# Tag Info

9

"Allowed" or "forbidden" are not the right terms; the Pope won't excommunicate you if you dare implement your own algorithms. The question is rather whether doing your own implementation is a smart move or not. For learning, doing your own implementation is a good idea. It will teach you a lot on how the said algorithms work. A lot of details on how ...

8

It depends. Specifically, it depends on the type of cipher, and on the way it's used. For stream ciphers like RC4, and for block ciphers like AES in CTR and OFB modes, decryption is effectively identical to encryption, and thus takes the exact same time. (Minor exception: encryption may require generating a unique nonce / IV, which might take a small ...

7

In computer science, and implementation of crypto, ROTL stands for ROTate Left. ROTL is also noted ROL, or RLNC for Rotate Left No Carry. On a $w$-bit word with bits numbered from $0$, bit number $j$ of the input of ROTL with a shift count of $n$ goes to bit $j+n\bmod w$ of the result; $n=1$ unless otherwise specified (and is the only value available on ...

4

You can generate a random string $s_1$ as long as the plaintext. Then XOR this value with the plaintext generating $s_2$. Now encrypt both parts using $\mathrm{Enc}_1$ and $\mathrm{Enc}_2$. You need to decrypt both to XOR the two parts together again. This is similar to secret sharing where you need two parts of a key to decrypt. If $\mathrm{Gen}_1$ and ...

4

A lot of software security vendors will implement their own crypto libraries simply because they don't want to depend on outside code. Usually for security reasons ("we don't know who wrote it, or who's allowed to push updates to it") and/or for maintenance reasons ("every time they push an update, we have to also") Note that these companies then spend lots ...

3

If you can efficiently find a $P$ that is not coprime to $N$, then you can easily factor $N$ (use GCD). If you know the factorization of $N$ (say $N=pq$), you can easily find a $P$ that is not coprime to $N$ ($kp$ for some constant $k$). This established the fact that finding $P$ not coprime to $N$ and factoring are equivalent problems. Now, how many ...

3

Yes, if (and this is important) the keys for $E$ and $S$ are selected independently. Consider that we had two encryption methods $E$, $S$ for which their composition $E(S(x))$ is not CPA secure; that is, we have some distinguisher $D$ that had some advantage in distinguishing that from a random function. Then, we can build a distinguisher for $E$ (by ...

3

Note: In this answer, I stick to a definition of the One Time Pad where the random pad is used only One Time; at least, I've the name of it as support! Otherwise, it is well known that the OTP encryption scheme consisting of XOR with a repeated key is insecure by even the weakest standard (unknown plaintext with redundancy). INDistinguishability under ...

2

First, don't roll your own crypto. Second, why would you want to use CBC-MAC, if you have GMAC (GCM-mode) and CMAC and even better HMAC? (all of which are better than CBC-MAC) Third, don't try to fix problems that have been fixed. (see second) Fourth, I'm not aware of this construction being standardized and I'd doubt it has been. (see points 1 to 3) ...

2

I'd say the people dealing in homomorphic encryption are at the forefront of applied mathematical research (Shai, Smart, Gentry, Boneh...). So world-class certainly wouldn't hurt! Pick up a paper cited by HELib (for one example starting place), read it. Fail to understand it, find a cited paper, read it... repeat until eventually you find a text book ...

2

It you need a deterministically derived key for AES, the DRBG algorithms of NIST SP 800-90A are suitable, and their output is directly usable as an AES key. An example use case is when computing an AES session key from a longer-term master key, and the nonce corresponding to that session. AES will expand its key (128, 192 or 256-bit) to 128-bit subkeys (one ...

2

I'm not aware of any classical polyalphabetic ciphers where the key could not be longer than the message. For the Vigenère cipher, the key is, effectively, repeated to make it as long as the message. There is no reason why it could not be repeated less than once, effectively discarding the unnecessary characters at the end of the key. Similarly, in the ...

2

The way I see it, you have a few options. The right one will depend on the details of the application, which are sparse in the question. Use a stream cipher (or stream-like mode). Each party has a separate key and encrypts/decrypts with their individual key. With this you only get n-out-of-n, not m-out-of-n where $m<n$. Use MPC. You can evaluate the AES ...

2

Faliure of indistinguishablity of encryptions under a eavesdropper does imply faliure of indistinguishablity of encryptions under a chosen-plaintext attack. But the converse is not necessarily true (ex. OTP) The aim of CPA-secure is not to decrypt previously unobserved ciphertext but to pass the distinguishability test after a set of (plaintext, ciphertext) ...

2

Key stretching is only used to make small-entropy keys less vulnerable to brute force attacks. If it is (nearly) impossible to break the original key, than there's little sense in using a iteration count of more than 1. If the input to the function is as big (in sense of entropy in bit) as the output, then an attacker could just attack the algorithm which ...

1

I don't know your exact scenario. However you have two options to encrypt data using elliptic curve cryptography (ECC). I'd recommend going with the first option I present. Use elliptic curve integrated encryption scheme (ECIES). ECIES basically performs ElGamal-like encryption on a key. The key is generated at random and encrypted like in ElGamal (replace ...

1

The threshold for a perfectly secure system is that a computationally unbounded adversary cannot conclude anything about the plaintext from the ciphertext. With a public-key system, the attacker can try to encrypt messages with the real public key; this is not possible with one-time pads. What the attacker can do, quite simply, is to try all one-bit ...

1

You cannot, you can however create a hash over the modulus. This is sometimes used as identifier for a key pair, e.g. in PKCS#11. The modulus is unique for RSA key pairs.

1

You can't. Recovering the md5sum of the private key means uncovering the private key, which is considered impossible for large values of $n$.

1

Yes this would work as stated by you. Explanation: If you're using a library supporting ECB (which you are actually using in this example) you can input the whole 32 bytes of plaintext and will receive the corresponding 32 bytes of ciphertext. Splitting the operation into two calls doesn't make any difference for libraries as internally they do nothing ...

1

What you described is to use a so-called "stram cipher". Stream ciphers output a random sequence of bytes for the same Key/IV pair. The usual usage of stream ciphers is to XOR the data with the stream to obtain the encrypted data. You may want to follow the same approach by replacing the LSBs by the bits that were output by the encryption procedure (Data ...

1

I would prefer to use standardized (like FIPS 140-2) secure random generator, since the whole point is to secure the encryption key. Of course, you might want to check this website for reference: http://www.cryptosys.net/rng_algorithms.html

1

Can it also be used as a one-time encryption scheme? You cannot build asymmetric encryption from just hash functions. There is an impossibility proof for that. So for asymmetric encryption the answer is no. For symmetric encryption, you can simply use the hash function directly to build encryption, no need to bother with Winternitz. But you could use ...

1

There's a lot of ways to attack this. The first thing to notice is that if you know the value of plaintext at index $i$, you can then deduce the value of all the plaintext bytes at index $i+8k$; for all integers $i$ (!). That's because the relation between plaintext and ciphertext bytes is $P_{i} = C_{i} \oplus P_{i-8}$; if you know $P_{i-8}$ (and, of ...

1

The stream cipher generates 128 key stream bits per iteration. Usually these bits are buffered internally. When the encryption or decryption (identical operation, encryption = decryption) takes place then the bits are taken out of the buffer and the plaintext at the same location is xorred with it. When the keystream buffer is exhausted the next iteration ...

1

The "significance of inside attacker or threat" is making the problem non-trivial. We "should we care about it in this case" because the protocol apparently claims to provide some sort of revocation.

1

My own two cents on this is that it started with a psychological bias, due to the illusion that AES-ciphering consecutive numbers in CTR mode is a weakness compared to the recursive AES-ciphering in CBC. Actually, I think I remember it was more of less told during that course on Coursera, that a consensus about the inoffensiveness of that counter with regard ...

Only top voted, non community-wiki answers of a minimum length are eligible