular attacks apply if you don't depends on the block cipher mode; I will give two common examples. In CTR mode, an attacker who fiddles with the IV can forge authenticated messages, but the content of the corresponding plaintext is beyond his control (since he doesn't know the key). Depending on the ...

11

n is the exponent. So when n is doubled from 64 to 128 it doesn't mean that you have to try twice as many values. It means that you have to try $2^{64}$ times the amount you were already trying (as $2^{128} = 2^{2\times64} = 2 ^{64+64} = 2^{64}\times2^{64}$). It is required to only search half of the key space on average (if average is the correct term ...

8

A Diffie-Hellman exchange needs not be synchronous. In DH, each party has a private key (x) and a public key (gx mod p). If the sender knows the recipient's public key ga, then he can build his own key pair (b and gb), compute the shared secret (gab), and send both his public key (gb) and the encrypted message (symmetric key derived from gab) to the ...

7

This is called a transposition cipher. It is the kind of thing that was commonplace before the invention of the computer, and some people were really good at breaking that in mere minutes (e.g. Edgar Allan Poe). In all generality, breakage is done by backtracking (wrong hypotheses on permutation elements leading to "impossible digraphs" that cannot occur in ...

5

That "algorithm" is fine, as long as the random values cannot be guessed by an attacker. The scheme is known as (trivial) secret sharing. XOR with completely random data is called a one time pad or OTP. The security of the algorithm therefore depends on the random number generator. Of course there are additional operational requirements to obtain system ...

5

I know that some of them are pretty hard to crack, but since they are so commonly known is it even practical to consider using something like that as an encryption method considering the algorithms for encryption and decryption are commonly known (from a security perspective)? In fact, this is exactly what we want. Schneier's law Anyone, from the ...

4

The Encrypt then MAC is done in general in order to be sure to decrypt into the correct plaintext, without risking of parsing a non-authentic plaintext message. If you don't MAC the IV, then Mallory (attacker that can tamper with messages as a man-in-the-middle) can modify the IV and your MAC will be still validated as good. So you will decrypt into an ...

4

The ECDSA algorithm can't be used for encryption. It's not that there's no accepted way to do it, it's that it's simply not possible to do so. Likewise, RSA signing can't be used to encrypt (there's a mandatory hash in signing that you don't want in encryption). However, RSA signatures work similarly to RSA encryption; they aren't interchangeable, but ...

4

The reason two permutations in a row don't increase security is that there is always a third permutation that's equivalent to performing the two permutations in a row. For instance, suppose we have 5 elements, and the following two permutations: \begin{align} \sigma_1 &: 12345\to34251 \\ \sigma_2 &: 12345\to43512 \end{align} Then if we apply ...

4

$2^{n}/2$ not $2^{(n/2)}$ surely? Or am I missing something here?

3

Perhaps the professor was misquoted; the assertion that (in the context of constructing cryptographic algorithms) "permutations which are done repeatedly does not further enhance security than just one permutation" is false. Proof by an extreme example: consider a variant of DES where we insert after permutation $P$ another permutation $Q=P^{-1}$. This DES ...

3

The MAC is NOT redundant. As alluded to by Paŭlo Ebermann's comment, the word authentication has a different meaning in the two scenarios you mentioned. In the key exchange phase of SSH, the purpose of authentication is to ensure to both parties that they are indeed talking to the right peer (if using mutual authentication). Typically, the server ...

3

In short: hybrid encryption. Encrypt the content with a random symmetric key. And encrypt this key with the public key of each recipient. Then all you need is a public key from all the people you want to share the content with. It doesn't even have to be the same public key cryptosystem for all the receivers. It might be they each come up with their ...

2

Could someone even recognize that the values are encrypted? Well, maybe, maybe not. You're correct that the values would all appear to be valid dates (this is known as format-preserving encryption, by the way), so they would not look obviously encrypted, the way, say, a random hex string would. If someone just saw a small number of such dates, with no ...

2

None of Twofish, Serpent and AES are currently known as broken, so as far as security is concerned, you can use any of them. AES has a slight advantage because it's very widely used, so if it gets broken you're more likely to hear about it and get relevant software updates quickly. The Snowden postings haven't changed much as far as cryptography usage is ...

2

Yes, the same weaknesses apply. Text on computers is a bunch of numbers; a OTP encrypts a sequence of numbers modulo 2.

2

There are $2^8$ one-byte (technically, one-octet) patterns. That implies there are $2^8$ four-octet strings where all four octets are identical out of $2^{32}$ possible patterns. $\frac{2^8}{2^{32}}=2^{-24}$

2

Yes, there are modes of operation that achieve the property that you are describing. For example, the Propagating Cipher Block Chaining (PCBC) mode of operation: This mode is similar to CBC but the output for each block is propagated to the input of the next one, so a small error will propagate indefinitely, both for encryption and decryption. There may ...

2

Based on your description, you will not be able to recover the original encrypted file. Since you specify that you used a password and do not indicate the use of an IV, my assumption is that you did, in fact, use a passphrase rather than a secret key. When you encrypt a file with a passphrase, OpenSSL assumes that it is a low-entropy string unsuitable for ...

2

No, the IGE encryption cannot be parallelized. Also the decryption of IGE/ABC is serial. The input to the block cipher for encryption is the ciphertext of the previous block xor'd with the plaintext (and the result is then xor'd with the previous block plaintext). For decryption, you have to XOR the ciphertext with the plaintext of the previous block ...

2

Salsa/ChaCha and the other eSTREAM winners are likely to be the "fastest but still secure" options today. Don't forget authentication of course. Reduced-round ChaCha/Poly1305 is likely to be the fastest software-only option, due to tuned implementations in the libsodium and NaCl libraries. UPDATED: The following slide deck has good info on state of the art ...

2

[After your edit I can confirm that the browser does the whole encryption in the background - you only get the "normal" HTTP connection to see and the downloaded files appear as big as the unencrypted files - even if the encrypted files are only marginally bigger. You don't ever see the encrypted version without some addition work. You can use a secure ...

2

swap-or-not seems perfect for your use case.

2

When creating a signed and encrypted PGP message, you only use your own keypair in the signing phase -- it's not used when encrypting the message (that only uses the recipient's public key). The recipient uses their own keypair only to decrypt the message, not to verify the signature. The two keypairs don't interact at all; that's why they don't have to be ...

2

A theoretical solution for cryptographic timelocking which if I am not mistaken was proposed by Andrew Miller, is to combine Witness Encryption (link) with the Bitcoin block chain. Witness encryption allows you to encrypt information such that users will only be able to decrypt it if they have access to information that satisfies certain properties. In the ...

2

Yes, it is because it will use DES (CBC) mode of operation. DES only has an effective key size of 56 bits. Attacks on DES are able to shave a few bits off of that. So the key and the can be brute forced regardless of the (PBKDF1) key derivation. MD5, while considered broken by itself, is less of an issue when it is used within PBKDF1 - as long as the ...

1

Generally, the actual key for most cryptographic algorithms is a fixed length bitstring (or something more complicated, like a tuple of appropriately chosen large numbers). Thus, if you just take a valid key and add a prefix to it, it will no longer be a valid key at all. (There are a few notable exceptions, such as HMAC, which can use any octet string as ...

1

As mentioned this is a very broad question, so please forgive me for not going into any great depth on each point. There are a few ways to beat encryption. One way is to attack the actual math of the cryptography: for PGP that would involve cracking RSA, which would involve finding a way to solve the discrete log problem. This is the hardest method, but ...

1

AES is asymmetrical in this regard. It is down to the key schedule, which generates a sequence of round keys from an initial key. In a modern desktop environment, the round key sequence is simply generated before encryption/decryption starts, so the difference in speed is minimal. In a memory-constrained environment like a smartcard, this may not be ...

1

Using the Chinese Remainder Theorem I can compute $M^3$, and then take the cube root. This is why multiple recipient RSA is insecure.

Only top voted, non community-wiki answers of a minimum length are eligible